Records.

Official Shareholder Register. The books and records pertaining to the Fund required by the Securities Laws, including records under Section 31(a) of the 1940 Act, that are in the possession or under the control of, or should be under the control of, Securitize (together with all copies and derivatives thereof, “Fund Data”) shall be the property of the Fund. Securitize shall maintain, as the Fund’s registered transfer agent and registrar, the Official Shareholder Register, which shall consist of (i) the authoritative Token ledger on the Supported Networks reflecting issuance, transfer and redemption of Tokens and (ii) the Off-Chain PII Record (as defined below) mapping each Wallet Address to the corresponding Shareholder and account attributes detailed in paragraph (b) below. Absent a documented technical failure of either component system, the Official Shareholder Register shall conclusively govern the record ownership of the Fund’s Shares for all purposes under this Agreement and the Fund’s governing documents. The Official Shareholder Register shall be maintained separately for each Investment Company, Fund and class of Shares, and, where a Supported Network is used for multiple funds or issuers, Securitize shall ensure logical and on-chain separation by means of distinct token contracts or equivalent mechanisms.

Off-Chain PII Record. Securitize shall maintain accurate records of the accounts for each Shareholder in a secure document or file maintained in traditional digital or analog format and not maintained on, or accessible through, any public blockchain (the “Off-Chain PII Record”), which shall reflect the following information:

Name, address and United States Tax Identification or Social Security number or similar information for non-US Shareholders, if any;

Any stop or restraining order placed against a Shareholder’s account;

Any know-your-customer and sanctions-screening records;

Any correspondence, including supporting documentation, related to the Shareholder’s account opening;

Any correspondence relating to the current maintenance of a Shareholder’s account;

Information with respect to tax withholding; and

Any beneficial ownership, if any.

Snapshot and Off-Chain Backup Register. In addition to maintaining the Official Shareholder Register, Securitize shall, on each Business Day, take no less than twice daily point-in-time snapshots (each, a “Snapshot”) capturing (i) a full export of Token balances and

Fund Data preparation, maintenance and preservation.

The Official Shareholder Register, the Off-Chain PII Record and the Backup Register are Fund Data and the Fund’s property. Securitize will maintain, index, duplicate, safeguard, and preserve the Off-Chain PII Record and the Backup Register on electronic media so they are easily retrievable and reproducible in human-readable and machine-readable formats, in accordance with Section 31(a) of the 1940 Act and Rules 31a-1, 31a-2 and 31a-3 thereunder, and with 1934 Act Rules 17Ad-6 and 17Ad-7 (including any required third-party undertakings if a service provider is used). The Off-Chain PII Record and the Backup Register will be encrypted at rest and in transit and subject to role-based access controls. Upon reasonable request, Securitize will provide Authorized Persons timely access to or copies of any Snapshot, its manifest and indexes, and will promptly surrender the Off-Chain PII Record and the Backup Register to the Fund upon request and upon termination, subject to retention obligations under applicable law.

Securitize shall prepare, maintain, index and preserve all other Fund Data in accordance with the Fund’s Registration Statement and the Securities Laws applicable to registered management investment companies, including the record maintenance and preservation requirements of Rules 31a-1 and 31a-2 under the 1940 Act. Without limiting the foregoing, Securitize shall maintain Fund Data on electronic storage media that provide (A) indexing sufficient to permit the easy location, access and retrieval of any particular record; (B) reasonable safeguards against loss, alteration, or destruction; (C) the ability to produce complete, true and legible paper or electronic reproductions upon request; and (D) a separately stored duplicate copy for the time required for preservation of the original. If any Fund records required by Rules 31a-1 and 31a-2 are prepared or maintained by Securitize or by a third party on Securitize’s behalf, Securitize shall obtain and maintain the written undertakings required by Rule 31a 3 that such records are the Fund’s property, will be surrendered promptly upon request, will be preserved for the periods prescribed, and will be made available to the Fund and to the SEC upon request.

1934 Act transfer-agent records. Securitize shall make, keep current and preserve all records required of registered transfer agents under the 1934 Act and the rules thereunder, including Rules 17Ad-6 and 17Ad-7, in each case as applicable to the services performed under this Agreement. To the extent Securitize maintains transfer-agent records on electronic storage media, Securitize shall maintain the indexes, access controls, retrieval capabilities, third-party undertakings, format escrow, and other conditions required by Rule 17Ad-7 so that such records are promptly accessible to the Fund and the SEC. Without limiting the foregoing, Securitize shall satisfy the control-book and master-securityholder-file requirements of Rules 17Ad-6(a)(1), 17Ad-6(a)(2) and 17Ad-6(b) by ensuring that the Official Shareholder Register (consisting of the on-chain Token ledger on each Supported

Access; format; delivery. Upon reasonable request of the Fund, and at such other times as are necessary to satisfy the Fund’s obligations under the Securities Laws, Securitize shall provide Authorized Persons with access to Fund Data and deliver the Official Shareholder Register, or any portion thereof, in mutually agreed human-readable and machine-readable formats that include, without limitation, Wallet Addresses, Token identifiers, on-chain transaction hashes, balances, timestamps, and the associated Shareholder identity information from the Off-Chain PII Record. Securitize shall also provide, upon request, the indexes, documentation, and other information necessary to access and search electronic records, together with such certifications as the Fund may reasonably request for audit or examination purposes.

Error correction; forks; reorgs; network events. Securitize shall maintain and follow written policies reasonably designed to address data errors, compromised Wallet Addresses, or other anomalies in the Official Shareholder Register, including procedures to reconcile discrepancies between the Token ledger and the Off- Chain PII Record and to effect remedial issuances or burns, or other corrective entries, as permitted by law and the applicable token standard. Securitize shall also maintain and follow a written policy that addresses responses to Network Events or upgrades on any Supported Network. That policy shall designate how Securitize will determine the canonical chain and shall require Securitize to document and promptly notify the Fund of any such event and its treatment. During any period in which a Network Event reasonably prevents accurate maintenance of the Official Shareholder Register, Securitize shall suspend on-chain recording as necessary and maintain and update the Backup Register, with subsequent reconciliation to the canonical chain once normal operations resume.

Conversion to Standard (Non-Tokenized) Shares. In the event of (i) a divergence between the Official Shareholder Register and the Off-Chain PII Record that cannot be resolved within a commercially reasonable timeframe, (ii) a material impairment of the applicable Supported Network or Fund Smart Contract that prevents accurate maintenance of the Official Shareholder Register, or (iii) a change in applicable law or regulatory action that prohibits the Fund from issuing Shares as Tokens, the Fund may, upon not less than thirty (30) days’ prior written notice to Securitize (or, if exigent circumstances require immediate action, as much advance notice as is reasonably practicable), direct Securitize to convert all outstanding Tokens to standard, non-tokenized Fund Shares, burn the associated Tokens, and cease on-chain recording for the affected Fund. Securitize shall cooperate with the Fund to effectuate an orderly conversion. If after such conversion, the Fund desires to convert the standard, non-tokenized Fund Shares to Tokens, Securitize will convert the non-tokenized Fund Shares to Tokens at the Fund’s sole cost and expense (including reimbursement of Securitize’s reasonable development and administrative hours at the rate set forth in the Fee Agreement), unless such conversion back to Tokens is directly necessitated by a material system failure or security breach of the Securitize Platform caused by Securitize’s gross negligence, willful misconduct, or fraud.

Operational Due Diligence and Monitoring of Supported Networks.

Prior to the initial deployment of Tokens on any blockchain network proposed for inclusion as a Supported Network (each, a “Prospective Network”), Securitize shall, using commercially reasonable efforts, support the Fund and such other Fund service providers as the Fund may designate (including, without limitation, the Fund’s investment adviser, Fund Custodian, independent auditors, and any technology-risk

Following the deployment of Tokens on any Supported Network, Securitize shall, on an ongoing basis and using commercially reasonable monitoring tools and practices, monitor each Supported Network for developments that are relevant to the integrity, security, and operational resilience of the Official Shareholder Register and the Fund’s tokenization infrastructure. Such ongoing monitoring shall include, without limitation, monitoring for: (A) governance changes, including changes to the Supported Network’s governance structure, decision-making processes, or core development teams; (B) protocol upgrades, hard or soft forks, changes to consensus mechanisms, token standards, or other material modifications to the Supported Network’s technical architecture; (C) network developments, including material changes to validator-set composition or concentration, node and RPC infrastructure availability, throughput capacity, finality characteristics, and any emerging or known vulnerabilities or security incidents affecting the Supported Network; and (D) material changes to the Supported Network’s financial crime risk profile.

If Securitize identifies a material adverse development with respect to any Supported Network, including, without limitation, a significant security incident, governance failure, material protocol vulnerability, regulatory action affecting the Supported Network, or a material change to the Supported Network’s financial crime risk

Survival; audit; cooperation. The obligations set forth in this Section, including with respect to record ownership, access, preservation, and delivery of Fund Data, shall survive termination of this Agreement for so long as Securitize is required to maintain such records under the Securities Laws. Securitize shall cooperate with the Fund’s independent auditors and provide information reasonably requested in connection with the expression of their opinion or the Fund’s financial reporting.

Services.

General Services. In addition to any specific services set forth elsewhere in the Agreement or in any Appendix to this Agreement, Securitize shall provide the following services on an ongoing basis:

Establish new Share ownership registrations in accordance with Shareholder account applications received in good order;

If new Share account applications are not received in good order, correspond to a commercially reasonable extent with the submitting persons to remediate such documentation into good order status;

Make changes to Shareholder account information and Share ownership registrations in accordance with Shareholder instructions received in good order;

Process purchase of Shares and redemption of Shares in accordance with the Fund’s Registration Statement, including whitelisting eligible investors, minting and burning Tokens associated with these instructions, including any restrictions therein, and instructions received in good order;

Issue Shares to a Shareholder as Tokens in such Shareholder’s whitelisted Wallet Address on the Supported Network on which such Shareholder has indicated it is purchasing, in accordance with the Shareholder account application or order when purchasing Shares;

Direct payment processing of wire transfers;

Process, pause or block Share transactions in accordance with Fund Instructions;

Provide Shareholders and potential investors with toll free telephone access for telephone inquiries;

Respond in a commercially reasonable manner and within a commercially reasonable period to written correspondence from Shareholders to the extent reasonably permitted by Fund Data;

As reasonably requested by the Fund: provide periodic Shareholder lists and statistics to the Fund in standard reports and certify Shareholder lists;

Notify on a timely basis the Fund’s investment adviser, accounting agent, and custodian (“Fund Custodian”) of Share activity;

Calculate any payments and such other fees, commissions, concessions and intermediary payables as the Fund and Securitize shall reasonably agree in writing, if any;

Record the issuance & redemption of Shares of the Funds and maintain a record of the total number of Shares of each Fund that are authorized, issued and outstanding;

Administer and support the smart contracts required for the Tokens; and

Enforce Fund rules, including at the account level.

Platform Services. Attached hereto as Appendix F sets forth the Platform Services provided by Securitize. Securitize shall (directly or through its Affiliates or approved subcontractors; provided however that delegation of any duty or obligation shall not relieve Securitize of such duty or obligation) perform its duties and obligations in relation to such Platform Services in a timely and professional manner without negligence, willful misconduct, fraud or bad faith and nevertheless at a minimum in accordance with the standard of care set forth in Section 18(a). The Fund understands and agrees that delays or failure of the Fund or its representatives to deliver required content, information, instructions (including Written Instructions) or other materials reasonably requested by Securitize in a timely manner will excuse Securitize from related performance requirements under this Agreement but only to the extent such delay materially caused or contributed to delays or disruption in the performance of Services. Each Party is to bear its own costs and expenses of performance.

Purchase of Shares.

Securitize shall issue and credit an account of an investor, in accordance with the Fund’s Registration Statement, once it receives:

A purchase order in good order; and

Confirmation of the receipt of funds by Securitize or the crediting of funds for such order to the Fund Custodian.

Notwithstanding the prior Section (i), after an initial subscription, Securitize can issue and credit an account of a Shareholder after confirmation of receipt of funds by Securitize for such order to the Fund Custodian that contains proper information including the Supported Network which hosts the Shareholder’s Wallet Address and the Shareholder’s Securitize ID, provided that the Shareholder’s Wallet Address has been whitelisted by Securitize prior to such issuance.

Securitize will block purchases of shares for any Shareholder at the instruction of the Fund in accordance with the Fund’s Registration Statement.

Redemption of Shares. Securitize shall process instructions to redeem Shares in accordance with the following:

All instructions given to Securitize regarding the redemption of Shares or the disposition of redemption proceeds must conform to the Fund’s Registration Statement, be accompanied by such documents as Securitize reasonably determines to be appropriate to the particular transaction.

To the extent the Shares are tokenized, the Shareholder shall either (a) tender the Shares in proper form to the Fund’s administrative redemption wallet, or (b) initiate a redemption request through the Platform, in each case in accordance with the procedures set forth in the Fund’s Registration Statement.

Securitize is authorized to delay or reject a redemption of Shares only until it determines that the endorsement on the instructions is valid and genuine, if necessary, that the requested redemption is legally authorized and otherwise complies with all applicable requirements in the Registration Statement, and that there is no basis to any adverse claims that may have been made regarding the Shares or the particular redemption, and Securitize shall incur no liability for delaying or rejecting transfers or redemptions in accordance with the foregoing authorization.

When Shares are redeemed, Securitize shall deliver to the Fund Custodian and the Fund or its designee a notification setting forth the number of Shares redeemed. Such redeemed Shares shall be reflected on appropriate accounts maintained by Securitize, either on chain or in analog form or both, reflecting outstanding Shares of the Fund and Shares attributed to individual accounts.

Securitize shall, upon receipt of the monies provided to it by the Fund Custodian for the redemption of Shares, pay such monies as are received from the Fund Custodian, all in accordance with any agreed upon procedures with the Fund and with the Fund’s Registration Statement.

Securitize shall not process or effect any redemption requests with respect to Shares of the Fund after receipt by Securitize or its agent of notification of the suspension of the determination of the net asset value of the Fund.

Transfer of Shares. Transfers of Shares shall be effected on a peer-to-peer basis on a Supported Network. Securitize shall suspend peer-to-peer transactions in the Shares, either absolutely or with respect to specified Wallet Addresses, promptly upon instructions from the Fund to do so.

Dividends and Distributions.

Upon receipt by Securitize of Written Instructions containing all requisite information that may be reasonably requested by Securitize, including payment directions and authorization, Securitize shall issue Shares in payment of the dividend or distribution, or, upon Shareholder election, pay such dividend or distribution in cash all in accordance with the procedures set forth in the Fund’s Registration Statement.

Securitize shall issue Shares or pay dividends or distributions as provided for in this Section and pay proceeds of Share redemption transactions as provided for in this Section, after it deducts and withholds all amounts it reasonably determines to be appropriate under any applicable tax laws, rules or regulations or other laws, rules or regulations, including any redemption fee permitted or required by law.

Certain mailings or Distributions of Information Electronically Regarding the Dividends.

Securitize shall

mail to the Fund’s Shareholders or deliver electronically, as the case may be based on Shareholder elections, such tax forms and other information, or permissible substitute forms or notices, relating to dividends and distributions paid by the Fund as are required to be filed and mailed by applicable law, rule or regulation; and

prepare, maintain and file with the IRS and other appropriate taxing authorities reports relating to all dividends and distributions by the Fund paid to its Shareholders (above threshold amounts stipulated by applicable law) as required by tax or other laws, rules or regulations.

Notwithstanding any other provision of this Section or this Agreement, and for clarification:

Securitize’s exclusive obligations with respect to any written statement that Section 19(a) of the 1940 Act may require to be issued with respect to the Fund (“19(a) Statement”) shall be, upon receipt of specific Written Instructions to such effect, to receive from the Fund the text which is to be printed on the 19(a) Statement, to print such text on appropriate paper stock (if physical delivery will be used) and to deliver such document to Shareholders, and

Securitize’s sole obligation with respect to any dividend or distribution that Section 19(a) of the 1940 Act may require be accompanied by a 19(a) Statement shall be to perform only the conduct expressly directed by Section 3(f)(iii)(A) above and shall expressly exclude any duty associated with any determination of the appropriateness of, or the drafting or other preparation of the text to be printed on, a 19(a) Statement.

Tax Reporting. Securitize and the Fund shall prepare necessary reports for investors to meet applicable tax laws. Certain tax reporting requirements are set forth in Appendix D hereto.

Communications to Shareholders.

Securitize shall mail or deliver electronically, as permitted by law, all communications by the Fund to its Shareholders, including but not limited to:

Reports to Shareholders;

Confirmations of purchases and redemptions of Fund Shares, as required by law;

Monthly or quarterly statements of accounts, as directed by the Fund, and annual statements of the account;

Dividend and distribution notices, including Section 19(a) Notices, as discussed in Section 3(f)(iii)(B) above; and

Year-end information necessary for federal tax filings.

Securitize may provide electronic delivery of the Shareholder communications listed above to Shareholders, subject to applicable law, upon the satisfaction by individual Shareholders of all pre-requisite requirements for electronic delivery.

Securitize will answer such correspondence from Shareholders or intermediaries relating to its duties hereunder and such other correspondence pursuant to Written Procedures.

Shareholder Inspection of Stock Records. Upon a request from a Fund Shareholder to inspect stock records and to the extent the record is not available on a relevant blockchain, Securitize will notify the Fund in a manner reasonable and timely under the circumstances and the Fund will be responsible for issuing any instructions granting or denying each such request. Unless Securitize has acted contrary to the Fund’s instructions, the Fund agrees to and does hereby release Securitize from any liability for refusal of permission for a particular Shareholder to inspect the Fund’s stock records.

Cancellation of Shares. Upon receipt of Written Instructions, Securitize shall cancel outstanding Shares (which, in the case of Tokens, shall be accomplished by burning such Tokens) to reduce the total amount of outstanding Shares by the number of Shares surrendered by the Fund.

Lost or Stolen Tokens. If Securitize receives written notice from a Shareholder of a lost or stolen private key or Token, Securitize will promptly take appropriate action such as investigating the issue and, if appropriate, freezing the Tokens associated with the Shareholder’s Wallet Address, verifying the Shareholder’s legitimate ownership of Tokens or verifying the occurrence of the loss or theft alleged in the Shareholder’s report. Securitize may isolate the particular Tokens, revoke such Tokens, re-authenticate a new Wallet Address per the Fund’s whitelisting procedures, and facilitate payment for revoked Tokens by federal wire on a best-efforts basis, where appropriate.

Lost Shareholders.

Securitize shall perform such services as are required in order to comply with Rule 17Ad-17 of the 1934 Act (the “Lost Shareholder Rule”), including, but not limited to, those set forth below:

documentation of search policies and procedures;

execution of required searches for “lost securityholders” as that term is defined in Rule 17Ad-17;

sending the required written notification to each “unresponsive payee”, as that term is defined in Rule 17Ad-17;

maintaining records to demonstrate compliance with the requirements of Rule 17Ad-17, including written procedures that describe Securitize’s methodology for complying with Rule 17Ad-17 and records of the results of the database searches for lost securityholders; and

retaining the records required by Rule 17Ad-17 in accordance with applicable SEC regulations.

For purposes of clarification: Section 3(l)(i) does not obligate Securitize to perform the services described therein for broker-controlled accounts, omnibus accounts and similar accounts with respect to which Securitize does not receive or maintain information which would permit it to determine whether the account owner is a “lost securityholder”, as that term is defined in the Lost Shareholder Rule.

Legal Process.

In the event (A) Securitize directly receives a US Legal Process Item (defined immediately below) that has been properly served, (B) the Fund receives a US Legal Process Item that has been properly served and delivers the US Legal Process Item to Securitize, or (C) the Fund accepts service of a US Legal Process Item that has not been properly served and delivers the US Legal Process Item to Securitize and requests that it be serviced by Securitize, Securitize will act in accordance with the applicable Written Instructions or Written Procedures in effect between the Fund and Securitize. Securitize shall, unless prohibited by the terms of the US Legal Process Item or by applicable law, notify the Fund promptly, and in any event within two (2) Business Days, of its receipt of any US Legal Process Item (and shall use commercially reasonable efforts to obtain leave to provide such notice if initially prohibited), shall deliver a copy of the US Legal Process Item to the Fund, and shall (i) provide the Fund with a reasonable opportunity (and in any event no fewer than the greater of five (5) Business Days and one-half of the response period set forth in the US Legal Process Item) to seek a protective order, motion to quash, sealing order, intervention, or other appropriate relief before responding, and (ii) use commercially reasonable efforts to assist the Fund (at the Fund’s reasonable request and reasonable expense) in seeking such relief, including by withholding or limiting disclosure, supporting Fund motions, designating disclosures as confidential, redacting Personally Identifiable Information to the extent permitted, and seeking extensions of the time to respond. Securitize shall conduct any disclosure under a US Legal Process Item in compliance with Section 11 (Confidentiality), Regulation S-P and applicable Privacy and Data Protection Legislation, and shall otherwise tailor any production to the minimum scope responsive to the US Legal Process Item. “US Legal Process Item” means a Legal Process Item (defined immediately below) which

Securitize’s only obligations with respect to a Legal Process Item originating from or requiring a response to a jurisdiction other than within the United States, notwithstanding that such legal process item may be directed at Securitize as agent of the Fund, shall be (i) if received by Securitize, to forward a copy to the Fund promptly (and in any event within two (2) Business Days) together with notice of the date and method of service, (ii) to act in accordance with Written Instructions received from the Fund but solely to the extent the Written Instructions direct Securitize to take an Administrative Action that is also consistent with U.S. law, and (iii) not to take any action affecting Tokens, the Official Shareholder Register, the Off-Chain PII Record or any Fund Shareholder account in response to such non-U.S. Legal Process Item except upon Written Instructions of the Fund. For the avoidance

Securitize shall maintain a log of each Legal Process Item received, the date and method of service, the response provided (including any Administrative Action taken and any information or documents produced), and the date of any notice to the Fund. Such log shall be made available to the Fund upon reasonable request and in any event no less frequently than quarterly. Securitize shall further notify the Fund (with a copy to the Fund’s Chief Compliance Officer) promptly upon (A) any pattern of related Legal Process Items affecting the Fund or any group of Shareholders, (B) any Legal Process Item naming the Fund or any of its trustees, directors or officers, and (C) any failure or anticipated inability to comply with the timing requirements of a Legal Process Item.

