KYC and Onboarding Requirements Notice

1. Introduction and Purpose

Monolith Private Wealth Limited (“MPW” or the “Company”), which operates the Monolith Market trading platform, is a company incorporated in the Republic of Mauritius and licensed by the Financial Services Commission (“FSC”) under: (i) an Investment Dealer Licence (Full Service Dealer, excluding Underwriting) issued under Section 29 of the Securities Act 2005, Rule 4 of the Securities (Licensing) Rules 2007, and the Financial Services (Consolidated Licensing and Fees) Rules 2008; and (ii) an Investment Adviser Licence (Unrestricted) issued under Section 30 of the Securities Act 2005 and the Securities (Licensing) Rules 2007.

The Company is a “reporting person” within the meaning of the Financial Intelligence and Anti-Money Laundering Act 2002 (“FIAMLA”) as amended, and is subject to all related obligations applicable to such persons in Mauritius, including the obligations introduced by the Anti-Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing (Miscellaneous Provisions) Act 2026 (“AMLA 2026”).

This notice (the “Notice”) sets out the Know-Your-Customer (“KYC”), Customer Due Diligence (“CDD”) and onboarding requirements that all prospective and existing clients must satisfy to open and maintain an account with the Company. The Notice is intended to provide transparency to clients regarding:

• The legal and regulatory basis for the information and documentation that the Company is required to collect;

• The specific identification documents and supporting information that must be provided at onboarding;

• The Company's ongoing due diligence and monitoring obligations;

• The circumstances under which Enhanced Due Diligence (“EDD”) will apply;

• The consequences of failing to provide or maintain accurate KYC documentation; and

• The client's rights with respect to the personal data collected in this process.

The Company adopts a risk-based approach to KYC and customer due diligence (“CDD”) in line with the FSC AML/CFT Handbook, the FIAMLA, the Financial Intelligence and Anti-Money Laundering Regulations 2018 (“FIAMLR”), and the recommendations of the Financial Action Task Force (“FATF”). The depth and scope of the due diligence applied to each client is proportionate to the risks identified including money laundering risk, terrorism financing risk, and — as now required under AMLA 2026 — proliferation financing risk.

2. Regulatory Framework

The KYC and onboarding requirements set out in this Notice are imposed on the Company by, and shall be interpreted in accordance with, the following principal instruments:

• Financial Intelligence and Anti-Money Laundering Act 2002 (FIAMLA) — Primary AML/CFT legislation establishing the duty to conduct customer due diligence, record-keeping, and reporting of suspicious transactions.

• Anti-Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing (Miscellaneous Provisions) Act 2026 (AMLA 2026) — Landmark legislative reform enacted 18 April 2026 that introduces 24 distinct amendments across multiple statutes, incorporating a full Countering Proliferation Financing (“CPF”) pillar, enhanced beneficial ownership definitions, expanded FIU and FCC powers, revised statutory response timelines (24 hours / 48 hours), strengthened CDD requirements, and a Centralised Information Management System (CIMS).

• Financial Intelligence and Anti-Money Laundering Regulations 2018 (FIAMLR) — Detailed prescriptive rules on CDD, EDD, identification of beneficial ownership, and risk-based procedures.

• Prevention of Terrorism Act 2002 (“POTA”) — Obligations to identify, freeze, and report assets connected to terrorism financing.

• Financial Crimes Commission Act 2023 — Establishes the Financial Crimes Commission (“FCC”), a competent authority for the investigation, prosecution, and prevention of financial crimes including money laundering, terrorism financing, and proliferation financing. As expanded by AMLA 2026, the FCC holds enhanced asset recovery and investigatory powers, including the authority to demand client account information within 48 hours and to suspend transactions linked to proliferation financing for up to 72 hours.

• United Nations (Financial Prohibitions, Arms Embargo and Travel Ban) Sanctions Act 2019 —Obligations regarding screening of clients and counterparties against UN sanctions lists, including those arising under UNSCRs 1718 and 1737 (proliferation financing and WMD). Amended by AMLA 2026 to align with the new CPF definitions and require immediate (24-hour) FIU notification of new UN designation.

