Internal Controls, Compliance and Operational Governance Policy

Objective, scope and principles

The policy establishes Swapo's structure for internal controls, compliance, operational governance, risk management and control environment, with principles, responsibilities, procedures, testing, records, monitoring, reporting, correction of deficiencies and cooperation with authorities. It seeks to ensure:

• compliance with Law No. 14,478/2022, with BCB Resolutions No. 519, 520 and 521/2025 and with the other applicable rules;
• operational integrity, asset security and protection of the assets under Swapo's responsibility;
• segregation between Swapo's own funds and virtual assets and those of clients;
• prevention of money laundering, terrorist financing and the financing of the proliferation of weapons of mass destruction (AML/CFT/CPF);
• protection of personal data and compliance with banking secrecy (Complementary Law No. 105/2001);
• cybersecurity, business continuity, quality of records and adequate client service;
• management of third parties and timely provision of information to the Central Bank of Brazil and the other authorities.

The policy covers Swapo's entire structure, processes, systems, products, assets and partnerships, including governance, virtual asset intermediation, client operations and own operations, settlement, reconciliation, prices and quotes, RFQ and OTC, liquidity providers and relevant service providers, AML/CFT/CPF and sanctions, cybersecurity, data protection, accounting, client service, regulatory reporting, continuity, audit, training and incident management.

The controls follow the principles of proportionality to size and risks, independence of the control functions, segregation of duties, documentation, traceability, continuous monitoring, accountability, timely correction of failures, protection of clients and their assets, prevention of the misuse of third-party assets, secrecy, cooperation with the authorities and continuous improvement.

Responsible officers, board of officers and committees

The policy provides for administrators or officers who are responsible to the Central Bank of Brazil, under BCB Resolution No. 520/2025, for the following areas:

• conduct of activities and business;
• AML/CFT/CPF;
• internal controls and compliance;
• risk management, capital and disclosure of information;
• cybersecurity and the incident response plan.

The designations must be formalized in a registered corporate act. Holding more than one function is allowed within the limits of the regulations, except where there is incompatibility, conflict of interest or a regulatory prohibition. Swapo must keep up-to-date records of the designations, the substitutes and the authority limits of each officer.

The board of officers is responsible for approving and reviewing the internal policies, the risk appetite, the organizational structure, the authority limits, the responsibility matrix and the business plan, for monitoring the indicators of controls, risks, compliance and incidents, and for ensuring resources for the control functions. Where one exists, the Board of Directors provides strategic oversight, with attention to the effectiveness of controls, financial integrity and compliance.

Subject to proportionality, the policy provides for, at a minimum, the following committees or functional equivalents, each with its own charter:

• Risk and Internal Controls Committee;
• Conflict of Interest Committee;
• AML/CFT/CPF Committee;
• Cybersecurity and Technology Committee, where applicable;
• Products Committee, where applicable to Swapo's profile.

Committee functions may be combined where proportionate, with the authorization of the board of officers, provided that the effectiveness of the control and the absence of conflict are preserved. Administrators must maintain adequate knowledge of the business model, the risks, the regulations and the controls, with continuing education and submission to the fitness assessment processes required by the Central Bank of Brazil. The business plan must be reviewed by the board of officers at least once a year.

Three lines, risk matrix and critical processes

Swapo adopts the three-lines model. The first line comprises business, operations, client service, treasury, technology and products, which perform the primary controls. The second line comprises Compliance, Risk Management, AML/CFT/CPF, Internal Controls, Information Security, Privacy and Regulatory Legal, which are responsible for rulemaking, monitoring, guidance, testing and reporting. The third line is internal audit, independent audit or another independent assessment.

The second and third lines have hierarchical and budgetary independence and direct access to the board of officers. The policy prohibits their members from performing an operational function in the same matter being assessed, prohibits compensation from impairing their independence, and prohibits them from being subordinate to the business areas.

The risk and control matrix must be versioned and must record, for each process, the risk, the impact, the probability, the preventive and detective controls, the evidence, the owner, the frequency, the authority level for exceptions, the effectiveness indicator and the action plan. It is reviewed at least annually, with an extraordinary update after a relevant event, incident, regulatory or product change, or audit recommendation.

The following, among others, receive reinforced control: the processes of registration and identification of clients, partners and employees, risk classification for AML/CFT/CPF, sanctions, transaction monitoring, deposits and withdrawals in fiat currency and in virtual assets, purchase, sale and exchange of virtual assets, RFQ and OTC, liquidity providers, custody where applicable and wallet management, asset segregation, proof of reserves, prices, settlement and reconciliation, own operations and operations with related parties, listing and delisting of assets, incidents and continuity, data protection, cybersecurity, engagement of third parties, regulatory reporting and complaint handling.

