Anti-Money Laundering and Counter-Terrorist Financing Policy (AML/CFT)

Objective

The policy establishes the principles, guidelines, responsibilities, procedures and internal controls that Swapo must adopt to prevent, detect, mitigate and report acts related to money laundering, terrorist financing, the proliferation of weapons of mass destruction, corruption, fraud and other unlawful practices, with emphasis on the risks specific to virtual assets.

Beyond regulatory compliance, the policy seeks to protect the integrity of the financial system and Swapo's reputation, and to promote a culture of integrity, transparency and accountability.

The Know Your Customer (KYC), Know Your Business (KYB), Know Your Transaction (KYT), Know Your Wallet (KYW) and Travel Rule policies, as well as the procedures for reporting to COAF (Brazil's Financial Intelligence Unit), are part of the same AML/CFT program.

Scope

The policy applies, on a mandatory basis, to administrators, officers, internal and outsourced staff, service providers, business partners, suppliers, agents, clients and any third party acting on behalf of or for the benefit of Swapo.

Adherence to the policy is a condition for starting, maintaining and continuing any business, professional or operational relationship with Swapo. Violations may lead to the termination of contracts and to reporting to the authorities.

In operations involving foreign jurisdictions, the policy also requires compliance with the applicable local rules, with the stricter standard prevailing.

Principles and risk-based approach

Swapo's AML/CFT work must follow these principles:

• Legality: all actions aligned with applicable laws and regulations.
• Good faith: honest conduct in all relationships, with any facilitation of unlawful activity prohibited.
• Transparency: clarity in operations, communications and decisions, to facilitate audits and supervision.
• Enhanced diligence in high-risk situations.
• Risk-based approach: resources and controls proportional to the risks identified.
• Traceability: analyses, approvals and refusals documented.
• Cooperation with the Central Bank of Brazil (BCB), COAF, the Federal Police, the Public Prosecutor's Office and other authorities.
• Confidentiality of regulatory communications.
• Non-discrimination: avoid arbitrary refusals and limit refusal to risks that cannot be mitigated.
• Responsible innovation: use of new technologies to improve controls, without compromising compliance.

The risks of money laundering and terrorist financing vary according to clients, products, services, channels, technologies, jurisdictions and third parties. For this reason, the policy provides for a specific internal AML/CFT risk assessment, at least annually and whenever there is a relevant change in the business model, regulation, products, technologies or the external environment. The assessment must be conducted by a multidisciplinary team, consider the existing controls, define proportional mitigation measures and be approved by management.

Prevention is everyone's responsibility, not just that of the Compliance department. The policy encourages internal reporting of concerns, without retaliation, including through anonymous channels.

Know your customer

Swapo must identify, qualify, verify and risk-classify individual and legal-entity clients, their representatives, ultimate beneficial owners, controlling persons and related parties, with procedures proportional to the risk. The steps provided for are:

• Registration: collection of identification and contact data, occupation or economic activity, estimated net worth and source of funds; for legal entities, corporate documents, control structure and ultimate beneficial owners.
• Verification of the information against reliable sources and, in virtual asset operations, verification of wallets.
• Identification of the ultimate beneficial owner down to the controlling individual, with a client declaration when necessary.
• Analysis of whether the client's profile is compatible with the intended products, services and volumes.
• Simplified diligence for low risks and enhanced diligence for higher risks, which may include proof of the source of funds (for example, bank statements or tax returns), interviews and intensified monitoring.
• Periodic updating of registration data and whenever a relevant event occurs.

The policy prohibits opening or maintaining a relationship with anonymous clients or clients with a fictitious identity, with entities whose control structure cannot be understood, and with persons or entities that appear on sanctions lists or show signs of unlawful conduct.

In transfers involving external wallets, Swapo must collect enough information to identify the client, record the addresses involved and classify the wallet as custodial or self-custodied based on the available evidence. A wallet is not considered self-custodied merely because it is external to Swapo.

Politically exposed persons and sanctions

Clients, partners, employees and third parties classified as politically exposed persons, their family members and close associates are subject to initial and ongoing verification, senior management approval to start or maintain the relationship, in-depth proof of the source of funds and wealth, and intensified monitoring.

