Anti-Money Laundering and Counter-Terrorist Financing Policy

BitLease Technologies Ltd. A subsidiary of 49G Holding Ltd. Incorporated in Abu Dhabi Global Market (ADGM) Registered Address: Unit PC-1, Level 7, Al Maryah Tower, Abu Dhabi Global Market Square, Abu Dhabi, Al Maryah Island, United Arab Emirates

ADGM Registration No.: 34619

Last Updated: 21 March 2026

Effective Date: 21 March 2026

1. Introduction and Commitment

1.1 Purpose

This Anti-Money Laundering and Counter-Terrorist Financing Policy (“AML/CFT Policy” or “Policy”) sets out the principles, procedures, and controls that BitLease Technologies Ltd. (“BitLease,” “Company,” “we,” or “us”) implements to prevent, detect, and report money laundering, terrorist financing, proliferation financing, sanctions evasion, and other financial crimes in connection with the BitLease platform and all related services (the “Platform”).

1.2 Commitment

BitLease is committed to operating at the highest standards of financial crime compliance. As a structured digital asset financing platform incorporated in Abu Dhabi Global Market (ADGM) and a subsidiary of 49G Holding, BitLease recognizes that the integrity of the Lease-to-Own (LTO) model depends on maintaining a platform free from abuse by those seeking to exploit financial systems for illicit purposes.

This commitment extends beyond regulatory minimums. BitLease aims to meet or exceed the standards expected of regulated financial institutions operating in the asset financing and leasing sector, recognizing that the digital asset class demands heightened vigilance. Compliance is not a formality. It is part of the architecture of trust that makes this platform possible.

1.3 Scope

This Policy applies to:

1. All users of the Platform, including Clients (Lessees), Lessors (Capital Providers), prospective users, and any person or entity interacting with BitLease;

2. All products and services offered through the Platform, including LTO Contracts, Investment Contracts, LTO Staking Delegation, LTO Wallets, and any ancillary services;

3. All BitLease employees, officers, directors, contractors, and agents;

4. All third-party service providers processing data or transactions on behalf of BitLease;

5. All jurisdictions in which BitLease operates or to which it provides services.

1.4 Nature of the Platform: Relevance to AML/CFT

BitLease is not a cryptocurrency exchange, broker-dealer, or money transmitter. It is a structured Lease to Own business where all transactions occur in stablecoins, all agreements are bilateral between BitLease and the user, and all digital assets are stored in MPC-secured escrow.

This closed system naturally reduces some types of money laundering risk, such as layering via peer-to-peer transfer, but in the process, it also raises other types of risk that require particular attention, such as the use of LTO Contracts in the laundering of money and the use of Buyout in the transfer of value. This Policy is intended to address these types.

2. Legal and Regulatory Framework

2.1 Governing Legislation

BitLease’s AML/CFT framework is designed to comply with the following, as applicable:

ADGM (Primary Jurisdiction):

• ADGM Anti-Money Laundering and Sanctions Rules and Guidance (ADGM AML Rules)

• ADGM Financial Services Regulatory Authority (FSRA) regulatory requirements

• UAE Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations (as amended)

• UAE Cabinet Decision No. 10 of 2019 Implementing the Executive Regulations

• UAE National Anti-Money Laundering and Combating Financing of Terrorism and Financing of Illegal Organisations Committee (NAMLCFTC) guidance

International Standards:

• Financial Action Task Force (FATF) Recommendations (2012, as updated)

• FATF Guidance on Virtual Assets and Virtual Asset Service Providers (updated October 2021)

• FATF Risk-Based Approach Guidance

Other Jurisdictions (where BitLease operates or plans to operate):

• EU Anti-Money Laundering Directives (AMLD 5, Directive 2018/843; AMLD 6, Directive 2018/1673)

• EU Markets in Crypto-Assets Regulation (MiCA), AML provisions

• EU Transfer of Funds Regulation (TFR), Travel Rule provisions

• UK Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (as amended)

• UK Proceeds of Crime Act 2002 (POCA) and Terrorism Act 2000

• Singapore Prevention of Money Laundering and Countering the Financing of Terrorism (applicable MAS Notices and Guidelines)

• Singapore Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act (CDSA)

2.2 Regulatory Engagement

BitLease actively engages with regulatory authorities in all jurisdictions where it operates. Licensing applications are in progress with ADGM FSRA, VARA, MiCA-designated authorities, FCA, and MAS. AML/CFT compliance is maintained regardless of licensing status. It is a foundational obligation, not a licensing condition.