Asset segregation and custody

The policy requires absolute asset segregation between Swapo's own funds and the funds and virtual assets of clients, in accordance with BCB Resolution No. 520/2025. The segregation covers financial funds, virtual assets, assets intended for immediate liquidity where permitted, wallets on the on-chain infrastructure, operating and settlement accounts, accounting records, technological controls and access profiles.

If Swapo engages a custodian, the policy requires a documented custody policy that is available to the Central Bank of Brazil, with separation of on-chain and off-chain wallets, proof-of-reserves methods with defined criteria and frequency, a biennial independent audit, scenarios for the transfer of assets in the event of interruption, discontinuation or liquidation, management of cryptographic keys and handling of events such as forks, airdrops and protocol updates.

In these cases, the controls must ensure individualized recording of each client's positions, timely reconciliation between internal records and on-chain balances, multiple authorization for movements, multifactor authentication, immutable records, periodic audit and an incident response plan. Engaged custodians must be assessed and monitored continuously.

The policy provides for a specific biennial independent audit of asset segregation, performed by a qualified provider, to verify the effective segregation, the proof-of-reserves methods, the key and access controls, the accounting and operational records and the transfer plans in the event of discontinuation. The report is made available to the Central Bank of Brazil, and its conclusions give rise to an action plan that is monitored until remediation.

Operations, AML/CFT/CPF, prices and third parties

Every operation must have sufficient records for it to be fully reconstructed: client, date and time, asset and pair, quantity, price and price source, spread, fees, costs and taxes, counterparty, liquidity provider where there is one, wallets or accounts, transaction hash where applicable, status, settlement, approvals, communications and receipts. Canceled, amended, rejected or out-of-band operations are also recorded, with cause, time, owner and outcome.

For AML/CFT/CPF, the policy provides for full identification of individual and corporate clients, with ultimate beneficial owners, politically exposed persons, sanctions lists, risk assessment and periodic update of registration data; controls over the origin and destination of funds and virtual assets and over the consistency of operations with the client's profile; transaction monitoring and on-chain analysis with auditable records; and continuous screening of clients, counterparties, wallets, transactions and providers against the lists of the United Nations Security Council, other applicable sanctions lists and internal lists. Indications of unlawful activity must be reported in a timely manner to the competent authorities.

The policy provides for controls over prices and quotes: adherence to the source hierarchy, monitoring of spreads, recording of quotes and RFQs, handling of out-of-band prices, control of operations with related parties, monitoring of slippage and of execution and settlement failures, and alerts for outlying or potentially manipulative operations.

The engagement of relevant service providers, including liquidity providers, requires documentary, regulatory, technical, operational and financial due diligence, assessment of AML/CFT/CPF, sanctions, information security and continuity, approval by the competent authority level, a contract with the minimum required clauses, service levels, audit rights, access by the Central Bank of Brazil to the documents, information and premises of the contractor, periodic monitoring, annual reassessment and a transition plan. For liquidity providers, the policy also provides for exposure limits per counterparty, monitoring of prices and execution quality, concentration control, management of conflicts of interest and a contingency plan for replacement.

Cybersecurity, data, records and continuity

The cybersecurity structure is the responsibility of the designated officer and must include access management on a least-privilege basis, multifactor authentication for privileged access and sensitive operations, segregation of environments, encryption of sensitive data, continuous monitoring, records protected against alteration, tested backups, vulnerability and penetration testing, change management, system acceptance and controls over integrations and cloud services. Incidents are classified, recorded, handled and, where applicable, reported to the authorities. Relevant incidents give rise to a report with root cause and action plan.

The processing of personal data follows the LGPD (Brazil's General Data Protection Law), with adequate legal bases, minimization, access control, limited retention, secure disposal, fulfillment of data subject rights and a Data Protection Officer, where applicable. Clients' financial and operational data receive a reinforced level of secrecy, under Complementary Law No. 105/2001. Personal data incidents are reported to the Brazilian Data Protection Authority and to the affected data subjects, where applicable.

Records must be kept for the legal and regulatory periods, with a minimum of 10 years for documents linked to foreign exchange operations and 5 years for AML/CFT/CPF documents, in a medium that preserves integrity, availability and legibility.

