KNOW YOUR CUSTOMER, ANTI-MONEY LAUNDERING AND TRANSACTION MONITORING POLICY

Executive Summary – PeepalCo Group AML Policy

Our Commitment

PeepalCo is committed to maintaining the highest standards of integrity, transparency, and regulatory compliance across all its businesses. Preventing money laundering (“ML”), terrorist financing (“TF”), and proliferation financing (“PF”) is a core responsibility and an integral part of how we design, operate, and govern our products and services.

This summary provides an overview of the key principles and controls underpinning Peepal Co’s AML/CFT/CPF framework. It is intended for customers, partners, and the general public and should be read as a high-level overview rather than a detailed procedural document.Regulatory Framework

Peepal Co and its relevant group entities comply with applicable anti-money laundering and counter-terrorist financing laws and regulations, including:

• The Prevention of Money Laundering Act, 2002 (PMLA);

• The Prevention of Money Laundering Rules, 2005 (PMLR); and

• Guidelines and directions issued by the Financial Intelligence Unit – India (FIU-IND), including those applicable to Virtual Digital Asset (VDA) service providers.

Where PeepalCo operates in multiple jurisdictions, local legal and regulatory requirements are applied in addition to group-wide standards.

Risk-Based Approach

PeepalCo follows a risk-based approach to AML/CFT/CPF compliance. This means that controls and monitoring measures are applied proportionately based on the level of risk posed by customers, products, services, transactions, and geographies.

We do not adopt a one-size-fits-all approach or engage in blanket de-risking. Each customer relationship and transaction is assessed on its own merits, taking into account the nature and level of risk involved and our ability to manage that risk effectively.

Customer Due Diligence

PeepalCo undertakes customer due diligence to understand who our customers are and how they use our services. This includes:

• Verifying customer identity using reliable and independent information;

• Understanding the purpose and intended nature of the relationship;

• Assessing source of funds and transaction behaviour, where applicable; and

• Applying enhanced due diligence measures for customers or activities assessed as higher risk.

Customers may be required to periodically update their information to ensure that records remain accurate and up to date.

Ongoing Monitoring and Transaction Review

Customer activity is monitored on an ongoing basis to ensure that transactions are consistent with the information provided and the customer’s risk profile. Monitoring covers both completed and attempted transactions and is designed to identify unusual or suspicious patterns that may indicate financial crime risks.

Where necessary, Peepal Co may seek additional information, apply enhanced scrutiny, or take appropriate action in line with applicable laws.

Suspicious Transaction Reporting

Peepal Co identifies and reports suspicious transactions through its registered reporting entities, including attempted suspicious transactions, to FIU-IND or other competent authorities as required by law. Reports are filed promptly after due analysis and in strict compliance with confidentiality and tipping-off prohibitions.

Customers are not informed of whether a transaction has been reviewed or reported to authorities.

Sanctions and Prohibited Activities

Peepal Co screens customers and transactions against applicable sanctions and watchlists. We do not knowingly engage with sanctioned persons, entities, wallets, or jurisdictions, or support activities that are illegal or designed to conceal the origin or ownership of funds.

Transactions involving high-risk jurisdictions or technologies are subject to enhanced scrutiny, and may be restricted or declined where risks cannot be adequately mitigated.

Information Security and Confidentiality

Customer information is handled with strict confidentiality and protected through appropriate technical and organisational safeguards. Access to AML-related information is restricted to authorised personnel on a need-to-know basis and disclosures are made only where required under applicable law or regulatory direction.

Governance and Oversight

Peepal Co maintains a robust governance framework for AML/CFT/CPF compliance. Oversight is provided by senior management and the Board, supported by dedicated compliance and risk functions. The effectiveness of the AML framework is reviewed periodically, including through independent assessments.

Transparency and Accountability

Peepal Co is committed to transparency in its approach to financial crime prevention and to cooperating fully with regulators and law enforcement agencies. This public summary reflects our ongoing commitment to operating responsibly, protecting the integrity of the financial system, and maintaining the trust of our customers and stakeholders.

This summary is published for general information purposes and may be updated from time to time to reflect regulatory changes or enhancements to Peepal Co’s AML/CFT/CPF framework.

Group AML Policy (Peepal Co)

1. Purpose and Regulatory Basis

1.1 Purpose of the Policy

Peepal Co (“the Group”) is committed to conducting its business with the highest standards of integrity, transparency, and regulatory compliance. The Group recognises that money laundering (“ML”), terrorist financing (“TF”), and proliferation financing (“PF”) pose significant risks to the financial system, technological platforms, and the broader economy.