The Fund shall be responsible for the reasonable, documented out-of-pocket expenses incurred by Securitize in complying with a Legal Process Item (other than expenses arising from Securitize’s negligence, willful misconduct, fraud, bad faith or breach of this Agreement), including reasonable fees and expenses of outside counsel retained by Securitize with the prior written consent of the Fund. Securitize shall bear its own internal costs for ordinary-course Administrative Actions.

Unclaimed Property Services.

For purposes of these services, references to property held in a Fund Shareholder account include Tokens recorded on a Supported Network associated with a Shareholder’s Wallet Address and cash and other property maintained in any account established by Securitize on behalf of the Fund. Subject to clauses (ii)–(v) below, Securitize shall take such on-chain actions (including freezing, burning, and re-issuing Tokens to a successor Wallet Address designated by the applicable state authority or the Fund) as are reasonably necessary to give effect to escheatment, reporting and reclamation obligations under the Unclaimed Property Laws, in each case (A) only upon Written Instructions of the Fund or in accordance with a final, non-appealable order of a state unclaimed property administrator or court of competent jurisdiction, (B) only after Securitize has confirmed that the successor Wallet Address has been whitelisted by Securitize in accordance with the Fund’s whitelisting procedures and applicable AML, CIP and sanctions screening (or, where the successor Wallet Address cannot be whitelisted, Securitize shall remit the equivalent cash value, calculated as of the date the obligation arises, in lieu of Token delivery, subject to coordination with the Fund and the Fund Custodian), and (C) with cryptographic documentation of the affected Tokens (including smart-contract identifier, block height, timestamp and Token quantity) preserved as part of the Fund Data.

Securitize shall implement and operate procedures reasonably designed to comply on a substantial basis on behalf of each Fund with the unclaimed property laws and regulations of the States and Territories of the United States (as defined below) (“Unclaimed Property Laws”), including (where adopted) the Revised Uniform Unclaimed Property Act (2016) and any successor uniform statute, with respect to Eligible Property (as defined below). The services described in this Section 3(n) (the “Unclaimed Property Services”) shall include, without limitation: (A) tracking of accounts for indicia of dormancy or abandonment in accordance with the applicable

“States and Territories of the United States” means the states of the United States of America, the District of Columbia, Guam, Puerto Rico, the U.S. Virgin Islands, American Samoa, the Commonwealth of the Northern Mariana Islands, and any other territory or commonwealth of the United States of America that has adopted an unclaimed property statute applicable to investment company shares or related cash, including any such statute substantially similar to the Revised Uniform Unclaimed Property Act (2016) or any successor uniform statute.

“Eligible Property” means property beneficially owned by a person or entity other than the Fund and held in a bank account maintained by Securitize for or on behalf of the Fund, or property held in a Fund Shareholder account, which is (x) subject to reporting or escheat under an Unclaimed Property Law, (y) of a nature or type or classification reasonably related to the services performed by Securitize under this Agreement (such as cash amounts representing negotiated dividend checks and shares in abandoned Shareholder accounts), and (z) under the control of Securitize

The Fund shall be the “holder” (or equivalent term) under all Unclaimed Property Laws and Securitize shall act solely as agent of the Fund in performing the Unclaimed Property Services. The Fund hereby authorizes Securitize to sign reports, sign letters and other communications, communicate with government representatives, current and former Shareholders and other appropriate third parties, and otherwise act in all manners on behalf of and in the name of the Fund and to utilize the Fund’s Tax Identification Numbers or other appropriate identifying numbers or data (“Identification Data”) in the scope and manner Securitize reasonably determines to be appropriate to perform the Unclaimed Property Services, including, for clarification, utilizing the Identification Data associated with each specific Portfolio of the Fund (including each class, series, tier or other subdivision of a Portfolio, if any) for reporting purposes if such use is determined to be

The Fund agrees, upon the reasonable written request of Securitize, to:

execute and deliver to Securitize in a timely manner any reports, forms, documents and instruments reasonably determined by Securitize to be appropriate in connection with its performance of the Unclaimed Property Services;

respond in a timely manner to requests from Securitize for information and requests to review information or reports related to the Unclaimed Property Services; and

provide sufficient letterhead paper of the Fund or its electronic letterhead template for use by Securitize in communications related to the Unclaimed Property Services.

The Fund agrees that upon any termination of the Agreement it will cause all property held in bank accounts maintained by Securitize for or on behalf of the Fund, and all property held in Fund Shareholder accounts maintained by Securitize on a Fund’s behalf, to be transferred to the Fund or to a successor service provider and Securitize may condition completion of such activities on the completion of arrangements reasonably satisfactory to Securitize for such transfers.

Shareholder Escheatment Notifications. Upon the Fund’s reasonable request, Securitize shall support the Fund in periodically distributing to Shareholders notifications regarding the risk of escheatment under the Unclaimed Property Laws and education on steps Shareholders may take to avoid dormancy (including updating their addresses, Wallet Address recovery information, and otherwise establishing contact with the Fund and Securitize), in each case consistent with the undertakings recommended by the SEC in its August 17, 2023 settled administrative proceeding regarding DST Asset Manager Solutions, Inc. (Release No. 34-98153) and any successor guidance or rulemaking. Securitize shall (A) provide draft notice templates for the Fund’s review and approval, (B) deliver such notices through the Shareholder Communication Portal described in Appendix F and by such other means (electronic or otherwise) as the Fund directs, and (C) maintain records of delivery sufficient to demonstrate compliance. The cost of such Shareholder notifications shall be borne by Securitize as part of the base Services, except for incremental out-of-pocket printing or postage costs which shall be Reimbursable Expenses.

State Audits and Voluntary Disclosures. Securitize shall reasonably cooperate with any state unclaimed property audit, examination, or voluntary disclosure agreement process involving the Fund and the Unclaimed Property Services, including providing books, records and reasonable assistance, and shall promptly notify the Fund of the initiation of any such audit or examination. Securitize shall exercise commercially reasonable efforts to obtain release agreements and, where available, indemnification agreements from states with respect to reports and remitted property delivered on behalf of the Fund.

Compliance, Regulatory and Fund Information Assistance. Securitize will in a commercially reasonable manner provide information and documentation relating to the Services, or the Fund with respect to the provision of the Services or such other information maintained by Securitize pursuant to the Agreement regarding the Fund, as the Fund may reasonably request, including without limitation to help the Fund respond to any request of a Regulatory Authority or other government or regulatory agency, including but not limited to a subpoena or request for information. Securitize shall be entitled to be paid fees for such services at the rate expressly set forth in the Fee Agreement for this Section 3(o), or if no applicable fee is set forth in the Fee Agreement and no fee is expressly agreed to by the Parties, at commercially reasonable rates, and to a reimbursement of all reasonable expenses incurred in connection with such services, and the Fund shall pay Securitize such fees and reimburse Securitize for such expenses upon being invoiced. information maintained by Securitize pursuant to the Agreement regarding the Fund,

Compliance Matters.

Securitize will, at its own cost at all times while this Agreement is in effect, take measures reasonably designed to assure its compliance with all regulations applicable to Securitize in its role as a provider of the Services (“Transfer Agent Regulations”) and generally accepted guidance and best practices applicable to the Services including changes in Transfer Agent Regulations, guidance and best practices.

Securitize maintains and shall continue to maintain a compliance program reasonably designed to prevent violations of the Securities Laws pursuant to Rule 38a-1 under the 1940 Act. Pursuant to its compliance program, Securitize will provide periodic reports to each Fund. Upon request of the Fund, Securitize will provide to the Fund in connection with any periodic annual or semi-annual Shareholder report filed by the Fund or, in the absence of the filing of such reports, on a quarterly basis, a sub-certification pursuant to the Sarbanes-Oxley Act of 2002 with respect to Securitize’s performance of the services set forth in this Agreement and its internal controls related thereto. In addition, on a quarterly basis, Securitize will provide to each Fund a certification in connection with Rule 38a-1 under the 1940 Act. Securitize reserves the right to amend and update its compliance program and the measurement tools and certifications provided thereunder from time to time in order to address changing regulatory and industry developments.

Securitize shall, at the Fund’s reasonable request, provide certifications and supporting Fund Data necessary for the Fund to comply with Rule 2a-7 under the 1940 Act, as applicable.

Each of the Fund and Securitize shall alone be responsible for monitoring potential and actual changes to the Transfer Agent Regulations and Securities Laws, for becoming aware of changes to the Transfer Agent Regulations that could impact its own business or operations in any manner, and for determining the impact of any potential or actual changes in Regulations on its business and operations. In the course of such monitoring, each of the Fund and Securitize shall consult with the other Party within a reasonable time of concluding in its reasonable judgment that a potential or actual change in Regulation is reasonably likely to

All cost and expense incurred by Securitize in modifying a Service or service delivery method or implementing a new Service or service delivery method necessitated by Securitize’s negligent performance of a Service or service delivery method or breach of this Agreement shall be borne exclusively by Securitize.

Site Visits.

Subject to the further provisions of this Section, a reasonable number of representatives of the Funds together, if so elected by the Funds, with auditors associated with a firm of certified independent public accountants (“Auditor Firms”) may once annually (based on a calendar year) and during normal weekday business hours, upon giving Securitize not less than thirty (30) days advance written notice and subject to Securitize’s reasonable security, privacy and confidentiality policies and procedures:

inspect and tour the Securitize premises principally utilized to perform the Services and related operations, and

examine on-site any books and records required to be maintained by Securitize in connection with the performance of the Services and the Written Procedures utilized by Securitize in performing the Services. During the annual site visit Securitize shall make available employees with knowledge about the Services performed and the Written Procedures utilized to perform the Services to conduct discussions with the Funds and answer reasonable questions of the Funds about such subjects, subject to Securitize’s reasonable security, privacy and confidentiality policies and procedures.

Notwithstanding the foregoing, the Fund acknowledges that certain Services may be performed using decentralized, distributed, or cloud-based infrastructure that is not physically located at any single Securitize premise and that certain books and records may be maintained electronically and not in physical form.

Subject to the further provisions of this Section and Securitize’s reasonable security, privacy and confidentiality policies and procedures, upon reasonable advance notice Securitize will schedule mutually agreeable times for personnel of the Funds to visit specific facilities of Securitize utilized to perform Services for the Funds and to conduct discussions with key employees at such locations about the Services performed at such locations and any other matters as the Parties may agree.

Subject to the further provisions of this Section and Securitize’s reasonable security, privacy and confidentiality policies and procedures, Securitize will give regulatory authorities with jurisdiction over the Funds, upon reasonable advance written notice and during normal weekday business hours, the ability to (i) inspect and tour the Securitize premises principally utilized to perform the Services and related operations, and (ii) examine on-site any books and records required to be maintained by Securitize in connection with the performance of the Services, in each case to the extent such books and records are physically maintained at such premises

Other Services. Securitize shall:

In accordance with its internal operational guidelines and all applicable regulatory requirements, open all mail addressed to the Fund and scan such mail into the Securitize System.

For the periods of time reasonably designated by the Fund, and subject to such fees and reimbursement of expenses as may be set forth in the Fee Agreement or mutually agreed to in writing by the Fund and Securitize, maintain (i) in the Securitize System, images that are scanned into the Securitize System, and (ii) at a facility of a third party reasonably acceptable to the Fund or at a Securitize facility, the original documentation scanned into the Securitize System;

Process Written Instructions received on behalf of the Fund from Fund Shareholders regarding financial transactions, nonfinancial transactions, and transfers of accounts between broker-dealers (as applicable), in each case, to the extent received in good order in accordance with Written Procedures and provide standardized responses with respect to Written Instructions regarding the foregoing received on behalf of the Fund from Fund Shareholders found not to be in good order;

At the reasonable request of the Fund, and subject to the Fee Agreement and such fees and reimbursement of expenses as the Fund and Securitize shall mutually agree in writing, seek to reconcile any inconsistency between the Fund’s register, the Fund’s accounting system, specified terms, transaction confirmations and any payments made by the Fund, on one hand, and the Fund’s instructions, on the other hand, as the Fund and Securitize shall mutually agree in writing in their sole discretion;

Other than with respect to Legal Process Items, notify the Fund in a timely manner of inquiries from the IRS, the SEC and any other applicable regulatory bodies, addressed to the Fund and received by Securitize in its capacity as an agent for the Fund, unless Securitize is prohibited from doing so by the terms of the inquiry or applicable law, regulations or legal process;

Provide the “Additional Digital Services” detailed in Appendix C.

Provide such additional services to the Fund pursuant to this Agreement as shall be agreed in writing between the Fund and Securitize from time to time.

Rights.

Intellectual Property Ownership.

Fund Intellectual Property. Neither this Agreement nor any provision herein transfers ownership from the Fund to Securitize of any Fund Intellectual Property Rights of any kind whatsoever. Without limiting the generality of the foregoing, the Fund owns and shall retain ownership of all Fund Intellectual Property, and all uses by Securitize of Fund Intellectual Property pursuant to the license herein, and the associated goodwill, shall inure to the benefit of the Fund. The Fund hereby grants (for itself and on behalf of applicable Authorized Persons and Affiliates) to Securitize and Securitize’s Affiliates, successors and assigns a (i) non-transferable, non-exclusive, royalty-free, worldwide right and license during the Term, to reproduce, create derivative works based on and otherwise use, in any manner and media, all Instructions and the Fund Data, to the extent any such Instructions and Fund Data, or any derivative works based thereon, are expressed, implemented or otherwise incorporated in any manner in any Fund Smart Contract, and (ii) non-

Securitize Intellectual Property. Subject to the Fund’s rights in all Fund Materials, all Securitize Intellectual Property Rights, unless otherwise indicated, are protected by applicable laws including, but not limited to, copyright, trade secret, and trademark laws, as well as other state, national, and international laws and regulations. Except as expressly provided herein, Securitize does not grant any express or implied right to Authorized Persons under any patent(s), copyright(s), trademark(s), or trade secret information or other Intellectual Property Right

Limited License Grant. During the term of this Agreement, and subject to the terms thereof, Securitize grants to the Fund, and the Fund accepts from Securitize, a non-exclusive, non-transferable limited worldwide license, without a right to sublicense (other than to the Fund’s Affiliates) to access the Platform solely for the purpose of preparing, facilitating and managing an offering and sale or issuance by Fund of Shares (or such other similar transactions) as described in the applicable Order Form (the “Company Offering”). In addition, Securitize agrees that it will grant, in accordance with the terms and conditions of the investment portal, the Registration Statement, the subscription documentation and any AML/ KYC related items to prospective investors solicited by Fund or its agents who are interested in purchasing Shares in the Fund’s offering the right to access the Platform in order to utilize the Services. If, based on the reasonable determination of Securitize or Fund, any Authorized Person is using the Services in a manner that is prohibited by this Agreement (a “Prohibited Use”), in addition to any of its other rights or remedies, Securitize may, without liability to Fund, suspend or limit the Fund’s or such Authorized Person’s access to the Services upon notice to the Fund and the Authorized Person and until such prohibited usage is fully remedied. The Fund shall use commercially reasonable efforts to provide Securitize notice of any Prohibited Use as soon as reasonably practicable after gaining knowledge thereof.

Restrictions; No Reverse Engineering. The Fund shall not, and shall not knowingly allow any of its employees, agents, contractors, or Affiliates, to (i) decompile, disassemble, or otherwise reverse engineer or attempt to reconstruct or discover any source code, underlying ideas, or interoperability interfaces of the Services by any means whatsoever; (ii) remove any product identification, copyright or other notices on the Services; (iii) provide, lease, lend, use for timesharing, service bureau, hosting purposes or otherwise use the Services to or for the benefit of third parties other than Fund and its Affiliates or others authorized hereunder; or (iv) without Securitize’s consent, modify, adapt, alter, translate or incorporate into or with other software or create a derivative work of any part of the Services.

Fund Smart Contract. Securitize hereby grants to Fund, and Fund accepts from Securitize, a royalty free, perpetual, irrevocable, worldwide, non-exclusive, non-transferable limited license, without a right to sublicense (other than to Fund’s Affiliates) or create derivative works thereon, to Securitize’s Intellectual Property Rights included in, or forming part of, the Fund Smart Contract. Fund hereby assumes all prospective obligations, liabilities and duties attendant to Fund’s provision of instructions for the Fund Smart Contract. The foregoing does not and is not intended to transfer or grant, and shall not otherwise affect in any way, ownership by Securitize of, or rights of Securitize in, any of Securitize’s Intellectual Property Rights or other proprietary rights, assets, content, products and services, and nothing in this Agreement shall be construed as the assignment or transfer of any ownership rights in any Intellectual Property Rights or other proprietary rights, assets, technology, content, products or services of Securitize and/or its Affiliates, including, without limitation, Securitize’s technology, software, ideas, know-how, or information, except for the limited license granted herein to the specific the Fund Smart Contract. Securitize hereby expressly reserves all of its rights not expressly granted to the Fund under this Agreement, and nothing herein shall be construed as granting the Fund any intellectual property rights in or to a specific blockchain. Subject to Securitize’s obligations pursuant to Section 19(b), for the avoidance of doubt, except as set forth herein, Securitize shall have no obligation to defend any third party claim arising or related to the Fund Smart Contract or any liability arising out of or related to the Fund Smart Contract after the term of the applicable Order Form, except for any claims arising out of Intellectual Property Rights and Securitize’s gross negligence, willful misconduct, or fraud.

Security and Access Policies.

General. Securitize shall implement and maintain security controls aligned to industry-recognized frameworks (such as NIST Cybersecurity Framework (CSF), ISO/IEC 27001:2022 or later) to protect Confidential Information against unauthorized disclosure or access, unlawful destruction, loss, or alteration.

Platform Security. Securitize shall use commercially reasonable efforts consistent with industry standards to protect the physical security and electronic security of the Platform and other systems utilized to provide the Services, including but not limited to using up-to-date anti-virus, security and firewall technology commonly used in the industry. The Fund agrees that it shall not, and shall ensure that its Affiliates do not, take actions that knowingly and negatively affect the confidentiality, integrity, and availability of Securitize’s systems and information assets.

Harmful Code. Subject to Section 11(f), if either Party becomes aware that an unauthorized party has accessed the Fund Data, or Confidential Information, or that Harmful Code has infected a relevant network or system of such Party, then it shall notify the other Party as soon as reasonably practical (but in any event within twenty four (24) hours), so the Parties can work together to mitigate any potential adverse effect and undertake any further steps that may be applicable or required by law. “Harmful Code” means (i) any virus, malware, trackware, ransomware, Trojan horse, worm, back door, time bomb, drop dead device, spyware, trackware, or adware, and (ii) any similar program, 51% attack, phishing, routing, routine, instruction, device, code, contaminant, logic or effect designed or intended to disable, disrupt, erase, harm, or otherwise impede the operation of, or enable any Person to access without authorization, or otherwise materially and adversely affect the functionality of, any IT Systems (or portion thereof). Each Party shall take commercially reasonable precautions to avoid, prevent, stop, find and eliminate the spread of all Harmful Code on its IT Systems.

No Export. the Fund shall not, and shall ensure that its Affiliates do not, remove or export from the United States or re-export from anywhere any part of the Services or any direct product thereof to any prohibited country or party as specified by the export laws of the United States. Further, each Party warrants to the other that it and each of its Affiliates is not on the United States’ prohibited party list and is not located in or a national resident of any country on the United States’ prohibited country list. The Fund acknowledges and shall ensure that its Affiliates are aware that the Services contain encryption technology, export of which is subject to regulation by the U.S. and certain foreign jurisdictions.

Limited Storage and Retrieval of Data. All Fund Data including third-party PII that is received, stored or otherwise maintained by Securitize and/or its Affiliates for the Fund pursuant to this Agreement shall be maintained in a secure hosting environment that meets or exceeds industry standards and satisfies the requirements set forth in this Agreement (including the exhibits hereto).

Anti-Money Laundering.

Securitize shall develop, implement, maintain and operate a written anti-money laundering and counter-terrorist financing program reasonably designed to assist the Fund in complying with the Bank Secrecy Act, the USA PATRIOT Act, the regulations of the U.S. Department of the Treasury (including 31 CFR Chapter X, and specifically the mutual fund AML program rule at 31 CFR 1024.210 and Section 352 of the USA PATRIOT Act), the customer due diligence rule at 31 CFR 1010.230, and other applicable anti-money laundering, counter-terrorist financing and sanctions laws and regulations (collectively, the “AML Laws”), in each case as in effect from time to time and as the same may apply to the Fund or to Securitize in its capacity as transfer agent to the Fund. Without limiting the foregoing, Securitize shall: (i) establish and maintain written internal policies, procedures and controls (the “AML Program”) reasonably designed to prevent the Fund from being used to launder money, finance terrorism or evade economic or trade sanctions; (ii) provide for independent testing of the AML Program at least annually, conducted by qualified Securitize personnel who are not responsible for the operation of the AML Program or by a qualified outside party; (iii) designate a person or persons (the “AML Officer”) responsible for implementing and monitoring the day-to-day operation and internal controls of the AML Program, and provide the Fund with the AML Officer’s name and contact information; (iv) provide ongoing training of Securitize personnel relating to the AML Laws and the AML Program; and (v) maintain books and records evidencing compliance with this Section 9 for the periods required by, and otherwise in accordance with, the AML Laws.

