Travel Rule Policy

Objective

The Travel Rule is the obligation to collect, keep and transmit the originator (sender) and beneficiary information that accompanies a virtual asset transfer, to increase its traceability and transparency.

The policy establishes guidelines, procedures and controls to ensure the collection, validation, retention and transmission of this information. It is part of Swapo's AML/CFT program and must be applied together with the AML/CFT, KYC, KYB, KYT, information security and data protection policies.

Scope

The policy applies to all virtual asset transfers in which Swapo takes part, including on-chain sends and receipts, in domestic and international operations, with other virtual asset service providers and, where applicable, with self-custodied wallets.

As a principle, Swapo must apply the Travel Rule broadly, at least at the level required by the applicable rules. Where there is no regulatory clarity on thresholds or formats, the policy provides for a conservative, risk-based approach, in line with FATF guidance.

Principles

• Risk-based approach: controls proportional to the risk of the client, product, channel, jurisdiction, virtual asset, counterparty and transactional behavior.
• Integrity and traceability: complete, consistent and auditable data.
• Security and confidentiality: transmission over a secure channel, with encryption, access control and segregation of duties.
• Minimization and purpose: data processing limited to what is necessary to comply with legal and regulatory obligations and to prevent fraud, money laundering and terrorist financing, in accordance with the General Data Protection Law.

Information that accompanies the transfer

The policy defines the minimum content of the information for each transfer:

• Individual originator: full name, client or origin wallet identifier and one additional identifying data point, such as CPF or equivalent document, date and place of birth, or address.
• Legal entity originator: legal name, CNPJ where applicable, wallet identifier and, when required by the KYC or KYB process, representatives and ultimate beneficial owner.
• Beneficiary: full name or legal name and destination wallet identifier.
• Counterparty provider: institutional identification, such as name, jurisdiction and registration or license, when available.

Whenever possible, data must follow the IVMS 101 standard, an interoperability reference among providers.

Transfer steps

For outgoing transfers, the policy provides for these steps:

• classify the transfer as destined to another provider or to a self-custodied wallet;
• verify the counterparty provider;
• collect the data and check that it is complete, consistent and compatible with the client's registration;
• check sanctions lists, restrictive lists, politically exposed persons and jurisdiction risk;
• transmit the information over a secure channel, before or at the time of the transfer;
• execute the transfer only after these validations;
• record the information and keep an audit trail.

For incoming transfers, Swapo must match the information received to the transaction, check it against the expected data and the registration, and handle any discrepancies. Completion of the operation for the client depends on the conclusion of these controls.

Self-custodied wallets

For transfers involving self-custodied wallets, the policy provides for enhanced measures, chosen according to risk, such as:

• proof of ownership or control of the wallet, for example by message signing or a test transfer;
• collection of information about the holder, when the client transfers to a third party;
• proof of the origin or destination of funds, where applicable;
• limits, waiting periods or manual approval in high-risk cases;
• enhanced monitoring, including after the transfer.

Counterparties, exceptions and refusals

Swapo must keep a register of counterparty providers, with jurisdiction, supervisory regime, license or registration, reputation, technical capacity to exchange data and incident history. Automated operation must only occur with counterparties that meet the minimum risk standard and can send and receive the required information; for the others, mitigation measures apply.

Exception situations are: incomplete or inconsistent data, transmission failure, a counterparty that does not apply the Travel Rule, and suspicion of fraud, money laundering or terrorist financing. In these cases, the policy provides for:

• holding or pausing the transfer, when possible;
• requesting additional information from the client or the counterparty;
• analyzing the risk and deciding whether to release, release with mitigation measures, or refuse and block;
• recording the decision, the person responsible and the evidence;
• assessing the need to report to COAF (Brazil's Financial Intelligence Unit), in accordance with the AML/CFT policy.

A contingency plan for technology failures in the exchange of information is also provided.

Governance, records and privacy

The board of officers must approve the policy and ensure resources. The officer responsible for AML/CFT coordinates the program; the AML/CFT area defines risk criteria and oversees exceptions and blocks; the operations area executes the flows; the information security area is responsible for technical controls and incident management; the data protection officer handles privacy governance; and internal audit performs periodic and independent tests.

Registration records, messages exchanged, transaction identifiers, decisions and evidence must be kept for the minimum period set by law and regulation, or for a longer period when required by an authority, protected against alteration and improper access and available for supervision and audit.

The sharing of Travel Rule data is intended to comply with AML/CFT obligations and is based on legal and regulatory obligation. Encryption in transit and at rest, strong authentication, access restricted to need, access logs and contractual clauses on confidentiality and incident handling with providers and counterparties are provided for.

The operations, compliance, support and technology areas must receive initial and annual training on the policy.

Review and non-compliance

The policy must be reviewed annually or when there is a relevant regulatory or material event. Violations subject employees and providers to disciplinary and contractual measures and, where applicable, to reporting to the competent authorities.

Legal basis and references

• Law No. 14,478/2022 (provision of virtual asset services).
• Decree No. 11,563/2023 (competence of the Central Bank of Brazil).
• BCB Circular No. 3,978/2020 and related AML/CFT rules.
• Law No. 9,613/1998 (money laundering).
• BCB Resolutions No. 519, 520 and 521/2025.
• FATF Recommendation 16 (payment transparency) and FATF guidance on the risk-based approach for virtual assets and virtual asset service providers.
• IVMS 101 message standard, as an interoperability reference.

About this version

Public version of the document “Travel Rule Policy”, dated September 21, 2026, which is part of the authorization request filed with the Central Bank of Brazil. Authorization has not been granted yet.

This text summarizes the internal document. Personal data (LGPD), monitoring parameters and technical details whose disclosure would undermine security, fraud prevention and anti-money laundering efforts have been omitted, as have terms subject to business confidentiality (BCB Resolution No. 520/2025, art. 52, § 2). This version does not replace the service agreement or the applicable regulations.

All policies · Transparency Center