Acceptable Use and Financial Crime Risk Appetite Policy

1.1. This Acceptable Use and Financial Crime Risk Appetite Policy ("Policy") applies to VIIO and to all natural and legal persons related to VIIO, as well as to all counterparties with which VIIO maintains any contractual or business relationship, including the USER.

1.2. Financial crime, as referred to throughout this Policy, covers money laundering, terrorist financing, tax evasion, proliferation financing of weapons of mass destruction, sanctions breaches, fraud and associated risks.

1.3. VIIO expects the USER to comply with the applicable laws, regulations, good industry practices and international standards on financial crime risk management in the jurisdictions where the USER operates.

1.4. The USER must comply with the requirements of this Policy at all times.

1.5. This Policy forms part of the VIIO Terms and Conditions ("T&C") that the USER accepted for the use of the SERVICES, as amended from time to time. Capitalised terms used in this Policy shall bear the meanings ascribed to them in the T&C, unless otherwise defined in this Policy.

1.6. If there is any inconsistency or conflict between this Policy and the T&C, the T&C shall take priority and prevail, unless this Policy specifies otherwise.

Permitted activities: All activities that are neither restricted nor prohibited.

Prohibited activities: Those sanctioned with the highest severity by the Office of Foreign Assets Control of the United States Department of the Treasury (OFAC). They involve the total blocking of assets and a prohibition on transactions. They are those included in the following lists:

• Specially Designated Nationals List (SDN): contains the names of individuals and entities that have been sanctioned for their involvement in activities such as terrorism, drug trafficking, proliferation of weapons of mass destruction or corruption, or for acting on behalf of or under the control of sanctioned countries.

Restricted activities: Sanctions programmes that are more targeted and do not involve a total prohibition. In these cases, certain transactions may be permitted while others are prohibited. They are those included in the following lists:

• Sectoral Sanctions Identifications List (SSI).
• Foreign Sanctions Evaders List (FSE): includes persons or entities that have violated or attempted to violate United States sanctions. Restrictions vary according to the applicable sanctions programme.

Any person in the U.S.: Includes persons in transit, for tourism or business, who carry out a transaction while physically present in United States territory.

Foreign branches: A company with a branch registered in the United States. That branch is considered a U.S. Person and is subject to the full jurisdiction of OFAC.

U.S. Person: Includes any United States citizen, any permanent resident alien, any entity organised under the laws of the United States or of any jurisdiction within the United States, including its foreign branches, and any person physically located in the United States.

Permanent resident alien: Green Card holders.

ISIC (CIIU): International Standard Industrial Classification of All Economic Activities (in Spanish, Clasificación Industrial Internacional Uniforme, CIIU).

Person subject to U.S. jurisdiction: Includes:

a) any individual, wherever located, who is a citizen or resident of the United States;

b) any person within the United States;

c) any corporation, partnership, association or other organisation organised under the laws of the United States or of any State, territory, possession or district of the United States; and

d) any corporation, partnership, association or other organisation, wherever organised or doing business, that is owned or controlled by the persons specified in paragraphs a) or c).

Blocking: Refers to the freezing of assets or other property. Blocking immediately imposes a general prohibition on transfers or dealings of any kind with regard to that property. OFAC may require U.S. Persons to block all property and interests in property of certain persons, known as "blocked persons". Where this is the case, any property or interest in property of a blocked person that is within the United States, or in the possession or control of a U.S. Person, must be blocked (that is, "frozen", not seized) and may not be transferred, withdrawn or otherwise dealt in.

Title to blocked property remains with the blocked person, but the exercise of the powers and privileges normally associated with ownership is prohibited without OFAC authorisation. Blocked persons include those listed on OFAC’s Specially Designated Nationals and Blocked Persons List (SDN List), foreign governments subject to blocking and persons blocked under OFAC’s "50 Percent Rule".

Money Services Business (MSB): Money transmitter or currency dealer or exchanger. The term includes any person doing business, whether on a regular basis or as an organised business, in one or more of the following capacities:

• Currency dealer or exchanger.
• Check casher.
• Issuer of traveller’s cheques, money orders or stored value (prepaid cards or wallets).
• Seller or redeemer of traveller’s cheques, money orders or stored value.
• Money transmitter.
• United States Postal Service.

Property: Includes financial property (for example, money, cheques, savings accounts, shares, bonds, debt or any other financial instrument), real, tangible and intangible assets (for example, goods, merchandise, vessels, land contracts and real estate) and any other property or interest therein, whether present, future or contingent.

Travel Rule: A compliance rule requiring financial institutions, including virtual asset service providers (VASPs), to obtain, retain and transmit specific information on the originators and beneficiaries of a transaction throughout the funds transfer process. The minimum information that must "travel" includes:

• Name of the originator (sender).
• Account number or wallet address of the originator.
• Physical address, national identification number, or date and place of birth of the originator.
• Name of the beneficiary (recipient).
• Account number or wallet address of the beneficiary.

Its purpose is to prevent anonymity in asset transfers, facilitating traceability to prevent money laundering and terrorist financing, and to enable the enforcement of sanctions, such as those on the OFAC list. It corresponds to Recommendations 15 and 16 of the Financial Action Task Force (FATF).

