Risk Management Policy

Purpose

The policy establishes principles, guidelines, responsibilities and procedures to identify, assess, monitor, control and mitigate the risks to which Swapo is exposed as a virtual asset service provider company.

The purpose is to conduct activities prudently and sustainably, in a manner consistent with the size, nature and complexity of operations, in compliance with the applicable regulations and with the expectations of the Central Bank of Brazil.

Scope

The policy applies to all of Swapo's activities and processes, to all personnel, administrators and relevant service providers, and to risks arising from proprietary, client and third-party operations. Risk management covers internal risks and risks originating from external factors, including regulatory and technological ones.

Principles

• Proportionality to the size and complexity of operations.
• Risk-based approach.
• Segregation of duties and responsibilities.
• Integration with corporate governance.
• Continuous improvement of controls.
• Transparency and traceability of decisions.

Risk governance

Senior Management is responsible for approving the policy and its revisions, defining risk appetite and tolerance, ensuring adequate resources and overseeing the effectiveness of controls.

The risk management function is performed by the Risk Department, which identifies and assesses relevant risks, proposes mitigation measures, monitors indicators, reports periodically to Senior Management and coordinates with Compliance, AML/CFT and Technology. The function acts independently of the operational areas, to the extent possible given Swapo's size.

Risk categories

The policy adopts an integrated approach and covers, at a minimum, the categories below:

• Operational risk: losses from failures or inadequacies in processes, people, systems or external events, such as errors in order execution, system unavailability and failures of critical third parties. Mitigation: standardized procedures, segregation of duties, operational controls, and business continuity and disaster recovery plans with periodic testing.
• Technological and information security risk: incidents related to systems, infrastructure, cybersecurity and data protection, such as cyberattacks, data leaks, cloud provider failures and advances in quantum computing. Mitigation: Information Security Policy, access controls, backups, encryption, continuous monitoring, technical audits where applicable and quantum-ready cryptography when necessary.
• Regulatory compliance risk: sanctions and losses arising from noncompliance with rules, reporting failures or inadequate documentation. Mitigation: Regulatory Compliance Program, regulatory monitoring, training and periodic review of policies.
• AML/CFT risk: use of Swapo for money laundering, terrorist financing or other illicit acts. Mitigation: compliance with BCB Circular No. 3,978/2020, KYC, KYB, KYT, KYW and Travel Rule policies, transaction monitoring and reporting to COAF (Brazil's Financial Intelligence Unit), when applicable.
• Reputational risk: damage to image and credibility with clients, the market and regulators, for example after operational failures, inappropriate advertising or security incidents. Mitigation: conduct and client relationship policies, responsible communication and a structured incident response.
• Third-party risk: dependence on service providers, suppliers and partners. Mitigation: prior due diligence at engagement, liability and continuity clauses, periodic monitoring and contingency plans.

Assessment, monitoring and continuity

Risks are identified and assessed through periodic process mapping, impact and probability analysis, risk matrices and incident review, and are classified according to their materiality and criticality.

Monitoring is continuous and uses key risk indicators, periodic reports to Senior Management, tracking of events and incidents and review of the effectiveness of controls.

Risk management is integrated with the Business Continuity and Disaster Recovery Plan, to ensure a coordinated response to events that affect the continuity of operations.

Training and risk culture

Swapo must foster a risk culture through periodic training, circulation of internal policies and awareness of individual responsibilities.

Review and effective date

The policy is reviewed periodically, in accordance with internal governance, and whenever there is a relevant change in the business model, relevant incidents or regulatory changes. It takes effect on the date of its approval by Senior Management, must be observed by personnel, administrators and third parties involved in Swapo's activities, and must be kept up to date and available for supervision and inspection by the Central Bank of Brazil.

Legal basis

• Law No. 14,478/2022;
• Central Bank of Brazil regulations applicable to virtual asset service providers;
• BCB Circular No. 3,978/2020;
• prudential best practices.

About this version

Public version of the document “Risk Management Policy”, dated September 21, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center