• FSC AML/CFT Handbook — Sector-specific binding guidance for FSC licensees on AML/CFT compliance, including risk assessment methodology and EDD triggers.

• Securities Act 2005 and Securities (Licensing) Rules 2007 — Provide the foundational licensing framework and conduct obligations for investment dealers and investment advisers.

• Data Protection Act 2017 — Governs the lawful processing, retention, and protection of personal data collected through the KYC process.

• FATF Recommendations — International AML/CFT standards adopted by Mauritius and reflected in domestic law.

3. General Onboarding Principles

3.1 Mandatory Nature of CDD

The Company is legally prohibited from establishing or maintaining a business relationship, or from carrying out a transaction on behalf of any person, where the Company has not been able to identify and verify the client in accordance with this Notice. The Company reserves the right, and where required by law has the duty, to:

• Refuse to open an account where required documentation is not provided or where information appears to be false, incomplete, or misleading;

• Suspend or restrict an existing account where ongoing CDD obligations cannot be satisfied;

• Terminate the client relationship where the Company is unable to comply with its AML/CFT obligations; and

• Report suspicious transactions or activities to the Financial Intelligence Unit (“FIU”) of Mauritius without prior notice to the client, as required by law.

3.2 Risk-Based Approach

Each client is assigned an internal money laundering risk rating or “MLRR” (typically Low, Medium, or High) based on a combination of factors including, but not limited to: country of residence, nationality, profession, source of funds, expected trading activity, products to be accessed, and any adverse media or sanctions findings. The KYC documentation requested, the depth of verification performed, and the frequency of periodic reviews are calibrated to the assigned MLRR.

Consistent with FIAMLA as amended by AMLA 2026, the Company’s risk assessment framework encompasses three distinct risk pillars:

• Money Laundering Risk (ML) — The risk that funds are the proceeds of crime.

• Terrorism Financing Risk (TF) — The risk that funds or services are used to finance terrorist activities.

• Proliferation Financing Risk (PF) — The risk of a potential breach, non-implementation, or evasion of targeted financial sanctions obligations under the United Nations (Financial Prohibitions, Arms Embargo and Travel Ban) Sanctions Act 2019, as required by FATF Recommendation 7 and AMLA 2026.

3.3 Currency of Documentation

Unless otherwise specified in this Notice, the Company requires that:

• Proof of identity documents be valid and unexpired at the time of submission;

• Proof of address documents be dated within three (3) months of the date of submission;

• Corporate and trust documents be dated within three (3) months of the date of submission or be the most recent version officially issued; and

• For trust structures: beneficial ownership information must be current at the time of submission. Under AMLA 2026 (amending the Trusts Act).

• All documents be provided in English or French; documents in other languages must be accompanied by a certified translation in accordance with the standards established in the FSC AML/CFT handbook.

3.4 Certification of Documents

Where the Company requires certified copies (rather than originals or electronic verification), certification must be made by a qualified independent professional, such as:

• An Authorised Senior Officer of the Company who has seen the originals;

• Registered lawyer or notary;

• Chartered accountant;

• Bank manager;

• Employee of the Person’s embassy or consulate, or

• Similar Person.

• An officer of the court

• A member of a recognized professional body

The certifier must include their name, profession, registration or licence number, contact details, date of certification, and confirmation that the copy is a true copy of the original and (where applicable) that the photograph is a true likeness of the individual.

Important: Submission of false, altered, or misleading documentation during the KYC process is a criminal offence under FIAMLA and may result in immediate termination of the client relationship, refusal of future applications.

4. KYC Requirements — Individual Clients (Natural Persons)

Individual applicants must provide the following at onboarding. Documentation will be verified through a combination of human review and, where available, electronic identity verification services.

