AML/KYC Policy

1.1. This AML/KYC Policy defines the procedures and measures applied by ExSora to identify and manage risks associated with transactions processed through the Service.

1.2. ExSora may conduct AML and KYC checks before, during or after the processing of an exchange transaction where this is necessary based on the circumstances of the transaction, applicable requirements or the Service's internal compliance procedures.

1.3. The scope and level of verification may vary depending on the characteristics and circumstances of a particular transaction.

1.4. The fact that a transaction receives a particular risk score does not by itself constitute the sole basis for determining the final outcome of the transaction. Risk scores may be considered together with other indicators and information available to ExSora.

For the assessment of blockchain transactions, ExSora may use specialized analytical tools capable of analyzing the history and characteristics of blockchain addresses and transactions and assigning corresponding risk indicators or scores.

The risk assessment may take into account, among other factors:

• the transaction history of the relevant blockchain address;

• exposure to high-risk services or jurisdictions;

• sanctions-related indicators;

• Dark Market-related indicators;

• Mixer-related indicators;

• Scam or fraud-related indicators;

• indicators associated with theft or other unlawful activity;

• terrorism-financing-related indicators;

• other warning markers or information available to ExSora.

2.1. Risk Levels

For internal risk assessment purposes, transactions may be classified into the following general risk categories:

Low Risk: Score 0–30

Transactions generally associated with a lower level of identified risk.

Medium Risk: Score 31–64

Transactions where additional risk indicators or circumstances may require further analysis or clarification.

High Risk: Score 65–85

Transactions associated with significant risk indicators that may require enhanced review and additional verification.

Prohibited Risk: Score 86+

Transactions associated with critical risk indicators or other circumstances that may prevent ExSora from completing the transaction.

These ranges are used as one of the factors in the overall risk assessment and do not automatically determine the outcome of every transaction.

A particular AML marker or indicator, including a Dark Market, Scam, Mixer, Sanctions or terrorism-related marker, does not necessarily constitute a separate risk category by itself. Such indicators may be assessed together with the transaction's risk score and other relevant circumstances.

3.1. Low-Risk Transactions

Transactions assessed as Low Risk are generally processed without requesting additional documents.

However, a Low Risk score does not prevent ExSora from conducting additional verification where other circumstances or risk indicators require it.

If additional information or verification is required, ExSora may temporarily suspend processing of the transaction until the relevant review has been completed.

3.2. Medium-Risk Transactions

Where a transaction is assessed as Medium Risk, ExSora may conduct an additional review of the transaction.

Depending on the circumstances, ExSora may request one or more of the following:

• an identity document;

• information concerning the transaction;

• information concerning the source or origin of funds;

• information confirming the purpose or nature of the transaction;

• other information or documents reasonably required to complete the review.

The presence of a Medium Risk score does not automatically mean that KYC documents will be required. Additional verification may also be requested where other risk indicators or circumstances are identified.

If the User refuses to provide the information reasonably required for verification, ExSora may be unable to complete the transaction and may proceed with a return of funds in accordance with this Policy.

3.3. High-Risk Transactions

Transactions assessed as High Risk may be subject to enhanced manual review.

Depending on the circumstances, ExSora may request:

• an identity document;

• a selfie or video selfie with an identity document;

• proof of address;

• Source of Funds documentation;

• information confirming the origin and traceability of the funds;

• information concerning the nature or purpose of the transaction;

• other documents or information reasonably necessary for the completion of the compliance review.

Examples of Source of Funds or transaction-related documentation may include:

• exchange transaction records;

• bank statements;

• transaction confirmations;

• agreements or other documents confirming the origin of funds;

• other documents reasonably capable of confirming the origin or traceability of the funds.

The review period depends on the complexity of the transaction and the information required for verification.

Following the review, ExSora may either proceed with the transaction or decide to return the funds, depending on the circumstances and applicable requirements.

3.4. Prohibited or Critical-Risk Transactions

Transactions presenting critical AML indicators or other circumstances that prevent their completion may be suspended or refused.

Such circumstances may include, among others:

• sanctions-related indicators;

• indicators associated with terrorist financing;

• serious fraud or Scam-related indicators;

• Dark Market-related indicators;

• other critical AML or compliance indicators;

• circumstances that prevent ExSora from lawfully or technically completing the transaction.

ExSora does not guarantee that documents will never be requested in such cases. Depending on the circumstances, the Service may request additional information or documentation before making a final decision.

Following the review, ExSora may:

• proceed with the transaction where permitted;

• continue the verification process;

• suspend or refuse the transaction; or

• return the funds in accordance with this Policy and applicable requirements.

Depending on the circumstances and identified risks, ExSora may request one or more of the following:

• a photograph or scan of an identity document;

• a selfie or video selfie with an identity document;

• proof of residential address;

• payment or transaction information;

• Source of Funds documentation;

• information confirming the origin and traceability of funds;

• information concerning the purpose or nature of a transaction;

• other information or documents reasonably necessary for verification.

