CRYPTOWALLET AML POLICYESTX SPÓLKA Z OGRANICZONA ODPOWIEDZIALNOSCIA ( also: Estx sp. z o.o.)is a company
incorporated in Poland with company registration number 0001039709 and a registered address at Romana
Dmowskiego 3 / 9, 50-203 Wrocław, Polska (hereinafter referred to as “Company” or “CryptoWallet”). Company
is aware of its corporate duty to assist the fight against anti-money laundering, corruption and against the fundingof terrorism.
1. GENERAL TERMS
1.1. VERSION CONTROL
VersionCreation date

AuthorReviewed byApproved by

Date

V1

01.02.2024

Legal department

AML department

MLRO

01.04.2024

11.2. POLICY SCOPE
1.2.1.
This policy applies to all employees, officers, directors, contractors, and agents of CryptoWallet. Itestablishes the framework and guidelines for preventing and detecting money laundering and terrorist
financing activities within CryptoWallet's operations.
1.2.2.
Security measures within the meaning of this code of conduct are remedies used in economic activities byCompany to:
1.2.2.1.
define the party to a transaction or an operation;
1.2.2.2.
achieve necessary due diligence in turnover;1.2.2.3.
avoid fraud, mistakes or other abuse;
1.2.2.4.
appropriately fulfil any obligations laid down in law or other regulations.
1.3.
1.3.1.
1.3.2.
1.3.3.
1.3.4.
1.4.
1.4.1.

1.4.2.

1.5.
1.5.1.

1.5.2.

REGULATORY FRAMEWORKThis AML policy is designed to comply with all relevant laws, regulations, and guidelines pertaining toanti-money laundering and counter-terrorist financing, including but not limited to:
Polish Money Laundering and Terrorist Financing Prevention Act
https://mf-arch2.mf.gov.pl/documents/764034/1010418/ustawa+tekst_EN+_15062018-f+_16072018.pdf
6th EU Anti-Money Laundering Directive 2018/1673
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018L1673
The Financial Action Task Force (FATF) Recommendations
https://www.fatf-gafi.org/en/topics/fatf-recommendations.html
BUSINESS CORE DETAILS
Estx sp. z o.o. is a registered virtual assets service provider by the Polish Tax Administration, authorized
to provide virtual currency services (Authorisation No. RDWW-1134 – VASP registy:
https://www.slaskie.kas.gov.pl/izba-administracji-skarbowej-w-katowicach/zalatwianie-spraw/rejestr-dzial
alnosci-w-zakresie-walut-wirtualnych)
CryptoWallet offers a range of products and services in the cryptocurrency industry. These include acryptocurrency exchange platform, digital wallet solutions, and crypto prepaid card solutions.
CryptoWallet caters to individuals and businesses looking to explore cryptocurrencies and blockchain
technology. Loading methods encompass fiat-to-crypto and crypto-to-crypto, crypto-to-fiat transactions.
While CryptoWallet is primarily operating from Poland, it has the legal capacity to onboard clients fromother countries, free from any limitations imposed by EU or Poland regulations.
DEFINITIONS
Money laundering means the concealment of the true nature, origin, location, manner of disposal,
relocation or right of ownership of property acquired as a result of a criminal activity or property acquired
instead of such property or the concealment of other rights related to such property; conversion, transfer,acquisition, possession or use of property derived from criminal activity or property obtained instead ofsuch property for the purpose of concealing or disguising the illicit origin of the property or of assisting
any person who is involved in the commission of such an activity to evade the legal consequences of that
person’s actions. Money laundering is regarded as such also where a criminal activity which generated theproperty to be laundered was carried out in the territory of another country.
Terrorist financing means the allocation or collection of funds to plan or commit terrorist acts within themeaning of the Penal Code or finance terrorist associations or knowing that these funds will be used forthe purpose.

21.5.3.

1.5.3.1.
1.5.3.2.
1.5.3.3.
1.5.3.4.
1.5.3.5.
1.5.3.6.
1.5.3.7.
1.5.3.8.
1.5.3.9.
1.5.3.10.
1.5.3.11.
1.5.3.12.
1.5.3.13.
1.5.3.14.
1.5.4.
1.5.5.
1.5.6.

1.5.7.

1.5.8.

1.5.9.

2.

Politically exposed person means a natural person who performs or has performed prominent public
functions, also the family members and persons known to be close associates of such a person. A person
who has not performed prominent public functions for at least one year prior to the date of the transaction
is not to be deemed a politically exposed person, nor the family members and persons known to be close
associates of such person. For the identification of a politically exposed person, public search systems,
national and international public databases of politically exposed persons and technical solutions offeredby service providers are used. Persons performing prominent public functions within the meaning of thisguide of conduct are:head of State or head of government, minister, deputy minister or assistant minister;member of a legislative body;a justice of a supreme court, constitutional court or another court the judgments of which can be appealed
against only in exceptional circumstances;a member of the supervisory board of a state audit institution or central bank;ambassador, chargé d’affaires and high-ranking officer;
a member of a directing, supervisory or administrative body of a state company. The term includes
positions in the European Union and other international
companies.
A family member of a person performing prominent public functions:
their spouse;a partner equal to a spouse under the law of the person’s country of residence or a person who as of thedate of carrying out the transaction had shared the household with the person for no less than a year;
their children and their spouses or partners;
their parents;
A close associate of a person performing prominent public functions is:a natural person who has a close business relationship with a person performing prominent public
functions or with whom a person performing prominent public functions is the joint beneficial owner of alegal person or contractual legal arrangement;a person who as a beneficial owner has full ownership of a legal person or contractual legal arrangement,
which is known to have been founded for the benefit of the person performing prominent public functions.
International financial sanction means a financial sanction that fully or partially prevents the subject of aninternational financial sanction using and disposing of financial means and economic resources or giving
thereof to its possession.
Subject to international sanction means a natural or legal person, an authority, a civil law partnership or
any other entity which is directly specified in the act on the imposition or implementation of internationalsanctions and with regard to whom the measures prescribed therein are taken.
Money Laundering and Terrorist Financing Prevention Act regulates the activities of credit and financial
institutions and other undertakings and institutions stipulated in the Money Laundering and Terrorist
Financing Prevention Act, as well as the activities of the Financial Intelligence Unit in preventing money
laundering and terrorist financing.
Money Laundering Officer is an employee appointed by the decision of the management board of theundertaking who is the MLRO with the Financial Intelligence Unit and ensures the implementation of themeasures established to prevent money laundering and terrorist financing in the institution. The MLRO
appointed by the board is Aleksei Arno.
Senior Manager/Responsible person is an employee appointed by the decision of the management boardof the undertaking who is the responsible person with the Financial Intelligence Unit and ensures that theinstitution that appointed them fulfils the requirements of the International Sanctions Act. The responsible
person appointed by the board is Aleksei Arno.
Client is a person who uses or has used a single service or multiple services provided by the institution
based on a contract concluded by CryptoWallet.
SENIOR MANAGEMENT AND RESPONSIBLE PERSON

3

2.1.

2.2.
2.2.1.
2.2.2.
2.2.3.
2.2.4.
2.2.4.1.
2.2.4.2.
2.2.4.3.
2.2.4.4.
2.2.5.

2.2.6.

2.2.7.

3.
3.1.
3.2.
3.2.1.
3.2.2.
3.2.3.
3.2.4.
3.2.5.
3.2.6.
3.2.7.
3.2.8.

Within CryptoWallet, it is the duty and authority of senior management to appoint a designated individual
to assume the role of the Responsible Person/Senior Manager. The Responsible Person is bestowed with
explicit duties and responsibilities concerning the proficient and effective administration of
CryptoWallet's operations. The responsible person appointed by the Senior Management and board isAleksandr Smirnin.
The duties of the Senior Manager/Responsible Person are:prepare a formal policy statement that outlines CryptoWallet's commitment to the prevention and risk
assessment of money laundering and terrorist financing activities;
check the client if the amount of the transaction exceeds 50,000 euros and if there are changes in the
management bodies, owners, or representatives. If the client is a legal body, their representative, membersof management bodies and actual beneficiaries must be checked;
check the entire client base and automated monitoring systems at least once a month.
In accordance with the International Sanctions Act, the responsible person collects and preserves for five
years the following information:
inspection time;
the name of the inspecting person;
results of the inspection;measures taken.
If there is a doubt whether a person with whom Company is in business relations or is making atransaction or carrying out an act, as well as a person intending to create business relations, make atransaction or carry out an act, is the subject of international financial sanction, additional, informationmust be requested from the respective person to determine whether these suspicions are correct.
If a person with whom Company is in business relations or is making a transaction or carrying out an act,
as well as a person intending to create business relations, make a transaction or carry out an act, refuses toprovide additional information or it is impossible to identify by means thereof if the person is a subject ofinternational financial sanction, the person having specific obligations or a person authorized by themrefuses to make a transaction or operation, takes measures provided for in the act on the imposition or
implementation of international financial sanction and notifies immediately the Financial Intelligence Unit
and the management board of Company of their doubts and of the measures taken.
If the activity of a person does not fully qualify as an activity that must be reported to the Financial
Intelligence Unit, according to these instructions, the client’s further activity must be taken underincreased attention. The Financial Intelligence Unit must be notified as soon as there is a reasonablesuspicion of suspicious behaviour by the client.
MONEY LAUNDERING REPORTING OFFICER
The Senior Management is responsible to appoint a designated individual to serve as the Money
Laundering Reporting Officer (MLRO). The MLRO is entrusted with specific duties and responsibilities
related to the detection and prevention of money laundering activities within CryptoWallet.
The duties of the Money Laundering Reporting Officer are:checking compliance with anti-money laundering requirements and regulations;transferring of information to the Financial Intelligence Unit in case of suspicion of money laundering or
terrorist financing or other illicit activity;
responding to requests made by the Financial Intelligence Unit and complying with its orders;collection of data received on suspicious and/or unusual operations and processing and storage of suchdata either in a designated electronic file or on paper, in which the details of the suspicious or unusualtransaction, data provider, date and place can be seen;
submitting periodic written reports to the management board on compliance with procedural rules;
informing the management board in writing about deficiencies in compliance with internal control
regulations, guidelines, and other legislation.
commissioning an annual report and promptly addressing any identified deficiencies outlined in thereport.
provide regular updates on system and control performance issues to interested third-party providers if
such sharing is not restricted by applicable laws and regulations.

4

3.3.
3.3.1.
3.3.2.
3.3.3.
3.3.3.1.
3.3.3.2.
3.3.3.3.
3.3.3.4.
3.3.4.
3.3.4.1.
3.3.4.2.
3.3.4.3.
3.3.5.
3.3.6.

The rights of the MLRO are:checking transactions and their formalization in accordance with the legislation
during the provision of the service, monitoring of activities to ensure their compliance with activities toprevent money laundering and terrorist financing.
The MLRO may only transmit information or data that has become known to them in connection withsuspected money laundering:to the management board and the employee appointed by the board;
Financial Intelligence Unit;
to the preliminary investigation authority in connection with criminal proceedings;
to the court based on a court order or decision.
Regarding suspicious or unusual transactions, the following information is recorded in a format which canbe reproduced in writing:details of a suspicious or unusual transaction;
person(s) involved in the transaction;
date and location of the transaction.
Notifications prepared by the MLRO are stored, used and preserved analogously to other information inaccordance with the provisions of this policy.
CryptoWallet is committed to cooperating with regulatory authorities and supporting the fight against
financial crimes, including money laundering and terrorist financing. As part of this commitment,

4.
RISK ASSESSMENT OVERVIEW
CryptoWallet is dedicated to conducting comprehensive risk assessments to identify, evaluate, and manage
risks associated with its activities and client activities. Set of rules provide an overview of the risk
assessment framework to address potential threats, including money laundering, terrorist financing, fraud,cybersecurity, and other risks related to the crypto industry.
4.1.
4.1.1.
4.1.1.1.
4.1.1.2.
4.1.1.3.
4.1.1.4.
4.1.2.
4.1.2.1.
4.1.2.2.
4.1.3.

4.1.4.

4.1.5.

RISKS ARISING FROM THE ACTIVITIES OF CryptoWallet.
CryptoWallet prepares a risk assessment to identify, evaluate and analyses the money laundering andterrorist financing risks associated with its activities, considering at least the following risk categories:
client-related risks;
risks related to countries or geographic areas or jurisdictions;risks related to products, services or transactions;risks related to the communication or mediation channels between CryptoWallet and clients or thedelivery channels for products, services, or transactions.
As a result of the risk assessment, CryptoWallet determines:
risk appetite, including the volume and scope of products and services offered in the course of business;risk management model, including enhanced due diligence measures to mitigate identified risks.
Risk appetite is a set of risk levels and risk types that CryptoWallet is willing to take in order to realize its
economic activities and strategic goals and which is confirmed in writing by the senior management of
CryptoWallet. The implementation of the above must take into account the risks that CryptoWalletis
willing to take or that it wants to avoid in relation to its economic activities, as well as qualitative andquantitative compensation mechanisms, such as planned income, measures implemented using capital orother liquid assets, or other circumstances, such as reputational risks and legal and other risks related tomoney laundering and terrorism financing or other unethical activities.
When applying the risk appetite, CryptoWallet determines as a minimum which person with whichcharacteristics it wants to avoid doing business with and in which cases it applies enhanced due diligencemeasures, including assessing the risks associated with such persons for CryptoWallet and determining
appropriate measures to mitigate these risks.
The risk assessment and determination of the risk profile are documented, and these documents are
updated on the basis of necessity and the published results of the national risk assessment. At the requestof the competent supervisory authority, CryptoWallet submits the documents prepared on the basis of thissection to the supervisory authority.

54.1.6.

4.1.6.1.
4.1.6.2.
4.1.6.3.
4.1.6.4.
4.1.6.5.

4.2.
4.2.1.
4.2.1.1.
4.2.1.2.
4.2.1.3.
4.2.2.
4.2.3.
4.2.4.

4.2.5.

4.3.
4.3.1.
4.3.2.
4.3.2.1.
4.3.2.2.
4.3.2.3.
4.3.2.4.
4.3.2.5.
4.3.2.6.
4.3.2.7.