3.1. VIIO applies customer due diligence, ongoing monitoring and, where required, enhanced due diligence measures to all of its business relationships with the USER.

3.2. As part of these measures, the USER will be required to share with VIIO information about its identity or organisation, its business and operating model, its customer base and its financial crime compliance systems and controls, where applicable and requested. The extent of the due diligence, ongoing monitoring and enhanced due diligence measures will be determined by VIIO on a risk-sensitive basis, depending on the type of USER, business model, regulatory landscape, product and transactions.

3.3. VIIO may impose conditions or restrictions to commence or continue providing the SERVICES. This includes restrictions on activities or transactions, as well as requesting the USER to cease and desist particular activities and not to use the PLATFORM or the SERVICES in relation to certain counterparties and jurisdictions.

3.4. VIIO may not be able to disclose the reasons for such restrictions and cease and desist requests where required by applicable law.

3.5. To comply with applicable anti-money laundering regulations, VIIO may request information about the intended purpose and nature of certain transactions carried out through the SERVICES by means of a request for information. The USER must provide complete responses to these requests to avoid delays to its transactions.

4.1. Based on the USER’s activities, VIIO may require the USER to establish and maintain policies, controls and procedures to mitigate and effectively manage the financial crime risks identified in its documented risk assessments. These policies, controls and procedures should cover, at a minimum: risk management practices; internal controls; customer due diligence; reporting and record-keeping; and the monitoring, management and internal communication of compliance with such policies, controls and procedures. VIIO expects the USER’s controls to be adequate to the nature, scale, size and complexity of its business, and to provide assurance that the USER will not violate applicable laws and regulations or pose an unacceptable level of financial crime or other regulatory compliance risk.

4.2. Based on the USER’s activities, VIIO may require the USER to conduct enhanced due diligence and enhanced ongoing monitoring in the situations and circumstances prescribed by applicable law and regulation. Where the USER is unable to apply due diligence measures to an end user, the USER must:

4.2.1. not carry out the transaction through VIIO, through the SUBMANDATARIES or on behalf of the end user; and

4.2.2. consider whether it ought to make a report to the competent authorities, in accordance with its legal obligations on money laundering and terrorist financing.

4.3. Where the USER has concluded that payments processed in connection with the SERVICES give reasonable grounds for knowledge or suspicion of money laundering or terrorist financing, and the matter has been reported to the competent authority, VIIO requires the USER to cease and desist all future activity, through the PLATFORM or the SUBMANDATARIES, relating to the person or company about which the USER has such knowledge or suspicion.

5.1. VIIO will not establish contractual relationships with counterparties, employees, suppliers or other stakeholders included on the lists that are binding in Colombia, namely the United Nations (UN) List.

5.2. VIIO will not establish any relationship with any natural or legal person that, after verification of the information provided, has submitted inaccurate or fictitious information.

5.3. A match against the OFAC List (Clinton List) or other national lists, or with negative public information related to money laundering, terrorist financing or proliferation financing of weapons of mass destruction, will be considered an important criterion for refusing or terminating a contractual relationship.

5.4. VIIO will not establish business relationships with, and requires the USER not to enter into relationships with, the following entities or individuals:

5.4.1. entities that provide anonymous accounts, numbered accounts or accounts in fictitious names;

5.4.2. shell banks;

5.4.3. shell companies with no independent operations, significant assets, ongoing business activities or employees;

5.4.4. companies using bearer shares or operating similar practices;

5.4.5. individuals or entities subject to financial sanctions under applicable law or regulation;

5.4.6. entities and individuals, including end users, located in the prohibited countries and regions listed in Appendix I; and

5.4.7. entities or individuals actively involved in, or with strong links to, the prohibited business activities listed in Appendix III.

5.5. The USER, including its personnel, is prohibited from using the SERVICES from any of the countries and regions listed in Appendix I, including, without limitation, by means of a virtual private network (VPN) or proxy services.

6.1. All payments will be made only to or from financial accounts that are not located in a country or territory designated as a "high-risk jurisdiction subject to a call for action" by the FATF, or blocked or sanctioned by OFAC, the United Nations Security Council, Canada or any other relevant jurisdiction, and that are not subject to restrictions by VIIO and its financial partners.

6.2. The PLATFORM and the SUBMANDATARIES must not be used to initiate or receive payments with the following characteristics:

6.2.1. payments that appear to relate to any form of illegal or unlawful activity, including, but not limited to, money laundering, terrorist financing, trade-based money laundering, fraud, bribery and corruption, sanctions evasion, ransomware, human trafficking and illegal wildlife trafficking;

6.2.2. payments for which the USER is required to hold a regulatory permission, including a licence granted by a local financial authority or the appointment of representatives or agents, without holding it;

6.2.3. payments that are sanctioned or involve designated persons under the sanctions regimes of the UN, the United States (OFAC), Canada or any other relevant jurisdiction;

6.2.4. payments to and from the countries and regions listed in Appendix I;

6.2.5. payments involving the prohibited business activities listed in Appendix III;

