Company: FRFXF
Filing Date: 2025-03-14
Form Type: F-4
Source: 0001104659-25-024010
Chunk: 99

Company: FAIRFAX FINANCIAL HOLDINGS LTD/ CAN
Filing Date: 2025-03-14
Form: F-4
Chunk 99
---
)insurer
must comply with the Insurance Sector Operational Cyber Risk Management Code of Conduct (the “Cyber Risk Code”), which
prescribes the duties, requirements, standards, procedures and principles with which all companies registered under the Bermuda Insurance
Act must comply. The Cyber Risk Code is designed to promote the stable and secure management of information technology systems of regulated
entities and requires that all regulated entities implement their own technology risk program, determine what their top risks are and
develop an appropriate risk response. This requires, inter alia, all regulated entities to develop a cyber risk policy that is to be delivered
pursuant to an operational cyber risk management program and appoint an appropriately qualified member of staff or outsourced resource
to the role of Chief Information Security Officer. The role of the Chief Information Security Officer is to deliver the operational cyber
risk management program.

It is expected that the cyber
risk policy will be approved by the regulated entity’s board of directors at least annually. The BMA will assess a regulated entity’s
compliance with the Cyber Risk Code in a proportionate manner relative to the nature, scale and complexity of its business. While it is
acknowledged that some regulated entities will use a third party to provide technology services and that they may outsource their IT resources
(for example, to an insurance manager where applicable), when so outsourced, the overall responsibility for the outsourced functions will
remain with the regulated entity’s board of directors. Failure to comply with the requirements of the Cyber Risk Code will be taken
into account by the BMA in determining whether a regulated entity is conducting its business in a sound and prudent manner as prescribed
by the Bermuda Insurance Act and may result in the BMA exercising its powers of intervention and investigation.

<div align='center'>- 57 -

DESCRIPTION OF THE NOTES</div>

As used under this heading
“Description of the Notes”, the terms “Fairfax” and the “Company” refer only to Fairfax Financial
Holdings Limited, and not its subsidiaries, and the term “Allied World” refers to Allied World Assurance Company Holdings, Ltd.
The Company issued the Initial Notes under an indenture, dated as of December 1, 1993, as supplemented and amended by the first supplemental
indenture dated May 9, 2011 and the Third Supplemental Indenture (as amended, the “Base Indenture”), among the
Company, The Bank of New York Mellon, as successor U.S. trustee (the “U.S