3. Governance and Organizational Structure

3.1 Board and Senior Management Responsibility

The Board of Directors of BitLease (and the Board of 49G Holding at the group level) bears ultimate responsibility for ensuring that the AML/CFT framework is adequate, effective, and appropriately resourced. Senior management is responsible for:

1. Approving and overseeing the implementation of this Policy;

2. Ensuring adequate resources (personnel, technology, training budget) are allocated to compliance;

3. Receiving and reviewing regular compliance reports;

4. Setting the Company’s risk appetite for financial crime exposure;

5. Fostering a culture of compliance throughout the organization.

3.2 Money Laundering Reporting Officer (MLRO)

BitLease has appointed a Money Laundering Reporting Officer (MLRO) with the following responsibilities:

1. Overall oversight of the AML/CFT compliance program;

2. Receiving, evaluating, and filing Suspicious Transaction Reports (STRs) / Suspicious Activity Reports (SARs) with the relevant Financial Intelligence Unit (FIU);

3. Acting as the primary point of contact with regulatory authorities and FIUs on AML/CFT matters;

4. Reporting to the Board on the effectiveness of AML/CFT controls;

5. Ensuring that the Company’s risk assessment is current and that controls are proportionate to identified risks;

6. Maintaining independence from business operations to ensure objectivity.

The MLRO has direct access to the Board and may not be overruled on decisions to file STRs/SARs.

MLRO Contact: mlro@bitlease.com (internal reporting only, not a public contact)

3.3 Deputy MLRO

A Deputy MLRO is appointed to act in the MLRO’s absence and to support the MLRO’s functions. The Deputy MLRO has the same authority and responsibilities when acting in the MLRO’s stead.

3.4 Compliance Team

A dedicated compliance team supports the MLRO in:

1. Conducting customer due diligence reviews;

2. Performing ongoing monitoring and investigation;

3. Maintaining AML/CFT records;

4. Delivering training programs;

5. Managing relationships with third-party screening and monitoring providers.

3.5 Three Lines of Defence

BitLease applies the three lines of defense model:

First Line, Business Operations: All employees are responsible for identifying and escalating potential financial crime indicators. Front-line staff are trained to recognize red flags.

Second Line, Compliance, and Risk: The MLRO, compliance team, and risk management function provide oversight, develop policies, monitor adherence, and conduct quality assurance.

Third Line, Internal Audit/External Review: Independent periodic review of the AML/CFT framework’s adequacy and effectiveness, conducted by internal audit or an external firm.

4. Risk-Based Approach

4.1 Principle

BitLease applies a risk-based approach (RBA) to AML/CFT, as mandated by the FATF Recommendations and ADGM AML rules. Resources and controls are directed proportionately to areas of highest risk. This does not mean lower-risk areas are ignored. It means controls are calibrated to the assessed risk level.

4.2 Enterprise-Wide Risk Assessment

BitLease conducts a comprehensive enterprise-wide risk assessment (EWRA) that evaluates money laundering and terrorist financing risk across the following dimensions:

Customer Risk:

• Individual Clients: jurisdiction of residence, source of funds, transaction patterns, PEP status, adverse media

• Institutional Lessors: nature of institution, jurisdiction of incorporation, regulatory status, ownership structure, source of capital

• High-risk categories: PEPs, customers from higher-risk jurisdictions (per FATF grey/black lists), complex ownership structures, cash-intensive businesses

Product/Service Risk:

• LTO Contracts: risk of misuse for integration of illicit funds through structured payments

• Buyout mechanism: risk of early exit as a value transfer method

• Full Settlement: large single-payment risk

• LTO Staking Delegation: risk of yield being directed to third parties

• LTO Wallets: stablecoin deposit/withdrawal patterns

Geographic Risk:

• Jurisdiction of user residence and nationality

• FATF grey-list and black-list jurisdictions

• Jurisdictions with known deficiencies in AML/CFT frameworks

• Sanctions-targeted jurisdictions

• Restricted Jurisdictions (including the United States)

Channel/Delivery Risk:

• Digital-only onboarding (non-face-to-face)

• Cross-border nature of services

• Use of stablecoins as the payment medium

Emerging Risk:

• New typologies specific to digital assets

• Regulatory changes

• Technological developments (privacy coins, mixers, bridges, though BitLease does not interact with these directly)

4.3 Risk Assessment Review

The EWRA is reviewed and updated:

1. At least annually;

2. Upon the introduction of new products, services, or markets;

3. Upon significant changes in the regulatory environment;

4. Upon identification of new money laundering or terrorist financing typologies relevant to the LTO model;

5. Following a significant compliance incident.

4.4 Customer Risk Rating

Each customer is assigned an individual risk rating (low, medium, or high) based on factors including

Risk ratings are reviewed periodically and may be upgraded or downgraded based on ongoing monitoring.

5. Customer Due Diligence (CDD)

5.1 Principle

BitLease undertakes Customer Due Diligence (CDD) on all customers before the establishment of a business relationship and continues to do so throughout the duration of the business relationship. The extent and frequency of CDD measures vary based on the risk profile of the customers.

5.2 Tiered Access and Verification

BitLease applies a tiered approach to platform access and verification. Each tier reflects a level of verification proportionate to the services the user can access.

Tier 1, Basic Access (Limited Services): Access to the basic functionality of the BitLease platform, such as browsing, simulation, and educational content, is granted without the need to complete verification, subject to the following conditions:

1. Basic identity capture (name, email, jurisdiction);

2. Sanctions screening against all applicable lists;

3. IP-based jurisdiction verification (Restricted Jurisdictions blocked);

4. No ability to execute LTO contracts, deposit stablecoins, or access financial services.

Tier 2, Standard Verification (Full Platform Access): Required before executing any LTO contract, funding an LTO Wallet, or accessing financial services:

1. Government-issued photo identification (passport, national ID, or driver’s license);

2. Proof of address (utility bill, bank statement, or government correspondence, dated within 3 months);

3. Selfie/liveness check for facial recognition matching against ID document;

4. Sanctions, PEP, and adverse media screening.

5. Source of funds declaration;

6. Jurisdiction and US person verification;

7. Affordability assessment data collection.

Tier 3, Enhanced Verification (Triggered by Risk Indicators): Performed if risk indicators are identified:

1. Detailed source of wealth documentation and verification;

2. Additional documentary evidence of the source of funds;

3. Enhanced ongoing monitoring with elevated frequency;

4. Senior management or MLRO approval for the business relationship;

5. More frequent periodic re-verification;

6. Potential restrictions on contract value or frequency.

Tier 4, Institutional KYB (Lessors and Institutional Clients):

1. Certificate of incorporation and constitutional documents;

2. Register of directors and officers;

3. Beneficial ownership structure to ultimate beneficial owners (UBOs) holding 10% or more, directly or indirectly;

4. Verification of identity of all UBOs and authorized signatories (to Tier 2 standard);

5. Regulatory license verification;

6. Audited financial statements (most recent two fiscal years);

7. AML/CFT policy attestation or summary;

8. Source of capital documentation;

9. Sanctions, PEP, and adverse media screening on all UBOs, directors, and the entity itself.

5.3 Verification Timing

1. CDD must be completed before the establishment of a business relationship (i.e., before the first LTO Contract execution or LTO Wallet funding);

2. Where permitted by applicable law and justified by risk assessment, verification may be completed during the establishment of the relationship, provided that (i) the delay is necessary to not interrupt normal business operations; (ii) money laundering and terrorist financing risks are effectively managed; and (iii) verification is completed as soon as practicable.

3. If CDD cannot be completed satisfactorily, the business relationship must not be established, or if already established, must be terminated.