4.1 Proof of Identity

One (1) of the following government-issued photographic identification documents:

4.2 Proof of Address

One (1) of the following documents, dated within the last three (3) months, clearly showing the client's full name and residential address (PO Box addresses are not accepted):

4.3 Additional Identifying Information

In addition to the documents above, the applicant must provide:

• Full legal name (as appears on identity document);

• Date and place of birth;

• Nationality / nationalities (if more than one);

• Country of permanent residence and tax residence;

• Tax Identification Number(s) (TIN) for each jurisdiction of tax residence;

• Contact details: email address and mobile telephone number;

• Occupation, name of employer, and nature of business (if self-employed);

• Estimated net worth and annual income (ranges acceptable);

• Source of funds and source of wealth declaration (see Section 6);

• Expected trading activity (volume, frequency, instruments);

• Investment knowledge and experience (assessed via questionnaire); and

• Confirmation of whether the applicant is a Politically Exposed Person (“PEP”) or a close associate or family member of a PEP (see Section 7).

4.4 Identity Verification Methods

The Company verifies client identity through a combination of the following methods:

• Electronic Identity Verification (eIDV): Cross-referencing of client-submitted data against independent databases (electoral rolls, credit reference agencies, sanctions and PEP databases);

• Document Authentication: Optical and forensic analysis of submitted identity documents to detect tampering, forgery, or invalid documents;

• Liveness Check / Selfie Verification: A real-time biometric capture of the applicant compared to the photograph on the identity document, with proof of liveness;

• Address Verification: Where electronic address verification is unavailable, a documentary proof of address as specified in Section 4.2; and

• Sanctions and Adverse Media Screening: Real-time screening against UN, EU, OFAC, UK HMT, and other relevant sanctions lists, as well as PEP and adverse media databases (see Section 7).

5. KYC Requirements — Corporate and Legal Entity Clients

Where the applicant is a legal entity (company, partnership, trust, foundation, or other arrangement), the Company will conduct due diligence on the entity itself, on its beneficial owners, and on the natural persons authorised to act on its behalf.

5.1 Documentation Required from the Entity

5.2 Verification of Ultimate Beneficial Owners (UBOs)

In accordance with the FIAMLR 2018 and the FSC AML/CFT Handbook, the Company is required to identify and verify each natural person who ultimately owns or controls the entity. This includes:

• Any natural person who directly or indirectly holds 25% or more of the entity's shares, voting rights, or economic interest;

• Any natural person who exercises ultimate control over the entity through other means — regardless of shareholding percentage — including through shareholder agreements, rights of dominant influence, the right to appoint or remove a majority of the board of directors or senior management, or any other arrangement conferring effective control. The Company will look through nominee shareholders, layered holding structures, and bearer share arrangements to identify the natural person(s) exercising ultimate control;

• Where no natural person can be identified under the above criteria, at least two the senior managing official(s) of the entity; and

• In the case of trusts: the settlor(s), all trustees, the protector (if any), all beneficiaries (or classes thereof), and any other natural person exercising effective control, consistent with the Trusts Act as amended by AMLA 2026. Changes to beneficial ownership of a trust structure must be notified to the Company within five (5) working days of occurrence.

For each identified UBO, the Company will require the same identification and verification documentation as applies to an individual client under Section 4 of this Notice.

5.3 Documentation Required from Authorised Representatives

Each director, authorised signatory, or other natural person empowered to operate the account on behalf of the entity must provide:

• Full KYC documentation as set out in Section 4 (proof of identity, proof of address, personal information);

• Evidence of their authority to act on behalf of the entity (e.g., board resolution, power of attorney); and

• A signed acknowledgment of the Company's terms applicable to authorised representatives.

6. Source of Funds and Source of Wealth

The Company is required under Mauritius AML/CFT legislation to establish a reasonable understanding of (i) the source of funds being used by the client to deposit into the account and (ii) the broader source of the client's wealth. These are distinct concepts and may both be required, particularly for higher-risk clients and for higher transaction values.

6.1 Source of Funds (“SoF”)

Source of Funds refers to the origin of the specific monies being transferred to the Company. Acceptable evidence may include:

• Bank statements showing the receipt of the funds (e.g., salary credits, business income, investment proceeds);

• Sale agreements and settlement statements (e.g., for real estate, business, or securities transactions);

• Inheritance documentation (will, grant of probate, executor's statement);

• Documentation evidencing the maturity of an investment or insurance policy;

• Loan agreements with a regulated lender, where applicable; and

• Tax returns, where the funds derive from declared income or business activity.

