COUNTERING THE FINANCING OF TERRORISM (CFT) POLICY

OF CATIVA CORPORATION GROUP S.A.

1. Introduction

CATIVA CORPORATION GROUP S.A. establishes this policy to ensure full compliance with local and international regulations related to Countering the Financing of Terrorism (CFT).

Terrorist financing involves the provision, collection, or movement of financial resources to support terrorist groups or individuals engaged in terrorist activities. Unlike money laundering, where funds originate from illicit activities, terrorist financing may involve money obtained from legitimate sources, such as donations and legal businesses.

1.1 Purpose

The main objectives of this policy are to:

• Identify, prevent, and mitigate terrorist financing activities within the company’s operations;

• Ensure that all employees and business partners are aware of risks and legal obligations;

• Establish strict guidelines for customer identification and transaction monitoring;

• Create robust procedures for reporting suspicious activities to the competent authorities;

• Ensure compliance with local and international regulations, protecting the company’s reputation.

1.2 Applicability

This policy applies to:

• All company employees, regardless of position;

• Clients and users of the company’s services;

• Business partners, including suppliers and service providers;

• Third parties who interact with the company in financial operations.

1.3 Legal Basis

The company fully complies with the following international standards and regulations:

• United Nations International Convention for the Suppression of the Financing of Terrorism (1999);

• United Nations Convention against Corruption (Merida Convention);

• Financial Action Task Force (FATF/GAFI) Directives on Counter-Terrorist Financing;

• Law No. XXX of Panama on Financial Crimes and Terrorist Financing;

• United Nations Security Council and European Union Sanctions and Restrictions.

2. Risk-Based Approach (RBA)

The company adopts a Risk-Based Approach (RBA), as recommended by FATF, ensuring that resources and controls are applied proportionally to the risks of each client or transaction.

2.1 Business Risk Assessment (BRA)

At least once a year, the company conducts a detailed analysis of risks associated with terrorist financing.
Key factors assessed include:

• Types of clients served and their risk profiles;

• Nature of transactions and financial volumes;

• High-risk jurisdictions (sanctioned countries or those associated with terrorism);

• Use of payment methods that favor anonymity (cryptocurrencies, cash, peer-to-peer transfers without financial intermediaries);

• History of clients and business partners involved in investigations or subject to international sanctions.

Mitigation Measures
Based on the risk assessment, proportional mitigation measures will be implemented, including restrictions and enhanced client verification.

3. Customer Due Diligence and Monitoring

3.1 Know Your Customer (KYC) and Standard Due Diligence

Before establishing any business relationship, the company must fully identify the client by collecting the following documents:

Individuals

• Valid identification document (passport, national ID, or driver’s license);

• Proof of residence (utility bill, phone bill, or bank statement);

• Proof of income (pay slip, tax return, or employment record).

Legal Entities

• Commercial registration and articles of incorporation;

• Identification of shareholders and directors;

• Declaration of business activities and origin of funds;

• Identification of Ultimate Beneficial Owners (UBOs).

3.2 Client Risk Classification

Clients will be classified into three categories:

• Low Risk → Ordinary clients with an economic and transactional profile consistent with their documentation.

• Medium Risk → Clients conducting large transactions or with limited financial transparency.

• High Risk → Clients from sanctioned countries, involved in sensitive sectors, or identified as Politically Exposed Persons (PEPs).

Enhanced Due Diligence (EDD) for High-Risk Clients
Clients classified as high risk will be subject to additional measures, including:

• Request for additional documentation regarding the origin of funds;

• Ongoing monitoring and periodic review of their financial activity;

• Strict oversight of international transactions and transfers to third parties.

4. Ongoing Monitoring and Reporting of Suspicious Transactions

4.1 Transaction Monitoring

The company will implement an automated monitoring system using artificial intelligence and predictive algorithms to identify suspicious transactions.

Alert Criteria include:

• Transfers to sanctioned or high-risk countries;

• Cash or cryptocurrency payments without economic justification;

• Structured transactions to avoid reporting thresholds;

• Transfers to third-party accounts without apparent commercial relationship.

4.2 Suspicious Transaction Reports (STR)

If a suspicious transaction is identified, the following actions will be taken:

1. The Compliance Officer reviews the transaction and collects all available evidence.

2. If suspicion is confirmed, a Suspicious Transaction Report (STR) will be submitted to Panamanian and international authorities within 24 hours.

3. The client’s account may be temporarily blocked until the investigation is concluded.

4. If imminent risk is detected, competent authorities will be notified immediately.

Whistleblower Protection: All employees reporting suspicious activities will be protected against retaliation.

5. Training and Auditing

5.1 Mandatory Training

• All employees must participate in periodic CFT training;

• Training will include simulations of fraud and terrorist financing detection;

• The company will maintain records of attendance and knowledge assessments.

5.2 Internal and External Audits

• The company will be audited annually by independent auditors to ensure compliance;

• Audit results will be presented to the board of directors and the Compliance Officer.

6. Sanctions and Penalties

• Clients involved in illicit activities will have their accounts terminated and will be reported to authorities.

• Employees who violate CFT guidelines may be dismissed for cause and prosecuted under applicable laws.

Last Review: February 14, 2025
Responsible: Compliance Officer