AML / KYC / CTF Policy

SWSS Fintech Limited (the "Company") is unconditionally committed to the prevention of money laundering, terrorist financing, proliferation financing and the circumvention of international sanctions. The Company operates a zero tolerance posture in respect of financial crime and deploys the controls described herein to detect, deter and disrupt illicit activity across SWSS Chain Mainnet, SWSS Chain Testnet and all dependent SWSS Ecosystem products.

This Policy is calibrated to, and operates by reference to, the following non exhaustive instruments and guidance, in each case as amended, supplemented or replaced from time to time:

• The Financial Action Task Force ("FATF") 40 Recommendations, including the standards applicable to Virtual Asset Service Providers and the Travel Rule (Recommendation 16).
• Directive (EU) 2018/1673 ("6AMLD") and its predecessor Anti Money Laundering Directives.
• Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto assets.
• The U.S. Bank Secrecy Act, FinCEN guidance on convertible virtual currencies, and the Anti Money Laundering Act of 2020.
• Monetary Authority of Singapore ("MAS") Notice PS-N02 and analogous notices applicable to digital payment token services.
• United Kingdom Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
• The consolidated sanctions lists administered by OFAC, the European Union, the United Nations Security Council and His Majesty's Treasury.

CDD

Customer Due Diligence, the identification and verification of the User and the assessment of the business relationship.

EDD

Enhanced Due Diligence, augmented procedures applied to higher risk Users, counterparties or transactions.

PEP

Politically Exposed Person, a natural person entrusted with a prominent public function, and their family members and close associates.

Beneficial Owner

The natural person who ultimately owns or controls a User or on whose behalf a transaction is being conducted.

SAR / STR

Suspicious Activity Report / Suspicious Transaction Report, a confidential filing made to the competent Financial Intelligence Unit.

Travel Rule

FATF Recommendation 16, the obligation to transmit originator and beneficiary information alongside qualifying virtual asset transfers.

The Company adopts a documented, evidence based risk based approach pursuant to FATF Recommendation 1. Inherent risk is assessed across the dimensions of customer typology, geography, product, channel and counterparty. Residual risk is calibrated against the strength of mitigating controls, and the resulting risk rating drives the intensity of due diligence and ongoing monitoring applied to the relationship.

Users seeking access to regulated functionality must complete Customer Due Diligence procedures administered through SWSS Identity X and the Identity Verification Layer (IVL). The Company operates three tiers of verification, each commensurate with the risk profile of the functionality engaged.

Enhanced Due Diligence is mandatory in circumstances including, without limitation: (i) relationships with Politically Exposed Persons; (ii) Users connected to higher risk geographies, as identified by the FATF public statements or by the Company's internal geographic risk register; (iii) complex or unusually large transactions lacking apparent economic or lawful purpose; (iv) transactions involving privacy enhancing technologies, mixers or non compliant counterparties; and (v) any other circumstance giving rise to elevated residual risk.

All Users are screened, at onboarding and on a continuing basis, against the consolidated sanctions lists administered by OFAC, the European Union, the United Nations Security Council, His Majesty's Treasury and any further list designated by the MLRO. Positive or partial matches trigger immediate transaction holds and escalation to the MLRO for adjudication. Politically Exposed Persons, their family members and close associates are subject to senior management approval prior to onboarding and to EDD on a continuing basis.

For higher risk Users, institutional counterparties and material deed acquisitions through SWSS RwaX, the Company requires the production of documentary evidence demonstrating the source of the funds applied to a transaction (Source of Funds) and the lawful provenance of the User's overall wealth position (Source of Wealth). Acceptable evidence comprises audited financial statements, banking statements, sale instruments, tax filings, employment records and analogous corroborating instruments.

Transactions effected through SWSS surfaces are subject to risk calibrated monitoring rules and behavioural analytics designed to surface typologies consistent with money laundering, terrorist financing, sanctions evasion, market manipulation and fraud. The monitoring framework encompasses on chain analytics across SWSS Chain Mainnet, attribution intelligence covering bridge counterparties and external networks, and velocity, structuring and pattern rules applied to off chain settlement.

Where the MLRO determines that there exists knowledge, suspicion or reasonable grounds to suspect that funds or transactions are connected to criminal conduct, the Company shall file a Suspicious Activity Report (or the analogous Suspicious Transaction Report) with the competent Financial Intelligence Unit, without tipping off the User in accordance with applicable law. Internal escalation operates on a documented chain of accountability culminating in the MLRO.

All Customer Due Diligence dossiers, transaction records, screening results, escalation notes and SAR filings are retained for a minimum period of five (5) years following the termination of the business relationship, or for such longer period as is required by applicable law (typically up to seven (7) years under particular national regimes). Records are stored under access controls satisfying the security measures described in Section 11 of the Privacy Policy.

The Company does not provide Services to Users ordinarily resident in, organised under the laws of, or accessing the Services from, jurisdictions subject to comprehensive sanctions or otherwise designated as prohibited by the Company's geographic risk register. The current register, which may be amended from time to time without notice, is furnished on request to the address in Section 14.

The following activities are categorically prohibited across all SWSS surfaces:

• Money laundering, terrorist financing, proliferation financing and sanctions evasion.
• Receipt or transmission of the proceeds of crime, including ransomware, darknet market activity and child sexual exploitation material.
• Use of unauthorised privacy enhancing mixers, coin join services or non compliant Virtual Asset Service Providers.
• Bribery, corruption and the facilitation of tax evasion.

Ultimate accountability for compliance with this Policy rests with the Board of the Company. Day to day operation is delegated to the Money Laundering Reporting Officer, who reports directly to the Board and is afforded the seniority, independence and resources necessary to discharge the role. All personnel involved in the operation of the Services receive mandatory financial crime training upon onboarding and on a recurring annual basis, supplemented by role specific refresher modules.

Suspected financial-crime activity, regulator enquiries and matters relating to this Policy should be addressed in writing to the MLRO at the Legal Desk contact form below, marked for the attention of the "MLRO, Confidential". All such correspondence is handled under strict confidentiality and in compliance with applicable tipping off prohibitions.