6.2 Source of Wealth (“SoW”)

Source of Wealth refers to the activities and circumstances that have generated the client's total net worth. The Company may request a narrative explanation supported by:

• Employment history and remuneration records (payslips, employer letters);

• Business ownership documentation and audited accounts;

• Records of significant inheritances or gifts;

• Investment portfolio statements demonstrating accumulation of wealth;

• Property ownership records and valuations; and

• Other documentation consistent with the stated source.

Note: The level of evidence required for SoF and SoW is proportionate to the assessed risk profile of the client and to the size of expected or actual transactions. The Company may request additional documentation at any time during the relationship if circumstances warrant.

7. Sanctions, PEP, and Adverse Media Screening

7.1 Sanctions Screening

All clients, beneficial owners, directors, and authorised representatives are screened against the following sanctions lists at onboarding and on an ongoing basis:

• United Nations Security Council Consolidated Sanctions List;

• Sanctions lists maintained pursuant to the United Nations (Financial Prohibitions, Arms Embargo and Travel Ban) Sanctions Act 2019 of Mauritius;

• European Union Consolidated Financial Sanctions List;

• United Kingdom HM Treasury Office of Financial Sanctions Implementation (OFSI) list;

• United States Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list and other US sanctions programmes; and

• Any other sanctions lists that the Company is required or considers prudent to screen against, including domestic sanctions in jurisdictions where the Company operates.

• Under AMLA 2026, the FIU is required to disseminate new UN targeted financial sanctions designations to all reporting persons within 24 hours of their issuance. The Company’s sanctions screening programme is calibrated to incorporate such designations immediately upon receipt of FIU notification.

As required under AMLA 2026 (implementing FATF Recommendation 7), the Company conducts targeted financial sanctions screening specifically directed at proliferation financing risk. This is a distinct screening obligation, separate from general sanctions screening, and focuses on:

• UN Security Council Resolutions 1718 (2006) and 1737 (2006) and all successor/related resolutions relating to the non-proliferation of weapons of mass destruction (nuclear, biological, chemical, and radiological weapons) and their means of delivery, including designations relating to the DPRK and Iran programmes;

• Any other UNSCR-based targeted financial sanctions designations relating to proliferation financing as disseminated by the FIU; and

• Any domestic proliferation financing designations issued pursuant to the United Nations (Financial Prohibitions, Arms Embargo and Travel Ban) Sanctions Act 2019, as amended.

All clients, beneficial owners, directors, authorised representatives, and counterparties are screened for PF exposure at onboarding and on an ongoing basis. A positive or potential match triggers immediate escalation to the Compliance Officer, account restriction, and a report to the FIU and FCC. The Company’s Compliance Officer maintains a documented PF risk assessment as part of the Business Risk Assessment required under FIAMLA.

7.2 Politically Exposed Persons (“PEPs”)

A politically exposed person (“PEP”) is an individual who is or has been entrusted with a prominent public function, including domestic, foreign, and international organisation PEPs, together with their family members and close associates. The Company:

• Screens all applicants against PEP databases at onboarding and on a continuous basis;

• Requires self-declaration of PEP status as part of the application;

• Applies Enhanced Due Diligence (EDD) to all confirmed PEPs (see Section 8);

• Obtains senior management approval before establishing or continuing a business relationship with a PEP; and

• Conducts more frequent reviews of PEP accounts.

The Company conducts a detailed PEP risk assessment using a six-factor matrix maintained in its internal AML Manual.

7.3 Adverse Media

All clients are screened against adverse media databases covering allegations or convictions related to fraud, financial crime, corruption, terrorism, organised crime, trafficking, and other reputational concerns. Adverse media findings will be assessed on their merits, considering credibility of source, recency, severity, and any judicial outcome, and may trigger EDD or refusal of the application.