CryptoWallet should discover that the law of a third country does not allow the application of procedural
rules and internal control standards that meet the requirements of the Money Laundering and Terrorist
Financing Prevention Act in its representative office, branch, or majority-owned subsidiary, it informs acompetent supervisory authority of such circumstances. The competent supervisory authority informs thecountries of the client and, if applicable, the European supervisory authorities, if, according to the first
sentence of this paragraph, it has become clear that the law of the third country does not allow the group
to implement procedural rules and internal control standards that meet the requirements of Directive (EU)2018/843 of the European Parliament and of the Council. In such cases, CryptoWallet. ensures theimplementation of additional measures in the respective representative office, branch, or majority-owned
subsidiary, which allow effective management of risks related to money laundering or terrorist financing
in other ways and notify the competent supervisory authority of the measures taken. In this event, thecompetent supervisory authority has the right to demand inter alia, by injunction, that CryptoWallet. andthe representative office, branch, or majority-owned subsidiary of CryptoWallet. do the following:
not establish new business relationships in that country;
terminate existing business relationships in that country;
suspend the provision of the service partially or completely;cease its activities;
implement other measures provided for in the regulatory technical standards established by the European
Commission on the basis of Article 45(7) of Directive (EU) 2015/849 of the European Parliament and of
the Council.
CLIENT RISK LEVELSFor the purposes of this policy, clients are classified and categorized based on the Client Risk Assessment
Policy, assigning them the following risk levels:
low risk clients;
moderate risk clients;
high-risk clients.
For all clients with low and moderate risk levels, CryptoWallet applies Client Due Diligence whenestablishing business relationships and in the course of business relationships.
CryptoWallet. may also apply enhanced due diligence to a client with a low and moderate risk levelshould the behaviour of the client or executed transactions cause doubts about the reliability of the client
and the purpose of using the services.
Special attention must be paid to a client with whom CryptoWallet is in business relations or is making atransaction or carrying out an act, as well as a person intending to create business relations, make atransaction or carry out an act, and whose actions and circumstances indicate the indirect possibility thatthe person is the subject of an international financial sanction.
If the sanction monitoring service provider's initial or ongoing screening identifies any direct association
between the client or/and a sanction regime, sanctioned individuals, or sanctioned companies, the client's
relationships with CryptoWallet. will be promptly terminated.
CLIENT DUE DILIGENCE (CDD)
Client due diligence (CDD) is a procedure conducted by CryptoWallet, aimed at confirming the client's
personal information and validating their personal identification documents.
CryptoWallet applies the following procedural rules every time before establishing a business relationshipand request client to provide the following information:
given name and surname;date of birthplace of birth;
telephone number and email
Nationality
address of place of residence;
document name, number, name of the issuing authority and date of issue

64.3.2.8.
4.3.3.
4.3.3.1.
4.3.3.2.
4.3.3.3.
4.3.3.4.
4.3.3.5.
4.3.4.
4.3.4.1.
4.3.4.2.
4.3.4.3.
4.3.5.
4.3.5.1.
4.3.5.2.
4.3.5.3.
4.3.6.
4.3.6.1.
4.3.6.1.1.
4.3.6.2.
4.3.6.3.
4.3.6.4.

4.3.7.
4.3.7.1.
4.3.7.2.
4.3.7.3.
4.3.7.4.
4.3.7.5.
4.3.7.6.

clarifies the purpose of the transaction and the nature of the business relationship and profession or
activity;
CryptoWallet. will deny an initial and further onboarding and reject conducting relationships:with a person who refuses to provide the data specified in the previous clause, as well as with a person
who the employee suspects to be a front;with a person, who does not submit the required documents and relevant information or if the employee
suspects, based on the submitted documents, that money laundering or terrorist financing may be
involved.
with a person, who has confirmed and direct connections with personal sanctions, sanctioned companies
or persons, sanctioned regions;with a person, who has confirmed and direct connections with money laundering, terrorism financing orother illicit activities.
with a person who does not comply with the age range of 18 to 65 years old
The following documents may be used to identify a natural person (should be valid at least 6 months):
a valid national identity card;a valid passport;
a valid national residence permit
CryptoWallet. possesses the authority to apply additional verification measures under the following
circumstances:
To verify the client's identity and meet the prerequisites for establishing a business association.
To offer an additional service provided by CryptoWallet..
When it is required to comply with contractual obligations between CryptoWallet. and third parties
service providers.
CryptoWallet. will request the following documents to comply with 3rd party contractual obligations,
governmental authority legal obligation or as additional measure of Customer Due Diligence:
Proof of address (e.g., gas, electricity, bank statement, governmental authority issued document) not older
than 3 months.
To utilize the Card Programme service, clients must fulfil a distinct condition by furnishing evidence of
their address prior to accessing the service. Failure to do so will result in the unavailability of the service
to the client.
Source of funds (bank statements, employment contract, loan agreement, property sale agreement) not
older than 3 months.
Source of wealth (business ownership, employment contract, gift documentation, investment portfolio).
Under certain requirements of the Card Programme, clients are mandated to submit Source of Funds andSource of Wealth information if their card transactions, encompassing purchases and ATM withdrawals,
surpass 25,000 EUR over a span of 12 months. CryptoWallet. will continually oversee the client's
expenditure and will conduct further Source of Funds/Source of Wealth assessments if the previously
gathered documentation does not align with the client's present spending patterns.
CryptoWallet. has the option to utilize reputable and specialized electronic service providers to obtain
technical identity data. Additionally, the company may choose to employ the following alternative
methods for verifying identity without relying solely on documentary evidence:
The company may independently verify the client's identity by cross-referencing the information provided
by the client with data obtained from consumer reporting agencies, public databases, or other reliable
sources.
The company may conduct reference checks with other institutions to confirm the client's identity.
The company may analyse the consistency of the identifying information provided by the client, including
their name, street address, postal code, and date of birth, to ensure logical coherence.
The company may utilize advanced techniques like "digital fingerprints" or IP geolocation checks to
identify and authenticate client devices
The company may require a notarized or certified true copy of a governmental authority-issued
identification document for valid identification purposes.
By incorporating these methods, the company aims to enhance its identity verification processes andensure the accuracy and reliability of client information.

7

4.3.8.
4.3.8.1.
4.3.8.2.
4.3.8.3.
4.3.9.

4.4.
4.4.1.

4.4.2.
4.4.2.1.
4.4.2.2.
4.4.2.3.
4.4.2.4.
4.4.2.5.
4.4.2.6.
4.4.2.7.
4.4.2.8.
4.4.2.9.
4.4.2.10.
4.4.2.11.
4.4.2.12.
4.4.3.
4.4.3.1.
4.4.3.2.
4.4.3.3.
4.4.3.4.

CryptoWallet. retains the right to conduct ongoing monitoring of its business relationship with a client,employing a risk-sensitive approach. This monitoring involves the following actions:
Periodically reviewing the documents, data, and information obtained by CryptoWallet. to ensure theircurrency and accuracy.
Diligently examining the Transactions and activities carried out by Clients to ensure their alignment with
CryptoWallet.'s understanding of the User's business and risk profile. Additionally, CryptoWallet. verifies
that such Transactions and activities are consistent with the User's declared sources of funds and wealth.
Identifying transactions that display unusually large amounts or exhibit patterns that deviate from thenorm, lacking any discernible economic or legal justification.
CryptoWallet. might apply Enhanced Due Diligence (EDD) measures instead or in additionally to Client
Due Diligence (CDD) procedures. Section 4.4 outlines the factors or events that may trigger theapplication of EDD measures.
ENHANCED DUE DILIGENCE
The purpose of this section is to provide guidance and direction for the application of enhanced due
diligence (EDD) measures in situations where a high risk is identified. EDD measures are additional
measures taken to verify a customer's identity and assess the legitimacy of their transactions and are used
when the risk of money laundering or terrorist financing is higher.
The Situations that require enhanced due diligence (EDD), but not exhaustive:
if the client is assigned a high-risk status as a consequence of the Customer Risk Assessment (CRA).
during the identification of the person or verification of the provided information there is doubt as to theaccuracy of the provided data or the authenticity of the documents;
a person using a professional service, or a client is related to a high-risk third country;
the nature of the situation entails a high risk of money laundering or terrorist financing.
at the discretion of a compliance specialist enhanced due diligence measures may be applied to mitigate
unknown risk associated with client.
possible involvement of politically exposed persons (PEPs) or their close associates, operation fromhigh-risk jurisdictions, or engaging in high-value transactions;significant changes in a client's risk profile, client account volumes or sources of funds;
regulatory updates or changes that mandate periodic or event-driven EDD reviews;
client is unable to provide adequate explanations or documentation for the source of their funds or wealth,or who’s financial activities are inconsistent with his known income or business activities;
Information suggesting client involvement in the illicit activities, associations with criminal organisations,or exposure to reputational risks.
engages in high-volume transactions (exceeding 10,000 EUR), and there is a significant abnormal
increasetransactions that involve complex structures or unusual patterns of behaviour.
In the aforementioned cases the company must apply the following enhanced due diligence measures:
Enhanced customer due diligence measures, which involve obtaining additional information about thecustomer, the customer's source of funds and source of wealth, and the customer's beneficial ownership.
Enhanced customer activity control measures, which involve requesting additional information or
documents regarding latest activity on client accounts or latest completed or initiated transactions.
Enhanced monitoring of transactions and client accounts, which involves more frequent and detailed
reviews of transactions, accounts activity and assessment of the connections with fraudulent, sanctioned
or illicit activities, entities or individuals.
Enhanced record-keeping, which involves maintaining additional records related to the customer and thetransactions conducted.

8

4.4.4.

After assessing the risks and their effects, CryptoWallet. evaluates the most appropriate countermeasures
to mitigate specific risks to the appropriate level for CryptoWallet. and arranges the implementation ofcountermeasures, if necessary. The risks associated with anonymity and fraud are avoided by identifying
persons by requiring the person concerned to provide a copy of an identity document and confirm its
authenticity. In addition, the person is asked to provide copies of utility bills showing the address of theirplace of residence as well as the connection of this address to this specific person. If the person does notprove the aforementioned facts or CryptoWallet. has doubts about the authenticity of the submitted
documents, no service will be provided to the person.

5.
5.1.

TRANSACTION MONITORING
Before engaging in any transaction, CryptoWallet. conducts thorough Know Your Client (KYC)
procedures and Customer Due Diligence and verifies the identities of the individuals or entities involved.
CryptoWallet. has integrated efficient systems and tools to ensure effective monitoring of cryptocurrencytransactions. These monitoring systems incorporate special software, blockchain analysis tools, and otherappropriate methods to identify any suspicious activities.
All transactions, both incoming and outgoing, shall be subject to monitoring to identify any suspicious or
potentially illegal activity.
CryptoWallet. conducts periodic client risk assessments to reassess the risk profile of clients. This will
involve reviewing their transaction history, monitoring their behaviour and activity patterns, and updatingrisk ratings accordingly.
Service Providers:
Sumsub offers advanced blockchain analysis and investigation tools to track and analyze cryptotransactions. It provides insights into initial and ongoing crypto transaction monitoring, transaction flow,
and identifies high-risk addresses. In addition to monitoring high-risk addresses, SUMSUB aims toprovide insights about the originators and beneficiaries VASPs (virtual assets service provider) of
cryptocurrency transfers. It analyzes transactional data and attempts to link wallet addresses to real-world
entities whenever possible. This could involve identifying the parties involved in a transaction, such as theindividuals or organizations associated with the cryptocurrency wallet addresses. Regarding sanctions
compliance, SUMSUB may also attempt to identify wallet addresses that originate from or haveconnections to sanctioned countries. By analyzing transactional data and applying known sanctions lists, it
can flag addresses that may be associated with individuals or entities in sanctioned jurisdictions.
Monitoring types
Manual monitoring entails a comprehensive and meticulous examination of client transactions to identify
suspicious or unusual activity. This process involves analyzing transaction patterns, account activities, thesource of funds, and other relevant factors to ensure compliance with AML-CTF regulations and identify
potential red flags. The aim is to detect any transactions that deviate from the established patterns or that
may indicate money laundering, terrorist financing, or other illicit activities. To achieve this, the Company
employs a risk-based approach, tailoring the level of scrutiny to the assessed risk level of the client andtransaction.
Frequency and Responsibility:
Daily Monitoring: Employees from the Compliance Team are responsible for conducting manual
monitoring on a daily basis. This ensures that any suspicious activity is promptly identified and acted
upon in a timely manner. The Compliance Team examines transactional behaviour, such as transaction
frequency, amounts, and types of transactions, to identify any unusual patterns or sudden changes that
may warrant further investigation.
Account Activity: Account-level analysis is performed to understand the overall financial behaviour of theclient. This includes reviewing incoming and outgoing transactions, the flow of funds, and the nature of
the client's interactions with other accounts.
High-Risk Indicators: The Compliance Team considers a range of high-risk indicators, such astransactions involving politically exposed persons (PEPs), clients from high-risk jurisdictions, andnon-face-to-face relationships, which may warrant enhanced due diligence and monitoring.

5.2.
5.3.
5.4.
5.5.
5.5.1.

5.6.
5.6.1.

5.6.1.1.
5.6.1.1.1.

5.6.1.1.2.
5.6.1.1.3.

9

5.6.1.1.4.

5.6.1.1.5.

5.6.2.

5.6.2.1.
5.6.2.1.1.
5.6.2.1.2.

Crypto Transaction Analysis: For clients engaging in crypto transactions, the Compliance Team
investigates the wallet addresses involved, transaction hashes, and the underlying purpose of the crypto
activity. Engaging in restricted actions, like employing privacy coins with active privacy functionalities or
intricate mixing services, results in the termination of associations with CryptoWallet..
Source of Funds: A critical element of manual monitoring is verifying the legitimacy of the source offunds for specific transactions. The Compliance Team investigates the origin of funds to ensure they alignwith the client's stated business or financial activities.
Automatic monitoring is a critical component of the CryptoWallet. Compliance framework, facilitating
real-time or near-real-time surveillance of transactions to swiftly detect patterns, deviations, or anomalies
that may signal potential risks or suspicious activities. The automated monitoring system employs
sophisticated algorithms and risk-based triggers to analyze vast amounts of transactional data, enabling
timely identification of suspicious behaviour and supporting proactive risk mitigation.
Ongoing Transaction Monitoring:
The automatic monitoring system provided by SUMSUB operates in real-time or near-real-time,
continuously scanning incoming and outgoing transactions across all channels and financial products
offered by the CryptoWallet..
The automatic monitoring system allows for swift identification of suspicious activity as it occurs,
enabling the Compliance Team to promptly investigate and take appropriate action.

5.6.2.2.
5.6.2.2.1.

Risk-Based Triggers and Alert Generation:
The automated monitoring system employs risk-based triggers, which are pre-defined parameters basedon the Company's risk assessment and regulatory requirements. Such as: Sanctions, Child Abuse, Material
Custom Address, Darknet Market, Decentralized Exchange, Contract Exchange, Fraud Shop, High risk
Gambling, High Risk Exchange, High Risk Jurisdiction, Illicit Actor-Org, Infrastructure as a Service
Lending Contract, Malware Merchant Services, Mining, Mining Pool, Mixing, Other P2P Exchange
Protocol, Privacy Ransomware, Sanctions Scam, Stolen Funds, Terrorist Financing

5.6.2.2.2.