5.4 Ongoing Due Diligence

CDD is not a one-time event. BitLease conducts ongoing due diligence, including:

1. Periodic review: Customer information and risk ratings reviewed at intervals determined by risk level:

• High-risk customers: at least every 6 months

• Medium-risk customers: at least every 12 months

• Low-risk customers: at least every 24 months

1. Trigger-based review: Immediate review is initiated upon:

• Unusual transaction patterns

• Significant change in transaction value or frequency

• Adverse media alerts

• Change in customer circumstances (e.g., new PEP status)

• Request for service outside the customer’s normal profile

• Multiple rapid Buyouts or contract terminations

• Large or unusual LTO Wallet deposits

1. Document refresh: Customers may be asked to provide updated identification, proof of address, or source of funds documentation at any time.

5.5 Politically Exposed Persons (PEPs)

BitLease has adopted enhanced due diligence for dealing with PEPs, their family members, and their close associates.

Identification: All customers are identified through checks of global PEP data bases during the onboarding process and on a regular basis during the course of the business relationship.

Definition: A PEP is defined as individuals who hold or have held the highest office in a country, top government officials, top judicial and military officials, top officials of state-owned enterprises, and top political party officials. It also covers their family members, including their spouse, children, parents, and siblings, and their close associates, including known business associates and legal advisors.

Enhanced Measures for PEPs:

1. Senior management approval is required before establishing the business relationship.

2. Enhanced source of funds and source of wealth documentation;

3. Enhanced ongoing monitoring;

4. More frequent periodic reviews (at least every 6 months);

5. The MLRO must be informed of all PEP relationships.

BitLease does not automatically decline PEPs but subjects them to the highest level of scrutiny.

5.6 Beneficial Ownership

For all entities (Lessors, institutional Clients, corporate accounts):

1. BitLease identifies and verifies the identity of all beneficial owners, meaning natural persons who ultimately own or control 10% or more of the entity (directly or through a chain of ownership);

2. Where no natural person meets the 10% threshold, the natural person(s) exercising control through other means are identified;

3. Where no such person can be identified, the senior managing official(s) are verified;

4. Beneficial ownership structures are documented and reviewed at least annually;

5. Complex, opaque, or multi-layered structures are treated as higher risk.

5.7 Inability to Complete CDD

If BitLease is unable to complete CDD to a satisfactory standard,

1. The business relationship must not be established.

2. If already established, it must be terminated in an orderly manner.

3. Active LTO Contracts will be settled through the standard termination process with Surplus Value returned to the customer.

4. The MLRO must be consulted on whether a STR/SAR filing is warranted.

5. All documentation and reasoning are recorded.

6. Transaction Monitoring

6.1 Overview

BitLease provides extensive and constant transaction monitoring for all activities on the Platform. It covers the entire lifecycle of transactions, including onboarding, LTO wallet activities, contract execution, installment payments, Buyouts, Full Settlements, terminations, and staking.

6.2 Monitoring Methodology

Rule-Based Monitoring: Automated rules designed to detect patterns and thresholds indicative of money laundering, terrorist financing, or other financial crime. Rules are calibrated to the specific risk typologies of the LTO model.

Behavioral Analysis: AI-assisted analysis of customer behavior patterns to identify anomalies that static rules may not capture. This includes deviations from established customer profiles, unusual timing patterns, and activity inconsistent with stated purpose.

Know Your Transaction (KYT): Blockchain-level analysis of stablecoin transactions interacting with the Platform, including:

1. Source wallet analysis (exposure to high-risk services: mixers, darknet, sanctioned entities);

2. Destination wallet analysis (for outgoing transfers, Buyout proceeds, staking rewards);

3. Transaction clustering and flow analysis;

4. Counterparty risk scoring.

6.3 Red Flags and Typologies

BitLease monitors for the following indicators, among others: These red flags are specific to the risks of the LTO model as well as general financial crime patterns.

LTO-Specific Red Flags:

1. Structuring through LTO Contracts: Multiple contracts opened in rapid succession with minimum Down Payments, followed by immediate Buyouts or terminations, potentially designed to move value through the Platform.

