ANTI-MONEY LAUNDERING AND COUNTER FINANCING TERRORISM POLICY

March 24, 2025

1. OVERVIEW

1.1. This Anti-Money Laundering and Counter-Terrorist Financing Policy (hereinafter referred to as the «Policy») of MWelt AG (hereinafter referred to as the «Company») establishes the fundamental principles and procedures adopted to mitigate risks associated with money laundering and terrorist financing (hereinafter «ML/CTF»).

1.2. While the Company is not legally required to comply with AML/CTF regulations, we acknowledge the importance of implementing rigorous measures to prevent any potential involvement in illicit financial activities. This proactive approach reflects our commitment to international best practices and reinforces the integrity of our operations. MWelt AG upholds the highest ML/CTF compliance standards and requires its management and employees to adhere strictly to these measures, ensuring our services are not exploited for unlawful purposes. This Policy outlines the Company’s dedication to identifying, preventing, and reporting any suspicious activity.

1.3. MWelt AG defines money laundering in accordance with applicable Swiss regulations and international AML standards. Under these guidelines, money laundering is considered to include:

• The conversion or transfer of assets derived from criminal activities, or assets obtained in exchange for such assets, while knowing that they originate from illicit sources, with the intent to conceal their unlawful origin or to assist individuals involved in such crimes in evading legal consequences.

• The acquisition, possession, or use of assets obtained from criminal activities, knowing at the time of receipt that they originate from such activities.

• The concealment or misrepresentation of the true nature, source, location, movement, ownership, or rights associated with assets derived from criminal activities.

• Participation in, conspiracy to commit, attempts to commit, or assistance in executing any of the above activities, including facilitating, advising, or enabling such actions.

• Money laundering is deemed to have occurred even when the underlying criminal activity that generated the illicit funds was committed outside Switzerland.

• Money laundering remains applicable even when the exact details of the criminal activity that produced the illicit assets cannot be fully identified.

1.4. This Policy applies to all employees, executives, and directors of MWelt AG. It defines the Company's approach to detecting, mitigating, and managing money laundering and terrorist financing risks, ensuring ethical business practices and financial transparency. MWelt AG is committed to training its employees on AML/CTF obligations, continuously monitoring compliance, and enforcing preventive measures. Through this approach, the Company not only fulfills its legal responsibilities but also reinforces its commitment to maintaining the highest standards of financial integrity.

2. PURPOSE

2.1. The primary purpose of this Anti-Money Laundering and Counter-Terrorist Financing Policy is to outline the commitment of Company to preventing the use of its services for money laundering or terrorist financing activities. This Policy establishes the framework for identifying, assessing, and mitigating risks associated with financial crimes to maintain the integrity of the Company and its operations.

2.2. This Policy is designed to ensure that the Company complies with applicable laws, regulations, and international standards in relation to money laundering and the financing of terrorism. It defines the responsibilities of the Company, its employees, and its management in detecting and preventing financial crimes, and it ensures that appropriate measures are in place to report suspicious activities.

2.3. The Company is committed to maintaining a culture of compliance where the prevention of money laundering and terrorist financing is embedded in all aspects of its business operations. This includes adopting procedures for monitoring and reporting suspicious activities, conducting due diligence on clients, and ensuring that employees are adequately trained to recognize and respond to potential ML/CTF risks.

2.4. The Company recognizes that effective prevention and detection of financial crimes requires continuous monitoring, regular updates to this Policy, and the implementation of controls that adapt to emerging risks. Through this Policy, the Company demonstrates its dedication to upholding the highest standards of financial integrity, transparency, and ethical conduct in all of its business dealings.

3. DUE DILIGENCE MEASURES

3.1. While the Company is not legally required to comply with Anti-Money Laundering (AML) and Counter Financing of Terrorism (CFT) regulations, we voluntarily implement the following due diligence measures to proactively address potential risks related to financial crime.

3.2. The due diligence measures include:

• We ensure that any business relationships are carefully assessed to verify the identity of involved parties and identify any potential risks.

• We verify the accuracy of information collected during business dealings, especially when there are concerns about the authenticity or adequacy of the provided details.