Securitize shall provide the following to the Fund’s AML Officer identified by the Fund from time to time:

Access to Securitize’s written AML policies and procedures within 30 days of the Effective Date and thereafter a copy of such within 30 days of a material change thereto;

A copy of the written report of each annual (and any interim) independent test of the AML Program prepared by the independent tester within 30 days of delivery of such report to Securitize, together with reasonable supporting

Within 30 days of the Effective Date and within 30 days of any material change thereto, a summary of the AML training provided for appropriate Securitize personnel.

The AML Services described in this Section 9 are intended to assist the Fund with its compliance obligations under the AML Laws as in effect from time to time, including any successor or replacement provisions to Section 352 of the USA PATRIOT Act, and shall be performed in a manner consistent with such laws as they may be amended or supplemented.

Foreign Account Due Diligence.

To assist the Fund in complying with requirements regarding a due diligence program for “foreign financial institution” accounts in accordance with applicable regulations promulgated by U.S. Department of Treasury under Section 312 of the USA PATRIOT Act (“FFI Regulations”), Securitize will do the following:

Implement and operate a due diligence program that includes appropriate, specific, risk-based policies, procedures and controls that are reasonably designed to enable the Fund to detect and report, on an ongoing basis, any known or suspected money laundering activity conducted through or involving any correspondent account established, maintained, administered or managed by the Fund for a “foreign financial institution” (as defined in 31 CFR 1010.605(f)) (“Foreign Financial Institution”);

Conduct due diligence to identify and detect any Foreign Financial Institution accounts in connection with new accounts and account maintenance;

Assess the money laundering risk presented by each such Foreign Financial Institution account, based on a consideration of all appropriate relevant factors (as generally outlined in 31 CFR 1010.610), and assign a risk category to each such Foreign Financial Institution account;

Apply risk-based procedures and controls to each such Foreign Financial Institution account reasonably designed to detect and report known or suspected money laundering activity, including a periodic review of the Foreign Financial Institution account activity sufficient to determine consistency with information obtained about the type, purpose and anticipated activity of the account;

Include procedures to be followed in circumstances in which the appropriate due diligence cannot be performed with respect to a Foreign Financial Institution account;

Adopt and operate enhanced due diligence policies for certain Foreign Financial Institution accounts in compliance with 31 CFR 1010.610(b);

Record due diligence program and maintain due diligence records relating to Foreign Financial Institution accounts; and

Report to the Fund about measures taken under (A)-(G) above.

Nothing in this Section shall be construed to require Securitize to perform any course of conduct that is not required for Fund compliance with the FFI Regulations.

The Foreign Account Due Diligence Services described in this Section 9(b) shall be performed in a manner consistent with the AML Laws as they may be amended, supplemented or replaced from time to time, including any successor or replacement provisions to Section 312 of the USA PATRIOT Act.

Customer Due Diligence; Beneficial Ownership.

To assist the Fund in complying with the FinCEN customer due diligence rule (31 CFR 1010.230) and any successor or amended rule (including any rule implementing the beneficial ownership reporting requirements of the Corporate Transparency Act to the extent applicable to investment companies), Securitize shall, in each case as part of its AML Program and CIP:

identify and verify the identity of each beneficial owner of each legal-entity Customer at the time a new account is opened, including each individual owning, directly or indirectly, 25% or more of the equity interests of the legal entity and a single individual with significant responsibility to control, manage or direct the legal entity;

understand the nature and purpose of each Customer relationship in order to develop a customer risk profile and assign an AML risk rating (e.g., low, medium, high) to each Customer based on a documented risk assessment methodology;

apply enhanced due diligence (EDD) measures for higher-risk Customers (including, but not limited to, high-risk jurisdictions, politically exposed persons, or other elevated risk indicators);

screen all Customers against politically exposed persons lists and adverse media sources on no less than a daily basis;

conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, maintain and update Customer information (including beneficial ownership information);

retain beneficial ownership records and certifications in accordance with 31 CFR 1010.230(i);

integrate blockchain-specific risk indicators into the Customer risk profile, including consideration of wallet-level risk scores derived from reputable blockchain analytics providers

implement a risk-based refresh and periodic review process for Customer accounts, whereby customer due diligence information is updated at intervals commensurate with the assigned AML risk rating, and on a trigger

report to the Fund’s AML Officer on the operation of, and any material exceptions identified in, the foregoing services.

Customer Identification Program.

To assist the Fund in complying with requirements regarding a customer identification program in accordance with applicable regulations promulgated by U.S. Department of Treasury under Section 326 of the USA PATRIOT Act (“CIP Regulations”), Securitize will do the following:

Implement procedures which require that prior to establishing a new account in the Fund Securitize obtain the name, date of birth (for natural persons only), address and government-issued identification number (collectively, the “Data Elements”) for the “Customer” (defined for purposes of this Agreement as provided in 31 CFR 1024.100(c)) associated with the new account.

Use collected Data Elements to attempt to reasonably verify the identity of each new Customer promptly before or after each corresponding new account is opened. Methods of verification may consist of non-documentary methods (for which Securitize may use unaffiliated information vendors to assist with such verifications) and documentary methods (as permitted by 31 CFR 1024.220), and may include procedures under which Securitize personnel perform enhanced due diligence to verify the identities of Customers the identities of whom were not successfully verified through the first-level (which will typically be reliance on results obtained from an information vendor) verification process(es).

Record the Data Elements and maintain records relating to verification of new Customers consistent with 31 CFR 1024.220(a)(3).

Regularly report to the Fund about measures taken under (i)-(iii) above.

Provide to the Fund copies of all policies and procedures adopted pursuant to this Section 10 within thirty (30) days of the Effective Date and within thirty (30) days of any material change thereto.

If Securitize provides services by which prospective Customers may subscribe for Shares in the Fund via the Internet or telephone, work with the Fund to notify prospective Customers, consistent with 31 CFR 1024.220(a)(5), about the program conducted by the Fund in accordance with the CIP Regulations.

On a quarterly basis, deliver to the Fund a written report summarizing key risk metrics for the investor population, including, without limitation, the distribution of AML risk ratings, wallet risk ratings, KYC/CIP refresh status, blocked or rejected transactions, total frozen Tokens and affected Wallet Addresses, and such other risk indicators as the Fund may reasonably request.

The CIP Services described in this Section 10 shall be performed in a manner consistent with the AML Laws as they may be amended, supplemented or replaced

FinCEN Requests Under USA PATRIOT Act Section 314(a)). The Fund hereby engages Securitize to provide certain services as set forth in this subsection (b) with respect to FinCEN Section 314(a) information requests (“Information Requests”) received by the Fund. Upon receipt by Securitize of an Information Request delivered by the Fund in full compliance with all 314(a) Procedures (as defined below), Securitize will compare appropriate information contained in the Information Request against relevant information contained in account records maintained for the Fund. Information relating to potential matches resulting from these comparisons, after review by Securitize for quality assurance purposes (“Comparison Results”), will be made available to the Fund in a timely manner. The Fund will retain responsibility for filing reports with FinCEN that may be appropriate based on the Comparison Results. In addition, a potential match involving a tax identification number will be analyzed by Securitize in conjunction with other relevant activity contained in records for the particular relevant account, and if, after such analysis, Securitize determines that further investigation is warranted because the activity might constitute “suspicious activity”, as that term is used for purposes of the USA PATRIOT Act, then Securitize will deliver a suspicious activity referral to the Fund. “314(a) Procedures” means the procedures adopted from time to time by Securitize governing the delivery and processing of Information Requests transmitted by Securitize clients to Securitize, including without limitation requirements governing the timeliness, content, completeness, format and mode of transmissions to Securitize.

Section 314(b) Information Sharing. To the extent the Fund elects to participate in voluntary information sharing under Section 314(b) of the USA PATRIOT Act and the implementing regulations at 31 CFR 1010.540, Securitize shall (i) provide reasonable assistance to the Fund in submitting and maintaining the required FinCEN notice, (ii) maintain reasonable procedures for handling information received from or shared with other financial institutions under Section 314(b), and (iii) safeguard the confidentiality of any information shared in accordance with 31 CFR 1010.540(b)(4).

Sanctions List Matching Services.

Securitize will, on a continuous basis and in any event (x) as part of the nightly processing cycle following each Business Day, (y) prior to opening any new account or whitelisting any new Wallet Address, and (z) promptly (and in any event within one (1) Business Day) following any update to any Sanctions List or any other applicable sanctions list, compare Appropriate List Matching Data (as defined in subsection (iii) below) contained in Securitize databases which are maintained for the Fund pursuant to this Agreement against the following lists, programs, determinations and data sets (collectively, the “Sanctions Lists”):

all sanctions lists, programs, regulations and determinations administered or enforced from time to time by the Office of Foreign Assets Control of the U.S. Department of the Treasury (“OFAC”), including the Specially Designated Nationals and Blocked Persons List (the “SDN List”), the Sectoral Sanctions Identifications List, the Non-SDN Menu-Based Sanctions List, the Non-SDN Chinese Military-Industrial Complex Companies List, the Foreign Sanctions Evaders List, any successor lists, and all comprehensive and country-based sanctions programs administered by OFAC, and including any entity that is owned, directly or indirectly, fifty percent (50%) or more, individually or in the aggregate, by one or more

sanctions lists administered or enforced by the European Union, Her Majesty’s Treasury of the United Kingdom, and the United Nations Security Council, in each case as in effect from time to time, including any successor or replacement lists (the “Global Sanctions Lists”);

the Financial Action Task Force lists of “high-risk jurisdictions subject to a call for action” and “jurisdictions under increased monitoring,” in each case as in effect from time to time, and any successor or replacement lists (the “FATF Lists”);

data promulgated in connection with determinations by the Director (the “Director”) of the Financial Crimes Enforcement Network of the U.S. Department of the Treasury that a foreign jurisdiction, institution, class of transactions, type of account or other matter is a primary money laundering concern (“PMLC Determination”); and

data promulgated in connection with any other lists, programs or determinations (A) which Securitize determines to be substantially similar in purpose to any of the foregoing lists, programs or determinations, or (B) which Securitize and the Fund agree in writing to add to the service described in this subsection (D).

In the event that following a comparison of Fund Data to a Sanctions List as described in subsection (i) Securitize determines that any Fund Data constitutes a “match” with the Sanctions List in accordance with the criteria applicable to the particular Sanctions List, Securitize:

will notify the Fund of such match and promptly file, or assist the Fund in filing, any blocking report or other report required by the applicable sanctions authority in connection with such match, in each case within the time period required by applicable law;

will send any other notifications required by applicable law or regulation by virtue of the match;

if a match to an OFAC List, will to the extent required by applicable law or regulation, assist the Fund in taking appropriate steps to block any transactions or attempted transactions;

if a match to a FATF List or a PMLC Determination, will to the extent required by applicable law or regulation conduct a suspicious activity review of accounts related to the match and if suspicious activity is detected will deliver a suspicious activity referral to the Fund;

if a match to a PMLC Determination, will assist the Fund in taking the appropriate special measures imposed by the Director; and

will assist the Fund in taking any other appropriate actions required by applicable law or regulation.

“Appropriate List Matching Data” means (i) account registration and alternate payee data, to the extent made appropriate by statutes, rules or regulations governing the Sanctions Lists, (ii) data determined by Securitize in light of statutes, rules or regulations governing the Sanctions Lists to be necessary to provide the services described in this Section 10(d), and (iii) data the Parties agree in writing to be necessary to provide the services described in this Section 10(d).

Legal Process SAR Referral. Upon the conclusion of the Legal Process Item described in Section 3(m): if Securitize, after a review of the Legal Process and other pertinent account records, determines that such information could indicate “suspicious activity”, then Securitize will deliver a suspicious activity referral to the Fund.

Suspicious Activity Monitoring; Blockchain Analytics; SAR Filings. (i) Securitize as agent of the Fund will engage in reasonably designed, risk-based ongoing monitoring of activities occurring with respect to the Fund during Securitize’s performance of transaction processing, recordkeeping and tokenization services, including (A) screening of each Shareholder Wallet Address (and each counterparty Wallet Address in any peer-to-peer transaction) against Sanctions Lists and against blockchain analytics indicators of exposure to mixers, tumblers, darknet markets, ransomware addresses, stolen-funds clusters and other illicit activity using one or more industry-recognized blockchain analytics tools (currently Chainalysis, TRM Labs or Elliptic, or such other comparable tool as the Fund and Securitize may agree from time to time), and (B) monitoring of fiat and stablecoin payment flows in compliance with the funds-transfer recordkeeping and “travel” rules at 31 CFR 1010.410(e)–(f) and any successor rules, and with FATF Recommendation 16 as implemented for virtual asset service providers. (ii) If in the course of such monitoring Securitize determines that any activity warrants further investigation as potentially suspicious, Securitize shall deliver a suspicious activity referral to the Fund within one (1) Business Day. (iii) To the extent permitted by law (including the SAR confidentiality rules at 31 CFR 1024.320(e)), Securitize shall promptly notify the Fund (and in any event within two (2) Business Days) of the filing of any Suspicious Activity Report relating to the Fund or to any Shareholder, and shall provide the Fund with such information regarding the underlying activity as is permitted to be shared. (iv) Securitize shall notify the Fund (with a copy to the Fund’s Chief Compliance Officer and AML Officer) of any actual or reasonably suspected violation of, or breach of controls under, the AML Laws involving the Fund or the Services as promptly as practicable, and in any event within twenty-four (24) hours after Securitize becomes aware of such incident, and shall reasonably cooperate with the Fund’s investigation and remediation thereof.

Securitize agrees to permit governmental authorities with jurisdiction over the Fund to conduct examinations of the operations and records relating to the services performed by Securitize under this Section 10 upon reasonable advance request and during normal business hours and to furnish copies at the Fund’s cost and expense of information reasonably requested by the Fund or such authorities and relevant to the services.

For purposes of clarification: All Written Procedures relating to the services performed by Securitize pursuant to this Section 10 and any information, written matters or other recorded materials relating to such services and maintained by Securitize shall constitute Confidential Information of Securitize, except to the extent, if any, such materials constitute Fund records under Securities Laws.

Each of the Fund and Securitize shall, in their respective capacities, comply with applicable AML Laws. The Fund acknowledges that it retains ultimate responsibility

On an annual basis (or more frequently as the Fund may reasonably request), and in any event no later than thirty (30) days following the end of each calendar year, Securitize will provide to the Fund (with a copy to the Fund’s Chief Compliance Officer, AML Officer and, upon request, the Board) a written certification that it has performed the services described in subsections (a) through (f) of this Section 10 and in Section 9 in compliance with this Agreement and the AML Laws during the period covered by the certification. Securitize shall also reasonably cooperate with any periodic AML/sanctions audit or review by or on behalf of the Fund (including by the Fund’s Chief Compliance Officer, internal audit function or independent public accountants) and shall make available, on reasonable advance notice and subject to applicable confidentiality and legal requirements, its AML/CIP/CDD/sanctions books, records and personnel as the Fund may reasonably request.

Identity Theft Red Flags Program. Securitize shall provide, as a core Service and not as an elective service, the “Red Flags Services” described below, which are reasonably designed to assist the Fund in complying with Rule 201 under Regulation S-ID (17 CFR 248.201) and Section 615(e) of the Fair Credit Reporting Act and any successor or replacement rules (collectively, the “Red Flags Requirements”), with respect to each “covered account” (as defined in the Red Flags Requirements) maintained by Securitize on behalf of the Fund. The “Red Flags Services” are hereby defined to mean the following services:

Securitize will maintain written controls reasonably designed to detect the occurrence of Red Flags (as defined below) in connection with (i) account opening and other account activities and transactions conducted directly through Securitize with respect to Direct Accounts (as defined below), and (ii) transactions effected directly through Securitize by Covered Persons (as defined below) in Covered Accounts (as defined below). Such controls, as they may be revised from time to time hereunder, are referred to herein as the “Red Flags Controls.” Solely for purposes of the Red Flags Section, the capitalized terms below will have the respective meaning ascribed to each:

“Red Flag” means a pattern, practice, or specific activity or a combination of patterns, practices or specific activities that may indicate the possible existence of Identity Theft (as defined below) affecting a Registered Owner (as defined below) or a Covered Person.

“Identity Theft” means a fraud committed or attempted using the identifying information of another person without authority.

“Registered Owner” means the owner of record of a Direct Account on the books and records of the Fund maintained by Securitize as registrar of the Fund (the “Fund Registry”).

“Covered Person” means the owner of record of a Covered Account on the Fund Registry.

“Direct Account” means an Account established directly with and through Securitize as a registered account on the Fund Registry and through which

“Covered Account” means an Account established by a financial intermediary for another as the owner of record on the Fund Registry and through which such owner of record has the ability to conduct transactions in Fund shares directly with and through Securitize.

“Account” means (1) an account holding Fund Shares with respect to which a natural person is the owner of record, and (2) any other account holding Fund Shares with respect to which there is a reasonably foreseeable risk to the particular account owner’s customers from identity theft, including financial, operational, compliance, reputation, or litigation risks.

Securitize will provide the Fund with a printed copy of or Internet viewing access to the Red Flags Controls.

Securitize will notify the Fund of Red Flags that it detects and reasonably determines to indicate a significant risk of Identity Theft to a Registered Owner or Covered Person (“Possible Identity Theft”) and assist the Fund in determining the appropriate response of the Fund to the Possible Identity Theft.

Upon the Fund’s reasonable request on not more than a quarterly basis, issue a certification in a form determined to be appropriate by Securitize in its reasonable discretion, certifying to Securitize’s continuing compliance with the Red Flags Controls.

On a quarterly basis, Securitize shall provide the Fund with a written summary of all Red Flags detected during the preceding quarter, including the number of alerts, the nature and disposition of each alert, any instances of Possible Identity Theft identified, and any remedial actions taken. Such quarterly report shall be provided no later than thirty (30) days following the end of each calendar quarter.

The Fund retains ultimate responsibility for its identity theft prevention program under the Red Flags Requirements. Securitize shall (i) reasonably cooperate with the Fund in connection with Board approval, annual review and periodic updating of its identity theft prevention program, (ii) provide the Fund with reasonable information regarding the Red Flags Controls and the performance of the Red Flags Services, and (iii) reasonably accommodate Fund-specified supplementation or augmentation of the Red Flags Services as needed for the Fund to comply with the Red Flags Requirements.

Confidentiality.

Generally. “Confidential Information” shall mean confidential or other non-public proprietary information that is disclosed by either Party to the other under this Agreement, including without limitation, software code and designs, hardware, product specifications and documentation, financial data, business, marketing and product plans, or technology, and Shareholder information (which includes, without limitation, any of the names, addresses, phone numbers, email addresses, and other PII relating to Shareholders).

Obligations of Confidentiality. Each Party agrees (a) that it and its Affiliates will hold in strict confidence and not disclose the Confidential Information of the other Party to any third

Exclusions from Obligations. A Party’s obligations of confidentiality under this Agreement shall not apply to information which such party can document the information (i) is or becomes in the public domain without the breach of any agreement or fiduciary duty or the violation of any law, (ii) was known to the Party prior to the time of disclosure without the breach of any agreement or fiduciary duty or the violation of any law, (iii) is proven by contemporaneous records to be independently developed by the Party without reference to the Confidential Information and (iv) is or becomes available to a Party from a third party not known by such Party to be in breach of any contractual obligation not to disclose such information.

Legally Required Disclosure. In the event either Party is required to disclose, pursuant to a judicial order, a requirement of a governmental, administrative or regulatory agency or by operation of law, any Confidential Information provided to it by the other Party then such Party shall provide the other Party written notice of any such requirement immediately after learning of any such requirement (if permitted by law to do so), and take commercially reasonable measures at the other Party’s expense to avoid or limit disclosure under such requirements and to obtain confidential treatment or a protective order and allow the other Party to participate in the proceeding (if permitted by law to do so).

Personally Identifiable Information. The Parties hereby acknowledge that each Party has a special responsibility under applicable data protection laws to keep personally identifiable information regarding Shareholders (“PII”) private and confidential. Securitize acknowledges that in no way shall it gain possession of any ownership or other proprietary rights with respect to Shareholder PII. Securitize agrees that it shall store and process the Shareholder PII in strict compliance with the terms of this Agreement and all applicable laws governing the use, collection, disclosure and storage of such information. In relation to the processing of any personal data of an identified or identifiable natural person each Party shall comply with the terms set out in Appendix H.

