Policy on Relationships, Contracting and Contact with Liquidity Providers

Purpose, scope and principles

This policy sets rules for the selection, contracting, relationship, communication, monitoring, assessment and offboarding of the liquidity providers of Swapo, a virtual asset service provider company (SPSAV). A liquidity provider is the legal entity that supplies Swapo, directly or indirectly, with quotes, a counterparty, depth, execution, settlement or capacity to buy, sell or exchange virtual assets.

The policy seeks to ensure price integrity, liquidity adequate to execute client orders, secure execution with controlled counterparty and settlement risks, mitigation of conflicts of interest, traceability, prevention of market manipulation and money laundering, sanctions compliance, transparency to clients and regulatory compliance.

It applies to liquidity providers, over-the-counter (OTC) desks, brokers, exchanges and other virtual asset service providers in Brazil or abroad, financial and payment institutions used to source liquidity, aggregators and routing platforms, market makers, companies of the same economic group and related parties that supply liquidity, and technology providers of order execution, quoting, routing or settlement.

Principles:

• Full contractual formalization, with no operations based on a mere de facto relationship.
• Prior due diligence and periodic revalidation, with proven technical, operational and financial capacity.
• Provider's regulatory compliance in the jurisdictions where it operates, and transparency about corporate ties, ultimate beneficial owners and control structure.
• Settlement security.
• Prevention of conflicts of interest and a ban on undue informational, technical, operational or fee advantages.
• Auditable records of quotes, communications, orders, executions and settlements, and continuous monitoring of performance, price, exposure and risk.
• Swapo's full responsibility to clients and the Central Bank of Brazil (BCB) for operations carried out with contracted providers.
• Data protection, banking secrecy and confidentiality.

Selection, due diligence and approval

Before contracting, Swapo must carry out a formal selection process that assesses, at a minimum:

• Corporate formation, jurisdictions of incorporation and operation, and regulatory licenses and authorizations.
• Ultimate beneficial owners, control structure and governance.
• Reputation, history of regulatory sanctions and of administrative or judicial proceedings, and screening against national and international sanctions lists.
• Anti-money laundering and counter-terrorist financing policies.
• Operational, financial and settlement capacity in the relevant networks and currencies.
• Assets and pairs traded, liquidity depth, spread history, response time and service levels.
• Custody model, cybersecurity, business continuity, insurance and audit reports, when available.
• Relationship with Swapo's related parties, and legal and regulatory risk.

Due diligence includes a registration questionnaire, corporate documents and certificates, identification of officers and ultimate beneficial owners, proof of licenses, the provider's internal policies, information on custody, settlement, business model, pricing methodology and controls against manipulation, formal statements on conflicts of interest and ties to Swapo's related parties, and acceptance of clauses on cooperation with the Central Bank of Brazil, audit, and access to documents and premises. Due diligence must be revalidated at least annually or upon a corporate change, regulatory event, incident or relevant change in the business model.

Higher-risk providers or those with relevant volume undergo enhanced due diligence, with reinforced verification of ultimate beneficial owners, adverse media searches, identification of politically exposed persons, independent confirmation of licenses, analysis of litigation and sanctions exposure, understanding of the business model and the markets served, and analysis of the wallets used for settlement.

Contracting depends on the participation of Operations, Risk Management, Compliance, Legal, Information Security (when there is a technology integration) and the responsible officer. It goes to the Board of Officers or the competent committee when it involves a related party, a strategic or critical provider, a relevant concentration of risk, a higher-risk jurisdiction or volume above the internal limit.

Contracts

The contract with a liquidity provider must provide, at a minimum, for:

• Purpose, business model, and assets and pairs covered.
• Quoting method, pricing criteria, spreads and fees, quote validity and trading deadlines.
• Method of settlement and transfer of assets, permitted networks, and authorized wallets or accounts.
• Procedures for confirmation, cancellation and error handling, and settlement security criteria.
• AML/CFT/CPF and sanctions compliance obligations, confidentiality, data protection and secrecy.
• Service levels, incident management, business continuity and subcontracting rules.
• Audit rights, provision of documents and information to the Central Bank of Brazil, and access to the contractor's documentation, information and premises.
• Termination and transition rules, liability, indemnification, and a plan to recover positions and control assets in case of discontinuity.
• A ban on directly charging Swapo's clients, on informational advantage and on using client flow for the provider's own benefit, and rules to prevent conflicts of interest.