This Group AML/CFT/CPF Policy (“Group Policy”) establishes a common framework for identifying, assessing, mitigating, and managing ML/TF/PF risks across all entities within the Peepal Co Group. The Policy sets out the Group’s minimum standards, governance principles, and oversight expectations to ensure that all Group Entities operate in a manner consistent with applicable anti-money laundering and counter-terrorist financing laws and regulatory guidance.

The intent of this Policy is to:

• Define the Group’s approach to AML/CFT/CPF compliance;

• Promote consistency in AML standards across Group Entities while allowing for jurisdictional and business-specific adaptations;

• Enable effective oversight and risk management at the Group level; and

• Support Group Entities in meeting their respective statutory and regulatory obligations.

1.2 Regulatory Basis

This Policy is formulated in accordance with, and with due regard to, the following laws, rules, and regulatory guidelines, as applicable:

• The Prevention of Money Laundering Act, 2002 (“PMLA”);

• The Prevention of Money Laundering (Maintenance of Records) Rules, 2005 (“PMLR”), including Rule 3A;

• The FIU-IND Guidelines on AML/CFT/CPF for Reporting Entities, including the revised guidelines applicable to Virtual Digital Asset service providers issued on 8 November;

• Applicable AML/CFT/CPF laws and regulations in jurisdictions where Group Entities operate, including but not limited to India and Bahrain.

This Group Policy is issued pursuant to Rule 3A of the PMLR and Paragraph 3.4.3(a) of the FIU-IND Guidelines, which require Reporting Entities, where applicable, to issue AML/CFT/CPF policies on a Group basis.

1.3 Relationship with Entity-Level Policies

This Group Policy establishes the overarching principles and minimum standards applicable across the Group. Each Group Entity that qualifies as a Reporting Entity under applicable laws is required to adopt and implement a detailed, standalone AML/CFT/CPF Policy and procedures tailored to its business activities, risk profile, and jurisdiction, consistent with this Group Policy.

2. Definition of “Group”

2.1 Meaning of “Group”

For the purposes of this Policy, the term “Group” shall have the same meaning as assigned to it under Rule 2(1)(cba) of the PMLR, and includes Peepal Co and all entities that are:

• Directly or indirectly controlled by Peepal Co; or

• Under common control or ownership with Peepal Co; or

• Otherwise considered part of the Peepal Co corporate group for governance and risk management purposes.

2.2 Group Entities

As on the date of adoption of this Policy, the Group includes, inter alia, the following entities:

• Bitkuber Investments Private Limited

• Bitcipher Labs LLP

• Nextgendev Solutions Private Limited

• Right Alpha Capital Private Limited (Erstwhile Known as Matdev Investment Advisers Private Limited

• Retrogen Private Limited

• Hodu Financial Services Private Limited

• NU Investors Technologies Private Limited

• Coinswitch Ventures Private Limited

• Innotech Labs Ltd

• Bitvault Custody Private Limited

This list is indicative and not exhaustive. Any entity that becomes part of the Peepal Co Group in the future shall be subject to this Policy from the date of its inclusion in the Group, unless otherwise determined based on regulatory or legal considerations.

3. Group AML/CFT/CPF Risk Appetite

3.1 Zero Tolerance for ML/TF/PF

Peepal Co adopts a zero-tolerance approach towards money laundering, terrorist financing, and proliferation financing. The Group does not knowingly establish or maintain business relationships, facilitate transactions, or engage in activities that are associated with ML/TF/PF risks that cannot be adequately mitigated or managed.

Any activity, relationship, or transaction that is identified as posing an unacceptable ML/TF/PF risk shall be declined, discontinued, or reported, as appropriate, in accordance with applicable laws and internal escalation mechanisms.

3.2 Risk-Based Approach

The Group adopts a Risk-Based Approach (“RBA”) as the cornerstone of its AML/CFT/CPF framework. Under this approach:

• ML/TF/PF risks are identified, assessed, and prioritised based on the nature of the business, customer profile, products and services, delivery channels, transaction behaviour, and geographic exposure;

• Controls and mitigation measures are designed to be commensurate with the level of risk identified; and

• Higher-risk relationships and activities are subject to enhanced scrutiny, monitoring, and approval.

The Risk-Based Approach is a mandatory minimum standard for all Group Entities and must be embedded into entity-level AML policies, procedures, and operational controls.