3.3. Employee Awareness:

• Employees are regularly updated on relevant practices and procedures to identify and manage risks associated with financial crime.

• Clear guidelines are provided to employees on identifying and reporting suspicious transactions.

3.4. Record Keeping:

• We maintain essential records of customer transactions and related documents in a secure manner to ensure that they can be accessed when needed.

• Records are kept for a reasonable period, in line with standard industry practices.

3.5. Compliance Oversight:

• A designated person oversees our compliance measures and ensures that we remain aligned with best practices.

• Regular reviews and audits are carried out to check the effectiveness of our internal policies.

3.6. Enhanced Due Diligence (EDD):

• We conduct more detailed checks for higher-risk customers or transactions, such as those involving large amounts or high-risk jurisdictions.

• Additional information may be required for these cases to ensure transparency and mitigate any potential risks.

4. IDENTIFICATION

4.1. When identifying clients, whether they are individuals or legal entities, it is essential for employees to collect specific information to ensure full compliance with regulations and to accurately establish the identity of the client or their representative. For individual clients (natural persons), the following information must be gathered:

• Employees must record the complete legal name of the client as it appears on official identification documents.

• If applicable and available, the client's personal identification code should be collected to further validate their identity.

• Employees must verify and collect information regarding the client's right to represent themselves or act on behalf of others. If a legal right of representation exists, details about the document granting such rights, including the document's title, date of issue, and the name or title of the issuer, should be recorded.

4.2. For legal entities, including Swiss-registered companies, branches of foreign companies in Swiss, and foreign legal entities, the following information must be collected and securely stored to ensure compliance and avoid any involvement in illicit activities such as money laundering or terrorist financing:

• Employees should record the official business name or legal entity name as registered.

• The registry code or registration number assigned to the legal entity, along with the date and time of registration, must be recorded for verification purposes.

• Employees should obtain the names of the manager(s) or members of the management board or any other body responsible for the entity's representation. Their specific powers and authority to act on behalf of the entity should also be clarified and documented.

• Contact details of the legal entity, such as email, phone numbers, and physical addresses, must be collected to ensure effective communication.

• Information on the right of representation must be obtained, including any power of attorney or other legal document granting authority to a representative. This should include details such as the name, the date of issuance, and the issuer’s details.

• The beneficial owner(s) of the legal entity must be identified and documented. Employees should gather key information on the beneficial owner’s identity, including their full name, date of birth, nationality, and the extent of their ownership or control within the entity.

By collecting and securely storing this essential information, employees ensure that the company complies with legal and regulatory requirements while also safeguarding against the risk of involvement in money laundering and terrorist financing activities. These measures not only help verify the legitimacy of clients but also provide critical documentation should it be required by regulatory authorities.

5. RISKS RELATED TO MONEY LAUNDERING AND TERRORIST FINANCING

5.1. To address and mitigate the risks associated with money laundering and terrorist financing, certain prohibitions and obligations apply to both the employees and the company. These actions are designed to prevent illegal activities and ensure compliance with applicable regulations:

5.1.1. Prohibited Actions:

• It is strictly prohibited to establish a business relationship or proceed with a transaction if there are reasonable suspicions of money laundering or terrorist financing.

• Transactions cannot proceed if the identity of a participant in a client or occasional transaction cannot be verified through reliable and independent sources of information.

• Employees must understand the full scope and purpose of any business relationship or occasional transaction. This includes identifying the client’s business location, trade or professional activities, primary trading partners, and methods of payment.

5.2. All transactions must be continuously monitored to ensure they align with the client’s known activities and risk profile.

5.3. Documents and information collected during the due diligence process must be regularly updated to reflect any changes in the client’s circumstances.The source of funds used in transactions must be thoroughly identified and documented. Special attention must be given to transactions that appear complex, unusually large, or deviate from typical client behavior, as they may indicate criminal activity, money laundering, or terrorist financing.Extra scrutiny is required for transactions involving clients from high-risk countries or territories.

5.4. The purpose of diligence measures is to gather sufficient information to identify the client, determine the origin of funds used in transactions, and ascertain the true beneficiary of those funds. Employees should focus on understanding the client’s background, financial activities, and any connections that may suggest higher risk.