2. Disproportionate Down Payments: Down Payments that are significantly larger than necessary or inconsistent with the customer’s declared financial profile;

3. Rapid Buyout patterns: Executing Buyouts shortly after contract inception, particularly where the economic rationale is unclear (the asset has not appreciated, no market event occurred);

4. Third-party funding: LTO Wallet funded from wallets not associated with the verified customer, or from wallets with exposure to high-risk services;

5. Inconsistent profile: Transaction values or patterns inconsistent with the customer’s declared source of funds, income, or employment;

6. Geographic anomalies: Access from Restricted Jurisdictions, or IP addresses inconsistent with declared residence;

7. Multiple accounts: Attempts to open multiple accounts or to use nominee identities;

8. Refusal to provide information: Reluctance to complete CDD, provide source of funds documentation, or answer compliance inquiries;

9. Abnormal staking behavior: Immediately opting into staking delegation and directing rewards to external wallets with no connection to the verified customer;

10. Sudden large settlement: Full Settlement of high-value contracts using funds with no documented source.

General Financial Crime Red Flags:

1. Transactions with wallets identified by blockchain analytics as having direct or indirect exposure to sanctioned entities, darknet markets, ransomware, fraud, or terrorist financing;

2. Customer information matches sanctions lists or adverse media profiles;

3. Unusual frequency of transactions with no apparent economic purpose;

4. Customer cannot or will not explain the economic rationale for their transactions;

5. Use of multiple stablecoin types or frequent conversion between stablecoins before depositing.

6.4 Alert Handling

1. Automated alerts are generated by the monitoring system and queued for compliance review.

2. A trained compliance analyst reviews each alert, conducts additional investigation as necessary, and determines whether escalation to the MLRO is warranted.

3. Alerts are resolved as false positives, documented and closed; (ii) Escalated to MLRO for STR/SAR consideration; (iii) Requiring additional CDD or restrictions on the account.

4. All alert handling is documented with reasoning, evidence reviewed, and outcome.

5. Alert handling timeframes: initial triage within 24 hours; full investigation within 5 business days (or sooner for high-priority alerts).

6.5 Sanctions Screening

Real-Time Screening: All customers and counterparties are screened against all applicable sanctions lists at:

1. Onboarding;

2. Each LTO Contract execution;

3. Each significant transaction (Buyout, Full Settlement, large deposits);

4. On an ongoing, daily batch basis for all active customers.

Sanctions Lists:

• OFAC Specially Designated Nationals and Blocked Persons (SDN) List

• OFAC Consolidated Sanctions List

• EU Consolidated Sanctions List

• UN Security Council Consolidated List

• UK HM Treasury Financial Sanctions Targets

• ADGM/UAE National Sanctions List

• Any additional lists mandated by jurisdictions where BitLease operates

Match Handling:

1. Exact matches result in immediate account restriction pending investigation.

2. Potential matches (fuzzy matches) are escalated to the compliance team for manual review within 24 hours.

3. Confirmed matches result in: account freezing, reporting to the relevant authority, and no further services provided.

4. All screening results, including negative results, are documented and retained.

6.6 Travel Rule Compliance

Where applicable (including under the EU Transfer of Funds Regulation, FATF Recommendation 16, and equivalent regulations):

1. BitLease collects and transmits required originator and beneficiary information for qualifying transfers.

2. Information includes name, account/wallet address, and additional identifiers as required;

3. BitLease assesses incoming transfers for completeness of travel rule information and applies risk-based measures where information is missing or incomplete.

4. Travel Rule compliance is implemented in coordination with BitLease’s stablecoin payment infrastructure.

7. Suspicious Activity Reporting

7.1 Internal Reporting Obligation

All BitLease employees, contractors, and agents are required to report any suspicious activity, or activity that generates suspicion or reasonable grounds for suspicion, to the MLRO.

Suspicion means a level of suspicion that is greater in degree than speculation, although it does not require a high degree of certainty. If a reasonable person in the same position as the reporting person would regard the activity as having a potential link to money laundering, terrorist financing, or any other type of financial crime, it must be reported.

7.2 Internal Reporting Process

The process is designed to be straightforward and clearly defined so that every team member knows exactly what to do.

Step 1, Detection: An employee identifies activity that raises suspicion through monitoring alerts, customer interaction, document review, or any other means.

Step 2, Internal Report: Employee submits an internal Suspicious Activity Report (iSAR) to the MLRO through BitLease’s secure internal reporting system. The iSAR includes: customer identification, description of the suspicious activity, supporting evidence, and the employee’s assessment.