Storage of Data. All PII that is received, stored or otherwise maintained by Securitize for the Fund pursuant to this Agreement shall be maintained in a secure environment with physical, technical, and administrative information and data security safeguards that meet or exceed industry standards. The Fund is responsible for transmitting all PII and Confidential information to Securitize in encrypted or otherwise secure form if it is transmitted outside the normal operation of the Platform. In the event of a breach or suspected breach of security of any Securitize system, website, database, equipment or storage medium or facility that results or may have resulted in unauthorized access to any PII or any Confidential Information by any third party (including any employee, agent or subcontractor of Securitize that is not authorized to access such information) (collectively, a “Security Breach”), Securitize shall (i) notify the Fund within twenty four (24) hours of being informed of such breach of security, (ii) make commercially reasonable efforts to re-secure its systems immediately and remedy the Security Breach, (iii) cooperate with the Fund, at Securitize’s expense, to draft

limiting the foregoing, Securitize acknowledges that the Fund is a “covered institution” subject to Regulation S-P. In its capacity as a service provider, Securitize shall:

notify the Fund of any Security Breach involving Fund Data or customer information systems without undue delay and in any event within the earlier of (x) twenty four (24) hours of becoming aware of such Security Breach or (y) such shorter timeframe as required for the Fund to comply with applicable law;

provide, on an initial and ongoing basis, all information reasonably requested by the Fund to enable the Fund to assess the nature, scope, and impact of the Security Breach and determine its obligations under Regulation S-P and other applicable laws, including whether a notification event has occurred;

provide timely updates as additional information becomes available, including information relating to containment, remediation, affected data, and impacted individuals; and

reasonably cooperate with the Fund to support the Fund’s compliance with its incident response, regulatory notification, and customer communication obligations.

Injunctive Relief. Each Party recognizes and acknowledges that any use or disclosure of the Confidential Information of the other Party in a manner inconsistent with the provisions of this Agreement will cause the other Party irreparable damage for which remedies at law may be inadequate. Accordingly, the non-breaching Party shall have the right to seek an immediate injunction in respect of any material breach of these confidentiality obligations to obtain such relief. Notwithstanding the foregoing, this paragraph shall not in any way limit the remedies in law or equity otherwise available to the non-breaching Party.

Disaster Recovery.

Securitize shall maintain a Business Continuity and Disaster Recovery Plan for the Services and execute such plan in the event of any unplanned or anticipated interruption of the Services consistent with the provisions set forth in Appendix K (Business Continuity) hereto. Upon the Fund’s request, Securitize shall provide the Fund with a copy of the most recent version of the Business Continuity and Disaster Recovery Plan, revision history, and any reports or summaries relating to past exercising such plan. Securitize shall actively exercise, review, and update its Business Continuity and Disaster Recovery Plan, and provide the Fund with copies of any updates thereof. Any future updates or revisions to the Business Continuity and Disaster Recovery Plan shall be no less protective than that in effect as of the Effective Date.

If Securitize fails to reinstate the Services within the recovery times set forth in the Agreement, and such failure continues unremedied for a period of more than twenty-four (24) consecutive hours following the execution of the Business Continuity and Disaster Recovery Plan the Fund may, in addition to other remedies available hereunder, at its sole discretion, immediately terminate the Agreement as a non-curable default.

Instructions.

Securitize will engage in conduct when so directed by a Written Instruction or an Implementing Communication (as defined below) only if the Written Instruction or Implementing Communication, as applicable, complies with the applicable requirements set forth in this Section 17. Notwithstanding any other provision of this Agreement, Securitize shall require Written Instructions before taking any of the following actions: (i) issuing, minting, burning, freezing, re-issuing or transferring Tokens (other than ordinary-course processing of Shareholder purchase, redemption and peer-to-peer instructions received in good order in accordance with Written Procedures); (ii) changing the bank account or wire instructions of record for the Fund or the Fund Custodian; (iii) effecting any redemption proceeds payment in excess of any threshold established by the Fund in writing; (iv) suspending or recommencing peer-to-peer transactions in Shares; (v) deploying, upgrading or amending any Fund Smart Contract; or (vi) any action affecting the Official Shareholder Register or Off-Chain PII Record other than ordinary-course recordkeeping.

Written Instructions. Notwithstanding any other provision of this Agreement: (A) unless the terms of this Agreement, Written Procedures or other written agreement between the Fund and Securitize expressly provide, in the good-faith determination of Securitize, all requisite details and directions for it to take a specific course of conduct, Securitize may, prior to engaging in a course of conduct on a particular matter, whether the course of conduct is proposed by or otherwise originates with Securitize or is directed by the Fund in a Fund Communication, require the Fund to provide it with Written Instructions with respect to the particular conduct, and (B) Securitize shall require Written Instructions with respect to (1) any conduct described in Section 17(a) above, and (2) any conduct specified in a Fund Communication if it determines in good faith that the Agreement, Written Procedures or other written

Implementing Communications. “Implementing Communication” means a Fund Communication that is not a Written Instruction and that the Parties have agreed in writing (including in the Written Procedures) does not require a Written Instruction. Securitize shall not unilaterally classify a Fund Communication as an Implementing Communication if the underlying conduct constitutes an action described in Section 17(a) or otherwise reasonably requires Written Instructions in light of the materiality, irreversibility or risk profile of the conduct.

Subject to the right of Securitize to require in accordance with Section 17(a)(i) that conduct directed by a Fund Communication be provided in a Written Instruction, Securitize reserves the right to decline to act in accordance with a Fund Communication:

for a Bona Fide Reason; or

if the Fund Communication (or contents thereof) does not constitute in all material respects, as Securitize determines in good faith, a “Standard Instruction”, which is hereby defined to mean:

an instruction received by Securitize directing a course of conduct substantially similar in all material respects to a course of conduct provided for in a Written Procedure, or

if a Written Procedure provides for a particular form of instruction to be used in connection with a matter (a “Standard Form”), an instruction received by Securitize (i) on the specified Standard Form which responds appropriately to all requirements of the specified Standard Form, or (ii) in a format other than the specified Standard Form but conforming in all material respects to, and responding appropriately to all requirements of, the specified Standard Form, as Securitize determines in good faith.

Notwithstanding the right reserved by Securitize in Section 17(b) to decline to engage in conduct directed by a Fund Communication that is not a Standard Instruction (such instruction being a “Non-Standard Instruction”):

Securitize will in good faith consider implementing a Non-Standard Instruction if:

Securitize in its sole judgment exercised reasonably determines sufficient time exists under the circumstances to evaluate fully and implement the requested conduct; and

the Fund makes its request in writing (including via e-mail) and provides all written materials, including descriptions and responses to questions, that in the reasonable judgment of Securitize are appropriate to fully evaluate the request.

The Fund shall implement commercially reasonable measures to provide that Fund Communications delivered to Securitize are authorized, accurate and complete. Securitize is not obligated to act, and may refrain from acting, on any “Ineligible Communication”, which is hereby defined to mean a Fund Communication that Securitize in good faith determines:

to be vague, ambiguous or incomplete;

to contain an error that is not reasonably reconcilable;

to have been received too late to be acted upon;

to be incapable of being implemented due to a failure to meet applicable specifications or system requirements;

to be in conflict with a previous or contemporaneous Fund Communication; or

to be incapable of being executed in accordance with all applicable performance standards due to any other defect.

Securitize will, as promptly as reasonable in light of the subject matter of the Fund Communication and the timing implications of the requested conduct, notify the Fund of its determination that a Fund Communication is an Ineligible Communication, and shall use commercially reasonable efforts to assist the Fund in remediating any such Ineligible Communication.

Securitize shall verify that the name of any person executing a Written Instruction is listed as an Authorized Person on the then-current list provided by the Fund.

Securitize is authorized to rely on communications from Shareholders of the Fund and from persons reasonably believed to be representatives of Shareholders, in each case based on identity verification reasonably determined to be in good order under the Written Procedures, solely with respect to matters reasonably related to the Services (together with Fund Communications other than those identified as Ineligible Communications, “Service Communications”, and communications from Shareholders or their representatives, “Shareholder Communications”); provided that any Shareholder Communication purporting to (1) add, change or re-authenticate a Wallet Address, (2) change a Shareholder’s registered address, bank account, beneficiary, or contact information, (3) effect a redemption of Shares or distribution of redemption proceeds, or (4) make any other change to a Shareholder’s account information of a type identified from time to time by the Fund as “high-risk”, shall be processed only after Securitize has completed the enhanced identity-verification and out-of-band confirmation procedures. Securitize shall promptly notify the Fund of any rejected Service Communications.

Securitize may agree to act in accordance with Oral Instructions on a particular matter under this Agreement. In such event, the Fund agrees to deliver to Securitize, for receipt by (A) 5:00 PM (Eastern Time) on the same Business Day as the day the Oral Instructions were given or (B) in the event such Oral Instructions were provided after such time, as soon as reasonably practicable following provision of such Oral Instructions, Written Instructions which confirm the course of conduct contained in the Oral Instructions. Under all circumstances and for all purposes of this Agreement: (A) if confirming Written Instructions are not received by the time specified above, Securitize’s contemporaneous written memorialization of the Oral Instructions (including any recording of the call) shall be presumed to constitute the Written Instructions applicable to the particular matter; and (B) if confirming Written Instructions are received by the time specified above but fail to confirm the course of conduct contained in the Oral Instructions in all material respects, the Fund and Securitize shall work together in good faith to memorialize such Oral Instructions, and pending such resolution Securitize shall suspend further conduct in reliance on the Oral Instructions to the extent reasonably practicable without prejudice to actions already taken in good faith.

In the event facts, circumstances, or conditions exist or events occur and Securitize reasonably determines that it must take a course of conduct in response to such situation (including a course of action that constitutes taking no action) and must receive an Instruction from the Fund to direct its conduct, and Securitize so notifies two Authorized Persons of the Fund (with reasonable detail regarding the relevant facts and Securitize’s proposed course of conduct), and the Fund fails to furnish Instructions within a reasonable period (“Response Failure”), Securitize will in good faith seek to determine the appropriate course of conduct in response to the circumstances and, except as set forth below, will have all rights with respect to the conduct taken in good faith in such circumstances (including a course of action that constitutes taking no action) that it would have if the conduct were specified in Written Instructions. Notwithstanding the foregoing, Securitize shall not, in connection with a Response Failure, (i) take any action described in Section 17(a)(i)–(vii) (other than to take no action, to preserve the status quo on an interim basis, or to comply with a final, non-appealable court or regulatory order in accordance with Section 3(m)), (ii) suspend or terminate Services to the Fund, or (iii) take any action that would result in a material monetary transfer from any Fund account or that would have a material adverse effect on the Fund, Shareholders or the Official Shareholder Register, in each case without first making commercially reasonable additional efforts to obtain Written Instructions, including by escalating to the Fund’s Chief Compliance Officer and a member of the Fund’s senior management.

Securitize shall be obligated to exercise reasonable care and diligence in the performance of its duties hereunder and to act in good faith in performing services provided for under this Agreement. Securitize shall be liable to the Investment Company (or any person or entity claiming through the Investment Company) for Loss the recovery of which is not otherwise excluded by another provision of this Agreement only to the extent the Loss is caused by the fraud, willful misconduct, intentional misconduct, bad faith, reckless disregard, negligence or breach of the duties or obligations of Securitize (“Breach Conduct”) under this Agreement. Subject to this Section 18(a), Securitize shall not be under any duty or obligation to inquire into and shall not be liable for the validity or invalidity, authority or lack thereof, or truthfulness or accuracy or lack thereof, or any instruction, direction, notice or instrument reasonably believed by Securitize to be genuine. In the absence of a finding to the contrary, the acceptance, processing and/or negotiation of a fraudulent payment for the purchase of Shares shall be presumed not to be Breach Conduct.

Notwithstanding any other provision, and for all purposes, of this Agreement: Neither Party nor its Affiliates shall be liable for any Loss (including Loss caused by delays, failure, errors, interruption or loss of data) or breach hereunder occurring directly or indirectly by reason of any event or circumstance, whether foreseeable or unforeseeable, which despite the taking of commercially reasonable measures is beyond its reasonable control, including without limitation: natural disasters, such as floods, hurricanes, severe storms (storms of a nature substantially equivalent to hurricanes but not meeting other criteria necessary to receive an official hurricane designation), tornados, earthquakes and wildfires; epidemics; action or inaction of civil or military authority; war, terrorism, riots or insurrection; criminal acts; job action by organized labor; interruption, loss or malfunction of utilities, transportation, computer or communications capabilities; non-performance by third parties (other than subcontractors of Securitize for duties or obligations described herein); or functions or malfunctions of the internet, firewalls, encryption systems or security devices caused by any of the foregoing (all and any of the foregoing being an “Event Beyond Reasonable Control”). Upon the occurrence of an Event Beyond Reasonable Control, the affected Party shall be excused from any non-performance caused by the Event Beyond Reasonable Control for so

Securitize shall not be liable for any Loss arising out of any action, omission or conduct of any prior service provider of the Fund or for any failure to discover any action, omission or conduct of any prior service provider of the Fund that caused or could cause Loss.

NOTWITHSTANDING ANY OTHER PROVISION OF THE AGREEMENT, IN NO EVENT SHALL ANY PARTY, ITS AFFILIATES OR ANY OF ITS OR THEIR DIRECTORS, OFFICERS, EMPLOYEES, AGENTS OR SUBCONTRACTORS BE LIABLE UNDER ANY THEORY OF TORT, CONTRACT, STRICT LIABILITY OR OTHER LEGAL OR EQUITABLE THEORY FOR LOST PROFITS, FOR EXEMPLARY, PUNITIVE, SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES, OR FOR ANY OTHER DAMAGES WHICH ARE NOT DIRECT DAMAGES REGARDLESS OF WHETHER SUCH DAMAGES WERE OR SHOULD HAVE BEEN FORESEEABLE AND REGARDLESS OF WHETHER ANY ENTITY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, ALL AND EACH OF WHICH DAMAGES IS HEREBY EXCLUDED BY AGREEMENT OF THE PARTIES. FOR PURPOSES OF CLARIFICATION: NO OTHER PROVISION OF THIS AGREEMENT SHALL BE INTERPRETED TO CONDITION, LIMIT, MODIFY, NULLIFY OR OTHERWISE PREVAIL IN WHOLE OR IN PART OVER THIS SECTION 18(d).

Each Party agrees to use commercially reasonable measures that do not require the expenditure of more than an insignificant sum to mitigate damages for which the other Party may become responsible; provided, that such Party provides notice as soon as reasonably practicable.

With respect to securities data, files, reports, information and research furnished to Securitize by third parties (not delegated duties, subcontracted or otherwise engaged by Securitize to perform the services hereunder on its behalf) and included in the Securitize System (“Securities Data”), the Fund acknowledges that Securitize makes no warranty concerning the Securities Data and Securitize disclaims all responsibility for the Securities Data, including its content, accuracy, completeness, availability or timeliness of delivery, and Securitize shall not be liable for Loss caused by “Errant Securities Data”, which is hereby defined to be Securities Data not being provided to Securitize with the content and at the time which is standard for the industry or which is required for performance of any service provided for herein in accordance with all applicable performance standards; provided, however, with respect to transaction activity communicated to Securitize by a Supported Network, Securitize will maintain commercially reasonable processes and procedures to detect and attempt to resolve rejected transactions.

While performing this Agreement Securitize shall be entitled to rely on, and engage in conduct based upon, its reasonable interpretation of “Legal Authority” (which is hereby defined to mean all laws and all regulations, rules, legal process and other acts and communications of an official nature of governmental, quasi-governmental bodies, regulatory and self-regulatory bodies) and the analysis and advice of legal counsel, including such reliance and conduct in circumstances when available Legal Authority is in conflict or does not provide unambiguous precedent or guidance. Securitize may rely and act in accordance with the analysis and advice of legal counsel that is reasoned notwithstanding the existence or availability of a differing legal analysis or advice or of different interpretations. For the avoidance of doubt, such conduct is included within the conduct described in Section 19(a). Securitize will endeavor in good faith to notify the Fund if it engages legal counsel in

This Section 18 shall survive termination of this Agreement.

The Fund agrees to indemnify, defend and hold harmless Securitize and its Affiliates in connection with services it provides pursuant to Section 3, and the respective directors, trustees, officers, agents and employees of each, from any and all Losses arising directly or indirectly from any action or omission to act taken or omitted by or on behalf of Securitize in connection with the provision of Services to the Fund, provided that in each case in which indemnification is sought, Securitize has not acted contrary to the standard of care set forth in Section 18(a) and there has been no Breach Conduct by Securitize or its Affiliates in the course of such action or omission to act. The obligations of each Portfolio of each Fund under this Section 19(a) shall be the several (and not joint or joint and several) obligation of each such Portfolio.

Securitize agrees to indemnify, defend and hold harmless each Fund and its Affiliates and their respective directors, trustees, officers, agents and employees, from any and all Losses arising directly or indirectly out of Securitize’s Breach Conduct in the performance of its duties under this Agreement.

This Section 19 shall survive termination of this Agreement.

Term. The term of this Agreement shall commence upon the Effective Date and continue for a period of one (1) year. This Agreement will automatically renew for successive one (1) year periods, unless a terminating Party gives written notice of termination to the other Party not less than ninety (90) days before the expiration of the then current term.

Termination for Cause. During the initial term and any renewal term, either Party may terminate this Agreement at any time upon (a) a material breach of a representation, covenant or term of this Agreement by the other Party which is not cured within thirty (30) days after receipt of written notice thereof from the terminating Party, (b) commencement of any proceeding in bankruptcy, reorganization, receivership, or insolvency by or against the other party, the other Party becomes insolvent or ceases to pay its obligations as they become due, or the other Party makes any assignment for the benefit of its creditors, or (c) based upon the Fund’s determination that there is a reasonable basis to conclude that Securitize is insolvent or that the financial condition of Securitize is deteriorating in any material respect. Termination of this Agreement with respect to any one particular Fund shall in no way affect the rights and duties under this Agreement with respect to any other Fund.

Transition Period. Upon the termination of this Agreement, Securitize shall provide up to one year of Services in accordance with the terms of the Agreement, subject to the payment of fees and other moneys consistent with the then current fee and remuneration agreement by the Parties, to provide sufficient time for the efficient and orderly disengagement of the Services. Within sixty (60) days of any notice of termination or expiration, the Fund will notify Securitize of a target transition date. Securitize shall cooperate with, and provide reasonable assistance to, the Fund, or such person as the Fund instructs and any successor service provider, to facilitate and complete the transfer of Securitize’s duties to such successor service and token provider, including but not limited to (i) promptly delivering to the Fund or such entity as the Fund instructs, the following items relating to the affairs of the Fund which are in Securitize’s possession at that time: Register, books of account, Fund Data, AML/ KYC data obtained by Securitize which are in Securitize’s possession at that time; (ii) promptly delivering to the Fund the following items specifically or exclusively developed in connection with the provision of the Services with respect to the Fund, if in existence: a true, correct and complete copy of the most current policies and procedures manuals, data maps, and registrar. Notwithstanding the foregoing, Securitize may keep a copy of any record or document in order to comply with its obligations under applicable law or bona fide record retention policy.

Securitize shall perform the services provided for in this Agreement in accordance with the written policies, processes, procedures, manuals, documentation and other operational guidelines of Securitize governing the performance of the services in effect at the time the services are performed (“Standard Procedures”). Securitize may embody in its Standard Procedures, including Standard Procedures for determining whether an instruction it receives is “in good order” (“IGO”) or is “not in good order” (“NIGO”), and act in reliance on: a reasoned course of conduct, conduct it reasonably determines to be commercially reasonable or conduct consistent with Industry Standards. Likewise, when in connection with providing a service, including IGO and NIGO determinations, Securitize is required to engage in conduct for which it does not have a Standard Procedure or Standard Procedures only partially address the facts and circumstances of a particular issue, Securitize may engage in and act in reliance on: a reasoned course of conduct, conduct it reasonably determines to be commercially reasonable or conduct consistent with Industry Standards. In making the decisions described in the foregoing sentences Securitize may rely on such information, data, research, analysis and advice, including legal analysis and advice, as it reasonably determines appropriate under the circumstances. For clarification: the published guidelines of the Securities Transfer Association shall constitute an Industry Standard on the subject matter addressed therein. Securitize may revise the Standard Procedures in accordance with the provisions of this Section 21(a). Securitize will notify the Fund in writing of any material change to a Standard Procedure in a manner that is timely given the nature of the change.

In the event that Fund requests documentation, analysis or verification in whatsoever form regarding the commercial reasonableness or industry acceptance of conduct provided for in a Standard Procedure, Securitize will cooperate to furnish such materials as it may have in its possession at the time of the request or which can reasonably be obtained without cost to the Fund, but the Fund agrees to reimburse Securitize for all out-of-pocket costs and expenses incurred, including the costs of legal or expert advice or analysis, in obtaining additional materials in connection with the request.

addressed as follows, unless a notice provided in accordance with this Section 22 shall specify a different address or individual:

if to Securitize, Securitize Transfer Agent LLC, 78 SW 7^th St Suite 500, Miami, FL, 33130, Attention: Legal; legal@securitize.io; and

if to the Fund, to [Name of Fund], 50 Hudson Yards, New York, NY 10001 Attention: General Counsel; with a copy to President and Chief Executive Officer of the Funds; and groupblackrocktaservices@blackrock.com.

delivered by hand (personal delivery by an Authorized Person to addressee); private messenger, with signature of recipient; U.S. Postal Service (with return receipt or other delivery verification provided); overnight national courier service, with signature of recipient; or electronic mail to the electronic mail address specified for the receiving Party pursuant to Section 22(a) (or such other electronic mail address as may be designated in writing from time to time); or facsimile sending device providing for automatic confirmation of receipt; and

deemed given on the day received by the receiving Party.