4. Applicability of the Policy

4.1 Scope of Applicability

This Group Policy applies to:

• Peepal Co; and

• All entities that form part of the Peepal Co Group, including regulated and unregulated entities, to the extent applicable based on their business activities and legal status.

All directors, officers, employees, and relevant third parties acting on behalf of Group Entities are expected to comply with the principles and requirements set out in this Policy.

4.2 Jurisdictional Applicability and Local Law Override

The Group operates across multiple jurisdictions, each of which may have distinct AML/CFT/CPF legal and regulatory requirements. Accordingly:

• Group Entities shall comply with this Group Policy in conjunction with applicable local laws and regulatory obligations;

• Where there is any inconsistency between this Group Policy and local laws or regulatory requirements, the stricter requirement shall prevail;

• Where local law mandates requirements that differ from or go beyond this Group Policy, Group Entities shall comply fully with such local requirements.

This approach ensures that the Group maintains consistent minimum standards while respecting jurisdiction-specific regulatory frameworks, including those applicable to entities operating outside India.

5. Group AML/CFT/CPF Governance Framework

5.1 Governance Philosophy

Peepal Co believes that effective AML/CFT/CPF compliance begins with strong governance, clear accountability, and active oversight at both the Group and entity levels. The Group’s governance framework is designed to ensure that ML/TF/PF risks are identified early, escalated appropriately, and managed consistently across all Group Entities.

The governance structure ensures:

• Clear ownership of AML/CFT/CPF responsibilities;

• Independence of compliance oversight from business functions;

• Timely escalation of material risks and issues; and

• Effective coordination between Group and entity-level compliance functions.

5.2 Group Board and Senior Management Oversight

The Group Board and senior management provide strategic oversight of the AML/CFT/CPF framework. Their responsibilities includeapproving this Group AML/CFT/CPF Policy and any material amendments thereto and

• for fostering a strong culture of compliance across the Group and ensuring that AML/CFT/CPF considerations are integrated into business strategy and decision-making.

5.3 Group Compliance and Risk Function

Peepal Co maintains a Group-level compliance and risk oversight function to support consistent implementation of AML/CFT/CPF standards. This function:

• Provides guidance and interpretation of AML/CFT/CPF requirements to Group Entities;

• Monitors adherence to the Group Policy and minimum standards;

• Reviews significant ML/TF/PF risk issues, including high-risk customer segments, products, or jurisdictions; and

• Acts as a coordination point for cross-entity information sharing and regulatory engagement.

The Group compliance function does not replace entity-level compliance obligations but operates as a second line of oversight to ensure consistency and effectiveness across the Group.

6. Minimum AML/CFT/CPF Standards for Group Entities

6.1 Group-Wide Minimum Standards

Peepal Co has established a set of minimum AML/CFT/CPF standards that apply to all Group Entities, irrespective of whether they are directly regulated as Reporting Entities. These standards represent the baseline level of controls that each entity must implement, subject to enhancement based on local laws and risk profiles.

6.2 Risk-Based Approach

Each Group Entity is required to adopt a documented Risk-Based Approach to AML/CFT/CPF, including:

• Identification and assessment of inherent ML/TF/PF risks relevant to its business model;

• Periodic risk assessments covering customers, products, services, delivery channels, and geographies; and

• Implementation of controls proportionate to the risks identified.

6.3 Customer Due Diligence and Enhanced Due Diligence

Group Entities must establish and maintain customer due diligence frameworks that include:

• Identification and verification of customers and beneficial owners, where applicable;

• Risk-based customer classification;

• Enhanced Due Diligence measures for higher-risk customers, relationships, or transactions.

6.4 Sanctions, PEP, and Adverse Media Screening

All Group Entities are required to implement screening mechanisms to identify:

• Sanctioned individuals, entities, wallets, or jurisdictions;

• Politically Exposed Persons and their close associates; and

• Adverse media or negative information relevant to ML/TF/PF risks.

Screening must be conducted at onboarding and on an ongoing basis, with appropriate escalation and review processes.

6.5 Transaction Monitoring and Reporting

Where applicable, Group Entities must have mechanisms to:

• Monitor transactions and activities for unusual or suspicious patterns;

• Investigate alerts and document outcomes; and

• File Suspicious Transaction Reports or equivalent regulatory reports in a timely manner with the relevant authority.

6.6 Record Retention

Each Group Entity is required to maintain AML/CFT/CPF-related records, including customer identification, transaction data, and investigation records, in accordance with applicable laws and regulatory requirements.

