Procedures for Reporting Suspicious Transactions and Specific Transactions to COAF

Objective

The procedures establish the criteria, flows, responsibilities and controls that Swapo must adopt to identify situations, transactions or proposals with indications of money laundering, terrorist financing, proliferation of weapons of mass destruction or other illicit activity, analyze them in a documented manner, decide on reporting and report them to the Council for Financial Activities Control (COAF) through the Siscoaf system.

The procedures also address the specific transactions subject to mandatory reporting under art. 49 of BCB Circular No. 3,978/2020. In these cases, the duty to report arises from the transaction falling within the rule, regardless of indications of illicit activity.

Scope

The procedures apply to all transactions carried out or proposed to Swapo; to all clients, users, partners and third parties; to all areas of Swapo; and to all assets and instruments, including fiat currency, virtual assets, tokens, stablecoins and in-and-out transactions between fiat currency and virtual assets.

Principles

• risk-based approach;
• technical independence of the Compliance area;
• timeliness in analysis and reporting;
• full documentation of the decision-making process;
• absolute confidentiality;
• full cooperation with the competent authorities.

The risk-based approach guides the analysis of suspicions, but does not remove the reporting of transactions that fall within the mandatory cases.

Identification and analysis

Swapo must use automated mechanisms and manual procedures to identify indications of suspicious transactions.

It must also maintain its own routine to identify transfers of virtual assets to or from self-custodied wallets that are subject to mandatory reporting, separate from suspicion alerts. The classification of the wallet must be based on recorded evidence: a wallet is not considered self-custodied merely because the address is external to Swapo.

Each potentially suspicious situation generates an internal case file, kept in a secure system with access control and an audit trail. During the analysis, the Compliance/AML area may request additional information from the client or internal areas, carry out further diligence, consult external databases and restrictive lists, and reassess the client's risk profile.

The analysis ends with a reasoned technical opinion that recommends reporting to COAF or closing the case. Relevant or complex cases are submitted to the Compliance Committee or to senior management. The decision not to report must be reasoned and recorded, and the relationship remains monitored.

Reporting to COAF

Once a suspicious transaction report is decided, Swapo must submit it through Siscoaf, with a clear description of the facts, amounts, dates, persons involved and grounds for the suspicion, within the regulatory deadline. Reporting does not depend on a minimum amount, on the conclusion of an investigation or on confirmation of the illicit act, and internal approvals may not delay the deadlines.

Specific transactions are reported regardless of suspicion. They include transfers of virtual assets to or from self-custodied wallets from the amount set by regulation and, when carried out within the activities permitted to Swapo, the other cases in art. 49 of BCB Circular No. 3,978/2020. Submission must observe the deadlines of that rule, including the transitional rule for transactions contracted in the last quarter of 2026.

For specific transactions, the responsible area checks the classification and the consistency of the data, without depending on discretionary approval by the committee. The absence of suspicion does not waive mandatory reporting. If the transaction also shows indications of suspicion, it goes through its own analysis, without prejudice to the mandatory submission.

After each submission, the person responsible must confirm receipt and keep the protocol number. Rejected files or files without confirmation are treated as pending items until they are resolved.

Confidentiality

It is also prohibited to mention the existence of a report in unauthorized external communications or to share information about it outside authorized channels. Breach of the duty of confidentiality is a serious violation, subject to administrative, civil and criminal sanctions.

Requests for information or documents from the client are made within regular diligence procedures, without revealing whether there is or will be a report.

Cooperation, records and contingency

Swapo must cooperate fully with COAF, the Central Bank of Brazil, the Federal Police, the Public Prosecutor's Office and the Judiciary, responding to requests, providing documents and clarifications, and adopting measures such as the preventive freezing of assets, when legally ordered.

Records of reports, analyses and decisions must be kept for at least ten years, in a secure and auditable manner, available to the Central Bank of Brazil and other authorities. Periodic checks must reconcile eligible transactions with the reports received through Siscoaf, to identify omissions, duplicates and delays.

System failures, unavailability of Siscoaf or absence of the person responsible trigger the contingency procedure, with a substitute acting and the measures taken recorded, without assuming any extension of regulatory deadlines.

Responsibilities, training and review

The operations and technology areas must ensure the capture and availability of the data. The Compliance/AML area checks the classification, verifies the information and carries out or oversees submission through Siscoaf. The officer responsible for AML/CFT must ensure resources and the designation of a substitute.

Employees must receive periodic training on identifying indications, the internal reporting flow, the duty of confidentiality, the legal consequences of non-compliance and the difference between suspicion-based reporting and mandatory reporting.

The procedures must be reviewed annually, whenever there is a relevant change in rules, and after relevant incidents or regulator determinations. Compliance is mandatory, and non-compliance subjects those responsible to internal, administrative, civil and criminal sanctions.

Legal basis

• Law No. 9,613/1998, especially arts. 10 and 11.
• Law No. 13,260/2016 (terrorism and its financing).
• Law No. 13,810/2019 (compliance with United Nations Security Council sanctions).
• Law No. 14,478/2022 (provision of virtual asset services).
• BCB Circular No. 3,978/2020 and amendments, especially BCB Resolution No. 591/2026.
• BCB Circular Letter No. 4,001/2020.
• BCB Resolutions No. 519, 520 and 521, of November 10, 2025, and amendments.
• COAF rules and guidance.
• FATF Recommendations.

About this version

Public version of the document “Procedures for Reporting Suspicious Transactions and Specific Transactions to COAF”, dated October 14, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center