Deutsche Bank Governance and operations Non-Financial Report 2022 Public policy and regulation On digital topics, regulatory activity had a strong focus on cloud, data and resilience. Political discussions in the EU are dominated by the ambition to achieve “digital sovereignty”, manifesting in increasing scrutiny of cross-border data flows and non-EU service providers. In 2022, the European Commission published a proposal for an EU-Data Act, with the aim of facilitating data access and sharing and setting a general framework for sectoral data access obligations. This framework will provide the basis for potential future legislation on Open Finance. The EU-Data Act also introduces requirements for the switching of cloud services, to increase interoperability and address vendor lock-in. In parallel, there is ongoing work on cybersecurity requirements for cloud services, following strict approaches towards the use of non-European cloud service providers. The Council of the EU adopted the Digital Operational Resilience Act, which introduces a direct oversight regime for critical technology providers in November while the UK authorities (Bank of England, His Majesty’s Treasury and Financial Conduct Authority) published a discussion paper on Critical Third Parties in September. The US Treasury is working on a report on cloud computing originally expected to be published before the end of 2022. The draft EU Regulation on Artificial Intelligence (AI) is still under development. In September 2022, the European Commission also published a proposal for a Directive on liability for artificial intelligence applications, which will be negotiated in parallel. The emergence of crypto assets and their use for investment and payment purposes required supervisors to provide targeted guidance for an ecosystem that lacks a robust legal basis and adequate consumer protection measures. In parallel, regulators across the globe review their frameworks and, where appropriate, extend them to crypto assets. This became particular imminent in the course of numerous insolvency and fraud cases related to individual crypto assets or -platforms. Whilst Deutsche Bank does not yet actively engage in any business models related to crypto assets, it closely follows the regulatory developments worldwide. In parallel, and in response to the progressing digitalization of the economies and societies and with a view to retaining the sovereignty of their national currencies, 90% of the central banks globally are assessing or have assessed the feasibility of issuing central bank digital currencies as a new form of central bank money. This has the potential to significantly change monetary systems and is therefore of key relevance for banks. Moreover, governments and central banks worldwide are focusing on increasing the use of real-time payments, increasing the supply of and access to payment services through innovative new solutions, as well as enhancing cross-border payments. For example, the European Commission reviews the impact of the revised Payment Services Directive, in effect since 2018, and published a legislative proposal for instant payments in October 2022. The G20 countries further developed the multi- year action plan for cross-border payments agreed in 2020, including the definition of key performance indicators to measure progress and priorities for future regulatory initiatives. 84