The business continuity plan must be documented, tested and reviewed at least once a year, with business impact analysis, strategies for critical processes, disaster recovery, internal and external communication and procedures for the transfer of positions and assets in the event of prolonged discontinuation. It covers the continuity of asset segregation, custody where there is any, client service and regulatory obligations.

Risk and capital management

The risk management structure is led by the Officer Responsible for Risk Management, with hierarchical and budgetary independence, and covers identification, assessment, measurement, mitigation, monitoring and reporting. The risks provided for include, among others, operational, market, credit where applicable, liquidity, counterparty, concentration, AML/CFT/CPF, cyber, continuity, regulatory and legal, reputational, smart contract risk where applicable, cryptographic key and custody risk where applicable, and fork and protocol risk.

The board of officers approves the risk appetite statement, with limits per category, monitoring indicators and handling of breaches, reviewed annually or after a relevant event, and receives a consolidated risk report at least every quarter.

Swapo must maintain capital compatible with the regulatory requirements, with periodic monitoring of the requirements, an additional margin according to risk appetite, capital planning integrated with the business plan, proportionate stress tests, timely notice to the Central Bank of Brazil of any noncompliance and an action plan to return to compliance. The board of officers monitors the capital adequacy indicators monthly.

Testing, reporting, nonconformities and audit

Internal Controls performs periodic tests on registration, AML/CFT/CPF and sanctions, transaction monitoring, prices, RFQ, liquidity providers, custody where applicable, asset segregation, reconciliation, own operations, third parties, incidents, complaints, regulatory reporting, access and related parties. Each test produces a report with findings classified as low, medium, high or critical, a recommendation, an owner, a deadline and follow-up.

Internal control indicators, such as AML/CFT/CPF alerts, settlement and reconciliation failures, incidents, unavailability, complaints by root cause, provider service levels, approved exceptions and overdue action plans, are monitored by the board of officers. Internal control reports are presented to the board of officers at least every quarter, and regulatory reporting obligations have centralized control of deadlines, owners and evidence.

Nonconformities are classified as low, medium, high or critical and receive an action plan with an owner, a deadline and evidence of remediation. Critical failures are reported immediately to the responsible officer and to the board of officers, who assess whether the Central Bank of Brazil and the other authorities need to be notified.

Administrators, employees and relevant third parties receive training at least annually on internal controls, AML/CFT/CPF, sanctions, data protection, information security, conflicts of interest, prices, contact with liquidity providers, incidents and ethics, with records kept for at least 5 years.

Internal audit, or an equivalent independent assessment function, periodically assesses the control structure, with unrestricted access to systems, records and people. Swapo must cooperate fully with the Central Bank of Brazil and the other authorities, responding to requests in a timely manner, with designated points of contact, centralized recording of interactions and priority handling of orders and recommendations.

Client service and complaints

The policy provides for a client service structure with:

• formal service channels, with published hours and means;
• a complaint-handling procedure with a defined response deadline;
• internal escalation for cases not resolved at first contact;
• follow-up through satisfaction and root-cause indicators;
• an ombudsman office or equivalent structure, as appropriate under proportionality (Swapo's ombudsman office is established in its articles of association, under BCB Resolution No. 28/2020);
• interaction with the Central Bank of Brazil's service and complaints system, where applicable.

Complaints are used to identify control deficiencies, with periodic review of causes and corrective actions.

Review, effective date and regulatory basis

The policy must be reviewed at least every 24 months, or sooner in the event of a relevant regulatory change, a change in the business model, a relevant incident, an audit recommendation, a requirement of the Central Bank of Brazil or a significant operational change. Cases not covered are resolved by the Officer Responsible for Internal Controls and Compliance, after consulting Compliance, Risk and Legal. The policy takes effect on the date of its approval.

Rules cited in the document:

• Law No. 14,478/2022;
• BCB Resolutions No. 519, 520 and 521/2025;
• BCB Resolution No. 277/2022 and the other applicable foreign exchange rules;
• BCB Normative Instruction No. 693/2025;
• Complementary Law No. 105/2001;
• Law No. 9,613/1998 and BCB Circular No. 3,978/2020, subject to the regulations of COAF (Brazil's Financial Intelligence Unit), as applicable;
• Law No. 13,709/2018 (LGPD);
• CMN Resolution No. 4,893/2021 and BCB Resolution No. 85/2021, as applicable;
• FATF Recommendations on virtual assets and virtual asset service providers.

About this version

Public version of the document “Internal Controls, Compliance and Operational Governance Policy”, dated September 21, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center