NFX Q-Port on-boarding guide September 21, 2018

Client enrollment Download the SafeNet App on your phone or desktop*. The Nasdaq Admin will then add the client’s email and information to the SafeNet Authentication Service (SAS) platform to provision a token. This will enable a licensed Mobile PASS token to be assigned to the app on user’s phone. You will receive a self enrollment email from the SafeNet Authentication Server <noreply@safenet-inc.com> once they are added to the SafeNet Portal. A sample of the message is shown below *You may need special admin privileges to download the MobilePASS application based on your firms corporate IT policy. NFX CLIENT ON-BOARDING

Client enrollment Upon clicking the link on the previous slide you will see a message similar to as shown on the right. After installing the MobilePASS App make sure to select the link – “Enroll your MobilePASS” This will enable you to enroll you your token. You will need to set a personal 4 digit PIN as described in following slide. NFX CLIENT ON-BOARDING

MobilePASS Install Instructions Install the SafeNet Token App called MobilePASS on your device (compatible with most OS). A 4 digit PIN will need to be setup after auto-enrollment based off the email invite. Please refer to Fig. 1 for a visual of the app icon on a iOS device. Each time the 4 digit PIN will be used to generate the Passcode (one time password – Fig. 2) which would need to be entered in the password field along with the assigned username credential that are managed on SafeNet portal by Nasdaq Market Ops. Please make sure you remember the 4 digit PIN that you use during setup. This would serve as a two-factor authentication to establish the SSL VPN connection into Nasdaq networks. Subsequently, the user would need to enter their application credentials to access the NFX application. Fig. 1 Fig. 2 NFX CLIENT ON-BOARDING

Credentials There is a separate set of username / password credentials for the actual Q-port application which should not be confused with the SafeNet credentials. The SafeNet Username is typically firstname.lastname in lower case letters. You will receive this info from the Nasdaq Market Operations team. The SafeNet token app (MobilePASS )will need to be installed and enrolled via the email you will receive from SafeNet. Once the SafeNet App is installed on your phone or desktop you will need to use this along with your SafeNet Username to login the initial webpage. The following slides will show you how to navigate various user interfaces and setup access to Q-port. Example of the Q-port Credentials  Owner Name:   LeBron James User Type:          WS_BRO Participant:        XYZ_Futures LLC                 Username:         XYZ_WS2 Password:           xxxxxxxx NFX CLIENT ON-BOARDING

Step 1: Login Web Page Enter https://Q-port.nasdaq.com in a browser (Only works on Chrome) URL. This leads to the Nasdaq login page shown below. Enter the SafeNet username into the ‘Name’ field. Enter the soft-token (MobilePASS) generated passcode to the Password field. NFX CLIENT ON-BOARDING

Step 2 : After two-factor authentication After the SafeNet username and MobilePASS token are entered, the following page will have a link which will launch the java applet. Click on ‘allow’ & ‘continue’ to setup the session. In case the link doesn’t launch the prompt for the java applet. Please follow the steps: In your URL bar, enter: chrome://flags/#enable-npapi Click the Enable link for the Enable NPAPI configuration option. Click the Relaunch button that now appears at the bottom of the configuration page. When you retry clicking on the application link, the prompt should now come up. NFX CLIENT ON-BOARDING

Step 3: Launch the SSL VPN tunnel After the SSL VPN tunnel is established click on the link one more time. Click on link one more time after the java applet is enabled. NFX CLIENT ON-BOARDING

Status Window After the SSL VPN tunnel is established you should be able to see the below status window. Internal Remote Host IP has been hidden due to Information Security reasons. NFX CLIENT ON-BOARDING

Step 4 : Create Shortcut for Q-port Application Right click on the desktop and click on ‘new’ followed by ‘shortcut’. Create a shortcut on your desktop for ease of use in subsequent logins. When you receive the prompt in Fig 1. please enter as shown below and then click on next. Name the shortcut as per your convenience. Q-port is shown as an example in Fig 2. The logo icon will be provided to you. Fig 2 Please note the app is only compatible with Chrome & IE version 11 and above. Fig 1 NFX CLIENT ON-BOARDING

Step 5 : Check Configuration Please make sure the URL address is https://127 .0.0.1:8443 by right clicking on the shortcut icon and going to ‘properties’. Please note the app is only compatible with Chrome & IE version 11 and above, so make sure they are your default browsers when creating shortcut. NFX CLIENT ON-BOARDING

Step 6 : Q-port Application Double click the Q-port APP shortcut icon after Step 3 (Step 4 & Step 5 are only a one time setup). Please make sure you click on the link shown on Step 3 once after the java applet was enabled for establishing the SSL VPN tunnel. Enter your Nasdaq Q-port application credentials in the necessary fields to login. In case your Q-port password doesn’t work call to reset password. +1 844 236 3191 (US/Canada) +1 215-496-5409 (International) email nfxops@nasdaq.com NFX CLIENT ON-BOARDING

Step 7 : Q-port Below is what you will display after login with your Q-port credentials. NFX CLIENT ON-BOARDING