Swapo may refuse or end the relationship with a politically exposed person when the risk is high and cannot be mitigated, with the decision documented.

The policy provides for ongoing screening against national and international sanctions lists, including those of the United Nations Security Council, and on-chain analysis to identify exposure to sanctioned wallets or wallets associated with unlawful conduct. A match against sanctions lists results in the immediate freezing of assets and a report to COAF and the Central Bank of Brazil.

Transaction monitoring

The policy provides for continuous monitoring of transactions, through automated systems and manual analysis, to identify transactions that are inconsistent with the client's profile, history or financial capacity, atypical patterns and links to unlawful conduct, including on blockchain networks. Alerts must be investigated and documented in a case file, with evidence, decisions and approvals.

A specific routine is provided for identifying the transactions subject to mandatory reporting to COAF, separate from the analysis of suspicions. Transactions below the mandatory reporting threshold remain subject to monitoring, including for structuring or attempts to avoid controls.

Monitoring must be auditable and undergo periodic effectiveness testing.

Reporting to COAF and cooperation with authorities

Transactions, proposals or situations with signs of money laundering, terrorist financing or proliferation financing must be analyzed by the Compliance/AML department, submitted to the Compliance Committee and reported to COAF through Siscoaf within the regulatory deadlines. A decision not to report must be reasoned and recorded.

Regardless of suspicion, Swapo must report to COAF the transactions that fall under the mandatory cases set out in the regulations, such as transfers of virtual assets to or from self-custodied wallets starting from the amount set therein.

The policy provides for responding to authorities' requests within the legal deadlines, including for the freezing of assets.

Governance, records and training

Ultimate responsibility for the policy lies with senior management, which must approve it, ensure human, financial and technological resources, and supervise its application. Swapo must appoint an officer responsible for AML/CFT before the Central Bank of Brazil, with qualifications and functional independence.

A Compliance/AML Committee is provided for, with representatives from compliance, risk, operations, legal, technology and management, to deliberate on higher-risk relationships and suspicion reports. The Compliance/AML department must act independently of the commercial and operational departments and report directly to senior management.

The policy requires keeping complete, intact and auditable records of registrations, transactions, analyses, reports and decisions, in a secure digital format, for at least ten years or for a longer period when required. Access is restricted to authorized persons, with access logging, and the processing of personal data complies with the General Data Protection Law (Law No. 13,709/2018).

The policy also provides for: procedures for getting to know employees, suppliers and partners; mandatory training upon hiring and periodically; an annual and independent effectiveness assessment; internal and external audit; and a contingency plan for incidents and system failures, without presuming any extension of regulatory deadlines.

Review and effective date

The policy must be reviewed annually or whenever there is a relevant regulatory, operational or technological change, on the proposal of the Compliance Committee and with the approval of senior management. Changes must be communicated internally and reflected in procedures and controls.

Non-compliance subjects those involved to administrative, civil, criminal and disciplinary sanctions.

The document indicates version 1.0, with an approval date of October 14, 2026.

Regulatory basis

• Law No. 9,613/1998, as amended by Law No. 12,683/2012 (money laundering).
• Law No. 13,260/2016 (terrorism and its financing).
• Law No. 13,810/2019 (compliance with United Nations Security Council sanctions).
• Law No. 14,478/2022 (provision of virtual asset services).
• BCB Circular No. 3,978/2020 and its amendments, including BCB Resolution No. 591/2026.
• BCB Circular Letter No. 4,001/2020.
• BCB Resolutions No. 519, 520 and 521/2025.
• COAF Resolution No. 36/2021.
• Recommendations of the Financial Action Task Force (FATF), in particular Recommendation 15, and FATF guidance on the risk-based approach to virtual assets.
• Sanctions lists of the United Nations Security Council, national lists and, in international operations, lists of other jurisdictions, such as those of the European Union and the U.S. OFAC.

About this version

Public version of the document “Anti-Money Laundering and Counter-Terrorist Financing Policy (AML/CFT)”, dated October 14, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center