KYC/KYB Policy

1. Purpose and Scope

This Know Your Customer Policy (KYC/KYB) sets forth the procedures and criteria adopted by Nora Finance for the identification, qualification and ongoing monitoring of partners credentialed as Nora Authorized Minters (NAMs) - the only entities authorized to mint and burn BRS, Nora Finance's BRL-pegged stablecoin.

Nora Finance operates exclusively as a stablecoin issuer (pure issuer model), without providing custody, intermediation or order execution services for digital assets to end users. As a result, Nora Finance does not qualify as a Virtual Asset Service Provider (PSAV) under Decree no. 11,563/2023 or Brazilian Central Bank Resolution no. 518/2024, and is not subject to prior authorization from the Central Bank of Brazil to operate.

Nevertheless, Nora Finance acknowledges that NAM partners frequently act as PSAVs, exchanges, neobanks or regulated DeFi platforms, and voluntarily assumes anti-money laundering and counter-terrorism financing (AML/CFT) commitments required by Law no. 9,613/1998 and the Brazilian crypto regulatory framework (Law no. 14,478/2022), adopting standards consistent with FATF recommendations.

2. Legal and Regulatory Basis

Nora Finance's KYC/KYB Policy is grounded in the following regulatory framework:

3. Definitions

4. General Principles

• Nora Finance adopts a risk-based approach (RBA) to scale the depth of due diligence for each NAM according to its individual risk profile.

• No NAM partner is activated without satisfactory completion of the KYB process described in this policy.

• Nora Finance does not maintain relationships with anonymous entities, entities in high-risk jurisdictions without plausible justification, or entities that refuse to provide requested information.

• Information collected is used exclusively for regulatory compliance purposes and is not shared with third parties, except when required by law or regulation.

• The entire KYB process is operationalized through a specialized compliance technology platform, ensuring traceability, versioning and compliance with the LGPD (Law no. 13,709/2018).

• Documentation collected must be retained for a minimum of 5 (five) years after the relationship is terminated, in accordance with regulatory requirements.

5. NAM Onboarding Process

5.1 Process Stages

5.2 Required Documentation

5.2.1 Corporate Documents

• Updated Articles of Association or Bylaws, registered with the competent body

• Certificate of Registration with the Commercial Registry or equivalent (issued no more than 90 days prior)

• Active CNPJ and good standing with the Brazilian Federal Revenue (registration status certificate)

• Proof of registered office address (issued no more than 90 days prior)

• Updated list of shareholders, partners and directors

5.2.2 Legal Representatives

• Official photo ID (RG, CNH or passport) - front and back

• Active CPF

• Proof of representation powers (power of attorney, election minutes or contractual clause)

5.2.3 Ultimate Beneficial Owners (UBOs)

• Identification of every natural person with direct or indirect interest >= 25% or with effective control

• Official photo ID for each UBO

• Beneficial ownership declaration signed by the legal representatives

• PEP declaration for each UBO and legal representative

5.2.4 Regulatory Documents (where applicable)

• PSAV operating authorization issued by the Central Bank of Brazil (or evidence of pending application)

• Registration/authorization number with other relevant regulators (CVM, SUSEP or foreign equivalent)

• NAM's own AML/CFT policy (executive summary or attestation of existence)

• Most recent audit report or compliance certification (if available)

6. Risk Classification and Enhanced Due Diligence

6.1 Risk Matrix

Each NAM partner is classified into one of the three categories below based on the weighting of inherent risk factors:

6.2 Enhanced Due Diligence (EDD)

For NAMs classified as High Risk, in addition to all standard KYB, the following additional measures are required:

• In-depth investigation of the source of funds destined for BRS minting

• Written declaration regarding the nature of activities and end-customer profile of the NAM

• Adverse media search and regulatory enforcement history check

• Manual verification of the ownership chain to the ultimate UBO

• Formal approval by Nora Finance's executive board (Compliance Officer and CEO)

• Establishment of reduced operational limits during the initial period (minimum 90 days)

• Mandatory quarterly review of risk classification

7. Sanctions and Restrictive List Screening

Every NAM candidate, its legal representatives and ultimate beneficial owners are subject to automatic and ongoing screening against the following databases:

• UN Security Council (UNSC), OFAC (USA), SECO (Switzerland) and HM Treasury (United Kingdom) sanctions lists

• National and international PEP lists

• COAF restriction registry and Central Bank of Brazil communications

• Jurisdictions under FATF enhanced monitoring (grey list and black list)

• Adverse media databases (negative press coverage on compliance, fraud or financial crime)

8. Ongoing Monitoring

The relationship with NAM partners is subject to continuous monitoring and periodic reviews, in accordance with the frequencies set forth in Section 6 by risk category.

8.1 Triggers for Immediate Review

• Material change in the ownership or control structure of the NAM

• Change in activity, jurisdiction of operation or customer base

• Alert generated by automated sanctions or adverse media screening

• Communication or determination from a Brazilian or foreign regulatory authority

• Request for significant increase in mint/burn operational limits

• Detection of atypical transactional patterns by the on-chain monitoring system

8.2 Periodic Information Update

Regardless of triggers, Nora Finance requests update of documents and registration information at the following minimum frequencies:

• Low Risk: annually

• Medium Risk: semi-annually

• High Risk: quarterly

8.3 Monitoring Technology Stack

9. Rejection and Termination Criteria

9.1 Onboarding Rejection

• Inability to identify the entity's ultimate beneficial owners

• Refusal to provide required documentation, or submission of documents suspected of being fraudulent

• Match on international or domestic sanctions lists with no resolution available

• Business model incompatible with legitimate use of BRS (e.g., crypto mixers, no-KYC platforms in jurisdictions where KYC is legally required)

• Entity headquartered in or controlled by a person resident in a jurisdiction under embargo or sanctions

• Material and unjustified inconsistency between information provided and independent verifications

9.2 Termination of Relationship

• Subsequent identification of any rejection criterion listed above

• Breach of obligations under the NAM Partnership Agreement, including refusal to update registration data

• Order from a regulatory or judicial authority

• Reasonable suspicion of use of BRS for money laundering, terrorism financing or other illicit activities

• Significant deterioration of risk profile without adequate mitigating measures

10. Responsibilities

11. Review and Effectiveness

This policy enters into force on the date of its approval by Nora Finance's executive board and shall be reviewed:

• Annually, as part of the regular compliance policy review cycle

• Whenever a material change occurs in applicable legislation or regulation

• Upon recommendation by external legal counsel or external audit

• In the event of a material compliance incident requiring procedural adjustment