The list above is indicative and not exhaustive. The specific information requested depends on the nature of the transaction and the circumstances identified during the review.

ExSora may refuse or suspend the provision of services where:

• the requested information is not provided;

• the information provided is incomplete or inconsistent;

• the information cannot be reasonably verified;

• documents show signs of alteration or falsification;

• other circumstances prevent the Service from completing the required compliance checks.

To perform AML/KYC checks and process exchange transactions, ExSora may use third-party specialized services and technical infrastructure.

Depending on the particular transaction, this may include:

• blockchain analytics and AML screening providers;

• identity verification providers;

• payment systems;

• liquidity providers;

• cryptocurrency exchanges and other financial infrastructure providers;

• IT, hosting and infrastructure providers;

• security and fraud-prevention services;

• legal and compliance consultants;

• other technical or operational service providers necessary for providing the Service.

ExSora does not necessarily use every category of provider for every transaction.

The involvement of third-party infrastructure may affect the processing time of a transaction. Where additional verification or restrictions are imposed by a third-party provider, the processing time may increase.

ExSora will provide the User with available information regarding relevant delays or additional verification where such disclosure is permitted.

ExSora recommends that Users review the blockchain address from which funds will be sent before creating an exchange transaction.

Users may use available blockchain AML screening and analytics services to check the address and review identified risk indicators.

When reviewing an address, Users are advised to pay attention to risk scores and relevant warning markers, including, where applicable:

• Sanctions;

• Scam or fraud;

• Dark Market;

• Mixer;

• terrorism-related indicators;

• other AML or compliance warnings.

If an address presents significant risk indicators, the User may consider using another address that is suitable for the intended transaction and whose transaction history can be reasonably verified.

The preliminary check performed by the User does not replace ExSora's own AML/KYC procedures.

By creating an exchange order, the User confirms that they have read and acknowledged this AML/KYC Policy.

The processing of a transaction generally follows the following sequence:

1. Order creation → 2. Receipt of funds → 3. AML analysis and transaction review → 4. Additional verification, if required → 5. Completion or return of funds.

If no additional review is required, the transaction may proceed to completion.

If increased risk or other relevant circumstances are identified, the transaction may be temporarily suspended while ExSora requests additional information or documents.

Following completion of the review, ExSora may either:

• complete the transaction; or

• return the funds.

The final decision depends on the results of the review, the circumstances of the transaction, applicable requirements and ExSora's ability to lawfully and technically process the transaction.

7.1. Grounds for Return

A return of funds may be made where:

• the transaction cannot be completed;

• the User refuses to provide information or documents reasonably required for verification;

• the User is unable to confirm information necessary for processing the transaction;

• AML/KYC or compliance circumstances prevent the transaction from being completed;

• technical circumstances make completion of the exchange impossible;

• other circumstances arise that prevent ExSora from completing the transaction.

7.2. Return Procedure

Where a return of funds is approved, ExSora may request the User to provide the details necessary to perform the return.

For security purposes, the User may be required to send the return request from the email address used when creating the relevant exchange order.

The request should contain:

• the Order number;

• the address or payment details to which the funds should be returned;

• the relevant blockchain network, where applicable.

The User should provide a valid address capable of receiving the returned funds.

ExSora may agree with the User on another available method of returning the funds where the original method cannot reasonably be used.

When returning funds, ExSora may deduct only the actual costs directly associated with the return, including applicable blockchain network fees and fees charged by payment or technical infrastructure, where such costs have actually been incurred.

No fixed 5% AML return fee is applied under this Policy.

7.3. Return Processing Time

Returns are processed within a reasonable period after ExSora has made the decision to return the funds.

The actual processing time may depend on:

• the blockchain network;

• payment systems;

• banking infrastructure;

• third-party providers;

• verification procedures;

• other circumstances beyond the reasonable control of ExSora.

ExSora processes personal data in accordance with its Privacy Policy and applicable data protection legislation.

Personal information may be processed for the purposes of:

• AML/KYC verification;

• transaction processing;

• fraud prevention;

• risk assessment;

• compliance with legal obligations;

• investigation of suspicious or unusual activity;

• protection of the rights and legitimate interests of ExSora and its Users.

Personal data may be shared with third-party service providers where this is necessary for AML/KYC verification, transaction processing, technical operation of the Service or where such disclosure is required or permitted by applicable law.

ExSora retains information and records relating to transactions and AML/KYC procedures for at least five years, unless a longer retention period is required by applicable law.

The retention period may apply to transaction records, verification information, relevant correspondence and other information necessary to demonstrate compliance with applicable requirements.

ExSora reserves the right to amend or supplement this AML/KYC Policy.

A new version of the Policy becomes effective upon publication on the official ExSora website, unless another effective date is specified in the relevant version.

For an exchange order that has already been created, the version of the AML/KYC Policy applicable at the time the order was created shall generally apply, unless otherwise required by applicable law or expressly provided by the terms applicable to the relevant transaction.