8. Enhanced Due Diligence (EDD)

Enhanced Due Diligence is applied where the Company assesses the client relationship as presenting a higher-than-normal risk of money laundering, terrorist financing, or other financial crime. EDD involves more extensive identification, verification, and ongoing monitoring procedures, including obtaining additional information and documentation.

8.1 Mandatory EDD Triggers

EDD is mandatorily applied in the following situations:

• The client (or any beneficial owner) is a Politically Exposed Person (PEP), family member, or close associate of a PEP;

• The client is resident or established in, or has significant connections to, a jurisdiction designated by the FATF as having strategic deficiencies in AML/CFT controls (a “high-risk jurisdiction”);

• The client is resident or established in a jurisdiction subject to EU or other relevant high-risk-third-country listings;

• The client conducts business in, or derives funds from, a high-risk industry sector (e.g., cash-intensive businesses, dealers in precious metals and stones, virtual asset service providers, gambling, arms dealing);

• Unusual or complex ownership structures, including the use of multi-layered holding structures, nominee shareholders, or bearer shares;

• Discrepancies, inconsistencies, or red flags identified during initial CDD;

• Transactions involving unusually large amounts, complex structures, or no apparent economic or lawful purpose; and

• The client, or any connected person or entity, is subject to, or has connections with, persons or jurisdictions subject to UN targeted financial sanctions related to proliferation financing (UNSCRs 1718, 1737, and related resolutions); or where the CO or MLRO has determined that a proliferation financing risk exists or cannot be excluded; and

• Any other circumstance where the Compliance Officer determines that EDD is appropriate.

8.2 Additional EDD Measures

Depending on the trigger, EDD measures may include:

• Obtaining additional identification information from a wider variety of sources;

• Conducting more detailed verification of the source of funds and source of wealth, with supporting documentation;

• Obtaining senior management approval for the establishment or continuation of the business relationship;

• Imposing reduced transaction limits and/or enhanced monitoring of the account;

• Performing more frequent periodic reviews (e.g., every six (6) or twelve (12) months);

• For Proliferation Financing related EDD: conducting targeted financial sanctions screening across all connected entities and jurisdictions; obtaining a specific declaration that the client is not engaged in or connected to activities subject to UN proliferation financing designations; and applying transaction controls consistent with UNSCR obligations; and

• Obtaining additional information on the intended nature of the business relationship; and

• Conducting site visits, where appropriate and feasible, in the case of corporate clients.

9. Ongoing Monitoring and Periodic Review

KYC is not a one-time event. The Company continuously monitors the client relationship to ensure that the information held remains accurate and current, and that account activity is consistent with the client's stated profile.

9.1 Transaction Monitoring

All client transactions are monitored in real-time and post-trade against the client's profile, expected behaviour, and a series of automated and manual scenarios designed to detect unusual or suspicious activity. Triggers include:

• Transactions inconsistent with the client's stated source of funds, income, or trading objectives;

• Sudden changes in trading volume, frequency, or product mix;

• Transactions to or from high-risk jurisdictions;

• Patterns indicative of structuring, layering, or other money laundering typologies;

• Any transaction that may constitute a potential breach, evasion, or non-implementation of targeted financial sanctions obligations, including those relating to proliferation financing under UNSCRs 1718 and 1737. Such transactions are subject to immediate suspension by the FIU for up to 72 hours under AMLA 2026, and the Company will cooperate fully with any such suspension order.

• Unusual deposit or withdrawal patterns; and

• Activity inconsistent with the client's MLRR or assigned categorisation.

9.2 Periodic Review

Client files are subject to periodic review at a frequency determined by the client's MLRR:

AMLA 2026 introduces mandatory statutory response timelines for regulated entities. The Company is required to respond to information demands from the FIU, FCC, and FSC as follows:

• 24 hours: Implementation of, and response to, newly disseminated UN targeted financial sanctions designations.

• 48 hours: Response to information demands from the Financial Crimes Commission regarding client or account information under the FCC’s expanded investigatory powers.

• Immediate: Cooperation with FIU transaction suspension orders (up to 72 hours) linked to proliferation financing or suspicious transactions.

