Anti-Money Laundering, Counter-Terrorist Financing, Counter-Proliferation Financing and KYC Policy

1Purpose, scope and status

1.1 This Policy sets out how Giottus prevents, detects and reports money laundering, terrorist financing and proliferation financing, and how it identifies and verifies its customers.

1.2 It applies to every person who holds or applies for an Account, to every transaction on the Platform, to every product and Addendum, and to every employee, officer, contractor and agent of Giottus, whether permanent or contractual.

1.3 This is the published summary of our programme. It is supported by a Board-approved internal policy and by internal procedures, systems documentation, escalation matrices, red-flag indicators and thresholds, which are confidential. We do not publish those details because doing so would assist a person seeking to launder money to avoid detection.

1.4 The Digital Rupee issued by the Reserve Bank of India is outside the scope of this Policy.

1.5 This Policy states what we do. It does not reproduce the provisions of the Act, the Rules or the Guidelines under which we do it, and nothing in it narrows an obligation those instruments impose on us or a right they give you. Where an instrument named in section 2 is amended, this Policy is to be read as giving effect to the version then in force, and we bring it into line at the next review under section 22.

2Legal framework

2.1 This Policy gives effect to:

• the Prevention of Money-Laundering Act, 2002, in particular sections 11A, 12, 12A, 12AA and 13, and notification S.O. 1072(E) dated 7 March 2023;
• the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005, in particular Rules 2, 3, 7, 8, 9, 9(13) and 10;
• the AML, CFT and CPF Guidelines issued by FIU-IND, as updated on 8 January 2026;
• the Unlawful Activities (Prevention) Act, 1967, in particular section 51A, and the orders and lists issued under it;
• the Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005;
• the Income-tax Act, 2025, in particular the provisions on deduction of tax on virtual digital asset transfers and on reporting by a reporting crypto-asset service provider, together with the OECD Crypto-Asset Reporting Framework as given effect in India;
• the directions issued by the Indian Computer Emergency Response Team (CERT-In) on 28 April 2022 under section 70B(6) of the Information Technology Act, 2000;
• the Financial Action Task Force Recommendations, in particular Recommendations 15 and 16; and
• the Information Technology Act, 2000, in particular section 43A, and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, in relation to the personal information we process for these purposes; and the Digital Personal Data Protection Act, 2023 and the rules made under it, from the commencement of the provisions concerned.

2.2 Where this Policy and Applicable Law differ, Applicable Law prevails and this Policy is to be read as amended accordingly.

3Registration and continuing conditions

3.1 Giottus is registered with FIU-IND.

3.2 We hold a Cyber Security Audit Certificate issued by a CERT-In empanelled auditor, affirming compliance with the applicable cyber security framework and the CERT-In Directions of 28 April 2022, and certifying that the audited environment is adequately safe to host and operate our notified activities. Its scope covers governance and access control including insider risk; infrastructure, network and endpoint security; application and AML systems security, including customer due diligence, transaction monitoring, wallet security, cryptographic controls, and backup and recovery; third-party, cloud, custodian and interface risk; and incident detection and response readiness.

3.3 Partner accreditation. Where we have or propose a business relationship with another registered virtual digital asset service provider, each party may require a Partner Accreditation for Compliance and Trust (PACT) certificate from the other. We maintain the internal assessment necessary to issue one, and we require one before entering into a business-to-business, broker or similar arrangement.

3.4 We do not use or avail the products or services of a third party based in a known high-risk jurisdiction.

4Governance and accountability

4.1 Designated Director. Giottus has appointed a Designated Director under section 13(2) of the Act and Rule 2(1)(ba) of the Rules, who is responsible for overall compliance with the obligations imposed under Chapter IV of the Act. The appointment has been notified to FIU-IND as Rule 7(1) requires.

4.2 Principal Officer. Giottus has appointed a Principal Officer under Rule 2(1)(f), who is responsible for the operation of this Policy and for furnishing information under Rule 8. The appointment has been notified to FIU-IND. The Principal Officer is based in India, is a management-level officer, is not responsible for business origination, and has unimpeded access to customer and transaction records. The Board reviews the appointment at least annually.

4.3 The Principal Officer and the Designated Director are separate individuals. Any change in either appointment is notified to FIU-IND promptly, with the name, designation, address and contact details of the person appointed.

4.4 Non-delegable decisions. The ultimate analysis of an alert, and the decision whether a transaction is suspicious, rest with the Principal Officer and are not delegated. The reasons for treating a transaction as suspicious, and the reasons for closing an alert without reporting it, are recorded in writing. The Principal Officer carries out surprise checks and sample transaction reviews.

4.5 Board reporting. The Principal Officer reports directly to the Board or a designated Board committee, quarterly, and in any event not later than annually, covering at minimum: the effectiveness of the programme; identified risks and vulnerabilities; a summary of suspicious transaction reports and other reports filed; FIU-IND instructions, red-flag indicators, typologies and guidance, and the status of their implementation; and any proposed change to this Policy.