These triggers generate alerts when transactions meet or exceed specified thresholds, deviate from
historical patterns, or match predefined suspicious activity indicators.
High-risk indicators, such as large transactions, rapid and frequent transfers, or transactions involving
high-risk jurisdictions, are included as part of the alert-generating mechanism.

5.6.2.2.3.

10

5.6.2.3.
5.6.2.3.1.
5.6.2.3.2.
5.6.2.3.3.
5.6.2.4.
5.6.2.4.1.
5.6.2.4.2.
5.6.2.4.3.
5.6.2.5.
5.6.2.5.1.

5.6.2.5.2.
5.6.2.5.3.
5.6.2.5.4.
5.6.2.5.4.1.
5.6.2.5.4.2.
5.6.2.5.4.2.1.
5.6.2.5.4.2.2.
5.6.2.5.4.2.3.
5.6.2.5.4.2.4.
5.6.2.5.4.2.5.
5.6.2.5.4.2.6.
5.6.2.5.4.2.7.
5.6.2.5.4.2.8.
5.6.2.5.4.2.9.
5.6.2.5.4.2.10.
5.7.
5.7.1.
5.7.1.1.
5.7.1.2.
5.7.1.3.

System-Generated Reports and Analysis:
In addition to real-time alerts, the automatic monitoring system generates comprehensive reports thatprovide a holistic view of transactional activities over a specific period.
These reports aid the Compliance Team in identifying trends, detecting emerging risks, and conducting
periodic reviews of transactional behaviour.
The analysis may involve data visualization techniques, anomaly detection algorithms, and trend analysis
to highlight potential areas of concern. Integration of Crypto Transaction
Monitoring:
The automatic monitoring system includes specialized tools and capabilities provided by key service
providers to monitor crypto transactions and wallets.
It tracks blockchain transactions, analyzes crypto addresses, and assesses potential risks associated withcryptocurrencies.
c. Crypto-related triggers, such as transactions involving privacy coins, mixing services, or suspicious
wallet activities, are integrated into the automatic monitoring system.
Travel Rule:
The travel rule applies to crypto assets transfers and crypto companies (VASPs). The rule requires these
institutions to collect and transmit specific information about their customers and the transactions theyfacilitate. CryptoWallet. is responsible for collecting and verifying this information from their customers
during the onboarding process and retaining it for the required period. They must also transmit thisinformation securely to the receiving CryptoWallet. or the next financial institution involved in thetransaction, ensuring that it accompanies the funds or assets being transferred.
CryptoWallet has used the solution from Sumsub Travel Rule Integration, that allows easily integratingtransaction monitoring, wallet screening, and Travel Rule compliance into our existing transaction andcompliance workflows and approvals.
The Travel Rule requirement, stipulating a 0 EUR Threshold, necessitates that all outgoing and incoming
cryptocurrency transactions shall be subjected to the Travel Rule procedure.
To comply with the Travel Rule regulations, CryptoWallet collects and transmits the following
information for each applicable transactions:
For incoming and outgoing transactions
When performing a transaction of exchange or transfer of virtual currency, the transaction initiator’s
provider of virtual currency service ascertains the identity of each customer, with respect to the initiator,
collects at least the following particulars:
Originator's Name: The name of the person or entity sending the funds.
Originator's Account Number: The account number or identifier associated with the sender.
Originator's Address: The address of the sender
Originator’s title and number of the identity document and personal identification code OR date and placeof birth and residential address/or registry code and country
Beneficiary's Name: The name of the person or entity receiving the funds (FATF recommendations are toensure the Sanction/PEP list screening of beneficiary is provided as well)
Beneficiary's Account Number or Wallet address: The account number or identifier associated with therecipient.
Beneficiary's Address: The address of the recipient
Transaction Amount and currency: The amount of funds being transferred.
Transaction Date: The date when the transfer was initiated.
Transaction Identificator: transaction hashTransaction risks related triggers.
Deposit:
Cardholder Name Discrepancy - The client provides a different name during the card payment step, which
does not match the information provided during Know Your Customer (KYC) verification.
IBAN Owner Name Mismatch - The name of the account (IBAN) owner provided by the client does notmatch the information provided during KYC verification.
Multiple Card Purchases - The client has utilized more than five different cards for payments throughout
their relationship with us.

11

5.7.1.4.
5.7.1.5.
5.7.1.6.
5.7.1.7.
5.7.1.8.
5.7.1.9.
5.7.1.10.
5.7.1.11.
5.7.1.12.
5.7.1.13.
5.7.1.14.
5.7.1.15.
5.7.2.
5.7.2.1.
5.7.2.2.
5.7.2.3.
5.7.2.4.
5.7.2.5.
5.7.2.6.
5.8.
5.8.1.
5.8.2.
5.8.3.
5.8.3.1.
5.8.4.
5.8.4.1.
5.8.4.2.
5.8.5.

Card Used by Different Clients - The same card has been used for payments on two different client
accounts.
Repeated 3DS Declines - We have received three consecutive declines of 3D Secure (3DS) authentication
codes for a particular transaction.
Multiple Cryptocurrency Purchases - The client has made several purchases of cryptocurrencies with fiat
currency within a very short timeframe.
High-Risk Country Transaction - The transaction originates from a country that is considered to be ahigh-risk location, either based on the bank card's location or the IBAN country.
High-Risk Transaction - The transaction has been flagged as high-risk according to SUMSUB, Fireblocks
Bank Antifraud Transaction Cancellation - The bank has declined the payment method (card) used by thecustomer due to fraud-related concerns.
Antifraud: 3DS Declined - The client's attempts to purchase cryptocurrency using various cards were
declined by the 3D Secure antifraud system.
Wallet Used by Multiple Clients - The same cryptocurrency wallet has been used for payments on two
different client accounts.
Crypto Travel Rule Declined - A withdrawal transaction was declined due to non-compliance with thecrypto Travel rule.
High-Risk Wallet - The recipient's cryptocurrency wallet address has been categorized as high or medium
risk based on a review conducted by SUMSUB.
Three or More Cards Used for Purchase - More than three different cards in succession have been used fora series of purchases in a single day.
Crypto Deposit Exceeding 10,000 EUR Equivalent.
Withdrawal:
Withdrawal to High-Risk Country - The withdrawal transaction is directed to a country deemed to behigh-risk, based on factors related to the card or IBAN issuing bank or the transaction's location.
High-Risk Transaction - The withdrawal transaction has been flagged as high-risk according to SUMSUB,
Fireblocks, or ClearJunction.
High-Risk Wallet - The client is withdrawing funds to a cryptocurrency wallet that has been identified as
high-risk by SUMSUB.
Wallet Shared by Multiple Clients - An attempt has been made to withdraw funds to an external addressthat is shared by another client.
High-Risk Person - The withdrawal transactions involve a person identified as high-risk, either from a listof sanctioned individuals or individuals with criminal records associated with money laundering andterrorist financing.
Crypto Travel Rule Declined - A withdrawal transaction was declined due to non-compliance with thecrypto Travel rule.
Escalation and Investigation of suspicious activity and Immediate Alert Notification:
The automatic monitoring system is designed to trigger real-time alerts when it detects transactions thatmeet predefined risk-based thresholds or exhibit suspicious patterns.
Designated members of the Compliance Team and the MLRO receive immediate notifications of thesealerts through secure and authenticated channels, ensuring swift attention to potential risks.
Comprehensive Transaction Details and Customer Profiles:
Upon receiving an alert, the automatic monitoring system provides the Compliance Team withcomprehensive transaction details, including transaction amounts, timestamps, involved parties, andrelevant transactional context.
Visualization:
The automatic monitoring system employs advanced data visualization tools that present transactions in auser-friendly format, facilitating a comprehensive understanding of transactional patterns andrelationships.
Graphs, charts, and interactive dashboards are utilized to display transaction flows and identify potential
clusters of suspicious activities.
Customer Enhanced Due Diligence (EDD):

12

5.8.5.1.
5.8.5.2.
5.8.6.
5.8.6.1.
5.8.6.2.
5.8.6.3.

5.8.6.4.
5.8.7.
5.8.7.1.
5.8.7.2.
5.8.7.3.
5.8.7.4.
5.8.7.5.
5.9.
5.9.1.
5.9.2.
5.9.3.
5.9.3.1.

5.9.3.2.
5.9.3.3.

5.9.3.4.
5.9.3.5.

If warranted by the nature of the alert or the client's risk profile, the Compliance Team initiates Enhanced
Due Diligence (EDD) procedures.
EDD involves a deeper examination of the client's background, including the source of funds, businessactivities, beneficial ownership, and any relevant political or high-risk connections.
Transaction Enhanced Due Diligence (EDD)
In cases where red flags or suspicious transactions are identified, CryptoWallet. is responsible to conductenhanced due diligence on the involved client and transaction.
EDD may involve gathering additional information about the transaction, the parties involved, and the
purpose of the transaction, such as financial questionnaire, source of funds and source of wealth.
If an involved party fails to meet the requirements of Enhanced Due Diligence (EDD), the designatedemployees must submit the investigation findings and gather information to the MLRO. This will initiate
further investigation and the preparation of a report for the Financial Intelligence Unit (FIU) andinterested third parties.
Any employee, contractor, or agent of the company who suspects or becomes aware of a transaction that
may be related to money laundering, terrorist financing, fraud, or other illicit activities must report it to
the designated MLRO.
Collaboration and Communication:
Throughout the investigation, the Compliance team collaborates closely with other relevant departments,
such as Legal and Management, to ensure comprehensive analysis and accurate decision-making.
Effective communication channels are established to share critical findings and coordinate actions
promptly.
Decision-Making and Reporting:Based on the results of the investigation, CryptoWallet. determines whether the flagged activity poses agenuine risk of money laundering, terrorist financing, or other financial crimes.
If warranted, the CryptoWallet. prepares a detailed Suspicious Activity Report (SAR) with all relevant
findings and submits it to the appropriate regulatory authorities in accordance with the prescribed
timeline.
Cryptocurrency and crypto wallets supporting policy.
CryptoWallet. maintains a steadfast dedication to furnishing a secure and dependable platform for clientsto engage in cryptocurrency and token trading, buying, and selling. To uphold the integrity of our platform
and safeguard our client base, we have implemented a comprehensive listing policy.
This AML policy's Attachment Nr. 1 includes the list of supported cryptocurrencies, which undergo
periodic review and adjustments based on demand and requirements.
Cryptocurrency listing requirements:
Transparency: Cryptocurrencies and tokens seeking listing on our platform must exhibit a high level oftransparency This includes Publicly identifiable development team with verifiable credentials. Clear andopen-source code to allow for community inspection. A well-documented whitepaper explaining the
project's purpose, technology, objectives, and use cases.
Legitimate Purpose: We strictly prohibit the listing of cryptocurrencies and tokens associated with any
illegal, fraudulent, or illicit activities. Projects should have a legitimate purpose within the blockchain andcryptocurrency ecosystem and contribute positively to the industry.
Anti-Fraud and Anti-Money Laundering (AML) Compliance: Each listing will undergo a comprehensive
SUMSUB check or similar blockchain analysis to ensure compliance with anti-fraud and AML
regulations. This involves: Verifying the blockchain contract and its direct connection with sanctioned
countries, entities, or individuals, confirmed connection with money laundering and other illicit activity.
Community and User Base: We value projects with a strong and active community as it indicates genuineinterest and support for the project. Cryptocurrencies and tokens with an established and engaged userbase will be given preference during the listing process.
Security and Stability: Projects seeking listing must demonstrate a secure and stable network
infrastructure. Any history of major security breaches or technological vulnerabilities may result inrejection.

13

5.9.3.6.
5.9.4.
5.9.4.1.
5.9.4.2.
5.9.4.3.
5.9.4.4.
5.9.4.5.
5.9.5.
5.9.5.1.
5.9.5.2.
5.9.5.2.1.
5.9.5.2.2.
5.9.5.2.3.
5.9.5.2.4.

5.9.5.2.5.
5.9.5.2.6.
5.9.5.2.7.
5.9.5.2.8.
5.9.5.2.9.
5.9.5.2.10.
5.9.5.2.11.
5.9.5.2.12.
5.9.5.2.13.
5.9.6.

Public Exchange Listing: Priority will be given to cryptocurrencies and tokens that are already listed on
reputable exchanges. Projects with a proven track record of successful listings on other platforms will beconsidered favourably.
Listing procedure:
Initial Review: The CryptoWallet. team will conduct an initial review of the listing application todetermine if it meets the basic listing criteria. Incomplete or misleading applications will be rejected at
this stage.
SUMSUB Check: After passing the initial review, the cryptocurrency or token will undergo acomprehensive SUMSUB check by CryptoWallet. to ensure compliance with anti-fraud and AML
regulations.
Community Evaluation: CryptoWallet. may involve the community in the evaluation process, seeking
feedback and opinions on the potential listing. While community input is valuable, the final decision rests
with CryptoWallet..
Approval and Listing: Once the cryptocurrency or token successfully meets all the listing criteria andpasses the SUMSUB check, CryptoWallet. will approve the listing, and it will be made available fortrading on its platform.
Ongoing Monitoring: After listing, CryptoWallet. will continuously monitor the supported
cryptocurrencies and tokens to ensure they maintain compliance with the AML policy. Projects found to
be in violation of any criteria may face delisting from our platform.
Prohibited cryptocurrency:
CryptoWallet. maintains a strict policy against supporting and listing any cryptocurrencies that fall under
the category of prohibited cryptocurrencies. As a responsible cryptocurrency platform, we do not endorse,
facilitate, or engage in any activities associated with prohibited cryptocurrencies.
Prohibited cryptocurrencies may include, but are not limited to, those involved in the following situations:
Illicit Activities: Cryptocurrencies associated with illegal activities such as money laundering, terrorism
financing, drug trafficking, or any other criminal endeavours.
Fraudulent Schemes: Cryptocurrencies linked to Ponzi schemes, pyramid schemes, or other fraudulent
activities designed to deceive investors.
Scam Projects: Cryptocurrencies tied to projects with no legitimate purpose, deceptive promises, or false
claims.
Privacy Concerns: Cryptocurrencies with enabled crypto privacy feature such as Monero (XMR) Zcash(ZEC) Dash (DASH) Grin (GRIN) Beam (BEAM) Horizen (ZEN) Komodo (KMD) Pirate Chain(ARRR). Whole list available on website: https://coinmarketcap.com/view/privacy/. Usage of these
cryptocurrencies is restricted and unavailable in conjunction with the CryptoWallet. service.
Hacking Incidents: Cryptocurrencies obtained through hacking, theft, or cyberattacks on exchanges orindividuals.
Market Manipulation: Cryptocurrencies involved in pump-and-dump schemes or other forms of market
manipulation. Non-Compliance with
Regulations: Cryptocurrencies failing to adhere to applicable legal and regulatory requirements, such as
anti-money laundering (AML) and know-your-customer (KYC) regulations.
Stolen Funds: Cryptocurrencies resulting from stolen funds or assets that were unlawfully obtained.
Controversial Content: Cryptocurrencies associated with illegal content, hate speech, or any form of
harmful and offensive material.
Sanctioned Entities: Cryptocurrencies issued or supported by entities or individuals subject tointernational sanctions or restrictions.
Vulnerable Smart Contracts: Cryptocurrencies built on insecure or flawed smart contracts that may beprone to hacks or exploitation.
High Volatility and Risks: Cryptocurrencies with extremely high volatility and no underlying value,
posing significant risks to investors.
Lack of Regulatory Compliance: Cryptocurrencies developed without considering or adhering toapplicable financial regulations and standards.
Prohibited crypto wallets.

