Know Your Customer (KYC) Policy

Purpose

This policy is part of Swapo's anti-money laundering and counter-terrorist financing (AML/CFT) program. It sets guidelines for identification, qualification, verification, risk classification, monitoring and registration updates of clients.

The objectives are to prevent Swapo from being used for illicit purposes, mitigate the risks of money laundering, terrorist financing, fraud and other financial crimes, comply with the regulations of the Central Bank of Brazil, and protect Swapo's integrity and reputation.

The policy adopts a risk-based approach: the due diligence applied to each client is proportionate to the risk identified.

Scope

This policy applies to all of Swapo's clients, including investors, business partners and any user who wishes to carry out transactions or use the services.

Identification and documents

Swapo must collect complete and accurate personal or business information, such as name, address, date of birth, identification document and contact details, and verify it through reliable documents. The documents that may be requested include, without limitation:

• Individuals: a valid identification document, such as an identity card (RG), passport or driver's license, and proof of residence issued within the last three months.
• Legal entities: documents proving the company's legal existence, such as articles of association and CNPJ, and information on the ultimate beneficial owners and main officers.

The policy prohibits opening or maintaining anonymous accounts or accounts under fictitious names.

Identity and background verification

The authenticity of documents must be verified through automated systems and manual procedures, which may include validation against official databases. When necessary, Swapo may request additional documents or conduct virtual interviews with the client.

Depending on the profile's risk level, additional validation by facial recognition with proof of life or by a recorded virtual interview may be required, to prevent identity fraud.

Checks are planned on politically exposed persons, economic activity, national and international sanctions lists, and media and proceedings related to financial crimes. Persons or entities involved in illegal activities or with a history of non-compliance must not be accepted as clients.

Risk classification and due diligence

Each client must be classified by risk, considering factors such as the type of client, the source of funds, geographic location, the volume and frequency of transactions, political exposure, history, the carrying out of international transactions, and the quality of the documentation provided.

The risk level defines the due diligence applied:

• Low risk: simplified due diligence, with complete registration and standard monitoring.
• Medium risk: standard due diligence, with document verification, profile analysis and regular monitoring.
• High risk: enhanced due diligence, with proof of the source of funds, analysis of transaction history, senior management approval and more frequent reviews.

Wallets and ongoing monitoring

In virtual asset transfers involving external wallets, Swapo must record the addresses involved, link them to the information on the client and the parties to the transaction, and identify, based on evidence, whether the wallet is custodial or self-custodied. A wallet is not considered self-custodied merely because it is external to Swapo.

The policy provides for ongoing monitoring of transactions, registration changes and atypical activity, in order to understand the nature and scope expected for the client's use of products, services and channels. Suspicious activity must be investigated and, when necessary, reported to the competent authorities.

Registration information also supports the mandatory reports to COAF (Brazil's Financial Intelligence Unit), which do not depend on the client's risk classification or on the identification of suspicion. Client information must be updated periodically.

Data protection

Personal data and documents collected in the KYC process must be stored securely, in accordance with the General Data Protection Law (Law No. 13,709/2018), with technical and administrative measures against unauthorized access, leaks and other forms of abuse.

The evidence used to identify and classify wallets must be preserved and linked to the records of the respective transactions.

Non-compliance, refusal and termination

Non-compliance with the policy may result in:

• refusal of registration;
• suspension or termination of the relationship;
• a report to COAF, when applicable;
• internal disciplinary measures, in the case of employees.

Employees and partners involved in the KYC process must receive adequate training to comply with the policy and identify compliance risks.

Review

The policy must be reviewed periodically, whenever there is a regulatory change, after relevant risk events and when there is a change in the business model.

Legal basis

• Law No. 9,613/1998 (money laundering).
• BCB Circular No. 3,978/2020, as amended by BCB Resolution No. 591/2026.
• Law No. 14,478/2022 (provision of virtual asset services).
• General Data Protection Law (Law No. 13,709/2018).
• Guidelines of the Central Bank of Brazil, the Brazilian Federal Revenue Service (Receita Federal), the Securities and Exchange Commission of Brazil (CVM) and the Financial Action Task Force (FATF).

About this version

Public version of the document “Know Your Customer (KYC) Policy”, dated October 14, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center