Notice on the Transition to PETRONAS’ Enhanced Third Party Risk Management (TPRM) Programme Supported by a Managed Service Provider (MSP)

Dear Valued Vendor,

PETRONAS has enhanced its Third Party Risk Management and due diligence processes through the Enhanced Third Party Risk Management (TPRM) Programme. Under the enhanced programme, PETRONAS has adopted a centrally managed, risk-based operating model supported by an appointed Managed Service Provider (MSP).

As part of this transition, you may receive communications directly from our appointed MSP in relation to TPRM activities, including:

• Requests to complete and submit the Know Your Counterparty Questionnaire (KYCQ);
• Requests for supporting documents; and
• Requests for clarification regarding information submitted.

Please note that these communications are authorised by PETRONAS as part of the Enhanced TPRM Programme. We appreciate your prompt cooperation in responding to such requests to facilitate an efficient assessment process.

To verify the authenticity of correspondence received, vendors are advised to:

• Confirm that the email originates from either of the authorised MSP email addresses: no_reply_eyv@ey.com or petronas.tprm@in.ey.com;
• Review the KYCQ carefully and ensure that all information provided is complete and accurate before submission; and
• Contact mytprm@petronas.com.my if you have any concerns regarding the authenticity of a communication.

PETRONAS remains committed to safeguarding the confidentiality of information shared throughout this process. Our MSP is contractually required to comply with PETRONAS’ cybersecurity, data protection and confidentiality requirements.

We appreciate your continued support and cooperation as we implement the Enhanced TPRM Programme.

Thank you.

PETRONAS