6.7 Training and Awareness

Group Entities must ensure that employees receive AML/CFT/CPF training appropriate to their roles and responsibilities. Training programs must be documented and reviewed periodically.

6.8 Client Acceptance Policy

Peepal Co and all Group Entities shall establish and maintain a clearly documented Client Acceptance Policy, approved by senior management, that defines:

• The categories and types of clients the Group is willing to accept, consistent with its risk appetite, regulatory obligations, and business strategy;

• The categories of clients, activities, or jurisdictions that are prohibited or restricted; and

• The conditions under which higher-risk clients may be accepted, including required approvals and Enhanced Due Diligence measures.

The Client Acceptance Policy must, at a minimum:

• Prohibit relationships with sanctioned individuals or entities and those involved in illegal activities;

• Define the Group’s position regarding high-risk industries, high-risk jurisdictions, shell banks, anonymous customers, and other unacceptable risk categories;

• Establish clear approval thresholds for onboarding high-risk clients (e.g., PEPs, complex ownership structures, high-risk geographies); and

• Be aligned with the Group’s Risk-Based Approach and periodically reviewed.

No business relationship may be established unless it complies with the approved Client Acceptance Policy.

7. Entity-Level AML/CFT/CPF Policies

7.1 Requirement for Standalone Entity Policies

Each Group Entity that qualifies as a Reporting Entity under applicable laws is required to maintain a standalone AML/CFT/CPF Policy that:

• Is aligned with this Group Policy;

• Reflects the entity’s specific business activities and risk profile; and

• Complies with all applicable local AML/CFT/CPF laws and regulatory guidance.

7.2 Alignment and Consistency

Entity-level AML/CFT/CPF policies must be consistent with the principles, risk appetite, and minimum standards set out in this Group Policy. Where entity-level requirements exceed Group standards due to local regulations, such enhanced requirements shall prevail.

7.3 Accountability at Entity Level

Each Reporting Entity within the Group shall appoint:

• A Designated Director or equivalent senior officer, where required by law; and

• A Principal Officer or equivalent compliance officer responsible for day-to-day AML/CFT/CPF compliance.

These officers are responsible for ensuring effective implementation of the entity-level AML/CFT/CPF framework and for acting as points of contact with regulators and law enforcement agencies.

8. Information Sharing Within the Group

8.1 Purpose of Information Sharing

Peepal Co recognises that timely and effective information sharing within the Group is critical to identifying emerging ML/TF/PF risks and ensuring consistent risk mitigation. The Group promotes structured information sharing to enhance collective awareness and resilience against financial crime risks.

8.2 Types of Information Shared

Subject to applicable laws and data protection requirements, Group Entities may share information relating to:

• ML/TF/PF typologies, trends, and red flags observed across the Group;

• High-risk indicators, customer behaviours, or transaction patterns;

• Regulatory alerts, advisories, and supervisory feedback; and

• Emerging risks associated with new products, technologies, or jurisdictions.

8.3 Safeguards and Data Protection

Information sharing within the Group is conducted in a controlled and secure manner. All shared information is:

• Limited to what is necessary for AML/CFT/CPF purposes;

• Subject to confidentiality and access controls; and

• Compliant with applicable data protection, privacy, and secrecy laws.

Where local laws restrict the sharing of certain information, Group Entities comply with such restrictions while exploring alternative lawful mechanisms for risk mitigation.

9. Regulatory Cooperation and Law Enforcement Engagement

9.1 Commitment to Regulatory Cooperation

Peepal Co and its Group Entities are committed to full, proactive, and timely cooperation with regulatory authorities and law enforcement agencies in matters relating to money laundering, terrorist financing, and proliferation financing. The Group recognises that effective AML/CFT/CPF compliance extends beyond internal controls and includes constructive engagement with competent authorities.

9.2 Cooperation with FIU-IND and Domestic Authorities

Group Entities that qualify as Reporting Entities under Indian law cooperate fully with FIU-IND, including by:

• Timely filing of Suspicious Transaction Reports, threshold-based reports, and other regulatory submissions;

• Furnishing information, records, or clarifications sought by FIU-IND under Section 12A of the PMLA;

• Responding to regulatory communications, advisories, and inspections in a transparent and accurate manner.

Requests from domestic law enforcement agencies are handled through established internal escalation channels to ensure lawful, timely, and complete responses.