4.6 Risk assessment. We carry out a documented enterprise-wide money laundering, terrorist financing and proliferation financing risk assessment at a periodicity determined by the Board, and in no case more than 12 months apart. A pre-launch risk assessment is carried out before we adopt any new technology, product or service, and expressly addresses anonymity-enhanced transactions. Outcomes and mitigations are placed before the Board.

4.7 Independent review of this Policy. This Policy is reviewed independently at least annually, by persons other than those who framed it.

4.8 No employee is penalised for raising a concern in good faith under this Policy.

5Client acceptance

5.1 No relationship is established and no transaction is permitted before customer due diligence is complete.

5.2 We do not open or maintain an Account:

• in an anonymous, fictitious, false or benami name;
• for a person who refuses or fails to complete due diligence, or whom we cannot identify to our satisfaction;
• for a person subject to sanctions as described in section 10;
• for a person under 18, and we do not accept a minor's Permanent Account Number;
• for a person who does not have the capacity to contract;
• for a person who is not an Indian citizen and a person resident in India, or an entity not incorporated or registered in India;
• for a person whose Account we have previously terminated for a breach of this Policy;
• for a person we have reason to believe has been exited by another reporting entity, a bank or a payment intermediary for financial-crime, sanctions or fraud reasons; or
• for a person who is, or would be, operating the Account for an undisclosed third party.

An entity that is incorporated or registered in India may still be refused where a signatory or beneficial owner is not a person resident in India and the risk cannot be managed to our satisfaction.

5.3 A discrepancy, mismatch or failure of verification triggers enhanced measures, including a mismatch between the declared address and the geolocation coordinates captured at onboarding.

5.4 Where customer due diligence or enhanced due diligence cannot be completed, onboarding is terminated and no transaction is permitted. Where the relationship already exists, it is terminated and a suspicious transaction report is filed.

5.5 Existing customers whose records do not meet the current standard are brought up to standard on a time-bound basis, failing which the Account is closed after due notice.

5.6 One person may hold one Account. Operating multiple Accounts, or operating an Account for another person, breaches the Terms and this Policy.

5.7 We may decline or exit a relationship where the risk cannot be managed. Where the reason is connected to a suspicion, we will not tell you the reason — see section 16.

5.8 False, incomplete or mismatched information. The accuracy of what you tell us is the foundation of everything in this Policy. Accordingly:

• a false or misleading declaration, a forged or altered document, or the concealment of a beneficial owner or of the person on whose behalf you are acting, is a material breach and is grounds for immediate restriction or termination of your Account, without notice;
• a material discrepancy between the information you have given us and the information we hold or obtain — including a mismatch between your declared address and the geolocation captured at onboarding, a name mismatch on bank verification, or a failure of liveness verification — triggers enhanced measures under section 8 and may result in a hold pending resolution;
• a failure to notify us within 30 days of a change to your identity documents, address, bank account, contact details, tax residency or beneficial ownership, as section 21.1 requires, is grounds for restriction of your Account until the position is corrected, and for termination where it is not corrected within a reasonable time; and
• in each case, where the circumstances give us reasonable grounds to believe that a transaction involves the proceeds of crime or the financing of terrorism, we file a suspicious transaction report, and section 16 applies to what we are able to tell you.
• use of a deepfake, injected image, virtual camera, emulator, GPS spoof, virtual private network, proxy or any other method intended to defeat liveness detection, geolocation capture or device binding is a material breach and is grounds for immediate restriction or termination, and section 12.6 applies.

5.9 Action taken under clause 5.8 is taken because the information on which the relationship depends has failed, and is not arbitrary. We record the discrepancy, the enquiries we made, and the basis of our decision, and — subject to section 16 — we tell you which limb of clause 5.8 applies.

6Customer due diligence

6.1 Individuals. We collect and verify: full name as it appears on the Permanent Account Number card; date of birth; gender; nationality; address; occupation; income range; the Permanent Account Number, which is mandatory and is verified; and any one of a passport, driving licence, proof of possession of Aadhaar, or voter's identity card, or the equivalent electronic document.

6.2 A selfie with liveness detection is mandatory. We establish that the person whose credentials are furnished is the same individual actually accessing the application and personally initiating account creation, by capturing a live photograph and employing liveness detection technology to verify physical presence at the time of onboarding.

6.3 We capture and retain additional identifiers, at onboarding and on transacting: the latitude and longitude of the onboarding location with date and timestamp; the internet protocol address with timestamp; the device identifier; virtual digital asset wallet addresses; and transaction hashes. We are required by law to do this. It is not a matter of consent, and it is disclosed in the Privacy Policy.

6.4 Bank account verification. We verify your bank account by penny-drop, confirming both ownership and operational status, with a name match.