This Agreement, or any term thereof, including without limitation the Schedules, Exhibits and Appendices hereto, may be changed or waived only by a written amendment, signed by the Party against whom enforcement of such change or waiver is sought.

Notwithstanding subsection (a) above, in the event an officer of an Investment Company, Authorized Person or other person acting with apparent authority on behalf of an Investment Company requests that Securitize perform some or all of the services provided for in this Agreement for a Portfolio not listed on Appendix B, as amended, and such Portfolio accepts such services and the relevant Investment Company or Portfolio pays amounts provided for in the Fee Agreement as Fees and Reimbursable Expenses, then in the absence of an express written statement to the contrary such services are provided in accordance with the terms of this Agreement, Appendix B is deemed amended to include the particular Portfolio and the Portfolio shall be bound by the terms of this Agreement with respect to all matters addressed herein, except that Securitize may terminate such deemed amendment to this Agreement, and terminate Services to such Portfolio, if within 90 days of the first such acceptance of services by the Portfolio, the Portfolio (or the Portfolio it constitutes a series, class, tier or other subdivision of) does not execute a written amendment to Appendix B on terms mutually acceptable to Securitize and the Investment Company in their respective sole discretion. Securitize and the Investment Company each reserve the right to negotiate terms appropriate to such additional Portfolios which differ from the terms herein.

Entire Agreement. This Agreement embodies the final, complete, exclusive and fully integrated record of the agreement of the Parties on the subject matter herein and supersedes all prior agreements and understandings relating to such subject matter, provided that the Parties may embody in one or more separate documents their agreement, if any, with respect to delegated duties.

Captions. The captions in this Agreement are included for convenience of reference only and in no way define or delimit any of the provisions hereof or otherwise affect their construction or effect.

Requested Information. The Fund will provide such information and documentation as Securitize may reasonably request in connection with services provided by Securitize to the Fund.

Governing Law. This Agreement shall be interpreted in accordance with the laws of the State of New York, (excluding conflict of laws rules) as applied to agreements entered into and to be performed entirely within the State of New York between New York residents, without giving effect to any conflict of law principles that would require the application of the laws of a different jurisdiction. The U.N. Convention on Contracts for the International Sale of Goods shall not apply to this Agreement. Any controversy or claim arising out of or relating to this contract, or the breach thereof, shall be determined by arbitration administered by the American Arbitration Association/International Centre for Dispute Resolution (www.adr.org) in accordance with its Commercial Arbitration Rules (or International Arbitration Rules if applicable); the number of arbitrators shall be three, the place of arbitration shall be New York, New York, and the language of the arbitration shall be English.

Partial Invalidity. If any provision of this Agreement shall be held or made invalid by a court decision, statute, rule or otherwise, the remainder of this Agreement shall not be affected thereby.

Force Majeure. No failure, delay or default in performance of any obligation of either Securitize or the Fund, including without limitation, with respect to the Services or Platform, shall constitute an event of default or breach of this Agreement to the extent that such failure to perform, delay or default arises out of a cause, existing or future, that is beyond the control and without negligence of such Party, including, without limitation, action or inaction of governmental, civil or military authority, change in law, fire, strike, lockout or other labor dispute, flood, terrorist act, war, riot, theft, earthquake and other natural disaster. The Party affected by such cause shall take all reasonable actions to minimize the consequences of any such cause.

Parties in Interest. This Agreement shall be binding upon and shall inure to the benefit of the Parties hereto and their respective successors and permitted assigns. Except with respect to those certain provisions providing for rights of the Custodian or obligations of the Fund with respect to the Custodian, and those certain provisions benefitting Affiliates of the Parties, (i) this Agreement is not for the benefit of any other person or entity and (ii) there shall be no third-party beneficiaries hereof.

No Representations or Warranties. Except as expressly provided in this Agreement, Securitize hereby disclaims all representations and warranties, express or implied, made to the Fund or any other person, including, without limitation, any warranties regarding quality, suitability, merchantability, fitness for a particular purpose or otherwise (irrespective of any course of dealing, custom or usage of trade), of any services or any goods provided incidental to services provided under this Agreement. Securitize disclaims any warranty of title or non-infringement except as expressly set forth in this Agreement.

Customer Identification Program Notice. To help the U.S. government fight the funding of terrorism and money laundering activities, U.S. federal law requires each financial institution to obtain, verify, and record certain information that identifies each person who initially opens an account with that financial institution on or after October 1, 2003. Certain of Securitize’s affiliates are financial institutions, and Securitize may, as a matter of policy, request (or may have already requested) the name, address and taxpayer identification number or other government-issued identification number of the Fund or others, and, if such other is a

Compliance with Law. Each of Securitize and the Fund agrees to comply in all material respects with the respective laws, rules, regulations and legal process applicable to the operation of its business (“Applicable Laws”). For clarification: Applicable Law with respect to Securitize means the laws, rules, regulations and legal process applicable to Securitize directly, not derivatively by virtue of providing a service to or performing a function for the Fund. The Fund agrees that Securitize is not obligated to assist the Fund with, or bring the Fund into, compliance with laws, rules, regulations and legal process applicable to the Fund, that the Fund is solely responsible for such compliance, except where Securitize has expressly agreed to provide that compliance service as a service hereunder; provided that any change is made consistent with Section 23.

Service Indemnifications; Survival. Sections 2(h), 3(n), 4, 5, 6 (with respect to fees and Reimbursable Expenses accrued through the effective date of termination), 7, 11, 12, 13, 17(d), 17(e), 17(f), 17(g), 17(h), 17(i), 18, 19, 20(c), 22, 27, 29(d), 29(e), 29(g), 29(h), 29(k), 29(l), 29(m) and 29(n) and provisions necessary to the interpretation of such Sections and any indemnifications and the enforcement of rights conferred by any of the foregoing shall survive any termination of this Agreement. In the event the Board of the Fund authorizes a liquidation of the Fund or termination of the Agreement, Securitize may require as a condition of any services provided in connection with such liquidation or termination that the Fund make provisions reasonably satisfactory to Securitize for the satisfaction of contingent liabilities outstanding at the time of the liquidation or termination.

Liability of Trustees, etc. A copy of the Declaration of Trust of the Investment Company is on file with the Secretary of the Commonwealth of Massachusetts, and notice is hereby given that this instrument is executed on behalf of the Trustees of the Investment Company as Trustees and not individually and that the obligations of this instrument are not binding upon any of the Trustees individually but are binding only upon the assets and property of the applicable Investment Company. Securitize acknowledges and agrees that any obligations and liabilities of the Investment Company or any Portfolio arising hereunder shall not be binding upon any of the Shareholders, Trustees, officers or employees of the Investment Company, as provided in the Investment Company’s charter documents, and that, to the extent the Trustees are regarded as entering into this Agreement, they do so only in their capacity as trustees and not individually. Securitize further acknowledges and agrees that it shall look solely to the property of the applicable Fund for the performance of any obligation or liability of the Investment Company hereunder.

Obligations Not Joint. For the avoidance of doubt, each Investment Company listed on Appendix B hereto is acknowledged to have separately executed this Agreement on behalf of itself and its Portfolios and this Agreement shall be deemed to be a separate agreement with respect to each Investment Company. Under no circumstances, and notwithstanding anything in this Agreement to the contrary, shall any one Investment Company or its Portfolios be liable for the obligations, actions or omissions of any other Investment Company or its Portfolios under this Agreement.

Further Actions. Each Party agrees to perform such further acts and execute such further documents as are necessary to effectuate the purposes hereof.

No partnership or agency. Nothing in this Agreement establishes a partnership, a joint venture, or the relationship of principal and agent between the Fund and any other person and

Counterparts. This Agreement may be executed in one or more counterparts and each such counterpart shall be deemed an original, with all such counterparts together constituting one and the same instrument.

the course of conduct is not consistent or compliant with, is in conflict with, or requires a deviation from an Industry Standard or a Written Procedure;

the course of conduct is not reasonably necessary or appropriate to or consistent with the services contemplated by this Agreement or, solely with respect to Sections 10 and 14 of the Agreement, constitutes a change to a service;

the course of conduct is in conflict or inconsistent with or violates a law, rule, regulation, or order or legal process of any nature;

the course of conduct is in conflict or inconsistent with or will violate a provision of this Agreement or constitutes a unilateral amendment of the Agreement;

the course of conduct imposes on Securitize a risk, cost, liability or obligation not contemplated by this Agreement with (i) potentially more than insignificant adverse consequences to Securitize incurred from sources external to Securitize, including without limitation, for illustration and not limitation: sanction, criticism, fines, penalties, examination comments or special examination of a governmental, regulatory or self-regulatory authority; civil, criminal or regulatory action; a loss or downgrading of membership, participation or access rights or privileges in or to organizations providing common services to the financial services industry; and significant reputational risk and/or (ii) potentially adverse consequences with respect to matters involving criminal, civil or regulatory liability;

the course of conduct imposes on Securitize a risk, cost, liability or obligation not contemplated by this Agreement, other than a risk, cost, liability or obligation governed by clause (v) above, including without limitation, for illustration and not limitation: imposes costs and expenses on Securitize that are not adequately recovered by fees and expense payments that a Fund indicates it is willing to pay and Securitize reasonably anticipates disputes with respect to the fees and expenses it will invoice for the course of conduct; or adds more than insignificant reputational, operational, strategic or credit risk; requires performance of a course of conduct customarily performed pursuant to a separate service or fee agreement;

other than with respect to personnel or potential personnel whose job description would qualify them to perform the Services, who shall be subject to clause (ix): the course of conduct requires resources in addition to those normally employed to provide services to the Funds and the fees proposed for such course of conduct do not account for such additional resources, adds gain/loss risk, requires an increase in or additional performance standards or performance levels or subjects Securitize to an increase in or additional service failure credits, requires resources that may not be reasonably obtainable in the general commercial marketplace, or is reasonably likely to result in a diversion of resources or disruption in established work flows, course of operations or functioning of controls;

the course of conduct requires technology, personnel with technological expertise or a technology service or product that is not available on a commercially reasonable basis or constitutes a service or function that is not related to services commonly performed for registered investment companies by organizations acting as transfer agents, registrars, dividend disbursing agents and/or Shareholder servicing agents or is not reasonably related to services already being performed by Securitize for a Fund; and

the course of conduct represents conduct not engaged in by Securitize and Securitize reasonably believes it lacks sufficient information, analysis or legal advice to determine that the conditions in clauses (iii) or (v) do not exist and the Fund and Securitize fail to reach agreement on a reasonable method of paying any expense of obtaining such information.

a written instruction which is (i) signed by an Authorized Person of the Fund (or a person reasonably believed by Securitize to be an Authorized Person of the Fund), (ii) agreed to in writing by Securitize on the instrument containing the written instructions, if such signature is required by Securitize as part of a Standard Form, (iii) addressed to and received by Securitize, and (iv) delivered by (A) hand (personally by the signing Authorized Person or by a third party providing confirmation of receipt), (B) private messenger, U.S. Postal Service or overnight national courier which provides confirmation of receipt with respect to the particular delivery signed by the receiving Party, or (C) facsimile sending device which provides automatic confirmation of the standard details of receipt if the facsimile transmission is sent to an Authorized Person of the Fund or to the designated relationship manager or customer service officer of Securitize,

trade instructions transmitted to and received by Securitize by means of an electronic transaction reporting system which requires use of a password or other authorized identifier in order to gain access; or

electronic mail or “email” sent by an Authorized Person of the Fund to, and acknowledged by, an Authorized Person of Securitize.

BlackRock Daily Reinvestment Stablecoin Reserve Vehicle

Zero Hash; Indemnity.

Reference is hereby made to that certain Master Services Agreement (the “MSA”) executed and entered into by and between Securitize, Inc., a Delaware corporation, which is an affiliate of Securitize (together, with its affiliates, the “Platform Operator”), and Zero Hash LLC, a Delaware limited liability company (“Zero Hash”), pursuant to which Zero Hash and its Affiliates have agreed to, among other things, provide certain services in connection with facilitating transmissions of fiat currencies and effecting digital asset transactions for customers of the Platform Operator (collectively, the “Zero Hash Services”). Securitize represents and warrants that Securitize (i) has provided a copy of the MSA, executed by each of the parties thereto, to the Fund, and (ii) notwithstanding the Fund’s receipt of the MSA and comments thereto, Securitize is solely responsible for the selection, use, monitoring and oversight of Zero Hash and the Zero Hash Services.

In connection with the MSA, Securitize is seeking the Fund’s consent to use the Zero Hash Services in Securitize’s performance of the Services. Securitize hereby represents and warrants that pursuant to the MSA, Zero Hash has agreed to ensure compliance with AML Laws and Sanctions (each, as defined in Section 9 of the MSA) in connection with the Zero Hash Services, and to, inter alia, adopt, implement, and maintain and follow a reasonable risk-based program to comply with AML Laws and Sanctions, as set forth in Section 9 of the MSA. Securitize agrees with the Fund that it shall be responsible for all acts and omissions of Zero Hash in connection with the Zero Hash Services, and Securitize hereby agrees to defend, indemnify and hold the Fund harmless from and against any Losses suffered by the Fund or its Affiliates arising from any breaches by Zero Hash of its representations, warranties and obligations in the MSA, including without limitation, Section 9 thereof, as well as from any Losses incurred by the Fund or its Affiliates arising from the Zero Hash Services. The terms of Section 19 of the Agreement shall apply with respect to any such claims for indemnification. Securitize agrees that it shall not amend the MSA in a manner that reduces representations, warranties or obligations of Zero Hash thereunder without the prior written consent of the Fund. Securitize hereby agrees to provide to the Fund all information within its control regarding Zero Hash’s compliance with its representations, warranties and obligations in the MSA. Notwithstanding the foregoing, Securitize may, if agreed to by the Fund, and upon 60 days’ written notice to the Fund, discontinue its use of Zero Hash Services in connection with the performance of the Services. Securitize shall work in good faith with the Fund to transition the Services previously performed by Zero Hash Services to an alternative service provider, for which the Fund shall approve prior to any transition being performed..

The Fund hereby consents to the use of the Zero Hash Services provided that: Securitize complies with its obligations under this Appendix C. Securitize will use commercially reasonable efforts to cause the Platform Operator to obtain from Zero Hash, no less frequently than quarterly, a report, in form and substance reasonably acceptable to the Fund, which includes a representation from Zero Hash that it has complied with the terms of Section 9 of the MSA. Such report shall include such other information and representations regarding Zero Hash’s compliance with Section 9 of the MSA as is reasonably requested by the Fund. Securitize shall promptly provide each such report to the Fund.

At least annually, Securitize will obtain from Zero Hash, and deliver to the Fund, an executed copy of the AML certification referenced in Section 26(r) of the MSA, a form of which is attached thereto as Schedule C.

Securitize will require Zero Hash to establish a separate Zero Hash financial account for the benefit of clients of the Fund (the “Zero Hash Account”). As consideration for the continuous maintenance of the separate account directly with Zero Hash, Securitize will issue to BlackRock a separate invoice pursuant to the terms of the Agreement in the amount of [●] per month.

Definitions. For purposes of this Appendix:

“60^th Day” means the day which follows by sixty (60) days the date affixed by the IRS to the relevant IRS TIN Communication.

“CP-2100 Notice” means a notice to a Fund from the IRS titled “Notice: CP-2100” for a specified tax year in which the IRS states, among other things, that some Shareholders of the Fund may have provided an incorrect Taxpayer Identification Number or an invalid combination of name and Taxpayer Identification Number and that the Fund may need to begin backup withholding.

“Documentary Evidence” means IRS TIN Communications, any written correspondence (including emails) from Securitize or from the Fund to the IRS related to an IRS TIN Communication, and any other written or recorded evidence that is reasonably relevant to the matter sought to be proved, including a written memorandum which purports to memorialize the contents of a personal or telephone conversation and which contains, in addition to the contents of the conversation, the date and approximate time the conversation occurred and the person with whom it occurred.

“Penalty Notice” means a notice to a Fund from the IRS titled “FORM: CVL PEN” for a specified tax year in which the IRS, among other things, states that a penalty is proposed for the specified tax year due to information returns filed by the Fund for that tax year and provides information to the Fund with respect to action that should be taken and responses that may be taken with respect to the proposed penalty.

IRS TIN Communications. The Fund agrees to provide to Securitize as soon as practicable after receipt, a copy of all CP-2100 Notices, all Penalty Notices and all IRS correspondence related to a CP-2100 Notice, a Penalty Notice or a response to a CP-2100 Notice or Penalty Notice (each, an “IRS TIN Communication”) in order to permit Securitize sufficient time to respond to IRS TIN Communications.

Abatement. Upon receipt of an IRS TIN Communication on behalf of or from the Fund, Securitize will engage in commercially reasonable conduct to respond in an appropriate manner to the IRS TIN Communication, including by way of illustration and not limitation, complying with instructions in CP-2100 Notices to mail “B Notices” to certain Shareholders or institute backup withholding with respect to certain Shareholders and seeking to abate penalties cited in a Penalty Filing. The Fund will deliver to Securitize, pursuant to the provisions of (E) below, copies of all CP-2100 Notices and IRS correspondence related to a CP-2100 Notice, a Penalty Notice or a response to a CP-2100 Notice or Penalty Notice within 5 days of receipt, and copies of all Penalty Notices, within 10 days of receipt (such 5 and 10 day periods being referred to collectively herein as the “Delivery Period”). If Securitize reasonably determines that a penalty cited in a Penalty Notice or IRS correspondence related to a Penalty Notice cannot be abated or abated any further with commercially reasonable conduct, Securitize will notify the Fund and the Fund’s Chief Compliance Officer and provide reasonable assistance to the Fund if the Fund requests Securitize’s assistance with Fund efforts to further seek abatement of the penalty. In the event that any penalty assessed or proposed against the Fund exceeds $[___] in the aggregate for any tax year, Securitize shall promptly notify the Fund’s chief compliance officer and, upon request, provide a written summary to the Fund’s board of directors or its audit committee. In consideration for such assistance, the Fund shall be obligated to pay Securitize for the Fees and reimburse Securitize for the Reimbursable Expenses to the extent set forth in the Fee Agreement for the services performed by Securitize in providing such assistance. In the event a Fund’s request for assistance under this Section 3(a)(1)(ix) requires in the reasonable

Payment of Penalties. Except as provided in the proviso below, Securitize shall be obligated to pay on the Fund’s behalf any penalty assessed by the IRS against the Fund due to the late filing of a 1099 or due to an error in filling out a 1099 with information properly furnished by a Shareholder (“Securitize Error”); provided, however:

In the event Securitize receives a IRS TIN Communication from the Fund after the Delivery Period but on or before the 60^th Day (a “Late Receipt”) and the IRS TIN Communication assesses a penalty against the Fund for a Securitize Error (a “Securitize Penalty”) that Securitize is unable to abate in full, the Fund shall be responsible for payment of the Securitize Penalty if Securitize provides reasonable Documentary Evidence that Securitize was unable to abate the Securitize Penalty in full due to its receipt of the IRS TIN Communication after the expiration of the Delivery Period; provided further, however, notwithstanding the foregoing, if in response to Securitize’s efforts to abate a Securitize Penalty the IRS indicates in an IRS TIN Communication that Securitize will not be permitted to abate the Securitize Penalty due to the nature or some other aspect of the Securitize Error, then Securitize shall be obligated to pay the Securitize Penalty unless the IRS indicates that it will not permit any such abatement efforts due to a series of late responses to IRS TIN Correspondence and the late responses are reasonably related to a series of Late Receipts; and

In the event Securitize receives an IRS TIN Communication from the Fund after the 60th Day, the Fund shall be responsible for the payment of all penalties that Securitize is unable to abate in full.

Delivery. All IRS TIN Communications shall be delivered to Securitize by the Fund as follows:

The Fund shall scan all pages of each separate IRS TIN Communication into an electronic image document having the .pdf suffix and transmit the .pdf document by electronic mail to one of the email addresses contained in a separate written listing of IRS TIN Communication contacts provided by Securitize to the Fund, as such list may be amended (an “IRS Email”). For purposes of determining compliance with the Delivery Period requirement in Section 3(a)(1)(ix)(C) above, IRS Emails received by Securitize on or before 4 PM (Eastern Time) on a business day shall be deemed received on the business day of receipt and IRS Emails received on a business day after 4 PM (Eastern Time) or on a non-business day shall be deemed received on the business day next following the day of receipt.

Simultaneously with the transmission of the IRS Email or promptly thereafter the Fund will send the original of the IRS Communication corresponding to the .pdf document in the IRS Email to Securitize by mail.

FATCA Services. Securitize shall implement on behalf of the Fund the “FATCA Services,” which is hereby defined to mean processes and procedures reasonably designed for the Fund to comply on a commercially reasonable, material basis, to the extent applicable, with: (i) Chapter 4 of Subtitle A, Sections 1471 through 1474, of the Code (the foregoing being commonly referred to as the Foreign Account Tax Compliance Act) (“FATCA”), all as in effect as of the Effective Date, and (ii) subject to Section 23 of the Agreement, modifications to FATCA and new Code provisions related to FATCA that become effective after the Effective Date.

Cost Basis Reporting. In accordance with IRS Regulations, utilizing relevant information provided to Securitize in the ordinary course of performing the services provided for in the Agreement, Securitize shall report cost basis information to Shareholders on an average cost basis by tax year and Shares,

Return Preparation. In accordance with the Code, Securitize shall prepare and deliver year-end and other Federal tax forms to Shareholders based on transactions in Fund Shares and related actions taken by Shareholders with respect to their Fund accounts and file the related Federal tax reports with the IRS.