Step 3, MLRO Assessment: The MLRO (or Deputy MLRO) evaluates the iSAR, conducts additional investigation as necessary, and determines whether the suspicion meets the threshold for external reporting.

Step 4, Decision:

1. If the threshold is met: The MLRO files a STR/SAR with the relevant FIU within the timeframe required by applicable law;

2. If the threshold is not met: The MLRO documents the reasoning and retains the iSAR for record-keeping purposes;

3. In either case, The MLRO determines whether additional measures are required (enhanced monitoring, account restrictions, or relationship termination).

Step 5, Consent: Where required by applicable law (e.g., UK POCA), the MLRO seeks consent from the relevant authority before proceeding with transactions that are the subject of a STR/SAR.

7.3 External Reporting

STRs/SARs are filed with:

1. UAE/ADGM: UAE Financial Intelligence Unit (FIU), goAML portal;

2. EU: Relevant national FIU in the applicable member state;

3. UK: National Crime Agency (NCA), SAR Online;

4. Singapore: Suspicious Transaction Reporting Office (STRO), MAS;

5. Other jurisdictions: The designated FIU or authority as required by local law.

7.4 Tipping-Off Prohibition

It is a criminal offense to inform a customer, or any other person, that a STR/SAR has been filed or is being considered.

All BitLease employees are trained on the tipping-off prohibition. Communications with customers during investigations are carefully managed to avoid any disclosure that could constitute tipping off.

7.5 Protection of Reporting Persons

BitLease prohibits retaliation against any employee who makes a good-faith internal suspicious activity report. Employees who report suspicions are protected under applicable whistleblower legislation and BitLease’s internal policies.

8. Record Keeping

8.1 Obligation

BitLease maintains comprehensive records of all CDD documentation, transaction data, monitoring alerts, STR/SAR filings, and compliance decisions for the periods required by applicable law.

8.2 Retention Periods

8.3 Record Format

Records are maintained in a format that:

1. Allows reconstruction of individual transactions and customer relationships;

2. Is readily retrievable and can be provided to competent authorities within the timeframe required by law;

3. Is protected against unauthorized access, tampering, and loss;

4. Is stored in encrypted form at rest and in transit.

9. Sanctions Compliance Program

9.1 Policy

BitLease maintains a zero-tolerance policy toward sanctions violations. BitLease will not knowingly:

1. Establish a business relationship with any sanctioned person or entity;

2. Process any transaction involving a sanctioned person, entity, or jurisdiction;

3. Provide any service that would facilitate the circumvention of sanctions.

9.2 Sanctions Risk Assessment

BitLease conducts a specific sanctions risk assessment considering the following:

1. Geographic exposure of the customer base;

2. Nature of digital assets and stablecoins (potential for cross-border value transfer);

3. Evolving sanctions designations affecting the digital asset sector;

4. Specific risks associated with each Supported Digital Asset’s blockchain (exposure to sanctioned addresses).

9.3 Screening Procedures

As described in Section 6.5, screening is conducted at onboarding, at each significant transaction, and on an ongoing batch basis. BitLease uses automated sanctions screening solutions with configurable matching algorithms (exact and fuzzy matching).

9.4 Asset Freezing

Upon identification of a confirmed sanctions match:

1. All accounts and assets associated with the sanctioned person or entity are immediately frozen;

2. No transactions are permitted, including LTO Contract terminations, Buyouts, or withdrawals;

3. The relevant authority is notified immediately.

4. Assets are held frozen until the relevant authority provides instructions or the sanctions designation is lifted.

5. The MLRO oversees the process and maintains documentation.

9.5 Restricted Jurisdictions and US Persons

BitLease does not provide services to:

1. Citizens, nationals, residents, or tax residents of the United States of America;

2. Persons located in Restricted Jurisdictions as maintained on the Platform;

3. Persons located in jurisdictions subject to comprehensive sanctions (e.g., OFAC comprehensively sanctioned countries).

These restrictions are enforced through IP-based geolocation screening, jurisdiction declaration at onboarding, ongoing monitoring, and Terms of Service provisions.