145.9.6.1.
5.9.6.1.1.
5.9.6.1.2.
5.9.6.1.3.
5.9.6.1.4.
5.9.6.1.5.
5.9.6.1.6.
5.9.6.1.7.
5.9.7.
5.9.7.1.

5.9.7.1.1.
5.9.7.1.2.
5.9.7.1.3.
5.9.7.1.4.
5.9.7.1.5.
5.9.7.1.6.
5.9.8.
5.9.8.1.1.
5.9.8.1.2.
5.9.8.1.3.

5.9.8.1.4.
5.9.8.1.5.
5.9.8.1.6.
6.
6.1.

Prohibited crypto wallets is restricted to use with CryptoWallet. service and may include, but are notlimited to, those involved in the following situations:
Unhosted wallets or Untraceable Wallets: Wallets that allow users to remain completely anonymous or
obscure transaction history are prohibited in conjunction with the services provided by CryptoWallet..
Highly Privacy-Centric Wallets: Wallets that implement extremely strong privacy measures, such as
CoinJoin, Mimblewimble, or other privacy-focused technologies, are prohibited in conjunction with theservices provided by CryptoWallet..
Wallets Associated with Darknet Markets: Wallets used in connection with illegal marketplaces on thedark web are prohibited in conjunction with the services provided by CryptoWallet..
Decentralized Wallets with No Oversight: Wallets that function in a decentralized manner without any
oversight from a central entity are limited, if wallet could be screened and monitored, or restricted, if theiractivity cannot be monitored.
Wallets with Ties to Sanctioned Entities: Wallets linked to individuals, organizations, or countries subject
to international sanctions will be prohibited.
High-Risk Wallet Addresses: Wallets identified as having participated in fraudulent schemes, hacking
activities, or scams will be prohibited.
Wallets Facilitating Prohibited Token Sales: Wallets involved in the distribution of unauthorized securities
or tokens will be prohibited.
Prohibited activity
CryptoWallet. explicitly prohibits any association, financial dealings, connections, or direct interaction
with Defi platforms, cryptocurrencies and crypto wallets, as clearly delineated in articles 5.9.5 and 5.9.6of this policy. If any such prohibited activities are detected, the consequences will be severe and may
result in immediate and irreversible actions, including but not limited:
Initiating the Enhanced Due Diligence procedure for the concerned client.
Permanently freezing incoming or outgoing transactions related to the prohibited activities;
Conducting a thorough investigation in collaboration with the compliance team and CryptoWallet.'s
Money Laundering Reporting Officer (MLRO).
Disclosing relevant information to appropriate third parties.
Blocking the CryptoWallet. account associated with the prohibited activities, with no possibility of
restoration.
Filing a report with the Financial Intelligence Unit (FIU) in accordance with regulatory obligations.
Direct or indirect connection with High-Risk crypto wallets
The SUMSUB KYT ongoing monitoring of connections with high-risk triggers in the context of crypto
wallets can be categorised into two types: direct and indirect.
Direct Connection: This occurs when a crypto wallet is directly linked to addresses, transactions, or
entities that have been identified as high-risk, sanctioned, or prohibited as per the guidelines outlined inarticle 5.9.6.
Indirect Connection: This involves evaluating the services and entities involved in the origination ordestination of funds within transactions associated with the target address. The assessment takes into
account scenarios where non-service addresses are present between the target address and theaforementioned services or entities.
In cases where there is a confirmed and direct connection with a high-risk crypto wallet, CryptoWallet.
applies Enhanced Due Diligence to thoroughly investigate the source and origin of these funds.
For situations where a crypto wallet has an indirect connection with a high-risk wallet and the exposure
percentage does not exceed 20% of the total transaction sum, CryptoWallet. applies a red flag for further
scrutiny.
In all situations related sanctioned regions, PEP, sanctioned entities, sanctioned individuals, and triggers
as described in article 5.9.6, CryptoWallet. implements the measures specified in article5.9.7.
UNUSUAL ACTIVITY REPORT
CryptoWallet. is obliged to notify the Financial Intelligence Unit and interested 3rd parties of (i) activitiesor (ii) circumstances identified in the course of economic activity:15

6.1.1.
6.1.2.
6.1.3.
6.1.4.
6.2.
6.2.1.

6.2.2.

6.3.

which have characteristics that indicate the use of proceeds from criminal activity or the commission ofrelated criminal offences (primarily related to reporting of suspicious and unusual transactions or
activities).
which give rise to suspicion, or which are known to be money laundering or the commission of related
crimes, or the characteristics of which point to money laundering or the commission of related crimes(primarily related to reporting a suspected money laundering transaction or activity);
which give rise to suspicion, or which are known to be terrorist financing or the commission of related
crimes, or the characteristics of which point to terrorist financing or the commission of related crimes(primarily related to reporting a suspected terrorist financing transaction or activity);in the event of which there is a suspicion or knowledge of the need to apply an international financial
sanction
The Financial Intelligence Unit and interested 3rd parties must also be notified of the following:
the circumstances of refusing to establish a business relationship or an occasional transaction, if the basis
for the refusal is suspicion of money laundering or terrorist financing, or if CryptoWallet. is unable toapply the due diligence that must be applied when establishing a business relationship, because the client
does not or refuses to provide the relevant data, or the data provided is not sufficient to ensure theadequacy of collected data;
the extraordinary termination of the business relationship, if the business relationship is terminatedbecause it is not possible to apply the due diligence again as after a reasonable period of time
CryptoWallet. has still not been able to apply sufficient due diligence to exhaustively collect data, verify
the accuracy of data or eliminate money laundering or terrorist financing suspicion, or because the client
does not provide or refuses to provide the relevant data, or the data provided is not sufficient to ensure theadequacy of collected data (primarily reporting a suspicious and unusual transaction or activity).
The notifications specified in clauses 6.1 and 6.2 must be made before making a transaction, which gives
rise to suspicion, or which is known to be money laundering or terrorist financing or the commission ofrelated crimes and if such circumstances are detected before making the transaction. Given the speed withwhich money laundering and terrorist financing crimes are committed, fulfilling this pre-transaction
notification obligation may be appropriate in other cases as well. If postponing the transaction may causesignificant damage, not making the transaction is not possible, or may prevent the capture of a potential
perpetrator of money laundering or terrorist financing, the transaction is executed and then a report is
submitted to the Financial Intelligence Unit. To identify such circumstances, the obliged person is incontact with the Financial Intelligence Unit.

7.
7.1.

IMPOSING INTERNATIONAL SANCTIONS
The objective of the national imposition of international sanctions and the implementation thereof is, incompliance with the United Nations Charter, to maintain or restore peace, prevent conflicts, and reinforce
international security, support and reinforce democracy, follow the rule of law, human rights andinternational law and achieve other objectives of the common foreign and security policy.
of the European Union. An international sanction within the meaning of this code of conduct is a measure thatis not related to the use of armed forces, and which has been decided to be imposed by the European
Union, the United Nations, another international organization or the relevant state in order to achieve theaforementioned goal.
7.2.
Subject to international sanctions means a natural or legal person, entity or body which is directly
specified in the act on the imposition or implementation of international sanctions and with regard towhom the measures prescribed therein are taken.
7.3.
A person with special obligations, to whom the special obligations of the International Sanctions Act
apply is, among other things, a virtual currency service provider within the meaning of the Money
Laundering and Terrorist Financing Prevention Act.

16

7.4.

7.5.

7.6.

7.7.

7.8.

7.9.

7.10.
7.10.1.
7.10.2.
7.10.3.
7.10.4.
7.10.5.

CryptoWallet. (hereinafter also person with special obligations) takes measures to fulfil the resulting
obligations upon the entry into force of the legislation establishing or implementing an international
financial sanction and demonstrates the diligence necessary to ensure the achievement of the goal of theinternational financial sanction and to avoid breach of the sanction. A natural or legal person who has asuspicion or who knows that a person with whom they have a business relationship or are making atransaction or operation with, as well as a person with whom they are planning to establish a business
relationship or make a transaction or operation, is subject to an international financial sanction,
immediately notifies the Financial Intelligence Unit of the identification of the subject of the international
financial sanction, the relevant suspicion and the measures taken.
CryptoWallet. places significant emphasis on the conduct of individuals and entities involved in its
economic activities, including those with whom it maintains business relations, conducts transactions, or
engages in any form of business. The company also considers individuals who intend to establish business
relations, conduct transactions, or engage in any business-related activities. Additionally, CryptoWallet.
considers circumstances that suggest the possibility that a person may be subject to international financial
sanctions. The company actively strives to mitigate any potential legal consequences and reputationalrisks associated with its interactions with sanctioned individuals. In line with its commitment tocompliance, CryptoWallet. promptly terminates relationships and initiates further investigations upon theconfirmation of any suspicions. The company strictly adheres to the policy of not engaging in any
dealings with sanctioned individuals.
CryptoWallet. periodically monitors the website of the Financial Intelligence Unit and immediately takes
the measures provided for in the legislation establishing or implementing the international financial
sanction in order to ensure the achievement of the goal of the international financial sanction and toprevent breaches of the international financial sanction.
Upon entry into force, amendment, invalidation or expiration of an international financial sanction
legislation, CryptoWallet., as a person with special obligations, immediately checks whether the personwith whom it is in business relations or is making a transaction or carrying out an act, as well as a person
intending to create business relations, make a transaction or carry out an act, is the subject of theinternational financial sanction imposed, amended or lifted.
If the legal act establishing or implementing an international financial sanction is declared invalid, it
expires, or it is changed in such a way that the application of the international financial sanction to thesubject of the international financial sanction is lifted in whole or in part, CryptoWallet., as a person withspecial obligations, immediately ceases the implementation of the measure to the extent provided for in
the act on the imposition or application of the international financial sanction.
CryptoWallet. establishes in writing or in a format which can be reproduced in writing procedural rules
for the implementation of an international financial sanction and the fulfilment of the obligations arisingfrom the respective law and procedure for checking the compliance with these procedural rules andappoints the person responsible for the implementation of the international financial sanction, whose
contact details he forwards to the supervisory authority.
According to the International Sanctions Act, persons with special obligations must carry out additional
due diligence to identify situations when international financial sanctions must be applied. To this end, thenamed persons must:
exercise extra diligence with respect to the client and the circumstances of the transaction (including theother party to the transaction) when establishing a business relationship and conducting transactions;credit and financial institutions pay attention to all parties and circumstances of the transaction (including
goods) in trade finance transactions to ensure enforcement of international sanctions;monitor the information on sanctions in their activities and the corresponding lists on the website of the
Financial Intelligence Unit;
notify the Financial Intelligence Unit of the identification of a subject of the financial sanction and theimplementation of a financial sanction on the basis of such information;collect additional information (including from the Client) if there is a suspicion that a person is subject tofinancial sanctions;17

7.10.6.

7.10.6.1.
7.10.6.2.
7.10.6.3.
7.10.6.4.
7.10.6.5.
7.10.7.

7.10.8.

7.10.9.

7.10.10.
7.10.10.1.
7.10.10.2.
7.10.10.3.
7.10.10.4.
7.11.

7.12.

7.13.

in the event of there still being a suspicion of financial transaction regarding the person or thecircumstances of the transaction and the other party after collecting additional information, notify the
Financial Intelligence Unit of the suspicion (also if additional information cannot be collected), whilerefusing to make further transactions and/or establish a business relationship;
notify the Financial Intelligence Unit of the refusal to establish a business relationship;
inform the Financial Intelligence Unit of a suspicion that a person is under the direct or indirect control ofa subject to international sanctions;have the procedural rules and MLRO necessary for the implementation of the financial sanction;
carry out checks to identify financial sanctions;store data related to financial sanction suspicions, implementations and corresponding controls.
Upon identification of the subject of international financial sanctions, it is necessary to identify themeasures established to sanction this person. The measures to be taken are described in the legislation
establishing the sanction, so the exact sanction imposed on the person must be identified in order toensure the legal and correct implementation of the measures.
All other persons must show due diligence in the course of their activities in order to identify the need forthe implementation of an international financial sanction. A natural who has a suspicion or who knowsthat the person with whom it is in business relations or is making a transaction or carrying out an act, as
well as a person intending to create business relations, make a transaction or carry out an act, immediately
notifies the Financial Intelligence Unit of the identification of the subject of the international financial
sanction, the relevant suspicion and the measures taken.
The Financial Intelligence Unit will check the application of the financial sanction within 10 working
days from the receipt of the notification, including whether the subject of the financial sanction has beencorrectly identified and whether the measures have been taken legally, and then inform the person that
submitted the notification about the result of the inspection within 2 working days.
A person with special obligations collects and preserves for five years the following information:
inspection time;
the name of the inspecting person;
results of the inspection;measures taken.
If a person with special obligations or a person authorized by them doubts whether a person with whom it
is in business relations or is making a transaction or carrying out an act, as well as a person intending tocreate business relations, make a transaction or carry out an act, is the subject of an international financial
sanction, they ask additional information from that person for the identification of said fact. If a person
who is in business relations or is making transactions or is carrying out acts with the person having
specific obligations, as well as a person who intends to create business relations, make a transaction or
carry out an act, refuses to provide additional information or it is impossible to identify by means thereof
if the person is a subject of international financial sanction, the person having specific obligations or aperson authorized by them refuses to make a transaction or act, takes measures provided for in the act on
the imposition or implementation of international financial sanction and notifies immediately the
Financial Intelligence Unit of their doubts and of the measures taken.
Upon entry into force of an act on the imposition or implementation of international financial sanctions
the employees of CryptoWallet. take measures to fulfil the obligations arising therefrom and demonstratedue diligence to ensure the achievement of the objective of the international financial sanction and avoid
breach of the sanction.
An employee of CryptoWallet. who has doubts or who knows that a person with whom CryptoWallet. is inbusiness relations or is making a transaction or carrying out an act, as well as a person intending to createbusiness relations, make a transaction or carry out an act, is a subject of international financial sanction,
immediately notifies the Financial Intelligence Unit of the identification of the subject of international
financial sanction, of the doubt thereof and of the measures taken.