Required Insurance. Securitize shall at its sole cost and expense, procure and maintain in effect the following required insurance coverage covering the risks, claims and liabilities arising from or in connection with the performance of work under this Agreement by Securitize as specified more fully below.

Worker’s Compensation in an amount sufficient to meet all applicable statutory requirements or applicable laws. Insurance shall cover Securitize’s employees for injuries arising out of their employment for Services provided under this Agreement. The insurance shall provide that Securitize’s insurer and Securitize waive all right of recovery by way of subrogation against Issuer via blanket endorsement.

Employer’s Liability insurance coverage in an amount not less than the greater of (i) [•] each accident or (ii) an amount sufficient to satisfy the applicable laws; such insurance shall cover all sums Securitize shall become legally obligated to pay because of bodily injury by accident or disease sustained by any employee of Securitize arising out of their employment for Services provided under this Agreement. The insurance shall provide that Securitize’s insurer and Securitize waive all right of recovery by way of subrogation against Issuer via blanket endorsement.

Commercial General Liability insurance coverage in an amount not less than [•] each occurrence, [•] general aggregate and [•] products completed operations aggregate and cover all sums Securitize shall be legally obligated to pay because of claims for bodily injury and property damage arising out of premises, operations, products and completed operations; and advertising and personal injury. This insurance shall provide: (i) contractual liability, with defense provided in addition to policy limits, covering Securitize’s liability (including certain indemnification obligations contained herein) under this Agreement; (ii) if any of the Services are subcontracted, independent contractors liability providing coverage in connection with such portion of the Services which may be subcontracted; (iii) broad form property damage liability; (iv) cross liability or a severability of interest clause; (v) that Securitize’s insurer and Securitize waive all right of recovery by way of subrogation against Issuer via blanket endorsement; and (vi) that Issuer shall be included as an additional insured as their interests may appear with respect to liability arising out of Securitize’s operations under this agreement via blanket endorsement.

Umbrella Liability insurance coverage in an amount not less than [•] each occurrence. Insurance shall be provided over Commercial General Liability and Automobile Liability policies and this insurance shall include Issuer as an additional insured as their interests may appear with respect to liability arising out of Securitize’s operations under this agreement via blanket endorsement.

Professional Liability Insurance (aka Errors or Omissions or Professional Indemnity) coverage not less than [•] per claim and in the aggregate and cover all sums Securitize shall be legally obligated to pay because of claims for acts, errors or omissions committed by Securitize, its agents, employees or subcontractors arising from the Services to be provided under this Agreement. If the policy is written on a “claims-made” basis, the retroactive date must be on or before the commencement of the Services and the coverage must remain in full force for a period of at least three (3) years following the termination of the Services.

Network Security & Privacy Liability Insurance (aka Cyber) coverage of not less than [•] per claim and in the aggregate cover all sums Securitize shall be legally obligated to pay because of claims alleging a security failure (including but not limited to failure of a computer system, unauthorized access / use of a computer system, virus transmission, denial of service, physical theft of hardware) or a privacy event (including but not limited to failure to protect confidential information). Coverage must include regulatory defense and penalties and cost to provide notification and credit monitoring to affected or potentially affected persons. If the policy is written on a “claims-made” basis, the retroactive date must be on or before the commencement of

GENERAL

Minimum Insurer Ratings. All insurance shall be procured from reputable insurers that are rated “A-” or better by A.M. Best & Company, or an equivalent rating made by another international rating agency (e.g., S&P, Moody’s or Fitch) and that are licensed / admitted to do business in the state or country where services are to be performed or otherwise acceptable by Issuer. Insurers with ratings lower than the foregoing and unrated insurers (including captives), require Issuer’s prior written consent.

Primary / Non-Contributory. All required insurance will be primary and all insurance or self-insurance maintained by Issuer is strictly excess and secondary and will not contribute with Issuer’s insurance or self-insurance.

Deductibles / Self-Insured Retentions (SIR) / Self-Insurance. Securitize agrees to be liable for all costs within the deductible or self-insured retentions.

Effect. The insurance requirements under this Agreement are not intended and shall not be construed to modify, limit or reduce the indemnification obligations made in this Agreement by Securitize to Issuer or to limit Securitize’s liability under this Agreement to the limits of the policies of insurance required to be maintained by Securitize hereunder. No warranty is made by Issuer that the coverage or limits set forth herein are adequate to cover and protect the interests of Securitize for Securitize’s operations. Additional insured or loss payee status for Issuer shall apply on a primary basis and extend to the full limits of liability maintained by Securitize even if those limits of liability are in excess of those required by this Agreement.

Evidence of Insurance Coverage and Notifications. Prior to the execution of this Agreement and upon receipt of written request from Blackrock that shall be no more often than once in a calendar year, Securitize shall furnish to Issuer certificate of insurance that evidences all the insurance coverage types, amounts and coverage requirements required in this Agreement. All required insurance will not be cancelled without replacement or coverage as required substantially reduced without thirty (30) days prior written notice to Issuer. Securitize’s failure to deliver in form and substance evidence of such insurance shall not be construed as a waiver of that party’s obligation to provide the required insurance coverage. Receipt by Issuer of a non-conforming certificate of insurance does not constitute acceptance. Securitize shall not take or omit to take any reasonable action or (insofar as it is reasonably within its power) permit anything to occur in relation to the insurance policies indicated above as would entitle the relevant insurer to refuse to pay any claim under the policies. Issuer reserves the right to modify the insurance requirements, including limits, upon reasonable request.

Subcontractor Insurance. In the event that Services are performed or provided by persons other than Securitize who are not parties to any Agreement with Issuer, Securitize will arrange to have such subcontractors maintain insurance, subject to terms and conditions and amounts required herein, prior to commencing with the performance or provision of such Services. It is understood and agreed that Securitize’s determination of the adequacy of the insurance carried by subcontractors in no way relieves Securitize from liability assumed by Securitize or insurance required of Securitize.

Onboarding:
Securitize Shareholder Support team to collect necessary documentation, review for compliance with jurisdictional regulations, tax regulations, and Fund requirements to onboard investors into the fund.

Compliance:
Securitize to perform Know-your-customer (KYC) and Anti-Money Laundering (AML) due diligence and screening during on-boarding of investors.

Fund Management Dashboard
Dashboard for the Fund to monitor investors, transactions, and transfer agent functions and retrieve exportable reports in real-time, including daily NAV, daily dividend accruals, and share class-level activity. (note: this is non-investor facing).

Shareholder Dashboard
Dashboard for individual investors to access Fund Data, view their specific holdings, transaction history, wallet(s), communicate with the Fund and wallet/payout management.

Continuous Purchase and Redemption Portal
Securitize to design, build, and integrate a Fund-specific portal to facilitate continuous purchases and redemptions of Fund shares at net asset value, provide Shareholder access to the Fund’s current prospectus and summary prospectus, and deliver real-time transaction confirmations. The portal shall support same-day settlement of purchase and redemption transactions in accordance with the Fund’s Registration Statement and Rule 22c-1 under the 1940 Act. Transaction and account information shall be available in the Fund Management and Shareholder Dashboards.

Securitize to monitor the following to ensure compliance with the applicable Securities Laws, the Fund’s AML program, and the Fund’s policies and procedures, and to provide necessary reports to the Fund and its Chief Compliance Officer:

Securitize and Fund partners will prepare and file all necessary tax information returns and reports for Shareholders, including Forms 1099-DIV, Forms 1099-INT (if applicable), and Forms 1099-B. Securitize shall support the Fund’s daily dividend accrual calculations and monthly or other periodic dividend payment reporting. Securitize shall comply with FATCA and CRS reporting obligations to the extent applicable. Securitize to upload and host tax forms and documentation in the Shareholder Dashboards.

Securitize to provide unlimited use of the Shareholder communication tool in the Fund Dashboard for targeted communication to Shareholders (fund updates, disclosures, and notifications). In addition, Securitize shall support the delivery of the following regulatory communications in compliance with applicable SEC rules governing electronic delivery: (i) prospectuses, prospectus supplements, and summary prospectuses; (ii) annual and semi-annual Shareholder reports; (iii) proxy materials and information statements; (iv) privacy notices under Regulation S-P; and (v) tax statements and Forms 1099. Securitize shall maintain records of Shareholder consent to electronic delivery and records of delivery for each such communication.

Securitize as transfer agent to process transactions in accordance with rules promulgated under the 1934 Act, the 1940 Act, and all other applicable Securities Laws:

Account Transition Assistance

AVAILABILITY/UPTIME FOR THE SECURITIZE ENVIRONMENT

Securitize Environment. The “Securitize Environment” consists of the servers, storage and networking hardware, operating systems, database management systems and operating systems, as well as computers owned by Securitize and those of its agents, that are required to be provided by Securitize to provide the Platform services to the Fund.

Fund Environment. The “Fund Environment” consists of Fund’s or third party servers, storage and networking hardware, operating systems, Internet connectivity, database management systems and operating platforms and all application software, as well as computers owned by Fund and those of its agents and Affiliates, that are required to be provided by the Fund in relation to its authorized use of the Platform under the Agreement.

SLA. The following is the Service Level Agreement (“SLA”) for the Platform:

Scheduled Maintenance. Periodic maintenance on the servers and system elements that support the Securitize Environment, for purposes of system upgrades, maintenance, and backup procedures (“Scheduled Maintenance”) will be scheduled by Securitize. Primary hours of Securitize service level standard support operations are 24x7, less Scheduled Maintenance. Scheduled Maintenance up to two (2) days per month, between the hours of 11:00 p.m. and 3:00 a.m., Pacific Time, or on some other schedule as determined by Securitize; provided, however, that no Scheduled Maintenance shall be performed during Market Hours (9:00 a.m. to 6:00 p.m., Eastern Time, on business days) or during any period in which the Fund’s daily NAV calculation, dividend declaration, or transaction cut-off processing is being conducted, without the prior written consent of the Fund. If emergency maintenance is needed to fix critical security vulnerabilities, Securitize will notify Fund as soon as possible. The Fund acknowledges that it may be necessary for Securitize to begin work and/or apply fixes prior to notification of Fund. Notification of Scheduled Maintenance will be sent via email at least 7 days in advance. Notification of emergency maintenance will both be called into Fund at and sent via email to the email address identified in the Order Form as soon as is technically feasible.

Unscheduled Maintenance. The application of ad hoc updates to the Platform (“Updates”) will be scheduled by Securitize in the event it is necessary for such Updates to occur outside of the Scheduled Maintenance times (“Unscheduled Maintenance”). Notification of Unscheduled Maintenance will be sent via email to the email address identified in the Order Form at least 1 day in advance.

Securitize Environment Service Level. In addition to Scheduled Maintenance and Unscheduled Maintenance, there may be events that from time to time will make the Securitize Environment not Available (as defined below) for a limited amount of time due to unforeseen software, hardware, network, power and/or Internet outages (“Unscheduled Downtime”). Notwithstanding anything herein to the contrary, Securitize shall have no liability for any failure to meet the Environment Performance Requirement set forth herein in the event that: (a) such failure is caused by independent, external circumstances that are not

Securitize and/or its Affiliates will operate the Securitize Environment, as set forth below, to be Available and functioning within the relevant SLA defined herein, measured on a monthly basis (the “Environment Performance Requirement”). For the purposes of this SLA Addendum, “Available” means that the Securitize Environment is accessible based on SLA measurement techniques for ninety-nine and nine tenths percent (99.9%) of the time during Market Hours (defined as 9:00 a.m. to 6:00 p.m., Eastern Time, on each business day) and ninety-nine and five tenths percent (99.5%) of the time during all other hours, in each case 24 hours a day, seven days per week, excluding Scheduled Maintenance or any loss or interruption of services resulting from actions or inactions of Fund, or their respective equipment or service providers. Actual availability percentage will be calculated with the following formula:

100% minus [((X) Total Unscheduled Downtime and Unscheduled Maintenance minutes in a month; divided by (Y) total minutes in said month); multiplied by (Z) 100%] = availability percentage

Uptime measurements are on fifteen minute intervals, utilizing Keynote UP5 measurements or another equivalent, technically feasible and commercially reasonable measurement technique.

SUPPORT SERVICES

Support Service Issues. Support service issues are grouped into the following three levels, in each case pertaining to issues that are caused by and in the sole control of Securitize, and excluding, for example, problems caused by Fund or the Fund Environment.

Securitize and/or its Affiliates will notify and respond to Fund regarding a reported issue as soon as an issue is noted within the response times below:

Securitize and/or its Affiliates shall provide an update by email to a mutually agreed upon distribution list each hour in the case of P1 problems and every 4 hours in the case of P2 problems.

The Fund shall have direct access 24 hours per day, 7 days per week, 365 days per year, to Securitize or its Affiliates’ online technical support system to report any service issues. In the event of a failure in the case of P1, or in the case of P2 a multiple failure, on the part of Securitize to achieve target response times, Securitize will promptly apply additional technical resources to the problems, including without limitation, Securitize’s technical resources most knowledgeable about the problems. This addition of resource shall continue until all relevant technical resources have been applied and/or the relevant problem has been resolved. In such cases and at Fund’s request, Securitize shall promptly supply Fund with a list of all technical resources working to resolve the problem.

FUND OBLIGATIONS

General; Compliance with Procedures. The Fund shall at all times comply with Securitize’s policies, procedures and controls provided by Securitize to Fund, as relevant. The Fund shall ensure that its board of directors (or trustees) and chief compliance officer are informed of the material terms of this Appendix and the services provided hereunder as part of the Fund’s compliance program adopted pursuant to Rule 38a-1 under the Investment Company Act of 1940.

Share Information and Notification. The Fund shall at all times provide true and accurate information to Securitize concerning the Fund’s authorized shares, outstanding shares, and share class structure (including any changes to share classes, expense ratios, or account minimums).The Fund must notify Securitize of any changes to the number of authorized and outstanding shares, the addition or removal of share classes, or any suspension of redemptions pursuant to Section 22(e) of the Investment Company Act of 1940, in writing at compliance@securitize.io, or any other email address selected by Securitize, promptly after any such change or event. Securitize shall not have any unilateral right to restrict the issuance or redemption of Fund shares; any such suspension shall be made solely by the Fund’s board of directors in accordance with Section 22(e) of the 1940 Act and the rules and regulations thereunder.

Affiliated Persons. The Fund shall provide Securitize with a current list of all “affiliated persons” of the Fund as defined in Section 2(a)(3) of the 1940 Act, to the extent relevant for compliance with the Fund’s code of ethics and related-party transaction policies. The Fund shall provide Securitize with an updated list promptly upon any change in the Fund’s affiliated persons.

Erroneous Share Issuance. In the event that Fund Shares, issued in the form of Tokens, are minted or issued in error due to incorrect information provided by the Fund or system error, Securitize shall promptly notify the Fund and cooperate with the Fund to cancel the erroneously issued shares and reverse the corresponding entries in the Shareholder records. Any adjustment to the Fund’s net asset value resulting from such erroneous issuance shall be handled in accordance with the Fund’s pricing and error-correction policies as adopted by the Fund’s board of directors. The Fund shall bear responsibility for any losses resulting from erroneous information provided by the Fund to Securitize.

Definitions. Terms herein shall have the meaning assigned to them in the Agreement unless otherwise set forth herein.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly, determines the purposes and means of the Processing of Personal Information.

“Personal Information” means (i) any information relating to an individual, which can be used either alone or with other sources of information to identify that individual; or (ii) any other information which falls within the scope of the relevant Privacy and Data Protection Legislation. In some Privacy and Data Protection Legislation Personal Information may be referred to as Personal Data.

“Personnel” means employees, agents and other representatives of a Party.

“Privacy and Data Protection Legislation” means all laws and regulations applicable to the Processing of Personal Information and may include, but is not limited to, the EU General Data Protection Regulation (2016/679), the EU Directive on Privacy and Electronic Communications 2002/58/EC, the Canada Personal Information Protection and Electronic Documents Act, the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), the Singapore Personal Data Protection Act 2012 and the California Consumer Protection Act. “Processing” means any operation or set of operations which is performed on Personal Information or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, restriction, erasure or destruction, and “process”, “processes” and “processed” will be interpreted accordingly.

“Processor” means any third-party Processing Personal Information on behalf of a Controller;

The Parties acknowledge that certain Personal Information, including professional contact details of each Party’s respective Personnel, may be Processed in connection with this Agreement for the purpose of: (i) carrying out diligence and administrative tasks in connection with the provision or receipt of the Services; (ii) applicable legal or regulatory requirements; (iii) requests and communications from competent authorities, courts or tribunals; (iv) protecting its rights; and/or (v) administrative, financial accounting, risk analysis, fraud/crime prevention and business relationship; and agree that, in respect of such Personal Information, each Party:

is a separate and individual Controller;

will comply with its respective obligations under applicable Privacy and Data Protection Legislation and not cause self or other Party to be in breach of Privacy and Data Protection Legislation;

act reasonably in providing such information and assistance the other Party may reasonably require to enable the other Party to comply with their obligations including:

complying with requests from individuals to exercise their rights under Privacy and Data Protection Legislation; and

in the event of a Personal Information security breach.

The Parties shall each make available to the other its privacy notice (as may be in effect from time to time), detailing the way in which Personal Information is Processed to its Personnel in connection with this Agreement. BlackRock’s Privacy Notice can be found at https://www.blackrock.com/corporate/compliance/privacy-policy.

The parties acknowledge and agree that when Processing certain Personal Information, Securitize will Process such Personal Information as Processor of BlackRock.

In respect of Personal Information Processed pursuant to this Agreement as Processor, Securitize shall:

only Process Personal Information in compliance with BlackRock instructions and the terms of this Agreement as detailed in Exhibit I, unless Securitize is otherwise required to Process Personal Information to comply with law to which Securitize is subject, in which case Securitize shall give prior notice to BlackRock unless prohibited by law or important grounds of public interest;

inform BlackRock where it reasonably believes that BlackRock’s instructions would be in breach of Privacy and Data Protection Legislation;

assist BlackRock in complying with its obligations under Data Protection Legislation, including, without limitation:

promptly notifying BlackRock of any request from an individual wishing to exercise their rights and providing assistance to enable BlackRock to respond to such requests, including but not limited to providing BlackRock with a copy of Personal Information Processed in relation to an individual within 10 days upon request;

immediately notifying BlackRock of any complaint, allegation or request (including by any individual or any relevant privacy and data protection regulator) relating to BlackRock’s obligations under Privacy and Data Protection Legislation;

comply with any instructions given by BlackRock in connection with the requirements of any relevant Privacy and Data Protection Legislation, including but not limited to assisting BlackRock with the completion of a data privacy impact assessment where required under Privacy and Data Protection Legislation;

not disclose or provide access to Personal Information without the written authority of BlackRock except for the purpose of fulfilling Securitize’s obligations under this Agreement;

ensure that all reasonable steps are taken to ensure the reliability of Securitize Personnel that will Process Personal Information, in particular, Securitize shall:

perform appropriate background screening checks

undertake appropriate Personnel training; and

limit such Processing to those Securitize Personnel who have a need to know or access Personal Information for the purpose of providing services under or in relation to this Agreement, and who will Process Personal Information under a duty of confidentiality to be evidenced in writing;

segregate Personal Information from Securitize’s own data and data Securitize Processes for other clients;

subcontract the collection or other Processing of Personal Information only in compliance with any additional conditions for subcontracting set forth in the Agreement. BlackRock acknowledges and agrees that Securitize’s affiliates and certain third parties may be retained as sub-processors to Process Personal Information on Securitize’s behalf in order to provide the Services. Securitize’s third-party sub-processors are listed under Exhibit I, Securitize shall promptly notify in writing BlackRock of any changes to its domain that may affect BlackRock’s ability to access the current list of sub-processors. Such notification must follow the process outlined in the sub-section (1) below. Prior to a sub-processor’s Processing of Personal Information, Securitize will impose contractual obligations on the sub-processor substantially the same as those imposed on Securitize under this Agreement to the extent applicable to the nature of the services provided by such sub-processor. Securitize remains liable for its sub-processors’ performance under this Agreement to the same extent Securitize is liable for its own performance.;

Notification: Securitize shall provide BlackRock with at least 30 (thirty) business days’ written notice of new sub-processors before authorizing such sub-processor(s) to Process Personal Information in connection with the provision of the Services. Securitize will notify BlackRock via the following e-mail addresses: groupblackrocktaservices@blackrock.com with a copy to GroupPrivacy@blackrock.com.

