Cryptographic key management and recovery

Objective

The procedure establishes Swapo's technical, operational, governance and control guidelines for the secure management of the cryptographic keys used in its virtual asset operations. Its objectives are:

• to ensure the confidentiality, integrity, availability and authenticity of the keys;
• to protect the virtual assets moved through Swapo's operational wallets against financial, reputational or regulatory losses;
• to reduce the risks of permanent loss, unauthorized access, fraud, human error, technical failures, cyber incidents and catastrophic events;
• to meet prudential and operational security requirements and those for preventing money laundering and terrorist financing.

Scope

The procedure applies to all cryptographic material used in virtual asset operations, in all wallet environments (hot, warm and cold), to own or contracted infrastructure, and to all persons with access to the related systems, whether administrators, employees, service providers, partners or suppliers.

It covers the entire lifecycle of the keys: generation, distribution, storage, use, backup, recovery, rotation, revocation and destruction.

Principles

• Segregation of duties: no person or system holds complete control over the keys.
• Least privilege: access is granted only to the extent strictly necessary and reviewed periodically.
• Defense in depth: multiple layers of physical, logical and cryptographic protection.
• Redundancy and resilience: systems designed to tolerate failures, with no single point of failure in people, equipment or software.
• Traceability and auditability: recording of all relevant actions on the keys.
• Proven recoverability: regular tests to ensure effective recovery, without loss of assets.
• Risk-based approach: controls proportional to the risks identified in the internal risk assessment.
• Transparency and accountability: clear documentation and periodic reports to Senior Management.

Keys are classified by nature, criticality and environment, so that controls are proportional to the risk of each one.

Access control and approvals

• The procedure requires that no employee have the isolated ability to move virtual assets.
• Critical actions require dual control, multiple signatures or equivalent mechanisms, with distinct roles for who executes, who approves and who audits.
• Access requires multi-factor authentication and follows the principle of least privilege.
• Key generation occurs only in authorized events, in a controlled environment and with formal recording, without the keys being recorded in clear text.
• Backups are protected by encryption and access control and are part of the Business Continuity Plan.

Records, monitoring and audit

• All actions on keys must generate intact records protected against alteration.
• Continuous monitoring, with alerts for abnormal access, and periodic internal and external audits are provided for.
• Keys must be listed in a formal inventory, reviewed periodically.
• Evidence, such as logs and test reports, must be available to the Central Bank of Brazil.

Recovery, testing and lifecycle

Key recovery seeks to fully restore access to virtual assets in cases of operational loss, equipment failure, unavailability of personnel, cyber incidents or disasters, without compromising security.

Recovery begins only after an event has been formally identified and approved by the security and compliance bodies, with a case record opened. Afterward, the affected keys must be replaced and a report with lessons learned must be prepared.

The procedure provides for periodic recovery tests, both theoretical and practical, including extreme scenarios, with results recorded and adjustments approved by the responsible committee. The absence of tests is treated as a serious failure.

Keys must be replaced periodically or upon suspicion of compromise, revoked immediately in incidents, and securely destroyed, with formal recording.

Incidents and third parties

Incidents involving keys are treated as critical. The procedure provides for isolating the affected environment, escalated internal communication, communication to the competent authorities when applicable, and root cause analysis, with structural fixes and an update of the risk assessment.

When there is outsourcing, Swapo retains final responsibility. The procedure requires selecting providers through prior due diligence, including as to certifications, and contracts with service levels, penalties for non-compliance and a right of inspection by Swapo and the Central Bank of Brazil.

Responsibilities and training

Updates to the procedure are proposed by the Information Security and Compliance area, approved by the Security Committee and Senior Management, and communicated internally through formal channels.

All persons with access to the related systems, including third parties, must receive training upon hiring and annually, with knowledge assessments and phishing and recovery simulations.

Non-compliance is a serious violation, subject to internal, administrative, civil and criminal sanctions. Swapo encourages reporting through whistleblowing channels.

Review

The procedure is reviewed annually, after relevant incidents or failed tests, and in the face of technological or regulatory changes. Updates are documented.

Regulatory basis and references

• Law No. 14,478/2022.
• BCB Resolutions No. 519, 520 and 521, of 2025.
• BCB Circular No. 3,978/2020.
• Law No. 9,613/1998.
• FATF Recommendations, in particular Recommendation 15, on new technologies and virtual assets.
• International best practices for information security and key management, such as ISO/IEC 27001 and 27002 and NIST publications, used as a reference and not as a certification.

About this version

Public version of the document “Cryptographic Key Management and Recovery Procedures”, dated September 21, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center