Risk Policy

Objective, scope and principles

The policy informs and guides users about the risks associated with the virtual asset services provided by Swapo, under Law No. 14,478/2022 and the rules of the Central Bank of Brazil. It also establishes guidelines and responsibilities to identify, assess, mitigate, monitor, respond to and report these risks.

The policy applies to all areas, employees, administrators and relevant third parties who act in critical processes. Risk management follows the principles of proportionality, segregation of duties, traceability, information security, operational resilience, diligence in selecting and supervising third parties, and continuous improvement.

Risk categories

Risks are grouped, without prejudice to others that may be identified, into:

• technological and cyber risk;
• smart contract and protocol risk;
• custody, credentials and self-custody risk;
• market, liquidity and price risk;
• reserve, peg and redemption risk;
• operational and continuity risk;
• third-party and supply chain risk;
• legal, regulatory and compulsory enforcement risk;
• illicit activity, fraud and sanctions risk;
• reputational risk.

Risks to the user and to the operation

Virtual assets may have high volatility, risk of total loss, liquidity difficulties and abrupt price swings. Blockchain transactions may be irreversible after confirmation, with no practical possibility of cancellation or chargeback. Network congestion may increase fees and delay confirmations and settlements.

In self-custody, the user is solely responsible for safeguarding the recovery phrase (seed phrase) and private keys. Loss, exposure, destruction or improper sharing of this information may cause total and irreversible loss of the assets, with no technical possibility of recovery by Swapo.

Digital services are subject to incidents such as intrusion attempts, account takeover, phishing, social engineering, compromise of devices and email, and exploitation of flaws in software and integrations. These incidents may lead to improper access, unauthorized movements, changes to registration data and unavailability. SMS and email authentication may be affected by fraudulent SIM swap or by takeover of the email account. Apps from outside the official stores, malicious extensions and compromised devices may expose credentials.

Swapo and its critical providers may also suffer denial-of-service attacks, ransomware, cloud failures and supply chain incidents, with temporary unavailability and delays in settlement and support. Swapo adopts controls compatible with its risk profile, but there is no zero risk.

Computational advances, including quantum computing, may weaken the cryptographic algorithms used by blockchains, wallets and digital signatures. Smart contracts and integrations may contain vulnerabilities, oracles may be manipulated and bridges between networks may be attacked. Audits, testing and monitoring reduce, but do not eliminate, these risks.

A stablecoin's peg depends on the sufficiency, availability and liquidity of the reserve assets and on the issuance and redemption processes. Market events, operational failures, banking delays, regulatory restrictions or unavailability of reserves may cause queues, temporary limits, delays and loss of the peg, including abruptly. Reserves and operating accounts may be blocked by court, administrative or regulatory orders or by special regimes applicable to banks, custodians or payment institutions.

Changes in rules, regulatory interpretation or case law may require adjustments to the product, terms and operational flows. Swapo may apply restrictions, blocks and refusal of transactions to comply with legal and regulatory obligations and with the prevention of illicit activity, which may affect deadlines and the availability of certain operations.

User responsibilities

The user undertakes to:

• keep access credentials, recovery phrase and private keys confidential and under exclusive control, without sharing them with third parties;
• use secure devices and networks, with up-to-date anti-malware protection, avoiding unofficial apps and suspicious links;
• confirm Swapo's official channels before providing data, installing apps or following support procedures;
• acknowledge that blockchain transactions may be irreversible after confirmation and that scams may occur outside Swapo's environment.

Controls and mitigation

Depending on its model and risk profile, Swapo may adopt controls such as:

• strong multi-factor authentication as the default, prioritizing SIM-swap-resistant methods;
• anomaly and account takeover detection, with risk-based blocking and enhanced verification for sensitive actions, such as changes to email, phone, limits, recipients and devices;
• segregation of duties, approval authority levels and audit trails for critical operations;
• vulnerability management, system hardening, penetration testing and continuous monitoring;
• incident response and communication plan, with records and evidence preserved.

Swapo follows the evolution of cryptographic standards, with crypto agility guidelines: periodic review of dependencies, technology migration planning and assessment of network and contract alternatives, when technically feasible.

The policy provides for a risk matrix by probability and impact, reviewed by the Risk Committee according to the evolution of the product, volume, integrations, critical third parties and the regulatory environment, and a register of priority risks with category, assessment, mitigation and responsible area. These include account takeover and SIM swap, smart contract exploitation, account blocking or seizure, ransomware and unavailability of critical systems, regulatory change and cryptographic risk.

Incident response

Security incidents, unavailability, smart contract failures and events that affect reserves or peg are classified into four severity levels: critical, high, moderate and low. The minimum response flow, supplemented by internal procedures, provides for:

• detection and opening of a record, with date, time, initial evidence and scope;
• immediate containment;
• analysis and eradication of the cause;
• recovery of services, with integrity validation, reconciliation and enhanced monitoring;
• communication to users when necessary, to critical third parties, to the Risk Committee and to authorities, as applicable;
• post-incident report with root cause, impact, lessons learned, corrective actions, deadlines and owners.

Records, evidence and authorization trails must be preserved, with chain of custody of evidence and respect for privacy and legal requirements.

Review, approval and related documents

The policy must be reviewed at least once a year and whenever there is a material change in the product, technology architecture, critical providers or regulatory environment. Approval rests with Senior Management, with the Risk Committee informed. Periodic training must be given to critical areas.

The policy must be interpreted together with the Terms of Use, the Privacy Policy, the Risk Management Policy, the AML/CFT Policy and other applicable policies.

About this version

Public version of the document “Risk Management Policy (Risk Policy)”, dated September 21, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center