Contracts with market makers must prohibit informational or technical advantage, require them to act on equal terms with other participants, without distorting prices or quantities, and prohibit trades in Swapo's environment in which the counterparty is Swapo itself or companies of its conglomerate. They must also set minimum quote-quality parameters (maximum spread, minimum depth and time offers remain open), require information on quoting algorithms and mechanisms, and provide for suspension rules, audit records, cooperation with the Central Bank of Brazil and offboarding.

Contracts must be reviewed at least every 24 months, or sooner in case of a regulatory or business model change, or an audit recommendation.

Communication, quotes and settlement

Contact with providers may take place only through registered, auditable corporate channels with retention, such as the internal request-for-quote (RFQ) system, an approved API or platform, corporate e-mail and chat, recorded telephone and the ticketing system. Messaging apps and personal e-mail, ephemeral messages, unrecorded calls to close a transaction and unrecorded verbal communications are prohibited for operational contact.

Only formally authorized persons may contact providers on behalf of Swapo. The list of authorized persons must be reviewed at least quarterly, with immediate revocation upon departure or change of role.

Each operational contact must be recorded with date and time, operator, provider, asset, pair, quantity, side of the transaction, price, spread and costs, quote validity, settlement deadline and method, network used, counterparty risk, confirmation and proof of settlement.

In request-for-quote (RFQ) transactions, Swapo must record the client's request, consult enabled providers, record all quotes received, including rejected ones, compare price, quantity, validity, settlement and risk, select the best quote under an approved methodology, record the justification, obtain the client's acceptance when applicable, execute, settle and reconcile the transaction.

Settlement must occur exclusively in wallets and accounts previously registered and linked to the enabled provider, with checks before each settlement, recording of the transaction and reconciliation with the internal record of the transaction.

Related parties, conflicts and prohibitions

A provider that is a related party of Swapo is subject to reinforced controls: formal declaration of the tie, approval by an independent body, comparison with unrelated providers, documented economic justification, monthly monitoring of prices, spreads and execution quality, periodic review by Compliance, a ban on exclusivity without a formally approved justification, and notice to the client when the tie may affect price, liquidity, execution or counterparty risk.

In dealings with providers, it is prohibited to:

• Close a transaction or transmit sensitive information through an unauthorized channel, or negotiate verbally without a record.
• Share client flow or lists of transactions without operational need and a contractual basis.
• Grant a provider an informational, technical, operational or fee advantage.
• Accept a personal benefit, compensation, commission or rebate that is not contracted.
• Change the price after acceptance without a recorded justification, or execute a transaction at an artificial price.
• Steer transactions out of personal interest or conceal a relationship with a related party.
• Use a provider that is not approved, is sanctioned or has an indication of pending sanctions.
• Split a transaction to circumvent internal or regulatory limits.
• Allow the provider to directly charge Swapo's clients for a service for which Swapo is responsible.

Operators may not accept gifts or benefits beyond the limits of the Conflict of Interest Policy, nor take part in trips or events paid for by a provider without prior authorization from Compliance. They must declare any family, corporate or economic relationship with providers or their representatives.

Monitoring, limits and incidents

Swapo must monitor each provider at least monthly, considering volume and concentration, average price relative to a market reference, average spread, response time, requote and failure rates, cancellations, settlement delays, incidents, sanctions or AML/CFT/CPF alerts, corporate changes, client complaints, out-of-band transactions, transactions with related parties, operational dependency and contract compliance. The results go in a monthly report to the responsible officer and the Risk Committee.

Risk Management must set limits per provider (volume, per asset, per pair, per transaction, unsettled exposure, failures and concentration), reviewed at least every 12 months. Excesses require prior approval and are recorded as exceptions.

Each provider must have a counterparty risk assessment and classification, with proportionate limits, monitoring and review frequency. Concentration limits per provider, economic group, jurisdiction, asset and pair prevent excessive dependency. For higher-risk providers, Swapo may reduce limits, shorten settlement deadlines, require prefunding or collateral, and move flow to lower-risk providers.

