1. Introduction

1.1. Purpose

Cryptoro OU and its subsidiaries (hereinafter “the Group”) are committed to maintaining the highest levels of ethical and professional behavior. We have zero tolerance for illegal and irregular acts that could affect our reputation and credibility.

The AML/CFT Policy of the Group is designed to ensure compliance with national and international legal requirements and legislation regarding Anti-Money Laundering and Terrorism Financing, as well as the implementation of International Sanctions. This policy aims to promote high ethical and professional standards and prevent the Group from being used intentionally or unintentionally in illegal or criminal activities performed by its customers.

‍

Money laundering includes:

● the conversion or transfer of property, knowing that such property

is derived from criminal activity or an act of participation in such activity, to conceal or disguise the illicit origin of the property or of assisting any person involved in the commission of

such activity to evade the legal consequences of his actions;

● concealing or disguising the true nature, sources, locations, dispositions, movements, and rights in regards to assets or ownership of property, knowing that such property is derived from criminal activity or an act of participation in such activity;

● the acquisition, possession, or use of property, knowing, at the time of receipt, that such property was derived from criminal activity or an act of participation in such activity;

● participation, association to commit, attempts to commit, and aiding, abetting, facilitating, and counselling the commission of any of the acts referred to in the preceding paragraphs.

Terrorist financing is the provision or collection of funds, by any means, directly or indirectly, with the intention that they should be used or in the knowledge that they are to be used, in full or in part, in order to commit any of the offenses within the meaning of Articles 1 to 4 of Council Framework Decision 2002/475/JHA of 13th of June 2002 on combating terrorism.

Sanctions Compliance

The Group ensures compliance with international sanctions regimes, including those imposed by the United Nations, the European Union, and other relevant authorities. Regular screening against updated sanctions lists is performed to avoid engaging in business with sanctioned entities or individuals.

1.2. Scope

This policy applies to all Cryptoro OU activities, including the Konto.com Exchange activity.

It applies to the following people and entities:

● The governing bodies of Cryptoro OU and any subsidiaries of Cryptoro OU, staff and consultants of Cryptoro OU group companies, regardless of their position, rank, or seniority (hereinafter referred to as"Cryptoro OU governing bodies and staff");

● Contractors, subcontractors, consultants, suppliers, beneficiaries, and, in general, relevant people or entities involved in the activities of Cryptoro OU and Konto Exchange (hereinafter referred to as the "Project Parties");

● Consultants, suppliers, service providers, and other people or entities in which Cryptoro OU holds equity interests or which are wholly or partially owned by Cryptoro OU; and

● All counterparties and other people through whom Cryptoro OU conducts business (collectively referred to herein as "Cryptoro OU's other counterparties and partners").

In order to ensure an effective anti-money laundering program and compliance with the European and local laws, internal rules and requirements, Cryptoro OU adopted know your customer and anti-money laundering procedures. The main coordinates of such procedures are:
A. Customer Due Diligence
B. Risk assessment
C. Transactions monitoring
D. Internal and External Reporting process. Reporting of suspicious transactions
E. Compliance assessment and testing
F. Staff Recruiting and Staff Training
G. Recording and Record keeping of Information.

2. Policy principles and rules

2.1. Risk Management Activities

The primary purpose of the risk management approach is to ensure the identification, assessment, scoring of risks, action planning, and mitigation of the potential risks the Group may be exposed to, concerning the laundering of proceeds of crime and financing of terrorism. To that end, the Group has developed procedures like “Know Your Customer” (KYC).

2.1.1. KYC

Accordingly, the Group performs necessary controls and takes additional measures for the identification and verification of the identity and/or address details of (potential) customers; the consistency of the income levels of customers, the sources of income of the customer; the possibility of the customers being included on national/international sanctions lists, etc.

The Group does not establish any business relations or perform the transaction requested if the proof of identification and verification is not made or sufficient information about the purpose of the business relations is not obtained, and the business relationship will be terminated when the identification and verification of the customer are not performed where it is required to be conducted in case of any suspicion related to sufficiency and accuracy/authenticity of the previously obtained identity details of the customer.

The standard customer due diligence process to be performed by the Group, at a minimum, as part of “Know Your Customer” measures may include:

- Identification and verification/authentication of the customer’s identity details, ultimate beneficial owners, authorized representatives under legal legislation and internal policies,

- Screening of the customers in case of the risk of them being on international sanctions lists,

- Determination of whether the customer and any related parties of the customer are a politically exposed person (PEP), or related/linked to a politically exposed person,

- Determination of whether the customer acts on behalf and/or account of other persons.

Enhanced due diligence measures are applied for customers during customer acceptance processes or subsequently. Enhanced due diligence involves the gathering of additional information to ensure that the person or entity is not participating in any improper or illicit conduct. This information should include but is not limited to, the source of the funds, the source of the individual or company’s wealth, and the individual’s occupation or the type of business.

2.1.2. Risk Assessment Methodology

All customers undergo an assessment process in respect of the potential risks of laundering proceeds of crime and the associated risks as part of the minimum standards set out under the AML/CFT Policy.

2.2. Monitoring and Control Activities

For the prevention of money laundering and of proceeds of crime and financing of terrorism, the Group carries out an ongoing monitoring and control process, mainly, concerning: High-risk customers and transactions, transactions with risky countries, and complex and unusual transactions.

2.3. Reporting of suspicious transactions

Suspicious transaction means the presence of any information, suspicion, or any matter which would require suspicion about the fact that the assets subject to a transaction, performed or attempted to be performed with or through the Group’s products, have been obtained illegally, or are used without authorization or for unlawful purposes, or are used by any terrorist organizations, terrorists or financiers of terrorism within such scope, or are related or associated with them.

The Group shall not provide any information to any person, including the persons who are a party to the relevant transaction, other than the information provided to the courts during any trial or the authorities as required by laws and regulations.

2.4. Retention of documentation

The Group retains any documents associated with its obligations in line with the requirements of the applicable laws and regulations and the relevant legislation on GDPR.

2.4.1. Secure Storage

All records are securely stored, ensuring that they are protected against unauthorized access, loss, or damage. Digital records are encrypted, and physical documents are kept in secure locations.

2.4.1. Accessibility for audits and reviews

Records must be accessible for internal audits, regulatory reviews, and compliance checks. The Group ensures that relevant documents can be retrieved promptly when required by authorities.

2.5. Training activities

Training activities are planned in coordination with internal procedures and organized for the entire staff of the Group as on-site (classroom learning) or off-site (e-learning programs, reminders, and awareness messages).

3. Final provisions

The Compliance Department is responsible for the evaluation and annual review of the Policy and, if deemed necessary, proposes amendments to recognize changes in the respective regulatory framework and continually improve operational efficiency and effectiveness.

Confidentiality of documents

All documents related to AML/CFT and international sanctions are confidential and proprietary to the company. They are intended solely for internal use. Unauthorized disclosure or use of these documents is strictly prohibited and may result in disciplinary action or legal consequences. Employees must respect the confidentiality of these documents and refrain from disclosing them to third parties without prior management approval.

‍

Any situation identified regarding non-compliance with this policy can be reported to the email address: legal@konto.com.