5.5. Employees must fulfill their legal obligation to report any suspicions of money laundering or terrorist financing to the appropriate authorities. This obligation does not breach confidentiality laws or contracts, and employees reporting suspicions in good faith will be protected from liability.

5.6. The company is committed to protecting employees who report suspicions of money laundering or terrorist financing from retaliation, threats, or any form of unfair treatment. Measures must be in place to ensure that employees can report their concerns without fear of negative consequences.

By implementing these comprehensive due diligence and reporting measures, the company ensures that it remains compliant with regulatory standards, effectively managing and mitigating the risks associated with money laundering and terrorist financing activities. Regular monitoring by regulatory bodies helps ensure these measures are consistently adhered to.

6. ENHANCED DUE DILIGENCE MEASURES

6.1. In circumstances where an employee encounters a client or transaction that presents a high risk of financial crime or legal violations, they are required to implement additional due diligence measures to mitigate these risks effectively. These enhanced measures include:

• To better understand the nature of the transaction and the risks involved, employees must gather further details about the client and any individuals with beneficial ownership.

• Understanding the client’s intended actions is vital to evaluating the associated risks, enabling employees to apply the appropriate level of due diligence.

• Employees should obtain information regarding the client’s financial resources and the origin of their wealth, as this helps assess the legitimacy of funds and detect any potential money laundering or terrorist financing activities.

• Before establishing or continuing a business relationship under high-risk conditions, approval from senior management must be obtained, ensuring that such decisions are made at the highest levels within the organization.

6.2. In addition to the above measures, employees must consider implementing one or more of the following precautionary actions to further mitigate risks:

• If the company’s operations are located in a high-risk country, the relevant activities must be halted to prevent exposure to potential risks.

• Employees should initiate an extraordinary audit of any subsidiary or branch operating in a high-risk jurisdiction to assess and address any risks associated with that location.

• Correspondent banking relationships with entities located in high-risk jurisdictions should be thoroughly assessed and, if necessary, terminated to reduce exposure to illicit financial activities.

By adopting these enhanced due diligence measures, companies can effectively identify and mitigate the risks associated with high-risk clients and transactions, ensuring compliance with regulations and preventing involvement in money laundering and terrorist financing activities.

7. TRAINING AND EMPLOYEE EDUCATION

7.1. All employees of the Company will undergo mandatory AML/CFT training during onboarding and annually thereafter. This training will focus on identifying, preventing, and reporting money laundering and terrorist financing activities. Employees in key roles, such as those handling high-value transactions or occupying compliance positions, will receive additional, specialized training suited to their responsibilities.

7.2. The Company will provide ongoing updates and refresher courses to ensure employees are informed of the latest developments in AML/CFT regulations and best practices. Training records will be maintained, documenting the dates, content, and participants of all training sessions.

8. MONITORING

8.1. The Company will implement manual systems to monitor transactions for any unusual or suspicious activity.

8.2. The Compliance Department will conduct detailed reviews of flagged transactions to determine whether further investigation is required, ensuring that potential risks are promptly addressed and mitigated. Regular audits will be carried out to evaluate the effectiveness of the manual monitoring process, capture any anomalies, and continuously improve the monitoring framework in alignment with the latest regulatory requirements and industry best practices.

9. DATA PRIVACY AND RECORD RETENTION

9.1. The Company is committed to implementing robust data security measures to protect customer information and transaction records from unauthorized access, alteration, or destruction.

• Access to sensitive data will be restricted to authorized personnel only, who will undergo regular training on data protection and security practices.

• Employees with access to sensitive data will be required to sign confidentiality agreements outlining their responsibilities and obligations regarding data protection.

• The Company will conduct periodic background checks on employees with access to sensitive data to ensure their continued trustworthiness and reliability.

• Regular security audits and assessments will be conducted to identify and address potential vulnerabilities in the data protection system.

9.2. Record Retention:

• All transaction records and customer identification documents will be retained for a minimum of five years from the date of the transaction or the termination of the business relationship, whichever is later.

• Records will be stored securely in electronic format, with access restricted to authorized personnel through secure authentication methods.

• Physical records, if maintained, will be stored in locked and secure locations, accessible only to authorized personnel.