Settlement failures or delays, divergent prices, errors in asset, network or wallet, prolonged unavailability, breach of service level, suspected manipulation, money laundering or involvement with sanctioned addresses, information leaks, security failures, insolvency and regulatory restriction of the provider are relevant incidents. They must be recorded, classified, handled and, where applicable, reported to the Central Bank of Brazil, COAF (Brazil's Financial Intelligence Unit) and other authorities.

Suspension, offboarding and continuity

A provider may be suspended or offboarded, among other cases, for relevant contractual breach, serious or recurring operational failure, regulatory, sanctions or reputational risk, recurring settlement failures, repeated off-market prices, refusal to provide information or cooperate with audit, Compliance or the Central Bank of Brazil, an uncommunicated corporate change, an unmitigated conflict of interest, an unaddressed security incident, breach of AML/CFT/CPF obligations, insolvency, or the provider's own request.

Offboarding follows a documented transition plan, covering handling of ongoing transactions, settlement of pending items, return of assets and retention of records.

The policy provides for a specific continuity plan for the provision of liquidity, integrated with the business continuity plan, with mapping of each provider's criticality, substitute providers previously assessed and contracted for contingency, activation procedures, maximum recovery times, communication with affected clients and regulatory reporting. The plan must be tested at least annually with a simulated discontinuity of a critical provider. Each relevant provider must have a documented exit plan.

Responsibilities, records and training

• Operations: operational communication, order execution and transaction recording.
• Risk Management: limits, counterparty assessment, monitoring and validation of exceptions.
• Compliance: conflicts of interest, AML/CFT/CPF, sanctions and regulatory adherence.
• Legal: contract review and legal support.
• Information Security: technology assessment of APIs and integrations.
• Internal Controls: tests at least semiannually on due diligence, channels, records, related parties, limits, quotes, settlement and offboardings.
• Internal Audit: full review of the liquidity provider management process in the annual plan.
• Board of Officers: approval of strategic providers, related parties and relevant exceptions, and appointment of the officers responsible to the Central Bank of Brazil.

Swapo must keep records of due diligence, approvals, contracts, quotes sent and received, communications, orders, executions, settlements, incidents, monitoring and offboardings for the legal and regulatory periods, with a minimum of 10 years for foreign-exchange-related transactions.

The policy provides for a formal process for the regulatory obligations relating to providers, including communications to the Central Bank of Brazil required by regulation, periodic information on virtual asset transactions, reporting of relevant events and responding to supervisory requests.

The employees involved must receive training at least annually on channels, records, prohibitions, related parties, conflicts of interest, fraud, market manipulation, AML/CFT/CPF, secure settlement and incidents, with assessment and records kept for at least 5 years. Breach of the policy subjects the offender to the sanctions of the Conflict of Interest Policy, without prejudice to other applicable measures.

Review and effective date

The policy must be reviewed at least every 24 months, or sooner in case of a relevant regulatory change, change of a critical provider, material incident, change in the liquidity model, audit recommendation or determination by the Central Bank of Brazil. Cases not covered are resolved by the responsible officer, after consulting Compliance, Risk and Legal.

The policy took effect on the date of approval, September 21, 2026.

Legal basis

• Law No. 14,478/2022 (provision of virtual asset services).
• BCB Resolutions No. 519/2025, No. 520/2025 (in particular the rules on contracting relevant services, liquidity providers and market makers) and No. 521/2025.
• BCB Resolution No. 277/2022, when there is a foreign exchange component, and BCB Normative Instruction No. 693/2025.
• Law No. 9,613/1998 and AML/CFT/CPF regulation.
• Complementary Law No. 105/2001 (banking secrecy).
• Law No. 13,709/2018 (General Data Protection Law).
• CMN Resolution No. 4,893/2021 and BCB Resolution No. 85/2021, as applicable, regarding relevant technology services.
• FATF recommendations for virtual asset service providers.
• Swapo's Policy on Identification, Prevention and Mitigation of Conflicts of Interest and Internal Controls Policy.

About this version

Public version of the document “Policy on Relationships, Contracting and Contact with Liquidity Providers”, dated September 21, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center