10. Proliferation Financing

10.1 Policy

BitLease implements controls to prevent the financing of the proliferation of weapons of mass destruction (WMD), in compliance with UN Security Council Resolutions and applicable national legislation.

10.2 Controls

1. Screening against all proliferation financing-related sanctions lists;

2. Monitoring for indicators of proliferation financing, including connections to designated entities, front companies, or trade patterns associated with WMD programs;

3. Reporting of suspected proliferation financing to the relevant authority.

11. Training

11.1 Mandatory Training

All BitLease employees, including senior management, receive AML/CFT training. This is not optional, and it is not a formality. Every person who interacts with the Platform or its users is expected to understand their obligations.

Onboarding Training: Within 30 days of joining. Covers:

1. Legal framework and BitLease’s obligations;

2. Overview of this Policy and related procedures;

3. Customer due diligence procedures;

4. Recognizing and reporting suspicious activity;

5. Sanctions compliance;

6. Tipping-off prohibition;

7. Employee’s personal legal obligations and potential criminal liability.

Annual Refresher Training: Mandatory for all staff. Covers:

1. Updates to legislation and regulatory guidance;

2. New typologies and emerging risks specific to digital assets and the LTO model;

3. Lessons learned from internal monitoring and investigations;

4. Regulatory enforcement actions and case studies;

5. Refresh on reporting procedures.

Role-Specific Training: Additional specialized training for:

1. Compliance team: advanced investigation techniques, STR/SAR drafting, blockchain analytics;

2. Customer-facing staff: recognizing red flags during onboarding and customer interaction;

3. Senior management and Board: governance responsibilities, regulatory expectations;

4. Technology team: understanding monitoring systems, data integrity, and security implications.

11.2 Training Records

All training attendance, content, and assessment results are documented and retained for at least 7 years.

11.3 Awareness Culture

Beyond formal training, BitLease fosters a culture of compliance awareness through:

1. Regular compliance bulletins and updates;

2. Compliance team accessibility for questions and guidance;

3. Clear escalation procedures;

4. Senior management’s visible commitment to compliance.

12. Enforcement Actions

12.1 Account-Level Measures

Where AML/CFT concerns are identified, BitLease may take one or more of the following actions:

1. Enhanced monitoring: Increasing the frequency and depth of transaction monitoring.

2. Account restrictions: Limiting transaction types, values, or frequency;

3. Transaction holds: Temporarily holding specific transactions pending investigation.

4. Additional verification: Requiring the customer to provide further documentation or information.

5. Account suspension: Suspending all account activity pending completion of the investigation.

6. Asset freezing: Freezing all assets in the customer’s account (required for sanctions matches);

7. Account termination: Permanently closing the account and terminating the business relationship.

8. Contract termination: Terminating active LTO Contracts through the standard termination process, with Surplus Value handled in accordance with the Terms of Service and applicable law.

12.2 Decision Authority

12.3 Customer Communication

When enforcement actions are taken:

1. The customer is informed of restrictions to the extent permitted by law;

2. No information is provided that would constitute tipping off. The customer is not informed that a STR/SAR has been filed, that they are under investigation for financial crime, or that the restriction is related to AML/CFT concerns;

3. Restrictions may be described in general terms (e.g., “additional verification required,” “account review in progress”);

4. The customer retains the right to complain through the standard complaints procedure, though complaints do not override compliance-driven account actions.

12.4 Handling of Assets Upon Compliance-Driven Termination

When a business relationship is terminated for compliance reasons:

1. Active LTO Contracts are terminated through the standard process.

2. Surplus Value is handled in accordance with the Terms of Service, subject to any legal hold, freeze order, or regulatory direction.

3. If assets are subject to a freeze order, they remain frozen until the relevant authority provides instructions.

4. BitLease cooperates fully with law enforcement and regulatory authorities.

5. The customer is not entitled to claim damages for compliance-driven account restrictions or terminations, to the extent permitted by law.

13. Third-Party Reliance and Outsourcing

13.1 Principle

Where BitLease relies on third-party service providers for elements of its AML/CFT compliance (e.g., identity verification, sanctions screening, blockchain analytics), BitLease retains full responsibility for compliance. Outsourcing of execution does not outsource accountability.