187.14.

7.15.

7.16.

7.17.

7.18.
7.19.
7.19.1.
7.19.2.
7.19.3.
7.19.4.
7.19.5.
7.19.6.
7.19.7.
7.19.8.
7.19.9.
7.19.10.
7.19.11.
7.19.12.
7.19.13.
7.19.14.
7.19.15.
7.19.16.
7.19.17.
7.19.18.
7.19.19.
7.19.20.
7.19.21.
7.19.22.
7.19.23.
7.19.24.
7.19.25.

In the economic activity of CryptoWallet., an employee of CryptoWallet. pays special attention to theactivities of the person with whom CryptoWallet. is in business relations or is making a transaction or
carrying out an act, as well as a person intending to create business relations, make a transaction or carryout an act, and to the circumstances which refer to the possibility that the person is a subject of aninternational financial sanction.
If an employee of CryptoWallet. doubts whether a person with whom CryptoWallet. is in business
relations or is making a transaction or carrying out an act, as well as a person intending to create business
relations, make a transaction or carry out an act, is the subject of an international financial sanction, they
inform the board of with CryptoWallet. of this suspicion, which in turn asks the said person for additional
information in order to determine whether these suspicions are correct.
If a person with whom CryptoWallet. is in business relations or is making a transaction or carrying out anact, as well as a person intending to create business relations, make a transaction or carry out an act,
refuses to provide additional information or it is impossible to identify by means thereof if the person is asubject of international financial sanction, CryptoWallet. refuses to make a transaction or act, takes
measures provided for in the act on the imposition or implementation of international financial sanction
and notifies immediately the Financial Intelligence Unit of their doubts and of the measures taken.
If an act on the imposition or implementation of international financial sanction is repealed, expires, or isamended in such a manner that the implementation of the international financial sanction with regard to
the subject of the international financial sanction is terminated wholly or partially, CryptoWallet. ceases
the implementation of the measure to the extent provided for in the act on the imposition or application of
the international financial sanction.
European Union sanctions against countries can be checked online on the website athttps://www.sanctionsmap.eu/#/main; it is possible to check the sanctions of the European Union and theUnited Nations against subjects
Additionally, CryptoWallet. leverages a KYC provider that offers client monitoring services and conducts
checks against a comprehensive range of sanction lists, including but not limited to the following.:
DFAT Australia Consolidated Sanctions List
DFATD Canada Special Economic Measures Act Designations
EU External Action Service - Consolidated list of Sanctions
European Council List of Designated Vessels
European Council Restrictive Measures on Russian entities destabilizing the situation in Ukraine.
Finland National Bureau of Investigation Asset Freeze List
Indonesia PPATK List of Suspected Terrorists and Terrorist Organizations DTTOT Sanctions
Iran March and May 2017 Sanctions against US entities
Ireland Organizations Sanction Laws
Israel Division of Sanctions Headquarters Prevention of Distribution and Financing of Weapons of Mass
Destruction sanctions
Israel National Bureau for Counter Terror Financing Designated associations and terrorist’s organisations
Luxembourg Liste des Sanctions Financières Internationales
Ministry of Finance Japan Economic Sanctions List
Monaco Economic Sanctions
New Zealand Police Designated Terrorists
Norway Sanctions and Restrictive Measures
OFAC Consolidated List
OFAC SDN List
Serbia Government Decisions on Terrorism related Sanctions Designations
Singapore First Schedule of the Terrorism (Suppression of Financing) Act
Sri Lanka Ministry of Defence Sanctions Designations under UN Regulation concerning the proliferationof WMD
Switzerland Federal Council Freezing of Foreign Illicit Assets
Switzerland SECO List
Taiwan Ministry of Justice Investigation Bureau Sanctions under Anti-terrorism Law
Thailand Designated Persons Sanctions List

19

7.19.26.
7.19.27.
7.19.28.
7.19.29.
7.19.30.
7.19.31.
7.19.32.
7.19.33.
7.19.34.
7.19.35.
7.19.36.
7.19.37.
7.19.38.
7.19.39.
7.20.

Thailand Designated Persons Thai Version
Tunisia Sancti
HM treasury’s office for financial sanctions consolidated list
FinCEN Sanctions List
United Nations Consolidated List
United Nations Security Council List of Designated Vessels
United States Bureau of Industry and Security Entity List
United States Bureau of Industry and Security Military End Client List
United States Bureau of Industry and Security The Denied Persons List
United States Bureau of Industry and Security Unverified List
Israel National Bureau for Counter Terror Financing Seizure of Cryptocurrencies
Sri Lanka Government Notifications Under The Preventions of Terrorism Act No. 48 of 1979
Qatar National Counter Terrorism Committee International Sanctions
United States Department of State Counter Terrorism Rewards Program Organisations
The responsible person or the person appointed by him checks the entry into force, amendment andtermination of sanctions using automated technological solutions and public databases of the key partnersof CryptoWallet. (Sumsub). Sanctions are monitored automatically and in the event of receipt ofinaccurate or incomplete data, the responsible person may organize an additional manual check. Also, theautomated control is structured in such a way that it monitors the existing Client base in real-time andwhen sanctions come into force against a specific client, it immediately transmits the information via
e-mail to the responsible person. In addition, if the automated system detects a contradiction with theinformation in the databases, it immediately sends the message via e-mail to the responsible person. The
designated person monitors on an ongoing basis the performance of the automated system and promptly
reports any issues that arise to the responsible person for further investigation. CryptoWallet. conducts
Sanction status screening for Clients during onboarding and during the year on an ongoing basis after
initial check was completed. Ongoing screening will be restarted after client annual recheck. Screening iscalibrated with a default fuzzy logic accuracy (threshold 90% and bi-gram jaccard similarity is used forcomparison) provided by the service provider.

20

8.
8.1.

8.1.1.
8.1.2.
8.1.3.
8.1.4.

8.1.5.

8.2.

8.3.

8.4.

8.5.
8.5.1.
8.5.2.
8.5.3.
8.5.4.

POLITICALLY EXPOSED PERSON AND NEGATIVE NEWS
Politically exposed person means a natural person who is or who has been entrusted with prominent
public functions including a head of State, head of government, minister and deputy or assistant minister;a member of parliament or of a similar legislative body, a member of a governing body of a political party,
a member of a supreme court, a member of a court of auditors or of the board of a central bank; anambassador, a chargé d’affaires and a high-ranking officer in the armed forces; a member of an
administrative, management or supervisory body of a State-owned enterprise; a director, deputy director
and member of the board or equivalent function of an international organisation, except middle-ranking or
more junior officials:
local politically exposed person means a person specified in clause 8.1 who is or who has been
entrusted with prominent public functions in European Economic Area country or
an institution of the European Union;
family member means the spouse, or a person considered to be equivalent to a spouse, of a politically
exposed person or local politically exposed person; a child and their spouse, or a person considered to beequivalent to a spouse, of a politically exposed person or local politically exposed person; a parent of apolitically exposed person or local politically exposed person;
person known to be close associate’ means a natural person who is known to be the beneficial owner or tohave joint beneficial ownership of a legal person or a legal arrangement, or any other close business
relations, with a politically exposed person or a local politically exposed person; and a natural person who
has sole beneficial ownership of a legal entity or legal arrangement which is known to have been set up
for the de facto benefit of a politically exposed person or local politically exposed person.
In instances where the client or the beneficial owner holds a politically exposed status, is related to apolitically exposed person as a family member or is associated with them as a known close associate,
CryptoWallet. will decline to establish the relationship. If such a status is verified subsequent to thecommencement of the relationship, it will result in the termination of the relationships.
CryptoWallet. conducts PEP status screening for Clients during onboarding and during the year on an
ongoing basis after initial check was completed. Ongoing screening will be restarted after client annual
recheck. Screening is calibrated with a default fuzzy logic accuracy (bi-gram jaccard similarity is used forcomparison, threshold 90%) provided by the service provider and performed daily. Clients will bescreened for negative news during onboarding and ongoing basis.
CryptoWallet. conducts a name check of a client daily and consider, based on a risk approach, extending
the check to the client’s beneficial owners against the latest sanction lists before the establishment of abusiness relationship with that client, regardless of what service is to be provided and perform ongoing
screening of our client base regularly thereafter.
Negative news check
The negative news screening aims to ensure that CryptoWallet. effectively identifies and mitigates any
reputational risks associated with its clients by conducting regular screening for negative news provided
by service provider.
CryptoWallet. utilizes the services of Sumsub for negative news screening of its clients. Sumsub's
screening system is implemented to identify negative news and adverse media associated with Clients.
Negative news screening is conducted during the Client onboarding process and on an ongoing basis.
If potential or true negative news matches are identified by Sumsub, CryptoWallet. takes charge of theescalation process, which may involve conducting enhanced due diligence or terminating Client
relationships as deemed necessary.
CryptoWallet. reserves the right to disclose the received monitoring information or results to relevant andinterested third parties for further investigation or approval, if it is not restricted by law or other applicableregulations.

21

9.
9.1.
9.1.1.
9.1.2.

9.1.3.

9.1.4.

9.1.5.

9.1.6.
9.1.7.
9.1.7.1.
9.1.7.2.
9.1.7.3.
9.1.7.4.
9.1.7.5.
9.1.7.6.
9.1.7.7.
9.1.7.8.
9.1.7.9.
9.1.7.10.
9.1.7.11.
9.1.7.12.
9.1.7.13.
9.1.7.14.
9.1.7.15.
9.1.7.16.

OUTSOURCING
CryptoWallet. acknowledges the significance of adhering to outsourcing requirements as outlined in thefinancial crime framework and undertakes the following steps to ensure compliance with regulatory
obligations:maintains a comprehensive procedures document that encompasses the recording, evaluation, andmonitoring of critical or important outsourced functions. These rules are regularly reviewed and updated
to align with the Regulatory Guidelines on Outsourcing.
conducts thorough assessments to determine the importance or criticality of each function that is
considered for outsourcing. The assessments include evaluating whether the function would typically be
carried out by CryptoWallet.. Additionally, CryptoWallet. conducts due diligence on potential service
providers, including assessing their financial stability. Risk assessments are performed, considering
Contractual Risk, Strategic Risk, Reputation Risk, Compliance Risk, Operational Risk, Exit Strategy
Risk, Access Risk, Concentration and Systemic Risk (including risks associated with dominant service
providers or multiple arrangements with closely connected providers), and Credit Risk.
assigns responsibilities for documenting, managing, and controlling outsourcing arrangements. The
designated personnel ensure that all legal and regulatory requirements, including the provided guidelines,
are met. Adequate resources are allocated to ensure compliance, including the documentation, andmonitoring of all outsourcing arrangements. An Outsourcing Register is maintained to track and record
relevant information.
establishes an outsourcing function within the organization or designates a senior staff member who isdirectly accountable to the management body or Board. This individual is responsible for overseeing andmanaging the risks associated with outsourcing arrangements, ensuring compliance with the establishedguidelines.
maintains comprehensive documentation to demonstrate compliance with its outsourcing policy andprocedures. This includes documentation at the Board level. A register of current outsourcing
arrangements is maintained, and internal audits are conducted to ensure ongoing compliance with thepolicy and regulatory requirements.
maintains contingency plans, including a plan for disaster recovery and periodic testing of backup
facilities.
ensures that its agreements with outsource providers contain clauses that align with the outlined
requirements, including:clear description of the outsourced function;
start and end dates with relevant notice periods;
governing law;parties' financial obligations;
identification of critical or important functions;locations from which the critical or important function will be provided or where relevant data will be
kept and processed;
provisions regarding availability, integrity, privacy, and safety of the data;
right to monitor and audit the service provider's performance;
agreed service levels, including "exact quantitative and qualitative performance targets" if applicable;
reporting obligations;mandatory insurance requirements;
requirements regarding business contingency plans;
provisions ensuring data accessibility in the case of insolvency, resolution, or discontinuation of theservice provider's business;
obligation for the service provider to cooperate with relevant regulators;
unrestricted right for CryptoWallet., to inspect and audit the service provider;termination rights

22

9.2.
9.2.1.
9.2.2.
9.2.3.
9.2.4.
9.2.5.
9.3.
9.3.1.
9.3.2.
9.3.3.
9.3.4.
9.3.5.

Occasionally, we may encounter issues or breaches in our outsourced activities, and it is expected that we
address and resolve these matters promptly. The utmost priority in resolving such disputes or breaches is
to ensure that they do not result in:
failure of the business to provide fair, efficient, and professional services to clients
failure of the business to comply with legislative and code requirements,
significant financial or operational losses for the business.
If a dispute or breach of contract arises with an outsourced supplier, it should be immediately referred to a
Senior Manager for resolution.
The Senior Manager will utilize their business skills and expertise to rectify the matter with the supplier.
If the Senior Manager is unable to satisfactorily rectify the matter with the supplier within 14 days, they
will consider one or more of the following options, based on the nature and severity of the situation:
accept the failure or breach by the supplier;seek assistance from relevant alternative dispute resolution facilitators;
consult our legal advisers regarding the matter;recommend to the Board the termination of the supply contract or agreement for their consideration;suggest to the Board the engagement of an alternative supplier to provide replacement services.

23

10.
10.1.

10.2.

10.2.1.
10.2.2.
10.2.3.
10.2.4.
10.2.5.
10.2.6.
10.2.7.
10.2.8.
10.3.

10.4.

10.5.

