annex 3 due diligence questionnaire to be answered by

Cuestionario de Debida Diligencia

FSI-07 Filled in by Date of issue

Pag 1/12

ANNEX 3 Due Diligence Questionnaire to be answered by Third Party

This questionnaire must be completed and signed by the compliance officer or the legal representative of the Third Party and it can be delivered printed or digitally. (Please include an official ID)

1. General InformationBy signing this questionnaire, I certify that I have carried out the necessary procedures and consultations to ensure that the answers provided in this document are truthful and complete

Prepared by:

(Name) Job position title:

Signature: Date:

Telephone: Mobile number:

E-mail:

Third Party Organization

Complete legal name:

Country and date of incorporation or registration:

Line of business:

Adress:

Fiscal address:

Countries where the company conducts or does business (commercial or services activities):

Telephone: Website:

FSI-07 Date of issue

Pag 2/12


1. Write down all the names under which the third party has carried out business, including affiliate or subsidiarycompanies, indicating the period for each one:

NAME PERIOD

2. In the case of legal entities, provide a list of the shareholders who have more than 10% and their nationality

NAME PERCENTAGE NATIONALITY

3. Explain what the legal structure of the company is (for example, controlled or controlling company, affiliate,subsidiary, etc., in which case you must list the structure of the group) until you reach the last holder or beneficiary.

4. If there is, specify who are the members of the board of directors of your organization.

NAME JOB POSITION TITLE

Filled in by


Pag 3/12


5. Indicate who are the main senior management members of your organization?

NAME YEARS OFSERVICE

JOB POSITIONTITLE

NATIONALITY

6. Indicate the country where your company will obtain the resources (financial and material, if applicable) for thisCommercial Agreement?

7. What are the subsidiaries or other organizations, that will participate with your company in the proposed project /association, if applicable?

NAME % RELATIONSHIP CONTACTS

8. Indicate the people who will be responsible for working with P.M.I. Comercio Internacional, S.A. de C.V. (Top 10 only).

NAME YEARS OFSERVICE

JOB POSITION NATIONALITY

Filled in by


Pag 4/12


___

9. List past or current relationships/agreements with P.M.I. Comercio Internacional, S.A. de C.V. (if you exceed 10agreements only provide the information of the last 10).

10. If you plan to use intermediaries or other people who are not part of your organization, to carry out procedures orservices on behalf of or in favor of P.M.I. Comercio Internacional, S.A. de C.V., before other public servants in Mexicoor public officers abroad, identify the name(s) and address(s), the relationship with you, and the activities that willbe carried out. Otherwise, if your answer is “NO”, click here

NAME ADRESS ACTIVITY

11. Bank account information:

BENEFICIARY BANK ACCOUNT CURRENCY BANK ACCOUNTREGISTRATION

COUNTRY

Filled in by


Pag 5/12


12. Do any of the bank accounts have a beneficiary that does not match the name of the Third Party?

Yes ________ No ______

Why? ___________________________

13. Are any of the Third party bank accounts registered in an offshore location or in a sanctioned bank or country?

Yes ________ No ______

Why? ___________________________

SECCIÓN I:

Sección I Sí No En proceso

1. Do you have a code of ethics?

2. Do you have a code of conduct?

3. Do you have an anticorruption policy?

If the answer was “NO” in the 3 previous questions, answer the following question; otherwise, go to number 5

4. Do you agree to adhere to the PEMEX’s code of ethics, code ofconduct and anti-corruption policies that P.M.I. ComercioInternacional, S.A. de C.V has adopted?

Nota: This question is only for Third Parties that answer of “NO” in the

questions 1, 2 and 3 of this questionnaire.

5. The policies and codes include the following characteristics:

• Transparent regarding donations

• They are public.

• They are extensible to its stakeholders, related parties,suppliers and others.

• Transparency in terms of political contributions andcontributions

• They establish the prohibition to offer or receive bribes.

• They establish the prohibition to offer or receive incentives ofany kind (cash, kind, etc.) for processing or facilitation.

6. Do you provide training to your staff on issues related to fightingcorruption?

Filled in by


Pag 6/12


7. Do you have any internal mechanism to report issues relatedto corruption?

8. If a complaint is received, do you follow up until you get results?If yes, can you mention any internal mechanism to follow up suchcomplaint?

9. Do your senior managers speak clearly on issues of corruption andemployee responsibility?

10. Do you know the obligations to which P.M.I. ComercioInternacional, S.A. de C.V. is subject that prohibit the illegalconversion, concealment, or transfer of money or property?

11. Are you aware of and willing to comply with the anti-corruptionlaws that are applicable to the Commercial Agreement?

12. Will you notify P.M.I. Comercio Internacional, S.A. de C.V., if thereare family relationships of its employees, partners, directors orshareholders with a public servant of the Mexican governmentand will it notify if such situation arises during the term of theTrade Agreement?

13. Are you aware of the national and international provisions thatare applicable to the Commercial Agreement in anti-corruptionmatters?

14. Do you agree that P.M.I. Comercio Internacional, S.A. de C.V., orthrough Third Parties can obtain an opinion on your compliance interms of ethics, corporate integrity, anti-corruption and moneylaundering prevention?

Filled in by


Pag 7/12


SECCIÓN II

1. Indicate if any of your employees, shareholders or members of your upper management a “public servant or publicofficer”?