Right to Object: BlackRock may object to Securitize’s use of a new sub-processor on reasonable grounds by notifying Securitize promptly in writing at dataprotection@securitize.io within thirty (30) business days after receipt of Securitize’s notice in accordance with the mechanism set out above. In its notification, BlackRock shall explain its reasonable grounds for objection. In the event BlackRock objects to a new sub-processor, Securitize will use commercially reasonable efforts to make available to BlackRock an acceptable change in the Services (without diminishing the same) or recommend a commercially reasonable and acceptable change to BlackRock’s configuration or use of the Services to avoid Processing of Personal Information by the objected-to new sub-processor without unreasonably burdening BlackRock. If Securitize is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, BlackRock may terminate without penalty the Agreement with respect only to those services which cannot be provided by Securitize without the use of the objected-to new

where Personal Information is subject to Privacy and Data Protection Legislation that restricts the export of Personal Information, not transfer such Personal Information to, or Process such Personal Information in, a different jurisdiction without the approval of BlackRock. It may be a condition of any approval given by BlackRock that Securitize shall enter into a Data Transfer Agreement with BlackRock (or any BlackRock affiliated entity benefiting from this Agreement), including incorporating any required contractual clauses or other mechanism mandated by any regulator with jurisdiction over the applicable Privacy and Data Protection Legislation (which, in respect of transfers from the EU, the EEA and/or their member states, Switzerland and the United Kingdom, shall be in the form as set out in the Annex to the Standard Contractual Clauses as updated from time to time, and in respect of other jurisdictions, shall be materially in this form), unless (i) the jurisdiction where the Processing will take place is recognized at the time as providing adequate protection for such Personal Information; or (ii) the transfer benefits from an alternative justification pursuant to the relevant Privacy and Data Protection Legislation. If Securitize’s provision of a Service results in Personal Information being transferred from a jurisdiction that regulates international transfers of Personal Information (including, without limitation, the UK, the EU, Switzerland and Australia) (the “Originating Jurisdiction”) by BlackRock directly to a Securitize entity in a third country that is not deemed by the jurisdiction from which the transfer took place as offering an adequate level of protection for the Processing of Personal Information under the Privacy and Data protection Legislation under the Originating Jurisdiction (a “Restricted Transfer of Personal Data”), then the parties shall be deemed to have entered into, and shall comply with, the Standard Contractual Clauses which shall be incorporated herein, in order to adduce adequate safeguards for the relevant Restricted Transfer of Personal Data. Any export or transfer of Personal Information under this Exhibit from the EU, the EEA and/or their member states, Switzerland and the United Kingdom to countries that do not ensure an adequate level of data protection within the meaning of Privacy and Data Protection Legislation of the foregoing territories shall also be subject to supplementary contractual and technical measures as may be required by BlackRock from time to time, including, inter alia:

Challenge to orders. In the event Securitize receives a legally binding order, request or similar from any third party established outside the EEA for compelled disclosure of any Personal Information (a “Request”), Securitize shall immediately communicate such Request to BlackRock. Where receiving a Request, Securitize shall (a) use best efforts to redirect the third party to request data directly from BlackRock; (b) challenge the Request (including using interim measures, seeking a protective order and other appropriate remedy and/or waiving compliance with the provisions of the request) for disclosure on the basis of any legal deficiencies under the laws of the requesting party or any relevant conflicts with the laws applicable in the jurisdiction(s) from which the transfer was first made; and (c) make no disclosure of such Personal Information until mandatorily or legally required to do so under applicable procedural rules or legal requirements. If, in the absence of a protective order, interim measures or other remedy or the receipt of a waiver, and if Securitize is nonetheless, legally compelled to disclose Personal Information, Securitize may disclose to such third party only that portion of the

Prohibition to handover encryption keys. To the extent legally permitted, Securitize shall at all times refrain from handing over, communicating or making available to any third party, including without limitation government bodies and law enforcement agencies, the encryption keys used by Securitize or by BlackRock to decrypt Personal Information in transit by Securitize on behalf of BlackRock. To the extent legally permitted, Securitize shall immediately inform BlackRock in writing where Securitize intends to decrypt Personal Data Processed on behalf of BlackRock in order to comply with a disclosure request issued by a third party;

Compliance with ENISA standards. Securitize shall ensure that the encryption measures it implements to protect the Personal Information of BlackRock, where such Personal Information is in transit from the EEA, the UK or Switzerland (as the case may be) to locations outside of the EEA, the UK or Switzerland uses encryption of at least AES-128, AES-192 or AES-256 or encryption which otherwise complies with paragraph 3.2.4 of the EU Agency for Cybersecurity (ENISA) 2020 “Guideline “State of the Art”: Technical and Organisational Measures” (or such other guidance as may replace that guidance from time to time);

Local law requirements. Transfers of Personal Information by Securitize to any public authority cannot be massive, disproportionate or indiscriminate in a manner that would go beyond what is necessary in a democratic society;

Third party right of data subjects. Data subjects may directly enforce the previous paragraph (4) against Securitize as a third-party beneficiary in, at the data subject’s choice (i) the courts of the jurisdiction in which the data subject is habitually resident or (ii) the courts of the jurisdiction of establishment of Securitize; and

Compliance with EU and UK supervisory regulators’ requirements. As Processor, Securitize shall comply with any and all requirements that are taken from the Regulation (EU) 2016/679 or otherwise legally binding obligations on Securitize, to the extent such legally binding obligations are applicable to its provision of the Services to its customers generally (i.e. without regard for BlackRock’s particular use of the Services), imposed by any competent EU or UK supervisory authorities relating to the international transfer of Personal Information outside of the EU or UK whilst relying on Standard Contractual Clauses and/or binding corporate rules, including any legally binding: (i) opinion, (ii) guidelines, (iii) recommendations and (iv) guidance issued, notably but without limitation, by the European Data Protection Board (EDPB), the UK’s Information Commissioner’s Office (ICO), the French Data Protection Authority (CNIL), the Spanish Data Protection Agency (AEPD), the

In addition, in circumstances where Securitize’s subcontracting, with the approval of BlackRock (where applicable), of the Processing of Personal Information to a third-party Processor constitutes a restricted transfer of Personal Information under Privacy and Data Protection Legislation, then Securitize (i) shall, and shall procure that its subcontractor shall execute the Module 3 (Processor to Processor) of the Standard Contractual Clauses with its subcontractor, and (ii) shall impose the same supplementary contractual and technical measures as are imposed on Securitize by BlackRock.

Securitize shall implement appropriate technical and organizational measures to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal information transmitted, stored or otherwise Processed. Such measures shall be commensurate with those of best industry standards of the industries in which BlackRock operates and the jurisdictions in which the Processing is undertaken, and shall include without limitation or without prejudice to Securitize’s obligations under any other provisions of this Agreement:

the use of pseudonymization of Personal Information where appropriate and the encryption of all Personal Information stored on all digital or electronic portable storage devices such as computer laptops, CDs, diskettes, portable drives, magnetic tapes and other similar devices, and as otherwise appropriate;

measures to ensure the ongoing confidentiality, integrity, availability and resilience of Securitize’s systems and services;

the ability to restore the availability and access to Personal Information in a timely manner in the event of a physical or technical incident;

a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing of Personal Information; and

reasonably assisting BlackRock to comply with its own data security obligations under Privacy and Data Protection Legislation related to this Agreement.

Securitize shall notify BlackRock in writing or in such form as may otherwise be agreed in writing between the parties from time to time, immediately (and in any event within twenty four (24) hours) if it becomes aware of:

any actual or suspected loss, damage or destruction of any Personal Information;

any third party accessing or suspected of accessing Personal Information other than as expressly permitted under this Agreement; or

any other actual or suspected security breach affecting any Personal Information.

Such notice shall detail the volume and type of Personal Information affected and the categories and number of individuals concerned. Securitize shall take whatever action is necessary to minimize the impact of such security breach and prevent such events recurring (including, without limitation, any action reasonably requested by BlackRock for such purposes). Securitize shall not notify any regulatory authority of any events set out in this paragraph 2(i) without the prior written consent of BlackRock, such consent not to be unreasonably withheld or delayed.

Without prejudice to any other provision of this Agreement, Securitize shall provide within thirty (30) days of a request from BlackRock evidence of its compliance with this Appendix. At BlackRock’s request, such evidence shall include, without limitation, and in addition to BlackRock’s right to audit in accordance with this Agreement, a detailed written description of the protections employed by Securitize and its subcontractors in connection with the Processing of Personal Information from which BlackRock can reasonably determine whether or not Securitize and its subcontractors are Processing Personal Information in compliance with this Agreement.

Securitize shall, at BlackRock’s request, allow BlackRock to audit Securitize’s compliance with its obligations under this Agreement relating to the Processing of Personal Information (including, without limitation, Securitize’s compliance with this paragraph) which shall be carried out by BlackRock and/or an inspection body composed of members who are independent to BlackRock and Securitize and are bound by a professional duty of confidentiality and selected by BlackRock.

Within thirty (30) days of the termination of this Agreement, Securitize shall, at the option of BlackRock, delete, destroy or return, in a manner determined by BlackRock, all the Personal Information held by Securitize and all subcontractors and any copies thereof, and certify to BlackRock in writing that it has done so. Securitize may retain a copy of specified Personal Information only to the extent it is obliged to do so to meet the requirements of the laws or regulations to which it is subject and evidenced to BlackRock for approval. In such cases, Securitize warrants that it will guarantee the ongoing confidentiality of the Personal Information and will not actively Process the Personal Information. At the end of any such agreed retention period, Securitize shall, at the option of BlackRock, delete, destroy or return the Personal Information, in a manner determined by BlackRock.

All applicable terms and conditions of this paragraph shall remain in full force and effect so long as Securitize and Securitize subcontractors Process Personal Information.

The performance of the Services under this Agreement.

The processing shall continue until the later of:

the Agreement being terminated in accordance with its terms and any notice period or transition period prescribed by Agreement having expired; and

Securitize no longer being subject to an applicable legal or regulatory requirement to continue to store the EU Personal Data.

Nature and purpose of processing

The processing is being conducted in order to facilitate the performance of the Services.

Issuer Data including: full name, postal address, email address, telephone number, date of birth, nationality, country of tax residence, taxpayer identification number, national identification or passport number, signature, bank account and payment details, shareholding and account balance information, transaction history (purchases, redemptions, transfers, dividends), source of funds and source of wealth information, KYC and AML verification records, sanctions and PEP screening results, authorized signatory and power of attorney details, beneficial ownership information, correspondence and communication records with the Fund or Transfer Agent

Authorized Participants

Obligations and rights

of the Issuer (as controller)

As set out in this Agreement.

Service

Administrator

Location

Data

which department administers the relationship.

Securitize shall comply with the obligations set forth in this Exhibit as a condition to any Securitize Personnel obtaining unescorted access to the Fund facilities (e.g., issuance of badge or access key), and/or logical access to the Fund’s network and/or computer systems by electronic means, either on-site or remotely (i.e., log-in credentials) (“Access”). Securitize agrees to the completion of a background screening which may include checks on identity, criminal records, sanctions, credit, civil actions, education and employment “Screening Standards”, and which shall be conducted by a consumer reporting agency within ninety (90) days prior to Securitize Personnel being granted Access. The Fund retains its right to restrict or refuse Access at any time to any Securitize Personnel.

Unless otherwise agreed to in writing by the Fund, Securitize shall use the Fund’s designated consumer reporting agency to conduct the required background screening for all Securitize Personnel requiring Access. Instructions on how to establish a relationship with the consumer reporting agency can be found here: https://www.blackrock.com/corporate/literature/publication/Securitize-personnel-assigned-toblackrock.pdf

Upon the Fund’s written approval, Securitize may use a non-the Fund designated consumer reporting agency to conduct the background screening, subject to the following:

The consumer reporting agency must be accredited by the Professional Background Screening Association;

The consumer reporting agency must conduct a background screening that meets the Fund’s Screening Standards; and

Securitize must provide an attestation that the background screening has been completed in accordance with the Fund’s Screening Standards.

For all Securitize Personnel performing Services for the Fund but not obtaining Access, Securitize shall ensure background screening is conducted in accordance with Section 27 of the Agreement.

Securitize will make available such documentation as the Fund reasonably requires within five (5) business days of the Fund’s request to demonstrate Securitize’s compliance with the requirements of this Appendix.

Securitize may be required to rescreen Securitize Personnel at the direction of the Fund due to regulatory or Access requirements.

General. Securitize shall implement and maintain security controls aligned to industry-recognized frameworks (such as NIST Cybersecurity Framework (CSF), ISO/IEC 27001:2022 or later) to protect Confidential Information against unauthorized disclosure or access, unlawful destruction, loss, or alteration.

Incident Management and Breach Notification.

Incident Management. Securitize shall establish a documented incident management process to ensure the timely detection of security events, coordinated response to threats and client notification. The process shall include post-mortem root-cause analysis with identified issues tracked to remediation and evaluation of lessons learned.

Breach Notification. In the event of a Breach that impacts BlackRock, Securitize shall, without undue delay and in any case within twenty-four (24) hours, notify the Fund via email and will copy (CC) BlackRock Information Security (InformationSecurity@blackrock.com). The notice shall include Securitize’s contact information (phone number and email address), approximate date and time of the Breach and other relevant facts. Securitize will provide more information to the Fund as it becomes available on the actions taken to rectify and address the Breach and its effects. Securitize shall not reference the Fund in any of its external Breach communication without prior written consent from the Fund. If required, Securitize will support the Fund’s legal and regulatory requirements with regards to notifications to regulators and/or Shareholders. The notice shall include Securitize’s contact information (phone number and email address), approximate date and time of the Breach, the likely consequences of the Breach and impact on the Services, and the measures taken or proposed to be taken to address the Breach, including, where appropriate, measures to mitigate possible adverse effects.

Remediation. In the event of a Breach that impacts the Fund, Securitize shall promptly implement measures necessary to restore the security of the Confidential Information and Securitize Systems. If such measures include temporarily restricting access to any Confidential Information or Securitize Systems to mitigate risks associated with further compromise, Securitize shall provide the Fund with as much advance prior notice as practicable under the circumstances. Securitize will cooperate with the Fund to identify any additional steps required of Securitize to rectify and address the Breach and its effects and update its processes accordingly. Securitize shall use best efforts to support the Fund’s information gathering activities. Upon request, Securitize shall promptly provide updates regarding the investigation and resolution of the Breach, including summaries of reports on the forensic or other investigation findings, postmortem assessments, remedial plans, and indicators of compromise. Securitize shall provide such reasonable assurances as requested that such Breach has been contained, remediated and is not likely to reoccur, including providing a certification of remediation and a report detailing the root cause, investigation findings and remedial measures.

Service Disconnection and Reconnection. In the event of disconnection or suspension of Services with any impacted Securitize System(s) due to a Breach or reasonable suspicion of a Breach:

Disconnection Cooperation. Upon request by the Fund, Securitize shall promptly cooperate to segregate or disconnect affected connections and maintain logical segregation of any impacted Confidential Information until such time that reconnection is authorized by the Fund. This may include persistent network connections, recurring data transfers or employee or other operational activities until the event is resolved.

Preconditions to Reconnection. Prior to any reconnection or resumption of Services, Securitize shall provide the Fund with a written statement confirming, at a minimum:

completion of investigation and remediation activities;

the root cause (to the extent it is known) of the Breach and confirmation that it has been addressed;

whether any Confidential Information was accessed or modified; and

the corrective measures implemented to prevent recurrence within the existing environment or the deployment of a new isolated environment.

Independent Confirmation. At the Fund’s reasonable discretion, Securitize shall provide an attestation from an independent incident response or audit firm confirming that the Breach has been contained and that normal operations may safely resume following testing.

Secure Reconnection. The Fund may, as a condition of reconnection, require reasonable technical validation steps to ensure the integrity and security of the Services.

Security Assessments.

Third-Party Due Diligence Assessments. In addition to any other obligations set forth in the Agreement, prior to commencement of Services, and on a periodic basis but no less than annually thereafter, upon written request and reasonable notice, Securitize shall accurately and promptly complete a written information security questionnaire provided by the Fund (or a third party on the Fund’s behalf) regarding its security practices and information technology environment in relation to the Services being provided to the Fund. Securitize shall cooperate with the Fund and will participate in control verification meeting(s), including but not limited to periodic tabletop exercises to stress test critical service delivery, to demonstrate its security program, and address any specific concerns raised by the Fund. Securitize shall remediate any high-risk (within 60 days) or medium-risk (within 90 days) control gaps that are identified, including by a third-party security rating provider, and provide written confirmation to the Fund. Securitize shall not make material changes to the in-scope Securitize Systems and/or information security program that may degrade the security protections over the Confidential Information it handles. Securitize shall notify the Fund in the event of material changes to in-scope Securitize Systems.

Independent Security Audits. Securitize shall, at least annually, undertake at its expense, an audit in accordance with a System and Organization Controls 2 (SOC 2) Type 2 audit, or an ISO 27001:2022 certification, (or successor standards to either one) covering controls related to its provision of Services, the scope of which shall be in accordance with Industry Standard practice. Upon request, Securitize shall provide a copy of its SOC 2 report, or its ISO 27001 certificate with accompanying Statement of Applicability (SoA) for the Fund’s review.

Penetration Testing. Securitize shall, at least annually, engage at its expense, a third-party service provider to perform Manual Penetration Testing of Securitize Systems related to the provision of Services. The method of test scoring and issue ratings shall follow Industry Standard practices, such as the latest Common Vulnerability Scoring System (“CVSS”). Securitize shall evidence remediation of material (critical or high risk) findings within sixty (60) calendar days. Upon request, Securitize shall provide the Fund the results of such testing and remediation activities in the form of an executive summary or attestation letter that includes, at a minimum, the scope and methodology of the testing performed, confirmation that testing was performed by an independent party, the date(s), the number of vulnerabilities by risk-level (i.e., critical, high, medium, low), and confirmation that all high or critical-level findings have been remediated and the fixes migrated to production.

Cybersecurity Right to Audit. Upon reasonable prior notice, the Fund and its authorized representatives (including its internal and external auditors) may audit Securitize’s compliance with the terms and conditions of this Appendix during reasonable business hours and in a manner that does not reasonably interfere with Securitize’s business. Such review may include, but is not limited to: Securitize Facilities, independent audit reports as contemplated by this Appendix, information security practices, policies, and standards with respect to the Services, and agreements with any Subcontractor(s) that support the Services. For purposes of such audit, Securitize will reasonably grant the Fund and its representative’s access to information about Securitize Systems and Facilities for the Fund to ascertain facts relevant to the subject matter of the audit. Securitize shall cooperate fully with any regulatory audit or inquiry applicable to the Fund that requires access to Confidential Information or systems used to provide the Services, including by providing access to relevant systems, documentation, and personnel as reasonably required.

Tabletop Exercises. Upon reasonable prior written request from the Fund, Securitize shall, at its own expense, participate in a tabletop exercise and stress testing to assess its operational resilience, and such request shall come no more frequently than annually. These exercises shall simulate disruption scenarios and evaluate response, recovery, and communication capabilities. Securitize shall provide a summary report of findings and remediation actions within thirty (30) days of completion of each such requested tabletop exercise and stress test.

Security Functions

Security Program. Securitize shall implement a documented information security program that is based on an industry accepted framework, and which contains administrative, technical, and physical safeguards to protect the Services provided to the Fund and related data.

Security Policies. Securitize shall develop and maintain comprehensive information security related policies and shall periodically review and update them in accordance with evolving technologies and security trends.

Security Officer. Securitize shall designate a point of contact (named below; written notification must be provided to the Fund in case of changes) to coordinate the continued security of all Confidential Information and Securitize Systems:

Name/Group: [●]

Title: [●]

Phone Number: [●]

Email Address: [●]

Information Security Training. In addition to any training obligations in the Agreement, Securitize shall, at least annually, provide all Securitize Personnel with appropriate ongoing information security training regarding Securitize’s processes for which compliance is required under the Agreement, including, without limitation, procedures to verify all Securitize Personnel promptly report actual and/or suspected Breaches. Securitize shall be responsible for retaining documentation that such training has been completed.

Encryption.

General. Securitize shall use Industry Standard Encryption techniques (such as those outlined by NIST SP 800-175B) for Confidential Information that is stored, processed, or transmitted while providing Services. Such techniques shall include the use of TLS 1.2 (or higher); key length of 256 bits or more for symmetric Encryption; and key length of 2048 bits or more for asymmetric Encryption. Securitize shall not use Encryption techniques that are known to be compromised. Securitize shall ensure that the transmission of Confidential Information over the Internet, wireless, or other public or shared networks, is secured using appropriate cryptography.

Key Management. Securitize shall ensure that cryptographic keys are securely managed. It shall maintain documented Industry Standard control requirements and procedures including periodic rotation (at least annually), auditing and access governance. If public key infrastructure (“PKI”) is used, Securitize shall implement Industry Standard best practices to protect such PKI against compromise.

Quantum Resistant Encryption. Securitize shall monitor developments in post-quantum cryptography and evaluate adoption of applicable standards as industry practice, regulatory expectations, and commercially reasonable implementations evolve. Implementation of post-quantum cryptographic controls shall not be required as a condition to launch.

Data Management.

Removable Media. The use of Removable Media is prohibited for storing Confidential Information without prior authorization from the Fund. Upon written authorization from BlackRock Information Security, Securitize shall ensure that the data on Removable Media is protected according to the encryption requirements of this Appendix.

Data Transport. For transportation of hardware, storage media, Removable Media, or documents containing Confidential Information, Securitize shall utilize a courier and ensure that all media are protected according to the encryption requirements of this Appendix.

Data Leakage. Securitize shall deploy data leakage prevention technical controls to detect and prevent any unauthorized transfers of Confidential Information outside of Securitize Systems.

Electronic Communications. Securitize shall ensure that all electronic communications related to the provision of Services, including but not limited to instant messaging and email services, are protected by Industry Standard processes and technical controls. If Securitize Personnel will have access to external email or the Internet from Securitize Systems while providing the Services, the Securitize shall have policies and systems to monitor usage in accordance with the requirements of this Appendix. Furthermore, if the Fund is licensing a Securitize System that includes (or eventually includes) electronic communication functionality such as email or chat, Securitize shall advise the Fund of such, including the available Securitize controls that would enable the Fund to supervise and archive such messages, or limit the use of such functionality.

