ANTI-MONEY LAUNDERING (AML) POLICY OF CATIVA CORPORATION GROUP S.A.

1. Introduction

CATIVA CORPORATION GROUP S.A. establishes this policy to ensure full compliance with national and international regulations related to Anti-Money Laundering (AML).

1.1 Purpose

This policy defines the principles, guidelines, and procedures to be followed in order to prevent and detect illicit activities within the company, mitigating operational, legal, and reputational risks associated with money laundering and terrorist financing.

1.2 Applicability

This policy applies to:

• All company employees;

• Clients and users of its services;

• Business partners, service providers, and suppliers;

• Third parties who, directly or indirectly, interact with the company in financial operations.

1.3 Legal Basis

The company operates in compliance with major international standards and regulations aimed at preventing financial crimes, ensuring a strict commitment to transparency and integrity in its operations. Applicable regulations include:

• Law No. 23 of April 27, 2015 of Panama, which establishes measures for the prevention of money laundering, terrorist financing, and the proliferation of weapons of mass destruction, as well as regulating the obligations of subject entities;

• Recommendations of the Financial Action Task Force (FATF/GAFI), which provide global best practices for combating money laundering and terrorist financing;

• United Nations Convention against Transnational Organized Crime (Palermo Convention), which establishes mechanisms for international cooperation in combating organized crime;

• United Nations Convention against Corruption (Merida Convention), which defines guidelines to prevent, detect, and punish corruption in both the public and private sectors;

• European Union Directives and United Nations Security Council Resolutions on Financial Sanctions, applicable to transactions and operations involving jurisdictions and entities subject to international restrictions.

Compliance with these regulations reflects the company’s commitment to ethical business practices aligned with international guidelines on combating financial crimes and transnational illicit activities.

2. Risk-Based Approach (RBA)

The company adopts a Risk-Based Approach (RBA) to determine the appropriate levels of Due Diligence and monitoring, in line with FATF best practices.

2.1 Business Risk Assessment (BRA)

The company conducts an annual detailed risk assessment to identify specific vulnerabilities in its operations.
Key factors assessed include:

• Client profiles and sources of income;

• Nature of transactions and financial volumes;

• High-risk jurisdictions and geographic exposure;

• Accepted payment methods, with special attention to digital currencies and international transfers;

• Use of emerging technologies that may facilitate anonymity in transactions.

Mitigation Measures
Based on this analysis, the company will implement proportional mitigating measures according to the level of identified risk.

3. Customer Due Diligence (CDD)

3.1 Identification and Verification of Identity

Before establishing any business relationship, the company must fully identify the client, collecting the following documents:

Individuals

• Valid identification document (passport, national ID, or driver’s license);

• Proof of address (utility bill, phone bill, or bank statement);

• Proof of source of income (pay slip, employment contract, or tax return).

Legal Entities

• Commercial registration and articles of incorporation;

• Identification of shareholders and directors;

• Declaration of the origin of company funds;

• Identification of Ultimate Beneficial Owners (UBOs).

3.2 Client Risk Classification

Clients will be classified into three categories:

• Low Risk → Clients with an economic and transactional profile consistent with their documentation.

• Medium Risk → Clients conducting high-volume transactions or with limited financial transparency.

• High Risk → Politically Exposed Persons (PEPs), companies in high-risk sectors, or clients in countries under international sanctions.

Enhanced Due Diligence (EDD) for High-Risk Clients
Clients classified as high risk will be subject to additional measures, including:

• Request for additional documentation regarding the origin of funds;

• Ongoing monitoring and periodic reviews of financial activity;

• Detailed oversight of international transactions.

4. Ongoing Monitoring and Reporting of Suspicious Transactions

4.1 Transaction Monitoring

The company will implement an automated monitoring system using artificial intelligence and algorithms to identify potentially suspicious transactions.
Alert criteria include:

• Large deposits or withdrawals without economic justification;

• Transfers to high-risk countries without clear purpose;

• Structuring operations to avoid reporting thresholds.

4.2 Suspicious Transaction Reports (STR)

Any suspicious transaction will be immediately documented and analyzed by the Compliance Officer. If the risk is confirmed:

• A Suspicious Transaction Report (STR) will be submitted to Panamanian and international authorities within 24 hours;

• The client’s account may be temporarily blocked until the investigation is concluded.

Whistleblower Protection: All employees reporting suspicious activities will be protected against retaliation.

5. Training and Auditing

5.1 Mandatory Training

• All employees must participate in periodic training on AML and CFT;

• Training will be mandatory and tailored to the employee’s role;

• The company will maintain records of attendance and knowledge assessments.

5.2 Internal and External Audits

• The company will be audited annually by independent auditors to ensure compliance;

• Audit results will be presented to the board of directors and the Compliance Officer;

• If deficiencies are identified, immediate corrective measures will be implemented.

6. Appointment of Compliance Officer and International Cooperation

6.1 Appointment of Compliance Officer

The company designates a Compliance Officer with the following responsibilities:

• Ensure enforcement of AML and CFT policies;

• Oversee employee training;

• Report suspicious transactions to authorities;

• Conduct regular internal audits.

6.2 International Cooperation

The company actively cooperates with:

• International Financial Intelligence Units (FIUs);

• Regulatory authorities in Panama and other countries;

• Global organizations such as the UN, FATF, and the European Union.

7. Sanctions and Penalties

• Clients involved in illicit activities will have their accounts terminated and will be reported to authorities.

• Employees who violate AML/CFT guidelines may be dismissed for cause and prosecuted under applicable laws.

8. Review and Update of the Policy

This policy will be reviewed annually and updated whenever regulatory changes occur.

Last review: February 14, 2025
Responsible: Compliance Officer