The Company has implemented operational protocols to ensure compliance with these timelines.

9.3 Trigger Events

Notwithstanding the periodic review schedule above, a full KYC refresh shall also be conducted upon the occurrence of any of the following trigger events:

• Material changes in the client's circumstances (e.g., change of nationality, residence, employer, occupation, marital status of which the Company becomes aware);

• Material changes in the ownership or control structure of a corporate client;

• Acquisition of PEP status by the client or a beneficial owner;

• Identification of adverse media or sanctions hits;

• Significant change in trading behaviour or risk profile;

• Expiry of identification documents on file;

• Suspicion-based escalations from transaction monitoring;

• Receipt of a new UN targeted financial sanctions designation from the FIU relating to the client or any connected person or entity; or identification of any proliferation financing risk indicator associated with the client relationship; and

• Regulatory or supervisory request.

10. Client Obligations

By opening and maintaining an account with the Company, each client agrees to the following ongoing obligations:

1. Provide truthful, complete, and accurate information at all times, including at onboarding and in response to any subsequent request by the Company;

2. Notify the Company promptly (and in any event within thirty (30) days) of any material change to information previously provided, including changes of address, employment, nationality, tax residence, PEP status, or beneficial ownership;

3. Provide updated identification documents prior to the expiry of those on file, upon request;

4. Provide additional information or documentation requested by the Company in the context of ongoing monitoring, periodic review, EDD, or to satisfy any regulatory or legal obligation;

5. Co-operate with the Company's compliance enquiries and respond within the timeframes specified;

6. Not use the account or services for any unlawful purpose, including but not limited to money laundering, terrorist financing, sanctions evasion, market abuse, fraud, or tax evasion;

7. Acknowledge that failure to comply with the obligations in this Notice may result in restriction or termination of the relationship, without compensation for any resulting loss; and

8. Acknowledge that the Company may be required by law to make reports to the FIU or other competent authorities without notifying the client, and that no breach of confidentiality arises from such reporting.

11. Consequences of Non-Compliance

Where the client fails to satisfy the requirements set out in this Notice — whether at onboarding or during the ongoing relationship — the Company may, in its discretion and in accordance with applicable law, take any of the following actions, alone or in combination:

• Refusal of Application: Decline to open an account or accept the prospective client;

• Account Restriction: Restrict the account by limiting the value or types of permitted transactions;

• Account Suspension: Suspend access to the platform and/or freeze trading activity;

• Withdrawal Limitations: Defer withdrawals pending satisfaction of outstanding documentation requirements (subject to applicable law);

• Termination of Relationship: Close the account and terminate the client relationship, returning client funds (after deduction of any sums lawfully owed) to a verified bank account in the client's name;

• Reporting: File suspicious transaction reports or related reports with the FIU and other competent authorities; and

• Refusal of Future Applications: Block the applicant from re-applying for an account with the Company.

The Company shall not be liable to the client for any loss, damage, cost, or expense suffered by the client as a result of the Company's exercise of any of the rights or actions set out in this Section, provided that the Company has acted in good faith and in accordance with its legal and regulatory obligations.

12. Personal Data and Data Protection

All personal data collected during the KYC and onboarding process is processed in accordance with the Data Protection Act 2017 of Mauritius and the Company's Privacy Policy. The Company is the data controller in respect of such personal data.

12.1 Purposes of Processing

KYC data is collected and processed for the following purposes:

• Compliance with AML/CFT obligations under FIAMLA, FIAMLR, POTA, the UN Sanctions Act 2019, and the FSC AML/CFT Handbook;

• Verification of identity and assessment of the client's risk profile;

• Detection, investigation, and prevention of financial crime;

• Compliance with tax information exchange obligations (FATCA, CRS);

• Performance of the contract with the client and provision of services; and

• Compliance with other applicable legal and regulatory obligations.

12.2 Legal Basis

The principal legal bases for processing are (i) compliance with the Company's legal obligations under Mauritius law, (ii) the performance of the contract between the client and the Company, and (iii) the Company's legitimate interests in preventing financial crime and protecting its business.