EXIT MANAGEMENT
CryptoWallet. keep the right to terminate relationships with a client at the sole discretion and the Client
will not be entitled to a remedy or alternative for discontinued services. CryptoWallet. has defined roles,
responsibilities, and governance for the exit strategy, including compliance personnel trained to handle theprocess efficiently and in compliance.
CryptoWallet. has identified specific red flags that may indicate potential financial crime risks orcompliance breaches. For example, if a Client consistently engages in large, unexplained transactions or
exhibits unusual transaction patterns inconsistent with their known business activities, it may trigger areview and consideration for exiting the Client relationship. Among other reasons not listed,
CryptoWallet. may also suspend or terminate your account for any or all the following reasons:
Any client found to be in violation of applicable AML regulations, such as engaging in money laundering
activities or knowingly facilitating transactions involving illicit funds, will be subject to immediate
termination of their account and associated privileges.
Clients who fail to comply with CryptoWallet.'s AML policy, including providing requested identification
documents, suspicious activity reports, or any other relevant information, may have their accountsuspended or terminated.
Clients engaged in high-risk activities, as determined by CryptoWallet.'s risk assessment procedures,
including but not limited to engaging in frequent large-scale transactions, transferring funds to/fromhigh-risk jurisdictions, or involvement in known illicit activities, may face termination of their account.
Clients providing false, misleading, or fraudulent information during the onboarding process, such asincorrect identification details or purpose of transactions, will have their account terminated.
Clients who refuse to cooperate with CryptoWallet.'s AML compliance measures, including blocking ordelaying the investigation of suspicious transactions or providing false explanations for their activities,
may be subject to termination.
Clients who have previously been warned or suspended for AML policy violations and continue to engage
in non-compliant activities may face permanent termination of their account.
In cases where a client is found to be connected with a sanction regime, sanctioned individuals, or
sanctioned companies, an exit management process will be initiated.
CryptoWallet. has established a clear communication approach when interacting with Clients during theexit process. For instance, if the decision to exit a Client is made, CryptoWallet. ensures that any
communication or engagement with the Client is conducted in a manner that maintains confidentiality andcomplies with the tipping-off rule. This ensures that the Client is not alerted to the fact that they are being
exited due to suspicions of financial crime.
CryptoWallet. has implemented a robust tracking and recording process for Client exits. For example,
when a decision is made to exit a Client, CryptoWallet. records essential information such as the Client's
name, the reason for exit consideration, the dates of review and final decision, the sign-off authority, andthe actual date of Client exit. This documentation ensures a transparent and auditable record of the exit
process.
CryptoWallet. maintains a watch list monitor Clients flagged for potential exit. This list allows
CryptoWallet. to focus on Clients who require ongoing scrutiny, ensuring that they are not inadvertently
overlooked during the exit process. Continuous monitoring helps detect any suspicious activities that may
require further investigation.

24

11.
11.1.

11.1.1.
11.1.2.
11.1.2.1.
11.1.2.2.
11.1.2.3.
11.1.2.4.
11.2.
11.3.
12.
12.1.

12.2.
12.3.
12.3.1.
12.3.2.
12.3.3.
12.3.4.
12.4.
12.4.1.
12.4.2.
12.4.3.
12.5.

RECRUITMENT
CryptoWallet. recognizes the importance of recruiting appropriately trained and experienced staff,
including contractors and third parties, to ensure a risk-based approach to combating financial crime. The
following measures ensure that CryptoWallet. recruits qualified individuals who contribute to our efforts
in combating financial crime and adhering to AML regulations: Clients flagged for potential exit. This list
allows CryptoWallet. to focus on Clients who require ongoing scrutiny, ensuring that they are notinadvertently overlooked during the exit process. Continuous monitoring helps detect any suspicious
activities that may require further investigation.
CryptoWallet. employs a risk-based approach to recruit appropriately trained and experienced individuals,considering the nature of roles and potential financial crime risks.
CryptoWallet. established a comprehensive employment screening system to assess suitability andintegrity, which includes:
identity Verification
employment History Checks
criminal Record Checks d. Regulatory Checks
reference Checks f. Ongoing Monitoring
CryptoWallet. screening process follows principles of fairness, consistency, and compliance withapplicable laws and regulations, while respecting privacy rights
CryptoWallet. conducts comprehensive training and orientation programs for all new employees, ensuring
a smooth integration into the organisation.
TRAINING
CryptoWallet. recognizes the importance of providing regular and up-to-date training on Anti-Money
Laundering (AML) and Counter-Terrorist Financing (CTF) to its employees. The frequency and content
of the training program will be adjusted to reflect changes in legal and regulatory requirements,
employees' duties, and business model changes. These training sessions will be conducted no less thanonce a year to ensure compliance and keep employees well-informed. The training program aims to
educate employees on the latest developments in preventing money laundering and terrorist financing,including practical methods and emerging trends.
The MLRO is responsible for implementing and overseeing the AML/CTF training program to ensure
employees are aware of their legal obligations. The MLRO should collaborate with relevant stakeholders
to develop and deliver comprehensive training sessions.
The frequency of AML/CTF training sessions will be determined based on the following factors:
Amendments to legal and regulatory requirements: Training should be updated to reflect any changes in
AML/CTF regulations.
Employees' duties: Training frequency may be adjusted based on employees' roles and responsibilities
within the organization.
Changes in the business model: If there are significant changes in the business model that impact
AML/CTF risks, additional training may be conducted.
On an annual basis, unless otherwise triggered by above mentioned factors.
The AML/CTF training program should cover the following key areas:
Understanding AML/CTF regulations: Employees should be educated on the legal and regulatory
requirements related to money laundering and terrorist financing prevention.
Latest developments and trends: Training should focus on the most recent developments in AML/CTF
practices, including emerging methods and trends used for money laundering and terrorist financing.
Practical methods and tools: Employees should be provided with practical knowledge, tools, andtechniques to identify, prevent, and report suspicious activities related to money laundering and terrorist
financing.
Training sessions may be conducted through various methods, including workshops, seminars, online
modules, or a combination of these approaches. The most suitable delivery method will be chosen basedon effectiveness, accessibility, and cost considerations.

25

12.6.
12.7.
12.8.
12.9.
12.10.
12.11.

13.
13.1.

13.2.

13.3.
13.3.1.

13.3.2.

13.4.
13.4.1.
13.4.2.
13.4.3.
13.4.4.
13.4.5.
13.4.6.

Failure to comply with the training requirements may lead to disciplinary actions, which can include
verbal warnings, written warnings, suspension, or termination of employment, depending on the severity
and frequency of non-compliance.
In cases where an employee fails to successfully complete the required AML/CTF training, they may
be provided with additional retraining opportunities. The employee will be required to participate in theretraining session(s) and successfully complete the assessment to meet the training completion
requirement.
CryptoWallet. maintains accurate records of employees' participation and completion of AML/CTF
training. These records will serve as evidence of compliance and may be used for auditing purposes orreporting to relevant authorities, if necessary.
After a new employee has signed their employment contract, the MLRO must instruct them in accordancewith the established procedure within at least one week after the new employee starts work and introduce
this code of conduct to the new employee against a signature.
The MLRO has the right to submit proposals to the management board of the undertaking regarding
training providers. If the obligation to enforce the code of conduct is assigned to another person on thebasis of an authorization agreement, they must follow the code of conduct in full.
AUDIT AND PROCEDURES FOR ENSURING COMPLIANCE WITH THE RULES OF
PROCEDURE AND INTERNAL CONTROL STANDARDSSupervision over the compliance of the management board of CryptoWallet. with the requirements of the
Money Laundering and Terrorist Financing Prevention Act and the legislation established on the basis
thereof is carried out by the Financial Intelligence Unit and/or other competent authorities and institutions
designated by relevant laws.
Compliance of the employees of CryptoWallet., its structural units and MLRO with the requirements of
the Money Laundering and Terrorist Financing Prevention Act and the legislation established on the basis
thereof is monitored and controlled by the management board of the undertaking, senior manager or
MLRO.
The competence of the employees of CryptoWallet. to comply with the requirements of the Money
Laundering and Terrorist Financing Prevention Act and the legislation established on the basis thereof:
only those employees who have been authorized to do so by the management board or the senior manager
and who have thoroughly familiarised themselves with the relevant legislation, information issued by thecompetent authorities, with these rules of procedure and have exhaustive knowledge in the field of
AML/KYC may handle operations related to the fulfilment of requirements and obligations arising from
the Money Laundering and Terrorist Financing Prevention Act and of the legislation established on thebasis thereof, including the implementation of due diligence, whereby only those employees also have theright to decide on the initiation, creation and continuation of business relationships;
in matters related to the fulfilment of requirements and obligations arising from the Money Launderingand Terrorist Financing Prevention Act and of the legislation established on the basis thereof, theemployees and heads of structural units of CryptoWallet. primarily consult with the MLRO and, in theabsence of such person, with the responsible member of the management board. The senior manager
always has the right to control the activities of the employees, heads of structural units and MLRO of
CryptoWallet..
The employees and heads of structural units of CryptoWallet. undertake to strictly comply with:
International Sanctions Act;
Money Laundering and Terrorist Financing Prevention Act;
Directive (EU) 2015/849 of the European Parliament and of the Council;
relevant instructions and orders of the Financial Intelligence Unit and other competent authorities;
procedural rules and internal control rules established by the management board of CryptoWallet.;relevant and legal orders and instructions of the management board, senior manager and MLRO of
CryptoWallet..

26

13.5.

13.6.
13.6.1.
13.6.2.
13.6.3.
13.7.

13.8.
13.9.

13.10.
13.11.

13.12.
13.13.

13.14.

13.15.

If an employee (or the manager of a structural unit) has a doubt as to whether a due diligence measure orother related criterion has been met (or the execution of a transaction or the establishment of business
relations is permitted) - the employee (or the head of a structural unit) must immediately contact their
immediate superior (head of a structural unit, MLRO, senior manager) and suspend the transaction orbusiness relationship until they receive an answer to their request and an order on how to behave.
CryptoWallet. implements the following system of internal control over compliance with 14.6.2. Money
Laundering and Terrorist Financing Prevention Act and the legislation established on the basis thereof andthe requirements of these procedural rules and internal control standards:
The activities of the employees of CryptoWallet. are monitored and controlled by:
the head of the structural unit of the employee;in the absence of the head of the structural unit of the employee, the senior manager and/or MLRO.
The employee must transmit to the head of the structural unit or, in the absence thereof, to the senior
manager and/or to the MLRO all relevant data concerning the identities of the clients of CryptoWallet.
and the nature of the business relations established with them, including the client’s personal data, data ofthe transaction carried out with the client, the results of the implementation of due diligence measures andother important information at the latest on the next working day after the completion of data collection
and implementation of due diligence.
The activities of the head of a structural unit of CryptoWallet. are monitored and controlled by the senior
manager of CryptoWallet. and/or to the MLRO.
The head of the structural unit of CryptoWallet. must transmit to the MLRO or the responsible member ofthe board at least once a month all relevant data collected by them or the employees of their structural unit
on the identities of the clients of CryptoWallet. and the nature of the business relations established withthem, together with relevant reports.
The activities of the MLRO of CryptoWallet. are monitored and controlled by the senior manager ormanagement board.
The MLRO checks the relevant data provided by the employees and heads of structural units of
CryptoWallet. on the identities of the clients of CryptoWallet. and the nature of the business relationships
established with them and organizes the storage of this data in accordance with the provisions of the
Money Laundering and Terrorist Financing Prevention Act and this code of conduct. The MLRO submits
relevant reports to the management board of CryptoWallet. once per quarter.
The activities of the senior manager of CryptoWallet. are monitored and controlled by other board
members or, in exceptional cases, by the general meeting of shareholders.
In the event of a temporary absence of the MLRO, the senior manager or the person temporarily
appointed by them checks the relevant data provided by the employees and heads of structural units of
CryptoWallet. on the identities the clients of CryptoWallet. and the nature of the business relationships
established with them, and organizes the storage of this data in accordance with the provisions of the
Money Laundering and Terrorist Financing Prevention Act and this code of conduct.
The senior manager and the management board of CryptoWallet. undertake to inform the employees of
the undertaking on an ongoing basis about changes in legislation and new positions of supervisory
institutions, the activities of CryptoWallet., changes in its risk assessments and criteria arising from clientsor certain client groups, changes in the long- and short-term business approach of the undertaking andseparate positions and guidelines (according to the market situation, political and economic situation,orders of supervisory bodies, etc.) to fulfil the obligations arising from the Money Laundering andTerrorist Financing Prevention Act. Said information and notices do not necessarily have to be formalized
as appendices to this manual and may be delivered at meetings, through individual managers, by e-mail,but they must be complied with and followed regardless of the delivery method.
Breach of the duty of care arising from the Money Laundering and Terrorist Financing Prevention Act,failure to comply with the order of the senior manager, management board or MLRO, or failure to informthe senior manager, management board, MLRO or the Financial Intelligence Unit in case of suspicion ofmoney laundering or terrorist financing, either directly or through the head of the structural unit, issufficient grounds for initiating disciplinary proceedings against the employee and/or head of structuralunit and to terminate the employment relationship.

27

13.16.

13.17.

13.18.

13.19.

14.
14.1.
14.1.1.
14.1.2.
14.1.3.
14.1.4.
14.1.5.
14.1.6.
14.1.7.
14.1.8.
14.1.9.
14.1.10.
14.1.11.
14.2.
14.2.1.
14.3.
14.3.1.
14.3.2.
14.3.3.
14.3.4.
14.3.5.

The management board of CryptoWallet. ensures that the resources allocated for ensuring compliancewith the Money Laundering and Terrorist Financing Prevention Act and the requirements of this code of
conduct are sufficient and that the employees directly involved in fulfilling the requirements of the Money
Laundering and Terrorist Financing Prevention Act operate in conditions where they are fully aware of therequirements of the Money Laundering and Terrorist Financing Prevention Act and this code of conduct.
CryptoWallet. must carry out an internal audit. During the internal audit, adherence to procedural rules,
compliance with internal control standards and the functioning of systems are also checked. The internal
auditor is subject to the requirements and legal bases of the activity provided for the certified internal
auditor in the Auditors Activities Act. The internal auditor checks the compliance of the activities of
CryptoWallet. and its managers and employees with legislation, regulations of the Financial Intelligence
Unit, decisions of management bodies, internal regulations, contracts signed by the virtual currency
service provider and good practice.
The virtual currency service provider guarantees the internal auditor all the rights and working conditions
necessary for the performance of their duties, including the right to receive explanations and informationfrom the managers and employees of the virtual currency service provider and to monitor the eliminationof discovered deficiencies and the implementation of suggestions made.
The internal auditor is obliged to immediately forward in writing to the managers of the virtual currency
service provider and the Financial Intelligence Unit any information that has become known to them
about the virtual currency service provider and which points to violations of the law or damage to theinterests of clients.