9.3 Cooperation with Foreign Regulators

Where Group Entities operate outside India or are subject to foreign regulatory regimes, Peepal Co supports cooperation with overseas regulators and law enforcement authorities, subject to applicable laws. Such cooperation may include information sharing, record production, or coordination through appropriate legal channels.

9.4 Central Coordination and Oversight

Regulatory engagements of material significance are escalated to the Group compliance function to ensure consistency, appropriate oversight, and institutional awareness. The Group maintains records of regulatory correspondence, requests, and responses to support accountability and auditability.

10. Audit and Independent Review

10.1 Independent Review Requirement

In line with regulatory expectations, Peepal Co ensures that the AML/CFT/CPF framework is subject to an independent annual review to assess its adequacy, effectiveness, and continued alignment with applicable laws and risk profiles.

10.2 Scope of Review

The independent review typically covers:

• Governance and oversight arrangements;

• Risk assessment methodologies;

• Customer due diligence and monitoring controls;

• Reporting and escalation mechanisms; and

• Training and awareness programs.

The scope may be adjusted based on regulatory changes, emerging risks, or prior audit findings.

10.3 Independence and Objectivity

The review is conducted by persons or functions independent of those involved in designing or operating the AML/CFT/CPF framework. Independence is maintained to ensure objective assessment and credible findings.

10.4 Reporting and Escalation of Findings

Audit findings and recommendations are documented and shared with:

• Entity-level senior management;

• Group compliance function; and

• Where material, the Group Board or senior management.

Corrective actions are tracked, and remediation progress is monitored to closure.

11. Training and Awareness

11.1 Group-Wide AML Awareness Baseline

Peepal Co establishes a baseline AML/CFT/CPF awareness program applicable across the Group. This baseline ensures that all employees, regardless of role or location, understand:

• The risks of money laundering, terrorist financing, and proliferation financing;

• The Group’s zero-tolerance stance; and

• Their responsibilities in identifying and escalating suspicious activity.

11.2 Role-Based and Entity-Specific Training

In addition to baseline awareness, Group Entities provide role-based training tailored to employees involved in higher-risk or compliance-sensitive functions, such as onboarding, transaction monitoring, compliance, and technology development.

11.3 Training Governance and Records

Training programs are documented, periodically reviewed, and updated to reflect regulatory developments and emerging risks. Attendance and completion records are maintained to demonstrate compliance and accountability.

12. Prohibited Relationships and High-Risk Jurisdictions

12.1 Prohibited Relationships

Peepal Co does not knowingly engage in or support relationships that pose unacceptable ML/TF/PF risks. This includes relationships involving:

• Anonymous or fictitious customers;

• Sanctioned persons, entities, or wallets;

• Activities designed to conceal ownership or source of funds; or

• Use of anonymity-enhancing technologies where risks cannot be effectively mitigated.

12.2 High-Risk Jurisdictions

The Group shall apply enhanced scrutiny to jurisdictions identified as high risk by competent authorities. Peepal Co ensures that products or services of third parties based in known high-risk jurisdictions are not utilised or availed where such use would expose the Group to unacceptable risk.

12.3 Risk Mitigation Measures

Where exposure to higher-risk jurisdictions or relationships is unavoidable for legitimate business reasons, enhanced controls, approvals, and monitoring are applied in accordance with the risk-based approach.

13. Public Disclosure

13.1 Transparency and User Awareness

In line with regulatory expectations, Peepal Co ensures that a clear, comprehensive, and concise summary of the AML/CFT/CPF framework is made publicly accessible.

13.2 Mode of Disclosure

Each Group Entity that interfaces with customers publishes an appropriate summary of its AML/CFT/CPF policy on its official website and/or mobile application. The disclosure is designed to:

• Inform users of the entity’s commitment to AML/CFT/CPF compliance;

• Set expectations regarding customer due diligence and monitoring; and

• Promote transparency and trust.

14. Policy Review and Update

14.1 Periodic Review

This Group AML/CFT/CPF Policy is reviewed at least annually to ensure continued relevance, effectiveness, and alignment with applicable laws, regulatory guidance, and the Group’s risk profile.

14.2 Trigger-Based Updates

In addition to periodic reviews, the Policy is updated whenever triggered by:

• Changes in laws or regulatory guidelines;

• Material changes in business activities or geographic footprint; or

• Identification of significant gaps or emerging risks.

14.3 Approval and Communication

Material amendments to the Policy are approved by appropriate Group governance bodies and communicated to Group Entities. Entities are responsible for ensuring timely alignment of their local policies and procedures with updated Group requirements.

Updated Date: 26th Feb 2026