6.4A How each item is verified. Your mobile number and email address are verified by one-time password or another verifiable mechanism. Your Permanent Account Number is verified online against the Income Tax database. Your bank account is verified by penny-drop with a name match. An officially valid document other than Aadhaar is accepted through DigiLocker or under an eSign mechanism wherever that route is available. Documents are checked against the issuing government database where a verification service exists for that document.

6.4B Video verification. Where a document cannot be validated by our automated checks, where the automated check returns a result we are not satisfied with, or where enhanced due diligence applies, we may require a live video session to confirm your identity and the authenticity of what you have given us. The session is recorded and retained as part of your identification record under section 18. We will tell you why we are asking.

6.5 Your own bank account only. Indian Rupee deposits may be made only from, and withdrawals only to, a bank account held in your own name that you have registered with us and we have verified. We do not accept funding from, and do not pay out to, a bank account belonging to any other person, for any reason, however the relationship between you and that person is described. Where we receive funds from an account that is not your verified account, we do not credit them; the funds are held, the matter is subject to enhanced scrutiny, and the funds are returned to their source on your request under clause 7.1 of the Terms, after we are satisfied as to their origin. An attempt to fund or withdraw through a third party's bank account may result in a hold on your Account, restriction or termination, and where it gives us reasonable grounds for suspicion, a suspicious transaction report. This is one of the most common patterns used to move the proceeds of crime through an exchange, and we police it strictly.

6.6 Legal entities. We collect the certificate of incorporation or registration, the constitutional documents, the resolution or authority under which the Account is operated, and identification and verification of every authorised signatory and every beneficial owner under section 9. The entity's Permanent Account Number is obtained and verified from the issuing authority's database in all cases.

6.7 We may require further information or documents at any time — before, during or after a transaction — including evidence of source of funds and, where enhanced due diligence applies, source of wealth. We may restrict an Account until it is provided.

6.8 The decision on whether due diligence is satisfactory is never outsourced. We use specialist third-party technology to assist with identity, document and bank verification; the decision is ours. Those providers are subject to due diligence and periodic review under section 20.5, and the categories of provider we engage are described in the Privacy Policy.

7Risk categorisation and periodic updation

7.1 Every customer is classified, at a minimum into High risk and Medium risk. We may add further categories above these; there is no low-risk band. Classification takes account of: identity and the sufficiency of documentation; occupation, business activity and expected activity; the source and expected pattern of funds; geographic exposure, including any connection to a tax haven or to a jurisdiction on the FATF grey or black list; product and delivery-channel risk, including the use of unhosted wallets and of leveraged products; politically exposed person status; adverse media; and on-chain exposure identified under section 12.

7.2 A customer's risk classification is not disclosed to the customer.

7.3 We review the risk classification of every Account at least once every six months, and additionally on a material change in activity or circumstances, on an alert, and on a change in the applicable lists. A change in classification updates the due diligence applied without undue delay.

7.4 Periodic updation of customer due diligence, measured from the date of account opening or the last updation:

7.5 Our updation policy is Board-approved and prioritises overdue customers. Where no information has changed, a self-declaration is accepted. Where due diligence information has changed, or a document has expired, full due diligence equivalent to that of a new customer is carried out. Where we adopt a live selfie or video at updation, that is documented in our internal programme.

8Enhanced due diligence

8.1 Enhanced due diligence is mandatory where the customer or a beneficial owner is:

• a natural or legal person from, or connected to, a known high-risk jurisdiction — specifically a country designated as a tax haven, or on the FATF grey or black list;
• a politically exposed person within Rule 2(1)(db), or an immediate family member or close associate of one; or
• a non-profit organisation.

8.2 We also apply enhanced due diligence where: the customer is classified as high risk; a legal person has an opaque ownership structure, bearer shares or a nominee arrangement; a transaction is unusually large or structured, or has no apparent economic or lawful purpose; the activity involves an unhosted wallet (section 14) or an unregistered service provider; a transfer lacks complete transfer information (section 13); there is a mismatch between the declared address and the captured geolocation; there is adverse media; or screening produces a possible match.

8.3 Enhanced due diligence includes: approval by senior management or the Principal Officer to establish or continue the relationship; establishing source of funds and source of wealth with documentary evidence; a fuller understanding of the purpose and intended nature of the relationship; and more frequent and more intensive ongoing monitoring.

8.4 Politically exposed persons. A relationship with a politically exposed person requires the approval of the Designated Director, source of wealth must be established, and the relationship is subject to enhanced ongoing monitoring throughout. We do not onboard a politically exposed person connected to a jurisdiction that is a tax haven or on the FATF grey or black list.

8.5 Where enhanced due diligence cannot be completed, we terminate the relationship and file a suspicious transaction report.

9Beneficial ownership

9.1 For a legal person we identify and verify every natural person who ultimately owns or controls the customer, or on whose behalf a transaction is conducted:

9.2 Control is assessed as ownership or control by other means, including through a chain of ownership, a shareholders' agreement, a right to appoint directors, or effective control in fact.

