Regulatory Compliance Program

Objective

The program establishes Swapo's formal, permanent and integrated structure of governance, controls, processes, responsibilities and monitoring to ensure:

• compliance with the regulatory framework for virtual asset service providers, including authorization, operation, governance, asset segregation, anti-money laundering and counter-terrorist financing (AML/CFT) and consumer protection;
• continuous adherence to the rules of the Central Bank of Brazil, the National Monetary Council, COAF (Brazil's Financial Intelligence Unit) and other authorities, with attention to cross-border and cyber risks;
• timely prevention, detection and correction of non-compliance, including violations of international sanctions and anti-corruption rules;
• mitigation of legal, regulatory, reputational, operational, prudential and concentration risks;
• integrity, transparency and resilience of operations, with a culture of compliance and ethics;
• protection of clients, the financial system and Swapo itself.

The program is operational, preventive, corrective and evolving, and is integrated into strategic decisions, business planning and product development. In case of conflict between rules, Brazilian rules prevail, followed by the strictest standard.

Scope

The program is mandatory for:

• administrators, officers, board members and committee members;
• employees of any employment relationship, hierarchy or type of engagement;
• service providers, partners, suppliers, agents and critical third parties, through contractual adherence clauses;
• all activities, products, services, channels, technologies and jurisdictions involved, including cross-border operations;
• all virtual assets with which Swapo operates.

In international operations, the program prioritizes compliance with United Nations Security Council sanctions and FATF lists. Violations subject those involved to internal sanctions and to reporting to the Central Bank of Brazil and COAF.

Principles

• Legality and full adherence to rules and contractual obligations.
• Independence of the compliance function, separate from the commercial areas, with unrestricted access to information and direct reporting to Senior Management.
• Risk-based approach, with resources proportional to the internal risk assessment.
• Proportionality to Swapo's size, complexity and risk profile.
• Segregation of duties, with double verification in critical operations.
• Traceability and auditable record of decisions, analyses and actions.
• Transparency and full cooperation with authorities.
• Continuous improvement of controls.
• Senior Management's responsibility to set the example in compliance and ethics.
• Integrity and corruption prevention, with third-party due diligence.
• Sustainability and social responsibility, with attention to the environmental risks associated with virtual assets.

Compliance governance

Senior Management approves the program and its revisions, defines the regulatory risk appetite, ensures human, technological and financial resources, oversees effectiveness through periodic indicator reports and decides on critical regulatory matters, such as the acceptance of politically exposed persons and reports to COAF.

The program provides for a Responsible Compliance Officer registered with the Central Bank of Brazil, with unblemished reputation, proven qualifications, functional independence, access to all information, direct reporting to Senior Management and to the Compliance Committee, and responsibility for the internal risk assessment and effectiveness evaluations.

The Compliance area acts independently of the commercial and operational areas and reports to the Responsible Officer. It is responsible for interpreting rules, assessing the regulatory impact of new products, maintaining the regulatory map, testing adherence to rules, supporting controls and third-party due diligence, conducting regulatory and AML/CFT risk analyses, coordinating responses to official letters and inspections, and keeping evidence of compliance.

The Compliance Committee is a permanent collegiate body, with representatives from Compliance, Risk, Operations, Legal, Technology and Senior Management, and meets at least once per quarter. It decides on relevant regulatory risks, approves policies and updates to the program, assesses incidents, non-compliance and reports to COAF, and oversees audit action plans.

Regulatory mapping, policies and new products

Swapo must maintain a regulatory map updated monthly or upon relevant events, which identifies the applicable rules, links obligations to area, process and product, defines owners and deadlines, and records controls and evidence. Regulatory changes are analyzed for legal, operational, technological, financial and reputational impacts, with an adaptation plan approved by the Compliance Committee and implemented within 90 days.

Regulatory risk is identified, assessed by probability and impact, classified as low, medium, high or critical, treated with proportional controls, such as enhanced diligence for high risks, and tracked through indicators. Management is integrated with the annual internal AML/CFT risk assessment, operational and cyber risk management, and strategic planning.

The program brings together versioned and approved policies and procedures, including:

• AML/CFT policy;
• KYC, KYB, KYW, KYT and Travel Rule procedures;
• asset segregation and proof of reserves;
• cryptographic key management;
• information and cyber security;
• business continuity and disaster recovery;
• conflicts of interest and anti-corruption;
• Code of Ethics and Conduct, with a whistleblowing channel;
• governance of critical third parties.

No product, service, channel or technology may be launched without prior Compliance analysis of regulatory classification, AML/CFT risks and necessary controls, with approval by the Compliance Committee and Senior Management.

Monitoring, non-compliance and audit

The Compliance area carries out continuous monitoring with automated tools, including for on-chain operations, periodic control testing, annual thematic reviews, self-assessments with indicators and an annual effectiveness evaluation, with a report and action plans. Results are reported to the Committee and Senior Management, with corrections within 60 days.

Non-compliance is recorded with evidence, classified by criticality, handled with root cause analysis, tracked until resolution and reported to Senior Management and, if material, to the Central Bank of Brazil. Cyber or AML/CFT incidents trigger the incident response plan.

The program provides for semiannual internal audit and annual independent audit, with a scope that includes penetration testing and record review, and follow-up of findings through action plans.

Relationship with regulators and third parties

Communication with the Central Bank of Brazil, COAF and other authorities is centralized in the Compliance area, with deadline control, traceability and periodic reports.

Critical providers undergo initial and ongoing regulatory due diligence, have compliance and AML/CFT contractual clauses and are continuously monitored, with annual audits. Final responsibility remains with Swapo.

Training, culture and whistleblowing channels

Everyone receives mandatory initial training upon hire, annual periodic training of at least 8 hours, role-specific content and knowledge assessments with certification.

Documentation, review and effective date

The program's acts must be documented, traceable and stored for 10 years, with encryption and compliance with the LGPD (Brazil's General Data Protection Law).

The program is reviewed annually or upon relevant regulatory, operational, corporate, technological or risk changes. Updates are proposed by the Compliance area, approved by the Compliance Committee and Senior Management, and communicated internally. Non-compliance subjects those involved to sanctions. The program takes effect on the date of its approval.

Legal basis and references

• Law No. 14,478/2022;
• BCB Resolutions No. 519, 520 and 521;
• BCB Circular No. 3,978/2020;
• CMN Resolution No. 4,893/2021;
• Law No. 9,613/1998;
• Law No. 13,260/2016;
• Law No. 13,810/2019;
• Law No. 12,846/2013;
• COAF Resolution No. 36/2021.

International references used as guidance: Basel Committee (BCBS) principles for compliance risk, COSO Internal Control – Integrated Framework, ISO 37301:2021, ISO 37001:2016 and FATF Recommendations 15 and 16, with the risk-based approach guidance for virtual assets and virtual asset service providers.

About this version

Public version of the document “Regulatory Compliance Program”, dated September 21, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center