Anti-Money Laundering and Counter-Terrorist Financing Policy

This is the Anti-Money Laundering and Counter-Terrorist Financing policy (the "AML Policy") of VirtuVault Technologies EOOD, a company operating a platform for the purchase, sale, and exchange of cryptocurrencies.

VirtuVault Technologies EOOD is a limited liability company incorporated under the laws of the Republic of Bulgaria, UIC (ЕИК): 207524160, with registered address: Sofia 1404, Sofia District (Metropolis), Metropolitan Municipality, Triaditsa region, 49A Bulgaria Blvd, fl. 1.2, Office. VirtuVault Technologies EOOD, referred to for brevity as the "Company," includes its owners, directors, investors, employees, or other related persons. The terms "User," "you," and "your" refer to the user of the cryptocurrency trading platform owned by VirtuVault Technologies EOOD.

The Company follows strict rules against money laundering and the financing of terrorism, as set out by local and international laws and regulations, to prevent any kind of unlawful and criminal activity and any potential involvement of the Company in such activity. Accordingly, VirtuVault Technologies EOOD applies this Policy in compliance with the Measures Against Money Laundering Act (the "MAMLA" / "ZMIП").

Compliance with this Anti-Money Laundering and Counter-Terrorist Financing Policy by the User is mandatory. Users must read, review, understand, and then agree to the terms below before using or benefiting from any of the Company's services.

Definitions

"Applicable laws" means the laws in force at the time in the territory of the country in which the Company operates.

"Identification document(s)" refers to:

• National identity cards and passports and any other official identity document;
• Documents that identify the registered address of a natural or legal person, including but not limited to, bank statements and utility bills; or
• Other documents that may be specified and requested by the Company.

"Politically Exposed Person" (PEP) is a natural person who performs, or has been entrusted with, the following prominent public functions in the Republic of Bulgaria, in another EU Member State, or in a third country:

• Heads of state, heads of government, ministers and deputy or assistant ministers;
• Members of parliaments or other legislative bodies;
• Members of constitutional courts, supreme courts, or other high-level judicial bodies whose decisions are not subject to further appeal except in exceptional circumstances;
• Members of courts of auditors;
• Members of the governing bodies of central banks;
• Ambassadors and chargé d'affaires;
• Senior officers of the armed forces;
• Members of administrative, management, or supervisory bodies of state-owned enterprises and companies wholly owned by the state;
• Mayors and deputy mayors of municipalities, mayors and deputy mayors of districts, and chairs of municipal councils;
• Members of the governing bodies of political parties;
• Heads and deputy heads of international organizations, members of management or supervisory bodies in international organizations, or persons performing an equivalent function in such organizations.

"Persons associated with a PEP" are persons who have the following connections to a Politically Exposed Person:

• Spouses or persons living together in a de facto marital relationship;
• First-degree descendants and their spouses or persons with whom the first-degree descendants live in a de facto marital relationship;
• First-degree ascendants and their spouses or persons with whom the first-degree ascendants live in a de facto marital relationship;
• Collateral relatives up to the second degree and their spouses or persons with whom such relatives live in a de facto marital relationship;
• Any natural person known to be a joint beneficial owner with a PEP of a legal person or other legal arrangement, or who has close business, professional, or other commercial relations with a PEP;
• Any natural person who is the sole owner or beneficial owner of a legal person or other legal arrangement known to have been set up for the benefit of a PEP.

"Sanctions lists" are lists of natural persons, legal entities, and entire countries involved in or suspected of participation in unlawful and criminal activities. Such lists are provided, for example, by OFAC, the EU, the UN, etc.

"Beneficial owner" means:

• A person who directly or indirectly owns a sufficient percentage of the shares, interests, or voting rights, including through bearer shares, pursuant to § 2, para. 1, item 1 of the Supplementary Provisions of the MAMLA;
• A person exercising control within the meaning of § 1v of the Supplementary Provisions of the Commerce Act;
• A person exercising decisive influence in making decisions regarding the composition of management and supervisory bodies, transformations, termination of activities, and other matters of essential importance for the activity, pursuant to § 2, para. 3 of the Supplementary Provisions of the MAMLA;
• A person exercising ultimate effective control through the exercise of rights via third parties, including but not limited to rights granted by authorization, contract, or other transaction, as well as through other legal forms enabling the exercise of decisive influence via third parties, pursuant to § 2, para. 4 of the Supplementary Provisions of the MAMLA;
• A settlor, trustee, protector, beneficiary, or a person in whose main interest a trust is created or managed, or a person who ultimately exercises control over a trust through direct or indirect ownership or by other means, or a person holding an equivalent or similar position;
• A person in whose name and/or on whose behalf a given operation, transaction, or activity is carried out and who meets at least one of the conditions listed in § 2, para. 1, items 1–3 of the Supplementary Provisions of the MAMLA;
• A person performing the function of a senior managing official when no other person can be identified as the beneficial owner.

User Verification

The Company applies customer identification provisions by verifying the identity of each natural person wishing to conduct fiat transactions on the platform operated by the Company, and the identity of the beneficial owners of any company/organization wishing to become a corporate client of the Company.

Following established "Know Your Customer" (KYC) rules, regulations, and procedures, the Company requires identification information and documentation that the User must provide. For the purpose of verifying any User's identity, the Company may rely on appropriate and licensed third-party service providers to validate identification documents and other data provided by the User.