9.3 No customer may transact on behalf of an undisclosed person. Every customer transacts for their own account, with their own funds, for their own benefit, unless we have approved an arrangement in writing.

10Sanctions, politically exposed person and adverse media screening

10.1 We screen applicants, customers, beneficial owners, authorised signatories, counterparty service providers and transaction counterparties against:

• individuals and entities designated under section 51A of the Unlawful Activities (Prevention) Act, 1967, and the orders and lists notified by the Ministry of Home Affairs;
• lists issued under the Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) Act, 2005;
• the United Nations Security Council consolidated list, including the ISIL (Da'esh) and Al-Qaida list and the 1988 list;
• lists circulated by the Reserve Bank of India, and the FIU-IND Compliance Orders list;
• the Ministry of Home Affairs lists of banned individuals, banned organisations and individual terrorists designated under the Unlawful Activities (Prevention) Act;
• the Ministry of External Affairs list of fugitives extradited, and the Ministry of Corporate Affairs list of multi-level marketing companies;
• the lists maintained by the Office of Foreign Assets Control of the United States Department of the Treasury, the European Union and His Majesty's Treasury of the United Kingdom, to the extent relevant to our counterparties, banking partners and service providers; and
• politically exposed person and adverse media data sources.

10.2 Screening is performed at a minimum at onboarding, on any change in customer due diligence details, on any change in the applicable lists, and at the time any virtual digital asset transaction is initiated.

10.3 We maintain safeguards so that no virtual digital asset transfer completes without sanctions screening. An incoming virtual digital asset may be received into a wallet under our control and is not available to you until sanctions, analytics and transfer-information checks are complete. Availability of a balance on the Platform is not a representation that the asset is free of risk, or that every hop in its history has been cleared. We may return the asset to its source, continue to hold it, or report it.

10.4 A possible match is escalated to the Principal Officer immediately and the transaction is not processed until it is resolved. A false positive is cleared through a documented four-eyes process, and the outcome is recorded.

10.5 On a confirmed match against a designated person we freeze the assets and funds concerned without delay, do not process the transaction, and report to the authorities within the period required by section 51A and the orders issued under it. We do not tell the customer the reason.

11Assets and activities we do not facilitate

11.1 Anonymity-enhancing crypto tokens. Transactions in tokens designed to conceal or obfuscate the origin, ownership or value of transactions are outside our acceptable risk appetite and are not permissible. We do not permit deposits or withdrawals of anonymity-enhancing crypto tokens, and such transactions are not facilitated.

11.2 Tumblers and mixers. We deploy transaction monitoring and analytical tools to identify transactions involving mixing or tumbling services. On detection, those transactions are not facilitated, and they trigger risk mitigation measures.

11.3 We may refuse, hold, return to source or report an asset which originates from, or has passed through, an address associated with sanctions, terrorist or proliferation financing, ransomware, a darknet marketplace, a known exploit or theft, child sexual abuse material, an investment-scam or authorised-push-payment cluster, a mixer or obfuscation protocol, or a wallet or service in a high-risk jurisdiction; or which our screening identifies as presenting risk above our threshold.

11.4 Initial coin and token offerings. The issuance, book-building, underwriting, market-making, placement and distribution of a virtual digital asset fall within the scope of our obligations, and automation through a smart contract does not relieve the controlling parties of them. Activities of this kind are strongly discouraged under the Guidelines, and we do not undertake them without a documented pre-launch risk assessment and Board approval.

11.5 The full list of prohibited assets and prohibited sources is published as clause 4.6 of the Terms to the User Terms and Conditions and may be amended by notice. Where we refuse a transfer on the basis of screening, you may ask us to review the decision under section 21.5, and we will explain the general basis of the decision unless we are prohibited from doing so.

11.5A We do not certify counterparties, wallets or assets. A completed transfer, a cleared deposit or an answer to a screening query is not a representation that a counterparty, a wallet or an asset is lawful, and we do not issue a letter or certificate to that effect.

11.6 We keep clause 4.6 of the Terms current. It is reviewed at least annually, and additionally on any change in our enterprise-wide risk assessment, on the emergence of a new anonymity-enhancing asset, protocol or obfuscation technique, on a change in the Guidelines, and on a designation by an authority. An amendment takes effect on notice, and takes effect immediately where Applicable Law or an immediate risk requires it.

12Ongoing monitoring and blockchain analytics

12.1 All activity is monitored on an ongoing basis, both automatically and with human review, against the customer's risk classification and expected profile. We use machine learning and analytical tooling for this purpose.

12.2 Monitoring covers the patterns that most often draw attention, and none of them requires any wrongdoing on your part to be looked at. It can be money reaching your Account from a bank account or UPI identifier that is not yours; withdrawals directed to several different bank accounts; deposits and withdrawals in quick succession; and funds moving in and straight back out without any trade in between. If there is an ordinary explanation, tell us and we will record it. An enquiry is not an accusation, and section 17 sets out what we may and may not do while one is open.