• Records will be regularly backed up to prevent data loss due to hardware failure or unforeseen events.

• In the event of a data breach or security incident, the Company will promptly notify affected parties and regulatory authorities in accordance with applicable laws and regulations.

• Records will be made available to regulatory authorities upon request, with proper authorization and in compliance with relevant data protection laws.

9.3. Data Retention Policy:

• The Company will establish and maintain a data retention policy that outlines the procedures for retaining and disposing of customer information and transaction records.

• The policy will specify the types of data that must be retained, the retention period for each type of data, and the procedures for securely disposing of data that is no longer required.

• The policy will be regularly reviewed and updated to ensure compliance with applicable laws and regulations and to reflect changes in business practices.

9.4. Data Access Controls:

• Access to customer information and transaction records will be restricted to authorized personnel only, based on the principle of least privilege.

• Access permissions will be regularly reviewed and updated to ensure that only authorized personnel have access to sensitive data.

• Strong authentication measures, such as multi-factor authentication, will be implemented to prevent unauthorized access to sensitive data.

• All access to sensitive data will be logged and monitored to detect and prevent unauthorized access attempts.

9.5. Data Encryption:

• The Company will encrypt all sensitive data, both in transit and at rest, to protect it from unauthorized access or interception.

• Strong encryption algorithms will be used to ensure the confidentiality and integrity of the data.

9.6. Data Disposal:

• When customer information or transaction records are no longer required, the Company will ensure that they are securely disposed of to prevent unauthorized access or disclosure.

• Secure data disposal methods, such as shredding or secure erasure, will be used to permanently delete data from storage devices.

• Records of data disposal activities will be maintained to demonstrate compliance with data protection laws and regulations.

10. CONFIDENTIALITY

10.1. The company is committed to maintaining the confidentiality of all information related to its clients, employees, partners, as well as internal documents and operations. All individuals who have access to confidential information are required to adhere to the provisions of this policy and take all necessary steps to protect such information.

10.2. Confidential information includes, but is not limited to:

• Personal data of clients and employees

• Business strategies, financial data, and projections

• Internal communications and operational procedures

• Any other information deemed confidential by the company or disclosed under a non-disclosure agreement (NDA)

10.3. Access to confidential information will be granted only to authorized personnel who need the information to perform their duties. All access will be logged and monitored to ensure that only authorized individuals have access.

10.4. All employees, contractors, and third parties working with the company are required to sign confidentiality agreements. These agreements outline the obligation to protect confidential information both during and after their engagement with the company.

10.5. Confidential information should only be used for legitimate business purposes and must not be disclosed to unauthorized parties under any circumstances, except when required by law or with prior written consent from the company.

10.6. The company will implement appropriate measures to safeguard confidential information from unauthorized access, theft, alteration, or loss. This includes using encryption technologies, secure storage solutions, and regular security audits.

10.7. Confidential information will be retained only for as long as necessary for business purposes or as required by law. Once the retention period expires, the company will ensure secure disposal of confidential information using industry-standard methods to prevent unauthorized access.

10.8. Any breach of confidentiality, whether intentional or accidental, will be investigated thoroughly. Employees found in violation of this policy may be subject to disciplinary action, up to and including termination of employment.

10.9. Employees and contractors are encouraged to report any concerns or breaches of confidentiality to the company’s Compliance Department or designated officer. The company will investigate any such reports promptly and take appropriate action.

11. REVIEW AND UPDATES

11.1. This policy will undergo an annual review. The review will be conducted by the Compliance Officer to evaluate the policy's suitability, adequacy, and effectiveness in preventing money laundering and terrorist financing activities.

11.2. Updates to this policy may be made when required to reflect changes in regulations, business practices, or other relevant factors. Updates will be promptly implemented following approval by the management board and communicated to all employees. Any modifications in AML/CFT regulations or guidelines issued by regulatory authorities will be swiftly reviewed, and this policy will be updated accordingly to ensure compliance with the latest requirements

11.3. Changes in business practices that may affect the policy’s effectiveness in preventing money laundering and terrorist financing will be assessed, and necessary updates will be made to ensure continued compliance and risk mitigation.