Yes No

If yes, please provide a list of the government office where you he/she is a public servant or public officer, and the positions held, as well as for how long the person holds or held those functions in government.

NAME GOVERNMENT POSITION TITLE PERIOD

2. Indicate if any of your employees, shareholder or member of upper management of your company are related (byrelationship, blood relationship, affinity; or by business associations or investments, etc.) currently or in the past(last 24 months) to a “public servant or public officer”?

No

If yes, describe the relationship between that person and the public servant or public officer

EMPLOYEE NAME/ SHAREHOLDER/EXECUTIVE

RELATIONSHIP WITH PUBLIC SERVANT OR PUBLIC OFFICER

NAME OF PUBLIC SERVANT OR PUBLIC OFFICER

3. Does the company, any of its affiliates or subsidiaries belong partially or totally to a “public servant or public officer”,or a person related to one of them, whether as a shareholder, investor, partner of the organization, or of any anotherway?

No

If yes, provide the name of the public servant or public officer and its total participation (%).

Yes

Yes

Filled in by


Pag 8/12


NAME OF PUBLIC SERVANT OR PUBLIC OFFICER

RELATIONSHIP TYPE PARTICIPATION %

4. Is it legal its participation in the Commercial Agreement with P.M.I. Comercio Internacional, S.A. de C.V ?

No

5. Is it a legal requirement to have permits, certifications, registrations, licenses or authorizations to carry out theCommercial Agreement? If so, are they in force and do they comply with the applicable regulations?

No

6. Describe the characteristics of your organization's compliance program and provide copies and / or descriptions ofits ethics, conduct and anti-corruption regulations or policies, as well as its compliance training activities, and itsreporting channels, if any?.

Yes

Yes

Filled in by


Pag 9/12


SECCIÓN III

1. Any of your employees or member of upper management of your organization provide or will provide financial orany other benefits to any employee, attorney and / or representative of PEMEX, its production subsidiaries and / oraffiliates; or to a government or public servant or a member of his family (for example, educational or medicalassistance, housing, etc)?

No

If yes, please explain. Please provide a list of all benefits awarded, the names of all recipients of such benefits, and their relationship to the “public servant or public officer” (eg cousin, sister, etc.).

NAME OF THE SERVER OR GOVERNMENT OFFICER, OR OF THE EMPLOYEE, REPRESENTATIVE AND / OR ATTORNEY OF PEMEX, ITS SUBSIDIARIES AND / OR ITS AFFILIATES

NAME OF THE MEMBER OF THE FAMILY OF THE GOVERNMENT SERVER OR OFFICIAL OR OF THE EMPLOYEE, REPRESENTATIVE AND / OR PEMEX’s ATTORNEY, ITS SUBSIDIARY / OR ITS AFFILIATES

FAMILY RELATIONSHIP

BENEFIT GRANTED OR TO BE GRANTED

2. Indicate if any public servant, employee, attorney and / or representative of PEMEX, its subsidiary companies and /or affiliates companies, any public servant or public officer or a member of the family of the aforementioned haveany interest, or will benefit in any way, as a result of the Commercial Agreement?

No

If yes, please explain.

Yes

Yes

Filled in by


Pag 10/12


3. Have you, or any employee or member of upper management of your organization, been convicted of a seriouscrime or felony of a fiscal, financial or corruption nature, in any country, including the one in which the CommercialAgreement will take place? Is there any pending legal process of this nature?

Yes No

If yes, describe the charges for which you or members of your organization have been convicted or have pending proceedings, and when it occurred.

4. Is there a pending litigation or legal process against your organization, or any employee, member of uppermanagement, initiated by a government entity in any country including the one in which the Commercial Agreementwill take place, in which the result could affect?

Yes No

If yes, please explain.

5. Does your organization have a corporate policy that includes facilitation payments?

No

If yes, please explain under what circumstances does your policy allow these payments to be made?

6. Does your company have strategies, plans and policies focused on information security aligned to organizationalobjectives?

No

If yes, how often are they reviewed / updated and what kind of practices do they consider?

Yes

Yes

Filled in by


Pag 11/12


7. Does your company have a practice or process associated with managing information security risks?

Yes No

If yes, do they consider the identification of threats, vulnerabilities, risks and potential impacts related to cybersecurity?

8. Does your company foster the commitment and culture of information security?

Yes No

If yes, who is responsible to execute/conduct the above? Example: Area in charge of information security, Director of Information Security or Chief Information Security Officer

9. Does your company promote awareness campaigns and information security training programs are designed foremployees?

Yes No

If yes, what topics are covered? Do they include the most common incidents reported, user liability, or information protection?

10. Does your company have procedures in place in case of information security incidents?

Yes No

If yes, what stages does you company consider? How often did these incidents occur in previous periods? What was the level of impact and response time?

Filled in by


Pag 12/12


11. Does your company have policies and procedures to enter into contracts or relationships with Third Parties regardingtechnology and / or information systems?

No

If yes, does your company include any information security elements? What type of validations are carried out during the selection, contracting, supervision, monitoring and reporting of activities?

12. Does your company conduct independent assessments on privacy and information security practices?

No

If yes, how often are they executed and what type of reports are issued?

Yes

Yes

Filled in by

annex 3 due diligence questionnaire to be answered by

Documents