Company: FRFXF
Filing Date: 2025-03-26
Form Type: 424B3
Source: 0001104659-25-028272
Chunk: 98

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-03-26
Form: 424B3
Chunk 98
---
 which all companies registered under the Bermuda Insurance Act must comply.

Failure to comply with the
requirements of the Bermuda Insurance Code will be taken into account by the BMA in determining whether an insurer is conducting its
business in a sound and prudent manner as prescribed by the Bermuda Insurance Act and may result in the BMA exercising its powers of
intervention and investigation (see below) and will be a factor in calculating the operational risk charge under the insurer’s
BSCR or approved internal model.

Cyber Code of Conduct

Our material Bermuda (re)insurer
must comply with the Insurance Sector Operational Cyber Risk Management Code of Conduct (the “Cyber Risk Code”), which
prescribes the duties, requirements, standards, procedures and principles with which all companies registered under the Bermuda Insurance
Act must comply. The Cyber Risk Code is designed to promote the stable and secure management of information technology systems of regulated
entities and requires that all regulated entities implement their own technology risk program, determine what their top risks are and
develop an appropriate risk response. This requires, inter alia, all regulated entities to develop a cyber risk policy that is to be
delivered pursuant to an operational cyber risk management program and appoint an appropriately qualified member of staff or outsourced
resource to the role of Chief Information Security Officer. The role of the Chief Information Security Officer is to deliver the operational
cyber risk management program.

It is expected that the
cyber risk policy will be approved by the regulated entity’s board of directors at least annually. The BMA will assess a regulated
entity’s compliance with the Cyber Risk Code in a proportionate manner relative to the nature, scale and complexity of its business.
While it is acknowledged that some regulated entities will use a third party to provide technology services and that they may outsource
their IT resources (for example, to an insurance manager where applicable), when so outsourced, the overall responsibility for the outsourced
functions will remain with the regulated entity’s board of directors. Failure to comply with the requirements of the Cyber Risk
Code will be taken into account by the BMA in determining whether a regulated entity is conducting its business in a sound and prudent
manner as prescribed by the Bermuda Insurance Act and may result in the BMA exercising its powers of intervention and investigation.

<div align='center'>- 57 -

DESCRIPTION OF THE NOTES</div>

As used under this heading
“Description of the Notes”, the terms “Fairfax” and the “Company” refer only to Fairfax Financial
Hold