12.3 Blockchain analytics. Every deposit and withdrawal address is screened, and wallet exposure and behavioural patterns are risk-scored, using specialist on-chain analytics tooling provided by an established analytics firm. Monitoring is designed to identify the origin and the destination of a virtual digital asset and to permit reconstruction of the transaction. The output feeds customer due diligence, risk classification, monitoring and reporting, and internet protocol addresses and device identifiers are used to improve the quality of the reports we file.

12.4 Transaction data stores are subject to role-based access control, backup and recovery.

12.5 Alerts are triaged, investigated, documented, and either closed with recorded reasons or escalated to the Principal Officer, against defined internal turnaround times. Monitoring, screening, escalation and reporting continue during a system outage or other disruption, under our business continuity arrangements.

12.6 Linkage across Accounts. The identifiers we are required to capture under clause 6.3 are also used to identify relationships between Accounts. A shared device identifier, a shared internet protocol address, a shared bank account or payment instrument, a shared beneficial owner, matching or near-matching identity data, coordinated trading patterns, or anomalous or inconsistent geolocation behaviour are treated as red flags. Where they appear we may open an account-linkage investigation, apply enhanced due diligence under section 8 to each Account concerned, restrict or link the Accounts, and — where the criteria are met — file a suspicious transaction report. Undisclosed multiple Accounts, and Accounts operated in concert or on behalf of an undisclosed person, are a breach of section 5.6 and section 9.3 and are grounds for closure of the additional Accounts. The use of a virtual private network, proxy or other technology to mask or misrepresent a device, location or internet protocol address is itself a red flag and is prohibited by clause 3.1 of the Terms.

12.7 Account takeover and victim deposits. Where we have reason to believe an Account has been taken over, or that a deposit or a transfer is the proceeds of authorised-push-payment fraud, a romance or investment scam, ransomware or any other offence against a third party, we may hold the balance, restrict the Account, file a report and cooperate with the originating bank, another reporting entity or an authority. We are not obliged to treat the person then logged in as the customer, and section 16 applies to what we are able to tell you.

13Transfer information — the Travel Rule

13.1 Where a virtual digital asset is transferred between Giottus and another service provider, we comply with the transfer-information requirements. They apply to every transfer. There is no monetary or value threshold.

13.2 Timing. The required information is submitted securely and immediately — before, simultaneously with, or concurrently with the transfer itself. Submission after the transfer is not permitted.

13.3 Counterparty screening before transmission. As the originating institution we undertake due diligence and sanctions screening on the counterparty before we transmit the required information, so as not to deal unknowingly with an illicit actor or a sanctioned person or entity. We maintain a communication channel for counterparty due diligence and transaction queries.

13.4 The information transmitted. As the originating institution we obtain, hold and transmit:

• the amount and type of virtual digital asset;
• the originator's Permanent Account Number and identity document number;
• the originator's verified full name;
• the originator's wallet address or account number used to process the transaction;
• the originator's physical address, verified by us as part of due diligence, and date of birth;
• the beneficiary's name; and
• the beneficiary's wallet address or account number.

13.5 As the beneficiary institution we obtain and hold the same originator information, and we verify the beneficiary's name for accuracy and confirm that the name and account number received from the originating institution match our own verified customer record. A discrepancy is escalated. Each side retains a record; the originating institution screens the beneficiary against sanctions lists and the beneficiary institution screens the originator; and both monitor and report on suspicion.

13.6 We deploy an appropriate technological solution for this purpose. In exceptional cases where deployment is not feasible, a controlled self-declaration mechanism may be used, and its use is documented.

13.7 A transfer with missing, incomplete or unreliable transfer information is subject to enhanced scrutiny, and may be restricted, delayed, declined or returned until the requirement is satisfied. Where appropriate it is escalated for a suspicious transaction report.

13.8 Transfer information is personal data. It is transmitted on the basis of our legal obligation, is disclosed in the Privacy Policy and in clause 4.4 of the Terms, and is retained under section 18.

14Unhosted wallets and unregistered service providers

14.1 Where at least one wallet in a transfer is hosted with us, the compliance burden is ours, and we maintain an internal mechanism to obtain originator, beneficiary and other required information from our customer. Such transfers fall within our full AML, CFT and CPF obligations.

14.2 We collect data on unhosted wallet transfers, monitor and assess that information to determine the risk posed, and apply enhanced due diligence and other risk-based controls to the transaction and to the customer.

14.3 We may impose additional limitations, controls or prohibitions on transactions with unhosted wallets, in line with our risk assessment, including enabling only those transactions assessed as reliable. Limits may be applied by asset, by network, by amount or by customer risk classification.