6.2.6. payments involving shell companies with no independent operations, significant assets, ongoing business activities or employees;

6.2.7. payments that do not appear to have a legitimate purpose, including, but not limited to, repetitive payments or transactions in round amounts, and payments lacking transparency regarding the originator or payer and the beneficiary or payee;

6.2.8. payments that involve the use of an informal value transfer system;

6.2.9. payments that appear to circumvent currency controls;

6.2.10. payments involving unregulated or unauthorised money or value transfer service providers, including Money Services Businesses (MSBs);

6.2.11. payments involving illegal gambling, including remote gambling;

6.2.12. payments involving centralised digital asset exchange providers or custodian wallet providers that are not duly licensed or registered for digital asset activities in their jurisdiction of operation;

6.2.13. transactions involving digital asset ATMs offering exchange services that are not duly licensed;

6.2.14. payments involving third-party payment processors that resell their services to third parties, or payments related to the provision of correspondent banking services to other financial institutions (also known as nested or downstream correspondent banking services), that have not been approved by VIIO in writing and do not have appropriate anti-money laundering, counter-terrorist financing and sanctions compliance programmes in place;

6.2.15. payments associated with payable-through accounts; and

6.2.16. payments involving shell banks.

7.1. Failure by the USER to comply with this Policy will constitute a breach of the T&C.

7.2. Any breach of this Policy may result in VIIO exercising its rights under the T&C, including, without limitation, the right to suspend or terminate the SERVICES.

The list below sets out the countries with which VIIO may not operate or have any link. These correspond to:

a) Countries on the Black List, considered "High-Risk Jurisdictions subject to a Call for Action" by the FATF, updated as of 13 February 2026.

• Burma (Myanmar)
• North Korea
• Iran

The list below sets out the countries that VIIO considers high risk. These correspond to:

a) Countries on the Grey List, considered "Jurisdictions under Increased Monitoring" by the FATF, updated as of 13 February 2026.

b) Countries blocked by OFAC sanctions, updated as of 18 September 2025.

All counterparties with links to these jurisdictions, or that carry out or are beneficiaries of transactions to and from them, are subject to enhanced due diligence. They must also operate under the conditions of the Travel Rule.

• Afghanistan
• The Balkans
• Belarus
• Bosnia and Herzegovina
• Croatia
• Slovenia
• Ethiopia
• Haiti
• Iraq
• Kosovo
• Lebanon
• Libya
• Mali
• Montenegro
• Nicaragua
• Central African Republic
• Republic of North Macedonia
• Democratic Republic of the Congo
• Serbia
• Syria
• Somalia
• South Sudan
• Sudan
• Ukraine
• Venezuela
• Yemen
• Zimbabwe

VIIO will not establish business relationships with entities or individuals actively involved in, or with strong links to, the following activities:

Group	Activity
Adult content and sexual exploitation	Promotion or advertising of escort or prostitution services (ISIC/CIIU 9609). Sharing or promoting explicit adult content, including, among others, pornographic videos and websites. Production or visual broadcasting of pornography, or strip clubs (literature, toys, DVDs, educational or scientific material and dating websites are not included). Procuring (pimping). Any business directly or indirectly involved in human trafficking, sexual exploitation or child sexual abuse material, including its hosting, distribution or facilitation.
Arms and defence	Arms and defence. Manufacture of military fighting vehicles. Manufacture of weapons and ammunition.<br>Dual-use weapons and goods. Dual-use surveillance technology.
Cash and high value	Cash-intensive and high-value businesses. High-value dealers that accept or generate high-value cash payments (USD 10,000 or more, or its equivalent in any currency) in exchange for goods. Scrap metal dealers or warehouses. Cash-funded remittances. Art and high-value collectible dealers.
Unlicensed or unregulated financial services	Shell banks and offshore banks. Unlicensed MSBs. Unregulated financial services, where a licence is required. Hawala. Unlicensed FX brokers. Binary options. Pyramid schemes and multi-level marketing. Get-rich-quick schemes. Unlicensed crowdfunding platforms. Fourth-party payments or multi-layered MSB or payment service provider arrangements, where payments are facilitated for a client’s client’s client.
Digital assets	Digital asset mixing or tumbling services, and chain-hopping or bridging services primarily designed to obfuscate the origin, destination or value of transactions. Digital asset service providers whose core business is the issuance, exchange or custody of privacy-enhancing digital assets, where transaction traceability cannot be reliably achieved. Unlicensed NFT marketplaces and token issuers.
Gambling and betting	Betting services. Unlicensed betting businesses, whether remote or not. Unlicensed gambling (for example, services provided using an offshore licence).
Opaque corporate structures	Shell companies (limited liability entities with no physical presence, no employees or no business activity in their jurisdiction of registration). Companies incorporated with bearer shares.
Wildlife	Illegal wildlife and plant trade.
Other illicit or unregulated goods and services	Unregulated pharmaceuticals or food supplements (for example, "nutraceuticals"). Piracy or illegal streaming. Counterfeit goods. Unlicensed charities. Political or religious organisations engaged in hate speech (promoting harm against, directly attacking or threatening other people).