AML/CFT Policy

1. Purpose

This Anti-Money Laundering and Counter-Terrorism Financing Policy (AML/CFT) sets forth the principles, responsibilities and procedures adopted by Nora Finance to detect, prevent and report suspicious activity related to money laundering, terrorism financing and the financing of proliferation of weapons of mass destruction (ML/TF/PFWMD).

The policy is grounded in the risk-based approach (RBA) recommended by FATF (Financial Action Task Force) and aligned with the prevailing Brazilian regulatory framework.

2. Nora Finance's Regulatory Positioning

Nora Finance operates exclusively as a stablecoin issuer (pure issuer model), issuing and managing BRS - a stablecoin pegged 1:1 to the Brazilian Real, with reserves composed of federal Government Bonds and CDBs from major Brazilian financial institutions.

Nora Finance does not provide custody of third-party digital assets, intermediation, order execution or wallet management services. As a result, it does not qualify as a Virtual Asset Service Provider (PSAV) under Decree no. 11,563/2023 or BCB Resolution no. 518/2024.

Notwithstanding, Nora Finance voluntarily assumes AML/CFT obligations consistent with its activity, recognizing that:

• Its direct customers (NAMs) frequently operate as PSAVs or regulated financial institutions

• Stablecoin issuance is an activity with potential risk of misuse for ML/TF purposes

• Adoption of rigorous compliance standards is both a competitive differentiator and a commitment to financial system integrity

3. Legal and Regulatory Basis

4. Definitions

5. Policy Principles

• Risk-based approach: AML/CFT measures are proportionate to the risk identified in each NAM and each operation

• Know your customer: no NAM is activated without satisfactory completion of the KYB/KYC process (see KYC/KYB Policy)

• Compliance independence: Compliance decisions are independent of commercial pressure

• Individual responsibility: every team member is responsible for identifying and internally reporting suspicious situations

• Continuous improvement: the policy is reviewed periodically and updated upon regulatory or operational changes

• Zero tolerance: Nora Finance does not maintain relationships with entities that refuse to cooperate with AML/CFT procedures

6. Institutional Risk Assessment (IRA)

Nora Finance periodically performs an Institutional Risk Assessment that maps the main ML/TF exposure vectors of its operation.

6.1 Activity Risk Profile

6.2 Mitigating Factors

• Mandatory KYB for every NAM prior to any activation

• Wallet whitelist: only pre-approved addresses can execute mint/burn

• Per-NAM operational limits configured and enforced in the system

• Continuous on-chain monitoring of every mint and burn operation

• NAMs are contractually responsible for KYC of their end users (NAM Agreement)

7. Customer Identification and Diligence

Nora Finance applies the KYB/KYC process to every NAM candidate as detailed in the KYC/KYB Policy and the NAM Program v1. This section summarizes the points relevant for AML/CFT purposes.

7.1 Minimum Required Identification

Of the entity (legal person):

• Corporate name, CNPJ, incorporation date and address

• Legal form and corporate purpose

• Ownership structure and control chain

• Active registration with the Brazilian Federal Revenue

• Regulatory status (authorized PSAV, in process, or other equivalent regulation)

Of beneficial owners and representatives (natural persons):

• Full identification (name, CPF or passport, nationality, date of birth)

• PEP qualification (direct and indirect, including family history)

• Identity verification with biometric check

7.2 Risk-Proportional Diligence

7.3 Heightened Attention Situations

The following situations require mandatory enhanced diligence:

• NAMs with PEP in a position of effective control

• NAMs headquartered in or with material operations in FATF grey or black list jurisdictions

• NAMs with complex ownership structure involving multiple holding layers

• NAMs in business segments classified as high risk by FATF (e.g., DeFi protocols without permissioned access)

• NAMs whose corporate controllers are in a process of merger or acquisition with material impact

8. Continuous Operations Monitoring

8.1 Monitoring Criteria

Nora Finance monitors all mint and burn operations through a combination of automated systems and analyst review. The criteria considered include:

• Volume: operations exceeding the NAM's historical pattern or approaching the monthly limit suddenly

• Frequency: unusual sequence of operations within a short time window

• Structuring: multiple operations of similar value performed in sequence to circumvent reporting thresholds

• Origin/destination addresses: transactions involving wallets on risk lists or associated with known illicit activity

• Timing: high-volume operations at atypical hours without prior justification

• Jurisdiction: fund flow with origin or destination in high-risk jurisdictions

8.2 Alert Investigation Workflow

8.3 Suspicion Indicators

The following indicators may, individually or in combination, characterize a suspicious operation:

• Mint or burn of value incompatible with the NAM's historical volume or declared size

• NAM unable to explain the economic purpose of a specific operation when questioned

• Operations involving wallet addresses not on the approved whitelist

• Refusal or unjustified delay in periodic registration update

• News or external information suggesting involvement of the NAM or its controllers in illicit activities

• Sudden change in operational profile without prior notice to Compliance

• Repeated attempts at operations exceeding system-configured limits

9. COAF Reporting

9.1 Mandatory Reports

Nora Finance will report to COAF, within the deadlines established by law:

• Operations or situations indicative of money laundering or terrorism financing

• Any operation that, after internal analysis, has not obtained satisfactory clarification regarding its lawfulness

9.2 Reporting Process

• Reports are prepared by the Compliance Officer (CFO)

• Submitted to COAF through the official system (SISCOAF - Sistema de Controle de Atividades Financeiras)

• Recorded internally with date, time and reason

9.3 Absence of Suspicious Activity

In periods where no suspicious operation or situation is identified, Nora Finance will submit a negative report to COAF in accordance with the frequency required by applicable regulation.

10. Sanctions and Restrictive Lists

Nora Finance performs continuous screening of every active NAM, its representatives and UBOs against the following databases:

• UN (UNSC), OFAC (USA), HM Treasury (United Kingdom) and SECO (Switzerland) sanctions lists

• National and international PEP lists, including indirect and historical exposure

• COAF and Central Bank of Brazil communications and determinations

• Jurisdictions under FATF enhanced monitoring (grey list and black list)

• Adverse media databases on compliance, fraud and financial crime

11. Records and Data Retention

Nora Finance maintains complete and traceable records of:

• The full NAM onboarding process (documents, decisions, dates, versions)

• Results of PEP and sanctions screening (onboarding and ongoing monitoring)

• Monitoring alerts generated and their resolution (false positive or investigation)

• COAF reports (internal records; documents submitted to COAF are confidential)

• Decisions on approval, rejection, suspension and termination of NAMs with justification

• Periodic reviews and re-KYBs performed

12. Responsibilities

13. Training and Compliance Culture

• Every Nora Finance team member receives initial AML/CFT training during onboarding

• Annual mandatory refresher training for the entire team

• The Compliance Officer maintains continuous professional development on crypto regulation and AML/CFT

• Compliance culture is a leadership responsibility: no commercial pressure justifies non-compliance with this policy

14. Review and Effectiveness

This policy enters into force on the date of its approval by Nora Finance's executive board and shall be reviewed:

• Annually, as part of the regular internal policy review cycle

• Whenever a material change occurs in applicable legislation or regulation (in particular following approval of Bill no. 4,308/2024 and publication of BCB operational rules for stablecoin issuers)

• Upon recommendation by external legal counsel or external audit

• In the event of a compliance incident requiring procedural adjustment

15. Related Documents

• KYC/KYB Policy - Nora Authorized Minters (NAM)

• NAM Program v1 - Nora Authorized Minters

• NAM Agreement (Authorized Minter Partnership Agreement)

• Institutional Risk Assessment (IRA) - to be drafted