Backups. Securitize shall create and maintain complete and currently immutable backup records of the Fund’s Confidential Information, including but not limited to server files (“backup files”) at least daily, and store copies offsite or replicate to another datacenter. Backup files on storage media must be encrypted per the requirements of this Appendix. Securitize’s storage and retention of backup files shall be subject to all terms of this Appendix. Securitize shall regularly test backup files to ensure the integrity and availability of Confidential Information.

Data Location. The schedule or statement or work (as applicable) under the Agreement shall set forth the geographic locations where data will be accessed, processed and stored by Securitize. Securitize must obtain prior written consent from the Fund to change the location where data will be accessed, processed or stored.

Asset Management

Asset Inventory. Securitize shall maintain an inventory of the Securitize Systems used in the delivery of Services to ensure that only authorized and supported systems are used to process, store or transmit BlackRock Confidential Information. Securitize shall, at least annually, review and update the inventory.

Supported Versions. Securitize must use supported versions of software and hardware for the delivery of the Services including anti-virus/anti-malware and other security software. Non-supported software and hardware (i.e., that can no longer receive security updates/patches) must not be used to provide the Services to the Fund.

Logical Segregation. Securitize shall maintain logical segregation controls between Confidential Information and other clients’ data within Securitize Systems. Prior to commencement of the Services, Securitize must disclose to the Fund any instances where Confidential Information will be stored on a shared/multi-tenant instance. Securitize shall obtain prior written consent from the Fund if changing from a single/dedicated tenancy to multitenancy.

Mobile Devices. If mobile devices are used to access Confidential Information, Securitize shall:

Implement a formal mobile device policy covering such devices.

Implement a centralized mobile device management (“MDM”) and/or mobile application management (“MAM”) to (1) prevent unauthorized privilege escalation or installation of unauthorized applications; and (2) enable remote wipe of Confidential Information in the event of theft or loss.

Only allow access through managed mobile devices with Industry Standard security controls such as device encryption, data segregation, complex passwords, and automatic screen lockouts.

Block access to Confidential Information from personal devices that are not managed via Securitize’s MDM, and jail-broken/rooted devices.

BlackRock Owned Systems. Securitize Systems are not permitted to connect to the Fund’s network or systems without explicit authorization from BlackRock Information Security. Any use of Fund-owned systems (including desktop, laptop or notebook computers, mobile devices (e.g., cell phones or tablets) and any other devices used for telephony or computing functions or wireless access) by Securitize Personnel to connect externally from Fund premises and/or interact with the Fund’s network or systems shall require prior written approval from BlackRock Information Security. Such use will be subject to the provisions of this Appendix and must comply with all applicable Fund policies, including, but not limited to Encryption requirements, secure log-on protocols, and any restrictions on downloading and storing Confidential Information or other data. The Fund reserves the right to override any security controls in place to obtain access to voicemail, email, computer (and software or other applications) and/or computer disks on Fund-owned systems.

Secure Destruction. Securitize shall maintain documented policies and procedures for data destruction, including shredders and confidential bins for document disposal, and chain of custody provisions. To destroy Confidential Information in its possession, Securitize shall utilize secure Industry Standard destruction methods such as those recommended by NIST SP 800-88 (or successor standard) to ensure that Confidential Information is rendered inaccessible and irretrievable. Upon request, Securitize shall certify in writing, or provide a Certificate of Destruction (“CoD”) to the Fund, affirming that Confidential Information was successfully and securely destroyed.

Network Security.

Securitize shall implement security measures for its external connections including internal/external Firewalls, Web Application Firewalls (“WAF”), an Intrusion Prevention Process (“IPP”), and appropriate mitigation against Denial of Service (“DoS”) Attacks.

Where Securitize has implemented a wireless network, it shall ensure that:

Its wireless network is protected by industry accepted encryption, i.e., WPA2.

Non-secure wireless connections are not used in the delivery of Services.

Multi-factor authentication is utilized for wireless connections.

Its guest wireless network is segmented from its internal network and/or the

production environment used in the delivery of Services to BlackRock.

Periodic wireless scans are performed using industry accepted tools.

Vulnerability Management.

General. Securitize shall have a documented process to identify and remediate any security vulnerabilities affecting the Securitize Systems used in the delivery of the Services to the Fund. Securitize shall remediate any identified security vulnerabilities within a reasonable amount of time and provide evidence of its processes to the Fund upon request.

Vulnerability Disclosure. In the event of a widespread security Vulnerability Disclosure, the Fund may contact Securitize to determine the impact of such events on Securitize Systems and/or Service delivery. Upon such request from the Fund, Securitize shall review its environment and provide an appropriate response, including extent of impact and remediation action plan(s), if applicable.

Malicious Code. Securitize shall implement anti-malware solutions on the Securitize Systems to protect against transferring malicious code (including without limitation Unauthorized Code and Self-Help Codes) to the Fund or the Fund’s systems via email or other electronic transmission. Securitize shall use Industry Standard anti-virus tools to scan all incoming files that may be stored or processed with files containing Confidential Information.

External Scanning. Where Services include an integration between Securitize Systems and Fund systems, the Fund reserves the right to perform periodic scans on all assets (including domain names, IP addresses, etc.) which may include non-Fund assets that are used to provide the Services to or on behalf of the Fund. Where applicable, identified critical or high-risk vulnerabilities will be reported to Securitize for remediation within seven (7) business days for critical and high vulnerabilities. Less severe vulnerabilities shall be remediated according to Industry Standard best practices. Upon request, Securitize shall provide a written confirmation to the Fund upon remediation of the vulnerabilities.

Security Performance. If the Fund discovers a decline in security performance or compliance (based on information from security rating companies such as BitSight), it may notify Securitize. Following such notification, Securitize will review the provided data and if relevant to the Services, Securitize shall develop a remediation action plan for the identified security issues in a timely manner in proportion to the risk(s) posed by the finding(s). Securitize shall provide such action plan to the Fund upon request.

Change and Patch Management

Change Management. Securitize shall ensure that changes to Securitize Systems and applications are managed according to a documented and approved change management process that includes an approval process. Where applicable, Securitize shall make best efforts to notify the Fund in advance if emergency changes could affect the Fund’s use.

Software Updates. Securitize shall ensure that software patches are implemented within a reasonable time, unless in the opinion of Securitize’s Chief Technical/Security Officer, this introduces higher business risks. Securitize Systems that for any reason cannot be updated shall have security measures installed to protect the vulnerable system. Upon request, Securitize shall provide written disclosure to the Fund.

Logical Access

Authentication: Securitize shall use Industry Standard authentication practices for verification prior to allowing access to Confidential Information.

User ID. Access to applications containing Confidential Information must be traceable to one user. Interactive systems or shared accounts may not be used to access Confidential Information.

Single Sign-On. Securitize shall support Single Sign-On (SSO) capabilities using industry-standard protocols such as SAML 2.0, OAuth 2.0, or OpenID Connect. Securitize shall support Single Sign-On using industry-standard protocols. The parties acknowledge that Shared Signals Framework (SSF) or substantially equivalent continuous identity-risk signaling capabilities are not required as a condition to launch and may be evaluated as part of Securitize’s future roadmap.

Passwords. Each user on Securitize’s network shall use a unique and complex password to access applications containing Confidential information. Securitize shall require users to update, at least every ninety (90) calendar days, PINs and passwords that control access to applications or systems containing Confidential Information.

Session Configuration. Sessions shall be configured to timeout after a period of user inactivity. Re-authentication shall be required after such timeouts or periods of inactivity.

Unsuccessful Logon Attempts. The number of unsuccessful logon attempts shall be limited to a maximum of ten (10). User accounts shall be locked for a defined period of time after the maximum number of unsuccessful logon attempts is exceeded.

Access Management. Securitize shall ensure that access to Confidential Information is limited to authorized Securitize Personnel and granted through formal and documented approval processes.

Remote Access. Remote access to Securitize Systems containing Confidential Information shall require Multi-factor Authentication and shall be subject to the logging and monitoring requirements of this Exhibit.

Privileged Access. Securitize shall ensure that:

Privileged access to Securitize Systems containing Confidential Information is based on least privilege principle and restricted to authorized individual users.

Privileged access or escalation is used exclusively for privileged operational use and not for business-as-usual activities.

Non-repudiation is maintained for all access.

All privileged access or escalation requires Multi-factor authentication.

Deactivation. Securitize Personnel’s access to Confidential Information shall be deactivated promptly upon changes in job responsibilities that render such access unnecessary, or termination of employment, or at any other time as requested by the Fund (where applicable).

Logging & Monitoring

Logging. For all Securitize Systems processing, storing, or transmitting Confidential Information in the course of providing Services:

Securitize shall maintain logs of key events, including access events, that may reasonably affect the confidentiality, integrity, and availability of the Service to the Fund and that may assist in the identification or investigation of material incidents and/or security breaches occurring on Securitize Systems.

In the event of a Breach, upon request, applicable data including but not limited to copies of forensic activities, network and application logs shall be made available to the Fund to support investigation activities.

Securitize shall ensure that applicable logs are:

Protected against modification or deletion;

Reviewed periodically (at least quarterly) by Securitize’s information security function; and

Retained for at least twelve (12) months.

Monitoring. Securitize shall actively monitor all networks and systems where Confidential Information is stored, processed, or transmitted to detect deviation from access control policies, actual or attempted intrusions, or other unauthorized acts.

Software as a Service (SaaS) Administrative Logging. Logging for SaaS Solutions. Securitize shall implement and maintain comprehensive audit logging mechanisms for systems and services supporting any SaaS-based Services provided to the Fund. These logs shall include administrative audit logs capturing administrative access and actions, including user provisioning, configuration changes, permission modifications, and data access activities.

Software Security Assurance

Secure Development. Securitize shall ensure that:

All development activities (internal and outsourced) are performed in accordance with a documented Secure Software Development Lifecycle (“SDLC”) Methodology, which shall be shared with the Fund upon request.

Securitize Personnel involved in any part of the SDLC process undergo Industry Standard application security training.

Developers’ access to production is limited to emergency and/or support purposes and subject to the logging and monitoring requirements of this Appendix.

System development and testing are performed in distinct environments segregated from the production environment and protected against unauthorized disclosure of Confidential Information.

Confidential Information is never used within test environments without prior approval from the Fund.

Application Security Testing Process. For software developed and utilized in the course of providing the Services, Securitize shall:

Ensure that all applications undergo a formal code review process. Upon request, Securitize shall provide evidence of this to the Fund.

Ensure that applications undergo both Static. Interactive and Dynamic Application Security Testing (“SAST”, IAST and “DAST”) as part of Securitize’s SDLC process. The method of test scoring and issue ratings shall follow Industry Standard practice, such as the latest Common Vulnerability Scoring System (“CVSS”). For critical or high-risk findings, Securitize shall evidence remediation within thirty (30) calendar days. Upon request, Securitize shall provide the Fund the results of such testing and remediation activities in the form of an executive summary or attestation letter that includes, at a minimum, the scope, testing date(s), a summary count by risk-level (critical, high, medium, low), and confirmation that any high or critical-level findings have been remediated and the fixes migrated to production.

For the avoidance of doubt, the foregoing requirements and obligations are also applicable for any application or software development activities outsourced by Securitize.

Application Programming Interface (API) Security. Where Application Programming Interface (“API”) connections will be used to provide Services, Securitize must ensure that its API management standards are aligned to Industry Standard best practices, including as outlined in the most current version of OWASP API Security Top 10 (https://owasp.org/www-project-api-security/).

Artificial Intelligence (“AI”) / Machine Learning (“ML”). Any use of AI/ML capabilities in the provision of Services must be subject to the requirements of this Exhibit. Securitize shall ensure that the design, development, deployment, use and monitoring of AI are according to Industry Standard practices such as the NIST AI Risk Management Framework (AI RMF), and OWASP ML Security Top 10 (https://owasp.org/www-project-machinelearning-security-top-10/). To the extent artificial intelligence or machine-learning capabilities are used in providing the Services, Securitize shall maintain documented governance, risk management, and oversight processes aligned with recognized industry practices. For the avoidance of doubt, ISO/IEC 42001 certification shall not be required as a condition to launch or provide the Services.

Subcontractor Risk Management

Risk Assessments. Securitize shall conduct a detailed risk assessment on its Subcontractors to assess their security posture and apply appropriate security protections. Upon request, Securitize shall provide evidence of such process to the Fund for any Subcontractor that supports the Services provided to the Fund. Securitize shall ensure that any Subcontractor it engages to support the Services provided to the Fund will maintain processes that are equivalent to those required of Securitize hereunder with respect to facilities, systems, and personnel. Securitize shall enter into a written agreement with each Subcontractor that

Data Centers. Any Data Center or Infrastructure-as-a-Service (“IaaS”) used by Securitize to host the Services provided to the Fund are subject to Section 14(a) (Risk Assessments) above.

Control Validation. If Securitize provides the service organization report i.e., a SOC 2 Type 2 audit report (without material findings or exceptions) for its third-party Data Center or IaaS provider to the Fund, then Securitize shall be deemed to be compliant with the foregoing.

Enhanced Requirements. Any Data Center used to support the Services must possess high availability features and full redundancy to ensure that system functionality continues at acceptable performance levels in the event of a system failure.

Revised Tokenization, Smart Contract, and Distributed Ledger Security Provisions The following provisions are intended to supplement and enhance the existing security Schedule and related Incident Response, Logging & Monitoring, Change Management, and Subcontractor Risk Management sections, to address risks specific to tokenized financial instruments and private or permissioned distributed ledger environments.

Token Supply and Ledger Reconciliation Controls

Controls preventing unauthorized minting, burning, freezing, or modification of tokens.

Multi-party approval controls for privileged token administration functions.

Documented reconciliation between on-ledger token balances and authoritative off-chain records, performed at least daily.

Security Governance

All smart contracts and material changes must undergo an independent security review by an application security team (or equivalent function) that is organizationally independent from the development team, prior to production deployment.

Such review shall assess access controls, privileged functions, token issuance and destruction logic, and upgrade mechanisms, as applicable.

Logging and periodic review of all administrative smart contract actions.

Security testing prior to deployment of changes affecting token logic or financial functionality.

Cryptographic Controls and Key Management

Private keys for minting, contract upgrades, or validator operations stored within Hardware Security Modules (HSMs) or equivalent secure environments.

Logical segregation of key types (minting, administrative, validator, treasury).

Documented emergency key rotation and compromise response procedures.

Prohibition on embedding private keys in source code repositories or infrastructure scripts.

Comprehensive audit logging of key generation, usage, rotation, and revocation events.

Distributed Ledger Incident Response Enhancements

Procedures addressing smart contract exploitation.

Response to unauthorized token minting, burning, or administrative override.

Validator compromise or consensus manipulation.

Private key compromise scenarios.

Ledger data corruption or network partition events.

Logging & Monitoring Enhancements for tokenization related Services

Logging of token issuance, redemption, minting, and burning events.

Logging of smart contract administrative actions. Alerting for anomalous token supply changes or abnormal transaction patterns.

GLOSSARY

Application Programming Interface(s), APIs. Set of functions and procedures that provides programmatic access to service functionality and data within an application or a database.

Breach.

Any incident involving Securitize Systems that has resulted in (or Securitize reasonably suspects has resulted in):

Unauthorized disclosure, access, use, receipt, or modification of Confidential Information in Securitize’s, Securitize Personnel’s or Securitize’s affiliate’s possession or control while providing Services, goods or software to the Fund, or

Any security failure that results in a material adverse effect on networks or Systems related to the provision of Services.

A Breach includes, but is not limited to, instances in which Securitize Personnel obtains access to Systems with Confidential Information beyond what is reasonably necessary to provide the Services, or otherwise uses such Systems inappropriately.

Data Center. A facility or repository that houses computing equipment such as servers, routers, switches, firewalls, backup equipment, fire suppression, and air conditioning equipment.

Denial of Service (DoS) Attack. An attack in which a malicious actor seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet.

Dynamic Application Security Testing (DAST). A security test of an application designed to detect conditions indicative of a security vulnerability in an application as it runs in a production environment, or in a test environment representative of the production environment in which such application will run.

Encryption. The process of using an algorithm to transform data into coded information to protect the confidentiality of the data.

Firewall(s). An integrated collection of security measures used to prevent unauthorized electronic access to Securitize’s networked computer system.

Industry Standard(s). Customs and practices followed by, and representing the degree of skill, care, prudence and foresight expected from, leading providers of the types of services that are the subject matter of the Agreement (or an applicable Schedule or SOW).

Infrastructure as a Service (IaaS). This is a form of cloud computing that provides virtualized computing resources over the internet. IaaS is one of the three main categories of cloud computing services, alongside software as a service (SaaS) and platform as a service (PaaS).

Intrusion Prevention Process (IPP). A method of reviewing system logs and processes in near real-time to identify, escalate and take preventative actions on identified patterns of

Manual Penetration Testing. A manual security test of an application, executed by a combination of automated tools and a certified tester.

Multi-Factor Authentication. Refers to authentication using at least two (2) of the following factors: “Something you know” such as a password, “Something you have” such as a token, or “Something you are” such as a biometric reading.

Multitenancy. This is a reference to the mode of operation of software where multiple independent instances of one or multiple applications operate in a shared environment. The instances (tenants) are logically isolated, but physically integrated.

Removable Media. Portable or removable hard disks, floppy disks, USB memory drives, zip disks, optical disks, CDs, DVDs, digital film, memory cards (e.g., Secure Digital (SD), Memory Sticks (MS), CompactFlash (CF), SmartMedia (SM), MultiMediaCard (MMC), and xD-Picture Card (xD)), magnetic tape, and all other removable data storage media that contain Confidential Information.

Secure Software Development Lifecycle (SDLC) Methodology. Refers to a documented process for planning, creating, testing, and deploying an information system that requires information security engagement, particularly with respect to the design, test, and deployment stages.

Self-Help Codes. Any back door, time bomb, drop-dead device, or other software routine whose effect is to disable a computer program automatically with the passage of time or under the positive control of an unauthorized person. Self-Help Codes do not include software routines whose effect is to permit an owner or authorized user of the computer program to obtain access to BlackRock system(s) or network (for example, remote access via modem) solely for purposes of maintenance or technical support with BlackRock’s permission and consent in each instance.

Static Application Security Testing (SAST). A security test of application code designed to analyze source code, byte code or binaries for coding conditions that are indicative of security vulnerabilities.

Securitize Facilities. Facilities involved in the provision of Services including all locations where Confidential Information or Securitize Systems is hosted or processed.

Securitize System(s). “Securitize System” or “Securitize Systems” refers to Securitize components (including any third party/subcontractor components) used by Securitize in the provision of Services which include but are not limited to network devices, applications, physical or virtual hardware or software, servers, databases and networks.

Unauthorized Code. Any Deliverable, System, software, mechanism or code (e.g.. any virus, Trojan horse, worm or other software routines or equipment components) that disrupts, modifies, deletes, or otherwise harms software, equipment or data, to perform any actions not authorized by the Fund, or to impede the operation of Fund systems, including software or materials provided by or on behalf of Securitize

Vulnerability Disclosure. The process of publicly publishing information about the security vulnerabilities/flaws pertaining to a computer system, network or software.

Web Application Firewall (WAF). A solution that is designed to protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet.

Business Continuity Service Levels.

Securitize will comply with all Recovery Time Objectives (“Securitize RTO”) set forth in this Exhibit. The Securitize RTO for the service is between zero (0) and four (4) hours:

Recovery capacity shall equal the normal service levels defined in the Agreement.

The continuity service levels apply regardless of the number of other customers Securitize is obligated to service during a disaster.

Business Continuity Plans.

Securitize shall deliver evidence of business continuity plans to the Fund within thirty (30) days of contract execution.

Securitize shall demonstrate that its business continuity plans contain:

Crisis Management procedures for command and control during a disaster;

Emergency notification procedures;

Recovery task assignments to and provisions for individuals or teams;

The relocation of affected Securitize staff to one or more alternate sites and the reallocation of work to other locations that perform similar functions until such relocation is effected; and

Procedures and accommodations for the recovery of systems, applications and networks.

Business Continuity Plan Maintenance and Exercising. Review and testing of Securitize’s business continuity plans shall occur at least annually. The Fund shall be allowed to monitor or participate in testing of Securitize’s business continuity plans. Securitize shall develop a plan to remedy any failures or anomalies identified during testing and make test results available to the Fund upon request.

Notification.

In the event that Securitize’s business continuity plan is executed for any Services or work locations supporting the Fund, or in situations indicating a potential execution where the Services could be affected, Securitize shall notify the Fund within one hour if the defined Securitize RTO is equal to or less than twenty-four (24) hours and in all other cases within six hours. Each Party shall maintain at all times identified points of contact for the purpose of requesting information and obtaining detailed, up-to-date status of the other Party’s progress and on-going actions during disasters. Either Party shall notify the other Party in writing (including via email) of any change to these contact points.

The persons listed below will be Securitize’s BCP contacts responsible for coordinating Securitize’s communication with the Fund regarding BCPs, including, without limitation, Securitize’s plan development, recovery testing and implementation of recovery procedures:

[ ]

Securitize shall notify the Fund within ten (10) business days of any changes to the BCP contact or any updates to their information by providing notice to the Fund BCP contact by email and follow-up letter.

Inspection.

Securitize shall cooperate with periodic assessments or audits of its business continuity plans conducted by or for the Fund. Securitize recognizes that the fund is governed by regulations that require it to periodically assess the continuity capabilities of its vendors.

Subcontractors.

Securitize’s use of Subcontractors does not diminish their obligation to provide business continuity capabilities as described in this Appendix for all Services provided under the Agreement, regardless of their origin and regardless of notice to the Fund.