RECORD KEEPING
In line with the regulations CryptoWallet. has developed this record keeping rules that highlights anapproach to record keeping. This approach is applicable to all Clients and Clients’ activity. All employees
are expected to adhere to the principles highlighted in this policy
client Verification information;
CDD/ EDD checks;
details of beneficial ownership;transactional data and evidence;
records of suspicious activity;internal reports to the MLRO;
external reports to FIU or relevant authority;
the practice’s risk assessment;
the practice’s compliance checks;
policies and Procedures change data;
other required information in accordance with Anti-Money laundering regulations
In addition to the data specified in this code of conduct, the employee of CryptoWallet. records thefollowing data about the transaction to be performed:
transaction type; unique transaction identifier; transaction price; transaction period; sending or recipient
account number; other special transaction conditions.
All mention records will be retained for at least five years from the end of the business relationship or thedate of the transaction as applicable. CryptoWallet. is storing the mentioned information with thefollowing 3rd party service providers:
SumSub - data related to customer KYC, CDD, EDD, screening against sanctions, domestic andinternational PEPs, adverse media, data related to Crypto monitoring and screening
PKO Bank Polski - data related to fiat transactions
Fireblocks - data related to the crypto transactions and risk flags
Zendesk - data related to the conversions with clients
Only responsible management and a person designated by responsible management have access to thestored data.

28

15.
15.1.
15.2.
15.3.

15.4.

15.5.

FINAL PROVISIONSThis Anti-Money Laundering (AML) policy may be amended or updated from time to time as required bychanges in laws, regulations, or best practices. Any amendments made will be communicated to all
relevant parties and will take effect immediately upon publication.
All employees and relevant stakeholders of CryptoWallet. are expected to comply with this AML policy
and its provisions. Non-compliance may result in disciplinary action, including termination of
employment or business relationships.
All information obtained and records maintained in accordance with this AML policy will be treated withthe utmost confidentiality. Access to such information will be restricted to authorised personnel on aneed-to-know basis, and appropriate safeguards will be implemented to protect against unauthorised
access or disclosure.
CryptoWallet. fully cooperates with relevant regulatory authorities and law enforcement agencies in any
investigations or inquiries related to money laundering or terrorist financing activities. This includes
providing requested information, reporting suspicious transactions, and implementing necessary measures
to assist in the prevention and detection of financial crimes. At the first request of an employee of the
Financial Intelligence Unit, all documents necessary for the inspection must be submitted to theinspectors.
If any provision of this AML policy is found to be invalid, illegal, or unenforceable, the remaining
provisions shall remain in full force and effectConfirmed by the management board of CryptoWallet on 10th February 2024: Aleksei Arno, MLRO.
Signature:29

APPENDIX 1 TO AML POLICYSUPPORTED CRYPTOCURRENCIESToken name

Abbreviature

Official information

SUMSUB KYT
monitoring support

Tether USDt

USDThttps://coinmarketcap.com/currencies/tether/yes

Tether EURt

EURT

https://coinmarketcap.com/currencies/tether-eurt/

yes

TrueUSD

TUSD

https://coinmarketcap.com/currencies/trueusd/

yes

USDD

USDD

https://coinmarketcap.com/currencies/usdd/

yes

DAI

DAI

https://coinmarketcap.com/currencies/multi-collateral-dai/yes

BITCOIN

BTC

https://coinmarketcap.com/currencies/bitcoin/

yes

LITECOIN

LTC

https://coinmarketcap.com/currencies/litecoin/

yes

ETHEREUM

ETH

https://coinmarketcap.com/currencies/ethereum/

yes

CARDANO

ADA

https://coinmarketcap.com/currencies/cardano/

yes

XRP

XRP

https://coinmarketcap.com/currencies/xrp/

yes

NEAR
PROTOCOL

NEAR

https://coinmarketcap.com/currencies/near-protocol/

yes

SPEND

SPEND

TOKEN https://cryptowallet.com/

yes

BNB

BNB

https://coinmarketcap.com/currencies/bnb/

yes

AVALANCHE

AVAX

https://coinmarketcap.com/currencies/avalanche/

yes

TRON

TRX

https://coinmarketcap.com/currencies/tron/

yes

POLYGON

MATIC

https://coinmarketcap.com/currencies/polygon/

yes

POLKADOT

DOT

https://coinmarketcap.com/currencies/polkadot-new/yes

ALGORAND

ALGO

https://coinmarketcap.com/currencies/algorand/

yes

DOGECOIN

DOGE

https://coinmarketcap.com/currencies/dogecoin/

yes

SOLANASOL

https://coinmarketcap.com/currencies/solana/

yes

30

APPENDIX 2 TO AML/KYC POLICYCUSTOMER RISK ASSESSMENT
1. INTRODUCTION
CryptoWallet evaluates AML/CTF risk by implementing the risk-based approach and considering national andsupranational risk assessments, as well as recommendations and guidelines of the Financial Action Task Force(FATF), European Banking Authority (EBA), and other international and local Laws and regulations.
CryptoWallet has created this CRA to explain how it assesses inherent risks across its individual customers.
Individual Customer risk assessment is updated where necessary based on the guidelines issued by European
supervisory authorities, FATF as well as the published results of the European Commission’s supranationalrisk assessment, National risk assessment, guidelines, and reports issued by the FIU. The risks inevitably varyfrom customer to customer, but the risks considered by CryptoWallet follow the risks set out in the legislationof the EU :● Customer Risk;● Country and/or Geographical Risk;● Transaction Risk;● Delivery channel Risk.
CryptoWallet must conduct appropriate due diligence prior to establishing a business relationship with a client.
In order for the Company to determine an appropriate level of due diligence it must conduct an inherent risk
rating of the client and determine the level of ongoing monitoring.
2. CRA METODOLOGY
CryptoWallet considers that every client presents a certain degree of risk, which will be apparent on theassessment criteria set out below. To identify, assess and prevent the potential ML/TF or Sanctions risks of aclient a granular and objective risk assessment should be performed.
Section 4 below sets out how inherent risk should be calculated for all clients based on:● Customer Risk;● Country and/or Geographical Risk;● Transaction Risk;● Delivery Channel Risk.
To determine the inherent risk level of the individual Customer and have adequate control measures to mitigate
the risk, CryptoWallet applies individual risk assessment. The company performs an individual risk assessmentof the Customer ML/TF risk in the following cases:● Before the establishment of the business relationship with the customer;● On an ongoing basis according to the initially assigned risk level to the customer.
The inherent individual risk assessment of the customer and the risk level attributed should be periodicallyreviewed and updated. Unless there is a specific change of circumstance, risk level assigned should be updated
on a risk-based approach as follows:
Inherent Risk Assessment

Inherent Risk Update

Low Risk

Every 3 Years

Moderate Risk

Every 2 Years

High Risk

Every 1 YearA change of circumstances for the purposes of the above will include, but is not limited to:● A possible match related to PEP, relevant Adverse Media or Sanctions;

31

●
●
●

A new service/product is provided to the customer which usage might lead to increase of the risk of
the customer;
There is a significant deviation in the customer’s behaviour from the information that the company
obtained during the customer’s onboarding;
The unusual transaction pattern is detected during ongoing monitoring of the customer.

The inherent risk level of the customer can be changed (increased or decreased) because of the re-assessmentof the risk, based on the results of the ongoing monitoring of the business relationship and/or new factors
relating to the customer. If the recalculation of customer’s inherent risk results in a change of risk from low ormoderate to high, approval to continue the relationship will be required from the AML Officer andsubsequently EDD will be performed.
3. CRA SCORING METHODOLOGY
The score of all risk factors in the CryptoWallet CRA is derived from the combination of (i) the risk level,
which is attributed to the selected option (multiple choices within the risk factors), and (ii) the impact level,
which is attributed to the risk factor.
For each question that has a “prohibited”, “high risk”, “moderate risk” or “low risk” score, the following
numerical scores are given by the CRA:
● Prohibited (the client is deemed prohibited / outside of company’s risk appetite);● High (score of 9);● Medium (score of 3);● Low (score of 1).
In addition, every risk factor has an attributed impact level, which depends on the importance of the risk factor
in the evaluation of the inherent customer’s risk based on the type of risk being assessed, as follows:● Customer risk (the risk factor score multiplied by 40%);● Screening risk (the risk factor score multiplied by 30%);● Transaction risk (the risk factor score multiplied by 15%); and● Delivery channel risk (the risk factor score multiplied by 15%).
The sum of all evaluated risk factors equals to the inherent customer’s risk score.
The Inherent customer’s risk score as set out in the CRA is described by the formula (and explained more indetail) below.
𝑍 = 𝑆𝑢𝑚(𝑎 + 𝑏 + 𝑐 + 𝑑), where● a – sum of score of questions 1.1-1.3● b – sum of score of questions 2.1-2.3● c – score of the question 3.1● d - score of the question 4.1● 𝑍 =Inherent Customer’s Risk Score
The Inherent customer’s risk score as well as customer’s inherent risk level is calculated based on theinformation provided in the CRA and presented on the right side of the CRA.
If there are any concerns related to ML/TF risks associated with the customer and there are additional criteria
not listed in the Customer risk assessment tool, Compliance department employees, as well as AML Officer,
has a right to overrule the recommendation of the risk assessment tool in case there is a motivated opinion thatthe customer’s risk level is higher than it is recommended by the risk scoring. Such decisions should beapproved by AML Officer and recorded in the internal log of the company.
Each risk factor has more than one option to select. A number of options has been assigned to one of the threerisk levels (from Low to High or Prohibited) for example:

32

Figure 1 Low, Moderate, High, Prohibited Risk Options
Alternatively, three risk levels (from Low to High):

Figure 2 Low, Moderate or High-Risk Options
In addition, each risk factor has a different impact on the risk (either 40%, 30% or 15%). The impact level(assigned to the risk factor) depends on the importance of the risk factor in the overall evaluation of thecustomer’s risk. The impact has been decided based on the guidance set out in Wolfsberg Guidance forcalculating risk assessments for the purposes of AML assessments1.
Furthermore, and as indicated above, in line with the CryptoWallet AML Policy there are number ofprohibitions assigned to each risk factor which returns an automatic prohibition of the customer and a rejectionof the business relationship.

Figure 3 Prohibited.

In order to aid objectivity, the majority of the questions have been designed to be answered by placing an “x” next
to pre-defined answers. If the analyst attempts to answer a question with two answers, an error message stating“Select only one” pops up.

Figure 4 Select only one error.

1

33

4. CLIENT RISK ASSESSMENT- CONSIDERATIONS AND METHODOLOGY
CryptoWallet enters into business relationships with individual customers. An AML Officer is responsible forthe individual risk assessment process. A risk assessment together with the risks posed by the customer must
be presented to the senior management who decides on the acceptance of high-risk customers and provides thewritten approval for onboarding the customer or continuing the business relationships with the customer. The
approval should be documented and added to the customer’s file.
If the customer is considered High Risk based on the inherent risk assessment, Enhanced Due Diligence(‘EDD’) measures must be applied. Prohibited countries are outlined in Appendix 4
Individual clients and users of CryptoWallet Services will be screened against sanctions lists through athird-party provider. CryptoWallet uses AML service provider – Sum&Sub for customers’ screening against
sanctions lists to ensure that we are compliant with international financial sanctions regulations. All thecustomers will be automatically screened against the relevant sanctions lists of designated persons after client
details are introduced in the CryptoWallet ’s internal IT systems. The clients would be deemed as Prohibited ifthey will:● have matches in the sanctions lists;● will reside in the prohibited country;● will fail to be verified by CryptoWallet.
CryptoWallet uses the AML service providers – SumSub as identification and verification tools for individual
clients. In case a third-party provider fails to verify the documents provided by the client, the compliance teamof CryptoWallet will perform a manual check. Therefore, a couple of verification methods with different risk
levels were introduced to the Risk Assessment tool. CDD and EDD processes are described in detail in the
CryptoWallet AML Policy.
5. INHERENT RISK CALCULATION
Once the client is assessed by CryptoWallet through the CRA, the score is calculated automatically in the CRA
Excel and the final risk score is presented to ascertain the inherent risk score of the client. There are no
exceptional circumstances and no manual override on the CRA process other than requesting exemptions fromthe AML Officer at CryptoWallet and Moorwand in relation to prohibited criteria. Based on the result from the
CRA, CryptoWallet takes the decision whether to onboard the client or not. Scores of customer Risk Rating for
CryptoWallet clients is indicated below:

Figure 5 Individual CRA Scoring
6. RISK APPETITE
In conjunction with the risk mitigation system established in the provisions of the model for identifying theclient’s risk level, the management board of CryptoWallet determines the risk level of CryptoWallet to bemoderate. CryptoWallet does not establish business relationships with persons against whom prohibitions are
stipulated by this guide of conduct and its appendices or by law and/or with respect to whom there is a suspicion
that the client will use the services of CryptoWallet in money laundering, tax evasion, terrorist financing or
criminal activity schemes or to facilitate them but does not create additional obstacles in regards to the use of theirservices by clients with respect to whom there are no such doubts. CryptoWallet primarily avoids client relationsif:
6.1. a client cannot be identified;34

6.2. due diligence resulting from the Money Laundering and Terrorist Financing Prevention Act cannot be applied
to the client for any reason
6.3. the client is located in a prohibited country
6.4. the client is subject to European Union or UN sanctions;6.5. the client has Politically exposed person history
6.6. the client has previously been punished pursuant to criminal procedure for money laundering, tax
evasion, terrorist financing or criminal activities that can be directly or indirectly associated withcredit fraud or virtual currencies or is facing criminal proceedings and the obliged person has
Information about this;6.7. also, CryptoWallet intends to minimize the number of high-risk clients by avoiding creating business
relationships with people who might be politically exposed persons and persons aged 65 years and over.
6.8. In relation to the remaining clients with whom the obliged person does not exclude the establishmentof business relationship, the obliged person shall establish due diligence measures resulting from the
Money Laundering and Terrorist Financing Prevention Act and the procedural rules and internal according to theclient’s risk level to mitigate risks, by assessing the overall risk level of the client using the risk assessment andmanagement model set out in this appendix and paying heightened attention to each risk level category of theclient35

ATTACHMENT 3 TO AML/KYC POLICYINDIVIDUAL CRA EXPLAINING THE EVALUATION CRITERIA
1. SCREENING RISK
Initially each client is assigned a risk score depending on the risk factors listed below:
Risk Factor

Adverse Media

Explanation
Have any true adverse media(negative news) matches
concerning financial crime
been detected relating to thecustomer?

Prohibited

Low

Moderate

High

n/a

No

Yes, butunverifiable

Yes,
verifiable

Match in the PEP list

Have any true matches in the
PEP lists been detected?

Yes

No

n/a

n/a

Match in the sanctions
list

Have any true matches in the
sanction’s lists been detected?