13.2 Third-Party Due Diligence

Before engaging any third party for AML/CFT-related services:

1. BitLease assesses the provider’s capabilities, regulatory standing, and reliability;

2. Contractual agreements require the provider to meet standards at least equivalent to BitLease’s;

3. Service levels, data protection, and confidentiality are contractually defined;

4. Regular oversight and performance review is conducted.

13.3 Reliance on Third-Party CDD

Where permitted by applicable law, BitLease may rely on third-party CDD conducted by regulated financial institutions, provided the following:

1. The third party is regulated and supervised for AML/CFT in a FATF-compliant jurisdiction.

2. The third party applies CDD standards at least equivalent to BitLease’s

3. BitLease obtains the relevant CDD documentation without delay upon request.

4. BitLease retains ultimate responsibility for the adequacy of CDD.

14. New Products and Services

Before launching any new product, service, or delivery channel, BitLease conducts an AML/CFT risk assessment to evaluate the following:

1. The money laundering and terrorist financing risks associated with the new product.

2. Whether existing controls are adequate or require enhancement;

3. Whether additional typologies or red flags are relevant;

4. The impact on the enterprise-wide risk assessment.

The MLRO must approve the risk assessment before the product is launched.

15. Regulatory Cooperation

15.1 Cooperation with Authorities

BitLease cooperates fully and promptly with the following:

1. Regulatory authorities (ADGM FSRA, VARA, MiCA-designated bodies, FCA, MAS, and equivalent);

2. Financial Intelligence Units

3. Law enforcement agencies;

4. Courts and tribunals.

Cooperation includes providing information and documentation upon lawful request, facilitating investigations, and complying with court orders and regulatory directions.

15.2 Regulatory Examinations

BitLease maintains its records, systems, and controls in a state of readiness for regulatory examination at all times.

16. Independent Review and Audit

16.1 Internal Review

The AML/CFT framework is subject to periodic internal review, conducted by persons independent of the compliance function, evaluating:

1. Adequacy and effectiveness of policies and procedures;

2. Quality of CDD and ongoing monitoring;

3. Appropriateness of risk assessments;

4. Effectiveness of training;

5. Quality of STR/SAR processes;

6. Compliance with applicable law and regulatory guidance.

16.2 External Audit

An independent external review of the AML/CFT framework is conducted at least every two (2) years, or more frequently if required by regulation or if significant deficiencies are identified.

16.3 Findings and Remediation

All findings from internal and external reviews are the following:

1. Reported to the MLRO and senior management;

2. Escalated to the board if significant.

3. Subject to documented remediation plans with defined timelines;

4. Tracked to completion.

17. Whistleblowing

BitLease maintains a confidential whistleblowing channel for reporting suspected financial crime, compliance failures, or unethical conduct:

1. Reports may be made anonymously.

2. Reports are received by the MLRO or, if the report concerns the MLRO, by the Board directly.

3. All reports are investigated confidentially.

4. Retaliation against whistleblowers is prohibited and constitutes a disciplinary offense.

5. BitLease complies with applicable whistleblower protection legislation.

18. Policy Review and Approval

18.1 Review Cycle

This Policy is reviewed and updated:

1. At least annually;

2. Upon significant changes in applicable law or regulation;

3. Upon changes to BitLease’s products, services, or risk profile.

4. Following significant compliance incidents;

5. Upon recommendations from an internal or external audit.

18.2 Approval

This Policy is approved by the Board of Directors of BitLease Technologies Ltd. and endorsed at the group level by 49G Holding.

19. Contact

Money Laundering Reporting Officer (Internal Only): mlro@bitlease.com

Compliance Department: compliance@bitlease.com

BitLease Technologies Ltd. A subsidiary of 49G Holding Ltd. Incorporated in Abu Dhabi Global Market (ADGM) Registered Address: Unit PC-1, Level 7, Al Maryah Tower, Abu Dhabi Global Market Square, Abu Dhabi, Al Maryah Island, United Arab Emirates

ADGM Registration No.: 34619

Last Updated: 21 March 2026

Effective Date: 21 March 2026