Business Continuity Plan

Purpose and scope

The Business Continuity and Disaster Recovery Plan sets guidelines, responsibilities, procedures and controls to ensure the continuity of Swapo's critical activities in the face of events that may cause relevant interruptions to operational, technological, human or third-party processes. Its objectives are:

• to reduce the impact of adverse events on clients, the market and the regulator;
• to preserve the integrity, availability and confidentiality of information;
• to ensure the orderly resumption of essential activities;
• to maintain compliance with applicable regulatory requirements.

The plan covers critical processes, technology systems and infrastructure, essential personnel, physical premises, service providers and critical third parties, and internal and external communication flows. It applies to officers, employees, service providers and third parties who take part, directly or indirectly, in Swapo's operations.

Principles

• Proportionality to Swapo's size and complexity.
• Priority for critical processes.
• Prevention and preparedness.
• Fast, coordinated response.
• Clear and timely communication.
• Defined responsibilities and governance.

Responsibilities and governance

Senior Management has final responsibility for the plan. It is responsible for approving the plan and its revisions, ensuring adequate financial, human and technological resources, overseeing tests and corrective actions, and ensuring alignment with Swapo's strategy.

The Risk and Capital Officer is responsible for the plan. This officer coordinates the drafting, maintenance and execution of the plan, declares its activation, coordinates the areas involved, reports relevant events to Senior Management and handles external communications, when applicable.

Critical processes

Swapo must carry out a Business Impact Analysis to identify and classify its critical processes, considering regulatory, financial, operational, reputational and technological impacts. Critical processes include:

• receiving and forwarding client orders;
• settlement and transfer of virtual assets;
• compliance and anti-money laundering and counter-terrorist financing monitoring;
• maintenance of essential technology systems;
• client service and support;
• recording, safekeeping and integrity of regulatory data.

For each group of critical processes, the plan defines an estimated maximum recovery time and a maximum acceptable data loss.

Scenarios considered

The plan considers, on a non-exhaustive basis, the following scenarios:

• unavailability of critical systems;
• failure of cloud or connectivity providers;
• cyberattacks;
• unavailability of key personnel;
• failures of critical service providers;
• unavailability of the physical headquarters;
• emergency regulatory events.

Continuity and recovery strategies

For operational and personnel continuity, the plan provides for:

• redundant technology infrastructure and use of high-availability cloud environments;
• formal documentation of critical processes;
• the possibility of remote operation of essential functions, with secure remote access;
• segregation between production and contingency environments;
• mapping of critical functions and definition of substitutes.

For disaster recovery, the plan provides for periodic and automated backups, secure and segregated storage, encryption of sensitive data, periodic restoration tests and, as applicable, redundant environments, contingency plans and the ability to migrate critical services quickly.

Critical third parties are those whose failure may compromise essential activities. Swapo must identify and classify them, require continuity contract clauses, periodically assess risks and performance, and keep contingency plans to replace them or mitigate failures.

Plan activation

The plan may be activated when there is a relevant interruption of critical systems, a significant risk to continuity, a determination by Senior Management or an event that requires notification to the regulator.

Activation includes an initial assessment of the event, immediate internal communication, triggering of contingency measures and formal recording of the event.

Communication in crisis situations

The plan provides formal communication procedures in crisis situations:

• to employees;
• to clients, when applicable;
• to the Central Bank of Brazil and other authorities, as required.

Communications must be documented and proportionate to the severity of the event.

Testing, review and effective date

Swapo commits to testing the plan periodically, recording the results and action plans, training the teams involved and reviewing the plan after tests or real events.

The plan must be reviewed annually, whenever there is a relevant change in the operating model, after relevant incidents and as a result of regulatory changes.

The plan is integrated with the risk management, information security and internal controls policies and with the regulatory compliance program. It takes effect on the date of its approval by Senior Management and must remain up to date and available for supervision by the Central Bank of Brazil.

Legal basis

• Law No. 14,478/2022.
• Central Bank of Brazil regulation applicable to SPSAVs.
• Prudential best practices for business continuity.

About this version

Public version of the document “Business Continuity Plan and Disaster Recovery Plan (BCP/DRP)”, dated September 21, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center