14.4 Proof of ownership and control. Before we process a transfer to or from an unhosted wallet we may require you to demonstrate that the wallet is yours and under your sole control. That may include:

• cryptographic proof of control — signing a message we specify with the private key of the address, or making a verifiable micro-transfer from it;
• a signed attestation of ownership and sole control, in the form we prescribe;
• evidence of the wallet software or hardware used, and screen-recorded verification where we ask for it; and
• an explanation, with evidence, of the source of the funds.

14.5 Where the evidence we request is not provided within the period we specify — which will be at least 7 days unless a shorter period is necessary — we may decline the transfer, return the assets to their source where that is technically possible and lawful, or continue to hold them pending resolution. Withdrawal addresses must be whitelisted and are subject to a cooling-off period before first use, and we may require the proof in this section again where an address has not been used for a prolonged period or where our risk assessment changes.

14.6 The same approach applies to transactions with a virtual digital asset service provider that is not registered with FIU-IND.

15Reporting to FIU-IND

15.1 We file the reports required under section 12 of the Act and Rules 3 and 8 of the Rules, electronically with FIU. Suspicious Transaction Report is filed irrespective of the amount of the transaction and of any threshold, and including an attempted transaction. STRs are filed not later than seven working days from the date on which the Principal Officer concludes that a transaction is suspicious.

15.2 We also furnish the statements of information in respect of crypto-asset transactions required under the Income-tax Act, 2025 and the rules made under it, together with the information required for the purposes of the Crypto-Asset Reporting Framework, and we correct any defect within the period allowed.

16Confidentiality and the prohibition on tipping off

16.1 Giottus, and every one of its officers, employees and contractual staff, must not disclose to a customer or to any other person that a report has been made, is being considered, or may be made, or that information has been furnished to FIU-IND or to any authority, or that an investigation is underway. The prohibition applies before, during and after the submission of a report.

16.2 This is why, where we restrict an Account, hold a balance or decline a transaction for a reason connected to a suspicion, we will tell you that we are unable to give reasons. That is a legal constraint, not a discretionary choice, and we would rather say so plainly than give you a reason that is not the real one.

16.3 Reports, and the information in them, are accessible only on a need-to-know basis, and access is logged.

16.4 What this section does not prevent. For the avoidance of doubt, none of the following is a disclosure prohibited by this section: transmitting or receiving transfer information under section 13, including the counterparty due diligence and the communication channel that section requires; requesting, providing or verifying a Partner Accreditation for Compliance and Trust certificate under section 3.3; exchanging information with another reporting entity to the extent necessary to comply with an obligation under the Act, the Rules or the Guidelines; responding to a lawful request from an authority under section 19; or making a report to FIU-IND or to any other authority. In each case the exchange is limited to what the obligation requires, and must not reveal that a report has been made, is being considered, or may be made.

17Restriction, holds and exit

17.1 Where this Policy requires it, we may decline a transaction, delay it, reverse it, restrict an Account, place a hold on a balance, or terminate the relationship.

17.2 A restriction or a hold is not a forfeiture. It does not transfer ownership of any asset to Giottus or to anyone else. Assets are released, returned or remitted only in accordance with the Terms or a lawful direction.

17.3 Where a requisition or direction permits, we limit a hold to the disputed sum rather than the whole balance.

17.4 Where we exit a relationship and no legal impediment prevents it, we return your assets in accordance with clause 21 of the Terms.

17.4A Return to source. Where we return a virtual digital asset or a fiat sum to its source, network fees, bank charges and any difference in value between receipt and return are borne by you, except where the return is required solely by our error.

17.4B Death or incapacity. On death or incapacity we deal only with a person who produces the documents the law requires and who completes customer due diligence to the same standard as a new customer. We may hold the assets until that is done. Section 16 applies where the reason for any hold is connected to a suspicion.

17.5 Action taken in good faith. Where we decline, delay, reverse or block a transaction, restrict an Account, place a hold, or terminate a relationship in good faith and in compliance with this Policy or Applicable Law, that action is not a breach of the Terms, and we are not liable for indirect or consequential loss arising from it — including loss of opportunity, loss of profit, or a loss caused by a movement in the price of a Digital Asset while the action was in effect.

17.6 Clause 17.5 does not limit, and is subject to, the following.

• Our liability for fraud, wilful misconduct and gross negligence. Clause 16.1 of the Terms preserves our liability for fraud, for wilful misconduct, for death or personal injury caused by negligence, and for anything which cannot lawfully be excluded. In addition, and as a commitment given in this Policy, we do not rely on clause 17.5 to exclude liability for our own gross negligence in the operation of this Policy.
• The independent review of a hold we imposed ourselves. The Terms require us to act proportionately and for no longer than is necessary, and give you the right to ask us to review a hold. This Policy adds a timetable to that right: where a hold or restriction arises from our own risk assessment rather than from a direction we are required to follow, we complete the review within 7 Business Days, extendable once with written reasons given to you, and it is carried out by a person independent of the original decision.
• Your rights under the Consumer Protection Act, 2019 and any other law, none of which is affected by anything in this Policy.