Yes

No

n/a

n/a

In order to answer the questions of the Screening Risk Factor part of the Individual CRA, the following should
be used as a guide:
1.1. CryptoWallet uses a third-party screening tool to check all the customers – when customers register in the system,
the information is transmitted to the provider and checked for negative adverse media, PEP matches and matches
in the sanctions lists. CryptoWallet is prohibited from working with PEPs and Sanctioned individuals.
1.2. In case there is a positive match in sanctions lists the result will be prohibited which should result in the CRA
being halted. If any question is unanswered or answered in an incorrect manner (i.e. wrong input – only ‘x/X’letter will return the score; two boxes are checked, etc.), then it will not be possible to proceed with the inherent
risk calculation.

36

2. CUSTOMER RISK

Risk Factor

Explanation

Prohibited

Low

Moderate

High

Country of residence

What is the risk level of thecountry where customer
resides? (according to Geo and
IP checks performed)

Prohibited

Low

Moderate

High

Relationships with theclientHow long has the client beenregistered with the company?

N/A

Less than 1 year

From 1 to 3
years

More than 3
years

Customer type

What is the employment
status?

Student

Unemployed

N/A

Employed

In order to answer the questions of the Customer Risk Factor part of the Individual CRA, the following should
be used as a guide:
2.1. CryptoWallet has agreed to follow Moorwand Guide on Countries, which has the list of countries divided by risk
rating based on the information obtained from different reliable sources. In addition, CryptoWallet performs thefollowing checks of geo-location for its individual customers:● IP address;● Device identifiers;● Virtual accounts wallet addresses.
2.2. The longer the customer has relationships with CryptoWallet, the lower risk will be assigned.
2.3. CryptoWallet will evaluate customers with different employment positions. Furthermore, there are no prohibited
statuses.
If any questions is unanswered or answered in an incorrect manner (i.e. wrong input – only ‘x/X’ letter will
return the score; two boxes are checked, etc.), then it will not be possible to proceed with the inherent risk
calculation.
3. TRANSACTION RISK
Risk Factor

ExplanationProhibited

Lo
w

Moder
ate

Hi
gh

37

Transaction
risk

What is theestimated value of thetransactions performed during
1 month?

N/A

5,000
10,
X
EUR< X < 10,000 000 EUR < X< 5,000 EUR
EUR< 20,000 EUR

In order to answer the questions of the Transaction Risk Section of the CRA, the following should be used as a
guide:
3.1. CryptoWallet decided to categorize the customers according to their monthly transaction volume within
CryptoWallet's limits. There are no prohibited limits; however, customers should provide an explanation for any
necessary limit adjustments.
3.2. If the question is unanswered or answered in an incorrect manner (i.e. wrong input – only ‘x/X’ letter will returnthe score; two boxes are checked, etc.), then it will not be possible to proceed with the inherent risk calculation.
4. VERIFICATION RISK/DELIVERY CHANNEL
Verification Risk, for the purpose of CryptoWallet’s business, the Company takes into account how thecustomers were verified during the onboarding stage. If CryptoWallet employees are unable to complete the
CDD measures on the customer it will not be possible to carry out an accurate CRA, onboarding should cease,and business relationships cannot be established. The following question and answers were created to assessthe delivery risk related to customer:

Risk Factor

Verification of thecustomer's identity

Explanation

Prohibited

Low

ModerateHigh

How was the customer's
identity verified?

Not verified

Via eKYC
tooln/a

Via manualverification

In order to answer the question of the Verification Risk Factor part of the Individual CRA, the following
should be used as a guide:
4.1. As CryptoWallet has contracted a third-party provider to complete identification and verification of the customers,
it is important to receive the information from the provider on the ongoing basis. In case the provider failed toverify the identity of the customer, manual checks should be applied by CryptoWallet dedicated team. Therefore,
manual verification of the documents was assigned High Risk. In case the verification by both methods fails, thecustomer should be assigned “Prohibited” risk rating and all the business relationships should be ended.
4.2. If the question is unanswered or answered in an incorrect manner (i.e. wrong input – only ‘x/X’ letter will returnthe score; two boxes are checked, etc.), then it will not be possible to proceed with the inherent risk calculation.

38

APPENDIX 4 TO AML POLICYSUPPORTED COUNTRIES AND ADDITIONAL AML/KYC PROCEDURES.
To ensure the highest standards of security, legality, and regulatory compliance, CryptoWallet has implemented additional
Anti-Money Laundering (AML) and Know Your Customer (KYC) procedures. These measures are specifically designed
to mitigate the risks associated with client jurisdiction and planned activities with CryptoWallet. Their purpose is toprevent fraud, money laundering, and other illicit activities connected with specific regions and countries
1.

REGULATORY SOURCES
1.1.
EU – High risk third countries and the International context content of anti-money laundering andcountering the financing of terrorism(https://finance.ec.europa.eu/financial-crime/high-risk-third-countries-and-internationalcontext-content-an
ti-money-laundering-and-countering_en)
1.2.
UN – Restrictive measures (https://www.sanctionsmap.eu/#/main)
1.3.
FATF – FATF – Jurisdictions under Increased Monitoring – June 2023
(https://www.fatf-gafi.org/content/fatf-gafi/en/publications/High-risk-and-othermonitored-jurisdictions/In
creased-monitoring-june-2023.html)
1.4.
Internal decision on high-risk and prohibited countries by CryptoWallet.

2.
SUPPORTED COUNTRIESCryptoWallet services are available to customers in specific jurisdictions. The following list outlines the supported
countries where our services can be used and accessed. This list is subject to change and will be updated as necessary.
LOW RISKMEDIUM RISKHIGH RISK

AustriaAT

AUT

Albania

AL

ALB

United Arab Emirates

AE

ARE

BelgiumBE

BEL

Argentina

AR

ARG

Bulgaria

BG

BGR

CyprusCY

CYP

CanadaCA

CAN

Croatia

HR

HRV

Czech
Republic

CZ

CZE

Australia

AU

AUS

Indonesia

ID

IDN

Denmark

DK

DNK

BrazilBR

BRA

MexicoMX

MEX

Estonia

EE

EST

Armenia

AM ARM

Montenegro

ME

MNE

FinlandFI

FIN

Azerbaijan

AZ

AZE

Philippines

PH

PHL

Malta

MT

MLT

Bhutan

BT

BTN

Qatar

QA

QAT

Portugal

PT

PRT

Chile

CL

CHL

South Africa

ZA

ZAF

FranceFR

FRA

Costa Rica

CR

CRI

Sri Lanka

LK

LKA

Germany

DE

DEU

Kenya

KE

KEN

TurkeyTR

TUR

GreeceGR

GRC

EcuadorEC

ECU

SerbiaRS

SRB

Hungary

HU

HUN

El Salvador

SV

SLV

Botswana

BW

BWA

IcelandIS

ISL

Columbia

CO

COL

Macedonia

MK MKD39

IrelandIE

IRL

Faroe Islands

FO

FRO

Italy

IT

ITA

GeorgiaGE

GEO

Latvia

LV

LVA

India

IN

IND

Romania

RO

ROM,
ROU

IsraelIL

ISR

Lithuania

LT

LTU

Malawi

MW MWI

Luxembourg

LU

LUX

Malaysia

MY MYS

Netherlands

NL

NLD

Malta

MT

NorwayNO

NOR

Moldova

MD MDA

PolandPL

POL

Namibia

NA NAM

Slovakia

SK

SVK

Nepal

NP

NPL

SloveniaSI

SVN

New Zealand

NZ

NZL

Spain

ES

ESP

Peru

PE

PER

SwedenSE

SWE

Singapore

SG

SGP

Liechtenstein

LI

LIE

ThailandTH

THA

Switzerland

CH

CHE

Ukraine

UA UKR

ZambiaZM ZMB

Japan

JP

3.

MCO

JPN

MU MUS

Uruguai

UY

URYÅland Islands

AX

ALA

Brunei darussalam BN

BRN

KR

MC

MLT

MauritiusSouth Korea

MonacoKOR

TYPES OF VERIFICATION PROCEDURES FOR SUPPORTED COUNTRIES
3.1.

3.2.

CryptoWallet applies the following measures for low-and medium-risk countries:
3.1.1.
Basic Customer Due Diligence:
3.1.1.1.
Identity verification
3.1.1.2.
Liveness check3.1.1.3.
Residence address collection
3.1.1.4.
Sanction/PEP/Adverse Media initial and ongoing screening
3.1.1.5.
Additional measure: Customer Due Diligence questionnaire
3.1.2.
CryptoWallet may apply Enhanced Due Diligence measures at any time for clients from low- andmedium-risk countries at its sole discretion. Alternatively, if a client from a low- or medium-riskcountry is determined to have a high-risk level based on the results of a risk assessment, they may
be granted a high-risk status
CryptoWallet applies the following measures for High risk countries:40

3.2.1.

4.

5.

Enhanced Customer Due Diligence:
3.2.1.1.
Identity verification
3.2.1.2.
Liveness check3.2.1.3.
Sanction/PEP/Adverse Media initial and ongoing screening
3.2.1.4.
Residence address collection and verification with Proof of address
3.2.1.5.
Additional measure : Enhanced Due Diligence questionnaire
3.2.1.6.
Additional measure : Source of Funds or Source of wealth based on clients expected
turnover

ADDITIONAL VERIFICATION MEASURES
4.1.

In addition to undergoing the Customer Due Diligence process for low- and medium-risk countries andEnhanced Due Diligence for High-Risk Countries during the initial account registration and establishmentof the client relationship, clients are required to complete a comprehensive questionnaire. This
questionnaire is specifically designed to gather detailed information regarding the client's planned
activities in connection with CryptoWallet Services. The purpose of this thorough inquiry is to ensure a
precise understanding of the client's needs, objectives, and the intended use of our services

4.2.

For low- and medium-risk countries, CryptoWallet applies a questionnaire to collect from client thefollowing information:
4.2.1.
The client should indicate what his main purpose is for using CryptoWallet services;
4.2.2.
The client should indicate his expected monthly turnover with CryptoWallet services.
4.2.3.
The client should indicate his current occupation and annual income.
4.2.4.
The client should indicate his source of funds (cryptocurrency /fiat currency).

4.3.

For high-risk countries, CryptoWallet applies as part of Enhanced Due Diligence Procedure aquestionnaire to collect from client the following information and documentation:
4.3.1.
The client should indicate what their main purpose is for using CryptoWallet services;
4.3.2.
The client should indicate his expected monthly turnover with CryptoWallet services.
4.3.3.
The client should indicate his current occupation and annual income.
4.3.4.
The client should indicate his source of funds (cryptocurrency /fiat currency).
4.3.5.
The client should provide documentation that confirms his source of funds or source of wealth4.3.6.
The client should indicate whether he is a Politically Exposed Person (PEP), a family member ofa PEP, or a close associate of a PEP.
4.3.6.1.
If the answer is yes, the client should clarify what type of PEP he is.
4.3.7.
The client should indicate whether he currently performs or has previously performed businessactivities.
4.3.7.1.
If the answer is yes, the client should clarify the type of activity and the company
involved

RESTRICTED COUNTRIES
5.1.
The use of CryptoWallet services in certain jurisdictions is restricted or prohibited due to legal andregulatory considerations. Currently prohibited country list:

Algeria
Cayman Islands
Afghanistan
Belarus
Bouvet Island
Central African Republic
Congo

DZ
KY
AF
BY
BV
CF
CG

DZA
CYM
AFG
BLR
BVT
CAF
COG

41

Congo democratic republic
Ethiopia
French Guiana
French Southern territories
Iran
Democratic people's republic of Korea
Libya
Nicaragua
Palestine
RussiaSint EustatiusSouth Sudan
Syria
BahamasBonaireChristmas Island
Cuba
Falkland Islands
French Polynesia
Guinea-Bissau
Iraq
Lebanon
Myanmar
Pakistan
Panama

CD
ET
GF
TF
IR
KP
LY
NI
PS
RU
BQ
SS
SY
BS
BQ
CX
CU
FK
PF
GY
IQ
LB
MM
PK
PA

COD
ETH
GUF
ATF
IRN
PRK
LBY
NIC
PSE
RUS
BES
SSD
SYR
BHS
BES
CXR
CUB
FLK
PYF
GUY
IRQ
LBN
MMR
PAK
PAN

Saba=Bonaire and Sint Eustatius
Somalia
Sudan
Trinidad and tobago
Yemen
JordanChina
puerto rico
United States
Venezuela
Western Sahara
KosovoMali
Zimbabwe
Egypt
Guam
Guinea Bissau
Haiti

BQ
SO
SS
TT
YE
JO
CN
PR
US
VE
EH
QZ
ML
ZW
EG
GU
GW
HT

BES
SOM
SSD
TTO
YEM
JOR
CHN
PRI
USA
VEN
ESH
QZZ
MLI
ZWE
EGY
GUM
GNB
HTI

42

Honduras
Virgin Islands, British
Bangladesh
Crimean Peninsula
Donetsk Region
Luhansk Region
Zaporizhzhia
KhersonHong Kong
Kerch
Transnistria region
Tunisia
Saudi Arabia
Tonga
Vanuatu
GuyanaWallis and Futuna
TuvaluMozambiqueSaint vincent and the grenadines
SenegalBosnia and Herzegovina
BurundiDarfur = western Sudan
Ghana
Laos
Antarctica
Bouvet islands
EritreaSouth georgia and the south sandwich islands
Heard island and mcdonald islands
United Kingdom
Barbados
Burkina Faso
Cameroon
Gibraltar
Jamaica
Niger
Nigeria
Tanzania
Uzbekistan
Vietnam
Uganda

HN
VG
BD

HND
VGB
BGD

HK

HKG

TN
SA
TO
VU
GY
WF
TV
MZ
VC
SN
BA
BI
SD
GH
LA
AQ
BV
ER
GS
HM
GB
BB
BF
CM
GI
JM
NE
NG
TZ
UZ
VN
UG

TUN
SAU
TON
VUT
GUY
WLF
TUV
MOZ
VCT
SEN
BIH
BDI
SDN
GHA
LAO
ATA
BVT
ERI
SGS
HMD
GBR
BRB
BFA
CMR
GIB
JAM
NER
NGA
TZA
UZB
VNM
UGA

43

Morocco
Swaziland=Eswatini
British indian ocean territory
American Samoa
6.

MA
SZ
IO
AS

MAR
SWZ
IOT
ASM

COUNTRY RISK REVIEW:
6.1.
Periodic review:
6.1.1.
The country risk list will be subject to regular reviews at least every 6 months to assess thecurrent geopolitical and economic landscape.
6.2.
Emerging Risks:
6.2.1.
The list will be updated promptly in the event of emerging risks or significant changes in thepolitical, economic, or security conditions of a country.
6.3.
Regulatory Changes:
6.3.1.
Any changes in international regulations or sanctions that impact the risk profile of a country willprompt an immediate review and update of the list.

44