Know Your Wallet (KYW) Policy

Objective

The policy establishes how Swapo must identify, verify, qualify and monitor the virtual asset wallets used by clients, so that they are not used for unlawful or abusive purposes or purposes contrary to the law.

In the virtual asset market, the risk of money laundering, terrorist financing, fraud, sanctions evasion and concealment of ultimate beneficial owners may lie not only with the client but also with the wallets the client uses. For this reason, KYW is an essential part of Swapo's anti-money laundering and counter-terrorist financing program.

Scope

The policy applies to all clients, individuals or legal entities, who use or intend to use virtual asset wallets in Swapo's services, and to administrators, employees, service providers, partners and third parties acting on behalf of Swapo.

Compliance with the policy is mandatory and is a condition for starting and continuing the relationship, whatever the service provided.

Concepts

• Virtual asset wallet: an address or set of addresses on blockchain networks that makes it possible to move, hold or receive virtual assets, regardless of the technology or type of custody.
• Know Your Wallet: a continuous process of identifying the wallet, verifying its link to the client identified in KYC, analyzing its history and assessing its risk, taking into account on-chain traceability and external information.
• Self-custodied wallet: a wallet whose instruments for controlling the virtual assets are held directly by the user, without a provider acting as custodian. This classification is not the same as the wallet's risk classification.

Wallet identification and linking

To use the services, the client must provide the addresses of the wallets they intend to use and declare that they are the owner or the legitimate controller of them.

Each wallet must be linked to a client previously identified and verified under the Know Your Customer Policy. The use of anonymous wallets, or wallets of undetermined or unverifiable ownership, is prohibited.

Where applicable, Swapo may require technical or behavioral evidence that the client controls the wallet, such as operational validations, proof of possession or other mechanisms compatible with the technology used.

Swapo must record, based on evidence, whether the wallet is custodied or self-custodied and, where there is one, which provider is the custodian. A wallet is not considered self-custodied merely because it is external to Swapo.

Risk analysis and monitoring

The history of each wallet must be analyzed with specialized traceability tools, to identify links to known unlawful activities, such as fraud, scams, theft, cyberattacks, terrorist financing, sanctions evasion or anonymization services.

The level of due diligence is proportional to the risk and may be intensified whenever indications of irregularity arise, whatever the client's initial classification. The wallet's risk may be reclassified at any time, based on new transactions, changes in behavior or new information.

The wallets linked to clients must be monitored continuously and in an integrated manner with transaction monitoring (KYT), to assess the consistency between the client's profile, the wallets used and the transactions carried out. The identification of self-custodied wallets also supports the mandatory reports to COAF (Brazil's Financial Intelligence Unit), which do not depend on suspicion or on the wallet's risk classification.

Wallets not accepted and measures

Swapo does not allow the use of wallets with significant indications of involvement in unlawful activities, of deliberate concealment of origin or of an attempt to circumvent monitoring and traceability. It also does not allow the omission, falsification or manipulation of information about the wallet's ownership, origin or history, or conduct that hinders analysis, audit or inspection.

In the case of high-risk wallets, Swapo may adopt proportionate measures, such as restricting or blocking transactions, requesting clarification, or reassessing or terminating the relationship. Where there are sufficient indications of unlawful activity, Swapo must report to the competent authorities, including COAF.

Noncompliance with the policy by clients, employees or third parties may lead to suspension or termination of the relationship, reporting to the authorities and the applicable sanctions.

Governance, records and data protection

Execution of the policy is the responsibility of the Compliance/AML area, which must act independently of the commercial and operational areas and report to senior management. Senior management must approve the policy, ensure resources and oversee its effectiveness.

Records on the wallets analyzed, including identification, risk history, analyses, decisions and communications, must be kept in a complete and auditable manner for the minimum period required by the regulations.

The processing of information complies with the General Data Protection Law and the internal information security policies, without prejudice to the legal reporting and inspection obligations.

Review and effective date

The policy must be reviewed periodically and whenever there is a relevant change in regulation, in the business model or in the risks of the technologies used. It takes effect on the date of its approval by senior management.

Regulatory basis

• Law No. 9,613/1998 (money laundering).
• BCB Circular No. 3,978/2020, as amended by BCB Resolution No. 591/2026.
• Law No. 14,478/2022 (provision of virtual asset services).
• FATF Recommendations.

About this version

Public version of the document “Know Your Wallet (KYW) Policy”, dated October 14, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center