Know Your Business (KYB) Policy

Objective

The policy establishes the principles, guidelines, responsibilities and procedures that Swapo must adopt to identify, verify, qualify, risk-classify and monitor legal entities, corporate counterparties, business partners, service providers, critical suppliers and other entities with which it has or intends to have a relationship.

The purpose is to prevent, detect and mitigate the risks of money laundering, terrorist financing and the financing of the proliferation of weapons of mass destruction, corruption, fraud, sanctions evasion and other unlawful activities.

Scope and principles

The policy applies to all legal entities and equivalent entities, domestic or foreign, that:

• are corporate clients of Swapo;
• act as commercial, strategic or technology partners;
• provide relevant or critical services;
• have access to sensitive information, financial flows or operational infrastructure;
• take part, directly or indirectly, in Swapo's service delivery chain.

Compliance with the policy is a condition for starting and continuing any business relationship. The policy is guided by the risk-based approach, by proportionality to the size, complexity and risk of the counterparty, by transparency and traceability of information, by identification of the ultimate beneficial owner and the chain of control, by segregation of duties and by integration with the KYC, KYT, KYW and AML/CFT policies.

Identification and verification of the company

As a condition for the relationship, Swapo must identify the corporate counterparty with, at a minimum:

• corporate name, trade name and CNPJ or foreign equivalent;
• address of the head office and of relevant branches;
• corporate purpose and activities actually carried out;
• date of incorporation and registration status;
• ownership structure and chain of control;
• administrators and legal representatives;
• ultimate beneficial owner, under the regulations.

The information must be verified against up-to-date corporate documents, reliable public and private databases, official national and international records and independent reputational sources. Whenever necessary, additional documents, formal statements or clarifications may be requested.

When the company transfers virtual assets involving external wallets, Swapo must record the addresses, verify their link to the company or to an identified third party, and classify the wallet as custodied or self-custodied, recording the evidence. A wallet is not considered self-custodied merely because it is external to Swapo.

Ultimate beneficial owner

Swapo must identify the company's ultimate beneficial owner: the natural person who, directly or indirectly, holds control or significant influence or has a relevant ownership interest, under the criteria of the regulations.

In complex structures, such as offshore entities, trusts, foundations or cascading holding companies, due diligence must be deepened until the ultimate beneficial owner is identified. Swapo does not maintain a relationship with entities whose ownership structure or chain of control cannot be adequately understood.

Risk classification and enhanced due diligence

The counterparty must be classified by risk considering, in an integrated manner, the nature and complexity of the activity, the jurisdictions involved, exposure to virtual assets or sensitive financial services, the reputational and regulatory history, the ownership structure, the relationship with politically exposed persons and the volume, nature and purpose of the operations. The classification guides the level of due diligence and monitoring.

Counterparties classified as medium or high risk are subject to enhanced due diligence, which may include:

• in-depth analysis of the origin of funds;
• expanded verification of ultimate beneficial owners and controllers;
• analysis of adverse media and legal proceedings;
• approval by top management;
• intensified continuous monitoring.

Companies that have politically exposed persons as partners, controllers, administrators or ultimate beneficial owners are subject to enhanced due diligence, approval by top management and intensified monitoring.

Continuous monitoring

The business relationship must be monitored continuously, with periodic update of the registration, reassessment of risk, follow-up of relevant changes in ownership, monitoring of transactions and atypical behavior, and continuous screening against sanctions and restrictions lists.

KYB information must be linked to the operation records to support the mandatory reports to COAF (Brazil's Financial Intelligence Unit), which do not depend on the counterparty's risk classification or on the identification of suspicion.

Refusal, suspension and termination

Swapo may refuse, suspend or terminate the business relationship when:

• there are significant inconsistencies in the information provided;
• it is not possible to identify the ultimate beneficial owner;
• indications of unlawful activity are identified;
• the company is listed on national or international sanctions lists;
• the risk is considered high and cannot be mitigated.

All decisions must be documented and traceable.

Governance, records and review

Execution of the policy is the responsibility of the Compliance/AML area, which must act independently of the commercial and operational areas and report to senior management. Senior management must approve the policy, ensure resources and oversee its effectiveness.

Analyses, documents, decisions and communications related to KYB must be recorded in a complete and auditable manner for the minimum period required by law. The information is treated confidentially, subject to the General Data Protection Law and the legal reporting obligations.

Employees who deal with corporate counterparties must receive periodic training. The policy must be reviewed periodically and whenever there is a relevant change in regulation, in the business model or in the risks, and takes effect on the date of its approval by senior management.

Regulatory basis

• Law No. 9,613/1998 (money laundering).
• Law No. 13,260/2016 (terrorism and its financing).
• Law No. 13,810/2019 (compliance with United Nations Security Council sanctions).
• Law No. 14,478/2022 (provision of virtual asset services).
• BCB Circular No. 3,978/2020, as amended by BCB Resolution No. 591/2026.
• BCB Resolutions No. 519, 520 and 521/2025.
• COAF rules, in particular COAF Resolution No. 36/2021.
• FATF Recommendations, in particular Recommendations 1, 10, 12, 15, 17 and 22.

About this version

Public version of the document “Know Your Business (KYB) Policy”, dated October 14, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center