12.3 Recipients of Data

Personal data collected in the KYC process may be shared with:

• The Financial Services Commission of Mauritius and other competent regulators;

• The Financial Intelligence Unit of Mauritius;

• Tax authorities (Mauritius Revenue Authority and foreign authorities under FATCA/CRS);

• Law enforcement and judicial authorities pursuant to lawful requests or court orders;

• Group companies, affiliates, and approved service providers (subject to appropriate safeguards); and

• Auditors, legal advisers, and other professional advisers bound by confidentiality.

12.4 Retention

KYC documentation and related records are retained for a minimum period of seven (7) years following the termination of the client relationship (or such longer period as may be required by applicable law or regulatory request), in accordance with Section 17(b) of FIAMLA 2002 and the record-keeping requirements of FIAMLR 2018.

12.5 Data Subject Rights

Subject to the limitations imposed by AML/CFT and other applicable laws, clients have the following rights in respect of their personal data: the right of access; the right to rectification; the right to erasure (in limited circumstances); the right to restrict processing; the right to data portability; and the right to object. Clients may exercise these rights by contacting the Company's Data Protection Officer at the details published in the Privacy Policy. Clients also have the right to lodge a complaint with the Data Protection Commissioner of Mauritius.

Important: Certain data subject rights are restricted where their exercise would conflict with the Company's obligations under AML/CFT laws — in particular, the Company may not delete records subject to mandatory retention, nor disclose information that would amount to "tipping off" a person who is or may become the subject of a suspicious transaction report.

13. Governance, Review and Updates

This Notice is owned by the Compliance Department of the Company and approved by the Board of Directors.

The Notice shall be reviewed at least annually, and more frequently upon:

• Any material changes in applicable Mauritius AML/CFT legislation or FSC guidance;

• Any update to the FATF Recommendations or related FATF-issued guidance materially affecting client due diligence;

• Any material changes in the Company's business model, product range, distribution channels, or client base;

• Any significant findings from internal audit, external audit, compliance review, or FSC inspection; and

• The issuance of any relevant Dear CEO letter, circular, or guidance note by the FSC or the FIU.

Material amendments to this Notice shall be communicated to clients with reasonable advance notice through the Company's online platform, mobile application, by email, or by such other durable medium as may be appropriate. This Notice was revised in June 2026 to incorporate the requirements of AMLA 2026 (Act No. III of 2026), enacted 18 April 2026. Key changes include: (i) incorporation of the full CPF pillar across all risk assessment, screening, and EDD sections; (ii) reference to the FCC as a competent authority; (iii) updated UBO definition; (iv) 24h/48h/72h statutory response timelines; (v) trust BO notification obligations; (vi) correction of missing section numbering; and (vii) consistent use of “reporting person” terminology throughout.

15. Contact and Complaints

Clients with questions about this Notice, or who wish to provide updated KYC documentation, may contact the Company's Compliance Department through the channels published on the Company's website. Complaints regarding the application of KYC requirements may be submitted in accordance with the Company's Complaints Handling Procedure, with the right of escalation to the FSC if not resolved to the client's satisfaction.

16. Legal Disclaimer

Disclaimer: This Notice has been prepared to comply with the Company's obligation to inform clients of the KYC and CDD requirements applicable to the client relationship under Mauritius law. It does not constitute legal or tax advice and does not purport to be an exhaustive statement of all obligations applicable to the Company or to clients. Clients seeking specific guidance regarding their position should consult an independent legal or tax adviser. In the event of any conflict between this Notice and applicable law or FSC rules, the applicable law or FSC rules shall prevail.

Annex A — Onboarding Checklist (Individual Clients)

The following checklist summarises the documentation typically required from an individual applicant. Additional documentation may be requested depending on the client's risk profile.

Annex B — Onboarding Checklist (Corporate / Legal Entity Clients)

The following checklist summarises the documentation typically required from a Corporate/Legal Entity applicant. Additional documentation may be requested depending on the client's risk profile.