Nothing in this section entitles us to act unreasonably, to act for longer than is necessary, or to retain a benefit at your expense.

17.7 Reactivation after dormancy. Where an Account has been inactive for a prolonged period we may require due diligence equivalent to that of a new customer before any further transaction is permitted.

18Records and retention

18.1 We maintain records of the identity of every customer and beneficial owner, of the due diligence performed, and of every transaction, in a form that permits the reconstruction of the transaction — its nature, the amount and types of virtual digital asset and fiat currency, the date, the parties, and the details required for transfer-information compliance.

18.2 Retention periods

18.3 We preserve complete audit trails, including verification responses, timestamps and authentication logs, in a tamper-proof manner, and we maintain a documented retention system permitting easy and prompt retrieval by a competent authority. Records are not destroyed during the retention period.

18.4 These periods are a legal requirement. They take priority over a request for the erasure of personal information, as Rule 5(4) of the 2011 Rules provides and as section 8(7) of the Digital Personal Data Protection Act, 2023 will provide on its commencement, and this is disclosed in the Privacy Policy. We do not retain personal data for longer than the law requires.

19Requests from authorities

19.1 We cooperate fully and promptly with FIU-IND, the Enforcement Directorate, the income-tax authorities, CERT-In, the police and other law-enforcement agencies, regulators and courts, and we provide the information and assistance required by a lawful request.

19.2 Requests should be addressed to our Nodal Officer at [email protected]. Our detailed procedure is an internal document which we do not publish, for the reason given in clause 1.3. The criteria we apply are these. A request must be in writing, must come from an officer competent to make it, must identify the legal provision relied on, must state the purpose, and must identify the Account or transaction with enough particularity for us to act. A request that does not meet those requirements is not actioned — we tell the requesting officer what is missing and ask for it. We acknowledge a valid request within 2 Business Days and respond within the time the request specifies or, where none is specified, within 10 Business Days.

19.3 Each request is checked for validity and scope, logged, and actioned within the period specified or, where none is specified, within 10 business days. Where a request is defective we say so and ask for it to be corrected, rather than declining silently or disclosing more than the request supports.

20People, training, audit and outsourcing

20.1 Recruitment screening is an integral part of our hiring process, so that a person of criminal background does not obtain access to our systems.

20.2 Training. Every employee completes AML, CFT and CPF training within 30 days of joining and a refresher at least annually, customised to their role. It covers customer due diligence, risk classification, enhanced due diligence, identifying and escalating suspicious activity, reporting, sanctions, transfer information, confidentiality and the prohibition on tipping off. Completion is assessed, records are kept, and access to relevant systems is restricted until training is completed.

20.3 Independent annual audit. We cause an independent annual audit of our AML, CFT and CPF controls, systems, procedures and safeguards, conducted at least once a year, take corrective action on any deficiency, and place the report before the Board or a designated Board committee. Internal audit findings are reported to the audit committee quarterly and tracked to closure.

20.4 External cyber security audit. We hold and maintain the CERT-In empanelled auditor certificate described in section 3.2.

20.5 Outsourcing. A third party used in support of this Policy must be subject to appropriate regulation or supervision, must not be based in a known high-risk jurisdiction, must meet our data protection and security requirements, and is subject to due diligence and periodic review. The decision on whether due diligence is satisfactory, and the decision to report, are never outsourced. Accountability for compliance remains with Giottus.

21Your obligations, and how to raise a concern

21.1 You must give us information that is true, complete and current, and tell us within 30 days of any change to your identity documents, address, bank account, contact details or beneficial ownership. A false or misleading declaration, and a failure to update within that period, carry the consequences set out in clause 5.8 — including restriction or termination of your Account.

21.2 You must transact only for your own account, with your own funds, from your own verified bank account, and for your own benefit, and you must hold one Account only. You must not fund your Account from, or withdraw to, another person's bank account — see clause 6.5. You must not act as a money mule for any person. If you allow another person to route money or assets through your Account, or to use your Account or your credentials, whether for a fee or as a favour, your Account will be closed and reported, and you may commit a criminal offence.

21.3 You must cooperate with any enquiry we are required to make, and provide the documents we request.

21.4 If you believe an Account or a transaction on the Platform is being used for money laundering, terrorist financing, fraud or any other unlawful purpose, tell us at [email protected] or [email protected]. You may do so without identifying yourself, and we will not disclose that you contacted us to the person concerned.

21.5 Indemnity. You will indemnify Giottus against any loss, penalty, claim or reasonable legal cost arising from information you gave us that was false, incomplete or not yours to give, or from your use of the Account for another person. This clause is subject to section 17.6 and does not exclude liability that cannot lawfully be excluded.

22Policy governance

22.1 This Policy is owned by the Principal Officer, approved by the Board of Directors, and reviewed at least annually and on any material change in law, in the FIU-IND Guidelines, or in our products, customers or risk profile.

