SAGRILAFT Policy

Money Laundering and Terrorism Financing (LA/FT) constitute one of the most complex risks the country faces, affecting the economy, reputation, and the community.

Operations involving virtual assets are high-risk because they use technology with global reach. Virtual currencies that can be exchanged for fiat currency present a high risk of laundering, and the exchange points between virtual and fiat currencies present the greatest need for transparency and oversight.

Coloca Group S.A.S. maintains a strong commitment to preserving legality and transparency in all its operations, adopting measures to prevent crimes such as LA/FT and corruption from infiltrating the Company.

At the time of adopting this policy, Coloca is not required by the Circular Básica Jurídica (Basic Legal Circular) of 2017 to implement SAGRILAFT.

Nevertheless, voluntarily and aware of the industry context, as well as its projected growth objectives and motivated by a firm commitment to promoting a culture of legality, ethics, and transparency, the company has decided to adopt this LA/FT Prevention policy.

General objective

To design, approve, and implement policies, procedures, mechanisms, and instruments that guide the conduct of Coloca, its directors, and employees, for the prevention and effective and timely control of LA/FT risk.

Specific objectives

• Establish methodologies for the identification and control of LA/FT risks
• Develop a culture of prevention among collaborators
• Protect the Organization from operating with illicit capital
• Create mechanisms for the detection, management, and reporting of Suspicious Operations

This policy is mandatory for all employees, shareholders, collaborators, legal representatives, the governing body, partners, contractors, consultants, and any natural or legal person with a current connection to Coloca.

It likewise applies to individual users and their payers who require services offered by Coloca.

• Virtual Asset: Digital representation of value that can be traded or transferred digitally.
• Beneficial Owner: Natural person who ultimately owns or controls a customer, or exercises effective control over a legal entity.
• Counterparty: Any person with whom Coloca has commercial or legal ties.
• Due Diligence: Process for knowing the Counterparty, its business, and its operations.
• KYC: Know Your Customer form to verify identity and assess risks.
• Restrictive Lists: Mandatory, permitted, cautionary, and PEP lists.
• Binding Lists: Lists of persons associated with terrorist organizations (UN, OFAC, EU).
• Unusual Operation: Operation whose amount or characteristics do not match the normal activity.
• Suspicious Operation: Unusual Operation that could not be reasonably justified.
• PEP: Politically Exposed Persons.

• All obligated persons must know, understand, and apply this Policy.
• It is the responsibility of the Manager and the person responsible for the expense to carry out the Due Diligence.
• Every onboarding must be carried out prior to contracting, using the designated form.
• The Company will NOT have ties with persons linked to LA/FT in Colombia or worldwide. No exceptions are accepted.
• Ties will only be established with persons who allow their identification and knowledge.
• When sufficient information is not provided, the onboarding will be declined.
• All operations are carried out through the Company’s systems and platforms.
• Coloca will cooperate with authorities in LA/FT investigations.
• LA/FT prevention clauses will be incorporated into all contracts.
• All employees must report Unusual or Suspicious Operations to their supervisor.

Every Counterparty must complete the Cash Transactions section when delivering an amount equal to or greater than $5,000,000 COP.

For an onboarding, the following procedure must be followed:

• Review prior to the relationship and attach evidence of checks against Restrictive and Binding Lists for the legal representative, company name, and shareholders with more than 5% ownership.
• In the event of red flags, notify the legal representative to take the relevant actions.
• If during the contractual relationship the counterparty becomes involved in LA/FT investigations, the party free from claims shall have the right to unilaterally terminate the contract without compensation.
• Upon execution of the contract, the counterparty declares that the information is truthful and authorizes verifications.
• Verifications are carried out prior to onboarding to minimize Contagion Risk.
• For new relationships, confirm the status of the RUT (tax registry) with the DIAN (Colombian tax authority).
• Suppliers complete the Know Your Customer Form with the required documentation.
• If they declare PEP status, their onboarding is brought to the attention of the immediate supervisor for independent monitoring.
• Every engagement must have clear documentation explaining the nature of the operations.
• Annually, all suppliers are screened against Restrictive or Binding Lists.

Coloca’s collaborators and employees who are involved in an investigation for actions or omissions related to the breach of any of the rules contained in this Policy, or any failure in the duty to report, or the attempt or commission of conduct relating to LA/FT, shall give rise to the enforcement of the administrative measures provided for in the employment contract, without prejudice to any judicial consequences that may arise.

If you become aware of a possible Suspicious Operation or breach of this Policy, report it to:

• Email: legal@colocapayments.com
• Suggested subject: "SAGRILAFT Report"
• Confidentiality: guaranteed in accordance with applicable law.