Any client who has passed KYC may conduct fiat transactions on the platform operated by the Company only if they use payment services in and on their own name.

Identification of natural persons

Any natural person wishing to transact on the Company's platform must be identified by collecting the following information:

• Full name;
• Date and place of birth;
• Personal identification number;
• An official identity document (national ID card and international passport) containing a photo, nationality, date of birth, and personal identification number, issued by the relevant state;
• Residential address;
• All citizenships held by the person;
• Information on professional activities and the reasons for planned or executed transactions;
• Source of funds to be used for trading on the platform;
• Expected monthly volume of purchases and sales.

The following checks are performed through an automated solution:

• Identity document verification;
• Real-time selfie;
• Face match against the image in the identity document;
• AML screening (international sanctions lists, PEPs, watchlists, and adverse media).

For natural persons whose trading volume over the last 120 days has exceeded the equivalent of EUR 15,000 (BGN 29,337.45), information on the source of funds is also required (completion of the relevant declaration and provision of supporting documentation demonstrating the stated source of funds).

The verification procedure for natural persons also applies to managers of legal entities wishing to use the services provided by the Company via a corporate account. In this regard, the manager must create a personal profile on bulto.io and pass the KYC procedure for natural persons.

Identification of legal entities and beneficial owners

General identity information
Each legal entity must undergo a verification process before starting to use the Company's services and must be identified by collecting the following information:

• Name;
• Registration number in the national register;
• Legal form under the local law of the state in which the legal entity is registered;
• Registered office and management address;
• A document confirming the company's address (bank statement, electricity/water or other utility bill) not older than 3 months;
• Information on business activities, licenses, registrations, share trading, clients, etc., and on the reasons for planned or executed transactions, in the form of a questionnaire;
• Information on the company's ownership structure;
• Articles of association/founding document;
• Most recent annual financial statements;
• Declaration identifying the beneficial owner.

Beneficial owners
The information the User must provide regarding the beneficial owners of the legal entity includes:

• The full name of each owner with at least 25% control over the company;
• An official identity document (such as a national ID card and international passport) containing a photo, nationality, date of birth, and personal identification number, issued by the relevant state.

If the legal entity is owned by another entity, the Company also requires:

• An extract from the commercial register;
• Articles of association/founding document;
• A document confirming the company's address (bank statement, utility bill);
• Information on the ownership structure (a chart).

Additional verification measures
For legal entities whose trading volume over the last 120 days has exceeded the equivalent of EUR 15,000 (BGN 29,337.45), information on the source of funds is also required (completion of the relevant declaration and provision of supporting documentation demonstrating the stated source of funds).

Screening against international sanctions lists

The Company is prohibited from conducting transactions with natural persons, companies, and countries listed on international sanctions lists; therefore, the Company screens its users against the relevant lists of the UN, the European Union, the UK HM Treasury, and the U.S. Office of Foreign Assets Control (OFAC), as well as other sanctions lists.

PEP screening

To identify Politically Exposed Persons among its Users, the Company does not rely solely on declarations provided by users, but also screens all individual account holders, all beneficial owners of corporate account holders, and any person who has access to a corporate account, against various domestic and international PEP lists.

Restrictions and refusal of service

Based on the information provided, the Company reserves the right, at its sole discretion, to refuse Users access to its services without prior notice. If the Company determines that any user information obtained in accordance with the described procedure is false, insufficient, or appears on a sanctions list, the Company may, at its discretion, either refuse/terminate the registration of such a user account or require re-verification of the documents and information provided by the respective User.

If the Company receives information that a User or an account is maintained under a false name, the Company has the full right to terminate and block such account immediately and without prior notice to the User.

VirtuVault Technologies EOOD also reserves the right to conduct ongoing identity checks on Users, especially in cases of unusual and suspicious activity or where the Company doubts the adequacy or reliability of previously received user identification data. Moreover, the Company has the right to request up-to-date documents from Users even if they have already passed identity verification in the past.

The Company reserves the right to terminate a User account, restrict and/or prevent access to its online platform, or report a User's activities to the competent law-enforcement authorities if there are suspicions of unlawful activity.

Sensitive personal information

Sensitive personal information is collected, shared, and stored securely in accordance with the Company's Privacy Policy and the General Data Protection Regulation (GDPR).

Retention of personal information

Personal data, documents, and information are stored for a period of 5 years after termination of the business relationship, in compliance with data-protection requirements under the Privacy Policy.

Risk-based approach

The Company is committed to the highest standards and therefore adopts a risk-based approach. As a result, the Company reserves the right to classify users into different risk categories based on the following factors:

• Place of residence, citizenship, and/or registered office of a person involved in a transaction;
• Characteristics of the person involved in the transaction;
• Economic activity and behavior of the person involved in the transaction.

VirtuVault Technologies EOOD maintains the confidentiality of risk categorization and may change any User's category at any time, taking into account various factors. Although Users have no right in any way to request disclosure of information regarding categorization, the Company may disclose a User's risk-categorization data to the competent law-enforcement authority if the Company determines that a specific User has carried out or is likely to carry out a suspicious transaction.

Changes

This Anti-Money Laundering and Counter-Terrorist Financing Policy may be reviewed and amended periodically. The User is required to visit the Company's website periodically and review the terms and any changes thereto. Continued use of the Company's services by the User constitutes consent to all amendments to the Policy.

If you have any questions regarding the Company's Anti-Money Laundering and Counter-Terrorist Financing Policy, please contact us at support@bulto.io.