22.2 Every version carries a version number, an effective date and a Board approval date. Superseded versions, and a summary of what changed, are available from support on request.

22.3 Where we amend this Policy in a way that materially affects your rights, we tell you before the change takes effect — by email to your registered address and by in-app notification — and we tell you what has changed and why. This is a commitment given in this Policy. We may make a change with immediate effect where it is required by law, necessary to protect users or the security of the Platform, or non-material or clarificatory. Clause 20 of the Terms governs changes to the Terms themselves.

23Contact

ASchedule A — what to have ready

A.1 This Schedule lists what we ask for. It is indicative, not exhaustive: we may ask for less where the risk is lower, and for more under section 8. Where a document has an expiry date it must be valid on the day you give it to us.

A.2 An individual

• Permanent Account Number card. Mandatory. A minor's Permanent Account Number is not accepted.
• One officially valid document — passport, driving licence, proof of possession of Aadhaar, or voter's identity card. Where you give us an Aadhaar number we handle it only as the law permits and mask it in our records.
• A live selfie with liveness detection, and a live video session where clause 6.4B applies.
• Your mobile number and email address, verified by one-time password.
• Your bank account details, verified by penny-drop with a name match.
• Your gender and nationality.
• Your occupation and income range.

A.3 A company

• Completed application form, and a board resolution authorising the Account and naming who may operate it.
• Certificate of incorporation; memorandum and articles of association; company Permanent Account Number; and Goods and Services Tax registration certificate where the company holds one.
• Ownership and control structure, identifying every beneficial owner as section 9 requires.
• For each authorised signatory and each beneficial owner: the individual documents at A.2, and a letter of authorisation for the signatory.
• Proof of the principal place of business, the mailing address and a telephone number.
• Bank account details with a statement, and where we ask for it the most recent income-tax return and financial statements.

A.4 A partnership firm or limited liability partnership

• Completed application form; registration or incorporation certificate; the partnership deed or LLP agreement; the firm's Permanent Account Number; and a resolution authorising the Account.
• Ownership structure, and the individual documents at A.2 for each partner and authorised signatory, with a letter of authorisation.
• Goods and Services Tax registration where held, proof of the place of business, mailing address and telephone number, and bank account details with a statement.

A.5 A trust or foundation

• Completed application form; registration certificate and trust deed; the trust's Permanent Account Number; and a resolution of the managing body.
• Details of every trustee, settlor, beneficiary and authorised signatory, with the individual documents at A.2 for each, and a letter of authorisation.
• Ownership and control structure, proof of the place of business, mailing address, telephone number and bank account details.
• A trust is treated as higher risk under Schedule C and enhanced due diligence under section 8 will normally apply.

A.6 A proprietorship concern, or a Hindu undivided family

• Proprietorship. The proprietor's individual documents at A.2, plus any two of: registration certificate; a certificate or licence issued by the municipal authority under the Shops and Establishments Act; sales or income-tax returns; a certificate or registration document issued by the tax authorities; a Goods and Services Tax certificate; or a utility bill in the name of the concern.
• Hindu undivided family. Completed application form; deed of declaration and list of coparceners; the family's Permanent Account Number; the individual documents at A.2 for the karta and each coparcener; proof of address; bank account details; and a letter of authorisation.

BSchedule B — evidence of source of funds and source of wealth

B.1 Where section 8 applies we ask you to show where the money came from. This table is what we accept. It is not exhaustive, and one clear document is better than several unclear ones. If you cannot evidence a source, tell us why rather than sending something that does not support it — an unexplained gap is what causes a problem, not the fact of asking.

B.2 Where what you tell us about your income, source of wealth or net worth does not fit what we see, we ask for more, and we say what we are asking for and why. A refusal to evidence a source, or the absence of any evidence, is itself a ground for suspicion, and where the position cannot be resolved we decline the transaction and may exit the relationship under section 17.

CSchedule C — business types that attract closer attention

C.1 Where the customer is a legal entity, the type of entity and the nature of its business both feed the risk classification in section 7, and the higher of the two governs.

C.2 The following business activities are treated as higher risk because they are cash-intensive or are commonly used to move value, and enhanced due diligence under section 8 will normally apply: arms dealing; money changing and exchange houses; gems, jewellery, precious metals and bullion dealing, including sub-dealers; real estate agency and construction; offshore corporate structures; art and antique dealing; restaurants, bars, casinos and night clubs; import and export agency where the goods are not for the trader's own manufacturing or retailing; stock and share broking; non-banking financial companies; transport operators and dealers in used or reconditioned vehicles; scrap metal dealing; liquor distribution; commodity intermediaries; co-operative banks; dealers and brokers in cars, boats and aircraft; and multi-level marketing firms.

C.3 Being in one of these categories is not an accusation and is not a bar. It means we ask more questions before we onboard you and we look more closely afterwards. Every other business activity is assessed on its own facts.