ANTI-MONEY LAUNDERING AND COUNTERING THE FINANCING OF TERRORISM POLICY

From: 1/10/2026

Digital Assets d.o.o. (hereinafter: the Company) is committed to the effective prevention of money laundering and the financing of terrorism (hereinafter: AML/CFT). The Company is a crypto-asset service provider supervised by the Croatian Financial Services Supervisory Agency (Hanfa) and is authorised to provide crypto-asset services in accordance with Regulation (EU) 2023/1114 on markets in crypto-assets (hereinafter: MiCA).

This AML/CFT Policy (hereinafter: the Policy) is a public summary of the measures, actions, and procedures that the Company applies in its day-to-day operations for the purpose of effective AML/CFT. The Policy does not replace the Company's internal acts adopted in accordance with applicable regulations, nor shall it be construed as an exhaustive description thereof.

LEGAL FRAMEWORK

In its operations, the Company applies in particular:

• the Act on the Prevention of Money Laundering and Financing of Terrorism (Official Gazette Nos. 108/17, 39/19, and 151/22, hereinafter: the AML/CFT Act) and the regulations adopted pursuant thereto
• Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (hereinafter: the Transfer of Funds Regulation)
• MiCA and the delegated and implementing acts adopted pursuant thereto
• directly applicable European Union regulations on international restrictive measures and the Croatian regulations governing their implementation
• applicable guidelines and instructions issued by the regulator or another competent authority.

The Company monitors developments in the European Union's AML/CFT legislative package and aligns its operations within the prescribed deadlines.

INTERNAL AML/CFT MEASURES

In accordance with the AML/CFT Act and related regulations, the Company carries out at least the following activities:

• preparing and regularly updating the assessment of money laundering (hereinafter: ML) and the financing of terrorism (hereinafter: FT) risks
• establishing policies, controls, and procedures for the effective management of ML and FT risks
• applying client due diligence measures
• screening clients and transactions against international restrictive measures
• ensuring that transfers of crypto-assets are accompanied by the information required under the Transfer of Funds Regulation
• monitoring business relationships and transactions, including crypto-asset transactions
• reporting suspicious transactions, funds, and persons to the competent authority
• appointing a Money Laundering Reporting Officer (MLRO) and their deputies
• providing regular employee training
• retaining and protecting data and maintaining records.

The Company carries out all activities and processes prescribed by the AML/CFT Act when establishing business relationships with clients and when conducting occasional transactions at its branches.

ML AND FT RISK ASSESSMENT

The Company identifies, assesses, and understands the ML and FT risks to which it is exposed and implements measures to mitigate, avoid, or accept them. The analysis covers risks relating to clients, geographic areas, products, services, transactions, and delivery channels.

Risks are classified as low, medium, high, or unacceptable, with appropriate due diligence measures applied to each category. The Company updates its risk assessment at least once a year and whenever there is a material change in its operations or risk exposure.

POLICIES, CONTROLS, AND PROCEDURES

The Company has established a system of internal controls and adopted internal acts for the effective management of ML and FT risks. These measures include a defined organisational structure and responsibilities, client due diligence procedures, risk management, employee training, record keeping, and regular independent audits of the AML/CFT system.

CLIENT DUE DILIGENCE

Client due diligence includes identifying and verifying the identity of natural and legal persons, their representatives, and their beneficial owners on the basis of reliable and independent documents and data, as well as obtaining information on the purpose and intended nature of the business relationship and, where required, information on the source of funds.

At the Company's branches, client identification is carried out in person by employees. Where a business relationship is established remotely, identification is carried out by means of electronic identification in cooperation with an external service provider, in accordance with applicable regulations.

The Company applies a risk-based approach and, depending on the assessed risk, applies simplified, standard, or enhanced due diligence. Enhanced due diligence is applied in particular to business relationships and transactions involving politically exposed persons, clients associated with high-risk third countries, complex or unusually large transactions, and other circumstances of increased risk identified in the AML/CFT Act and the Company's internal acts.

Clients are required to provide the Company with accurate, complete, and up-to-date data and documentation and to notify the Company without delay of any relevant changes.

Where client due diligence cannot be carried out in full, or where illegal activity is suspected, the Company will refuse the transaction, refuse to establish a business relationship, or terminate an existing business relationship, and will consider whether an obligation to notify the competent authority arises.

INTERNATIONAL RESTRICTIVE MEASURES

The Company screens clients, their beneficial owners, and transactions against lists of persons and entities subject to restrictive measures, including the restrictive measures of the United Nations, the European Union, and the United Kingdom, upon the establishment of a business relationship, on an ongoing basis throughout its duration, and when conducting occasional transactions at its branches.

The Company does not establish business relationships with persons subject to restrictive measures, nor does it conduct occasional transactions for such persons. Where required by applicable regulations, the Company freezes funds and crypto-assets and notifies the competent authorities.

TRANSFERS OF CRYPTO-ASSETS

In accordance with the Transfer of Funds Regulation, the Company ensures that transfers of crypto-assets are accompanied by the required information on the originator and the beneficiary, and exchanges such information with other crypto-asset service providers involved in the transfer.

For transfers involving self-hosted addresses, the Company applies risk-based measures, including, where required, verification of the client's ownership or control of the self-hosted address. The Company may refuse, suspend, or return a transfer of crypto-assets that is not accompanied by the required information, and may request additional information and documentation from the client before executing or approving the transfer.

MONITORING OF BUSINESS RELATIONSHIPS AND TRANSACTIONS

The Company continuously monitors business relationships and transactions to ensure that they are consistent with its knowledge of the client, the client's risk profile, and, where necessary, the client's source of funds.

Key measures include verifying that activities and transactions are consistent with their previously established purpose and nature, analysing the source of funds, monitoring transactions that deviate from usual patterns, and updating client documentation and data.

Monitoring is carried out through a combination of automated systems and manual review, including the use of specialised blockchain analytics tools to screen crypto-asset transactions, wallet addresses, and their counterparties.

RESTRICTIONS ON THE PROVISION OF SERVICES

The Company does not establish or maintain business relationships with anonymous clients, with persons subject to restrictive measures, with persons for whom client due diligence cannot be carried out, or with persons from jurisdictions in which the Company does not provide its services. Based on its risk assessment, the Company may restrict or refuse to support particular crypto-assets, services, or types of transactions.

REPORTING OF SUSPICIOUS ACTIVITIES

In accordance with the AML/CFT Act, the Company reports any suspicion, knowledge, or reasonable grounds to suspect ML or FT to the competent authority and acts upon the orders of the competent authority, including the temporary suspension of the execution of transactions.

EMPLOYEE TRAINING

The Company ensures that all employees involved in AML/CFT activities are familiar with the applicable regulations and internal acts. This is achieved through regular internal and external training sessions, seminars, and an annual training programme.

DATA PROTECTION AND RECORD KEEPING

The Company retains data and documentation on clients, transactions, and business relationships for the periods prescribed by the AML/CFT Act and processes personal data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection regulations, ensuring the confidentiality and security of client data.

FINAL PROVISIONS

This Policy is a summary of the Company's internal AML/CFT framework. The Company's operations are governed in full by the Company's internal acts adopted in accordance with applicable regulations. The Company reserves the right to amend this Policy at any time in order to maintain compliance with applicable regulations.

This Policy supersedes all previous versions of the Policy that applied prior to its date of entry into force.