Company: FRFXF
Filing Date: 2025-10-01
Form Type: F-10
Source: 0001104659-25-095645
Chunk: 109

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-10-01
Form: F-10
Chunk 109
---
 charge under the insurer’s BSCR or approved internal model (as applicable).

#### Cyber Code of Conduct
Our material Bermuda (re)insurer must comply with the Insurance Sector Operational Cyber Risk Management Code of Conduct (the “

#### Cyber Risk Code
”), which prescribes the duties, requirements, standards, procedures and principles with which all companies registered under the Bermuda Insurance Act must comply. The Cyber Risk Code is designed to promote the stable and secure management of information technology systems of regulated entities and requires that all regulated entities implement their own technology risk program, determine what their top risks are and develop an appropriate risk response. This requires, inter alia, all regulated entities to develop a cyber risk policy that is to be delivered pursuant to an operational cyber risk management program and appoint an appropriately qualified member of staff or outsourced resource to the role of Chief Information Security Officer. The role of the Chief Information Security Officer is to deliver the operational cyber risk management program.

It is expected that the cyber risk policy will be approved by the regulated entity’s board of directors at least annually. The BMA will assess a regulated entity’s compliance with the Cyber Risk Code in a proportionate manner relative to the nature, scale and complexity of its business. While it is acknowledged that some regulated entities will use a third party to provide technology services and that they may outsource their IT resources (for example, to an insurance manager where applicable), when so outsourced, the overall responsibility for the outsourced functions will remain with the regulated entity’s board of directors. Failure to comply with the requirements of the Cyber Risk Code will be taken into account by the BMA in determining whether a regulated entity is conducting its business in a sound and prudent manner as prescribed by the Bermuda Insurance Act and may result in the BMA exercising its powers of intervention and investigation.

<div align='center'>65</div>

TABLE OF CONTENTS

#### Recovery Planning
The Insurance (Prudential Standards) (Recovery Plan) Rules 2024, as amended (the “

#### Recovery Plan Rules
”) became effective on 1 May 2025. The Recovery Plan Rules require every Class 3A, Class 3B, Class 4, Class C, Class D and Class E (re)insurer or an insurance group, which is determined by the BMA to be economically important, systematically significant or at risk of posing a threat to the financial stability of Bermuda should they fail, to prepare a recovery plan in accordance with the Recovery Plan Rules. In making such determination, the