SwapBee Anti-Money Laundering (AML) Policy

1. Purpose and Scope

This Anti-Money Laundering Policy (“AML Policy”) sets out the principles, controls, and procedures adopted by SwapBee Inc. (“SwapBee”, “we”, “us”, or “our”) to prevent the misuse of its Services for money laundering, terrorism financing, sanctions evasion, or other illicit activities.

This AML Policy applies to all access to and use of the SwapBee website, API, widgets, and related services (collectively, the “Services”).

SwapBee adopts a risk-based and proportionate approach, taking into account the nature, scale, and limited role of its Services.

2. Regulatory Positioning of SwapBee

SwapBee operates as a non-custodial software aggregator and routing platform.

SwapBee:

• Does not take custody or control of user funds or crypto assets.
• Does not operate user accounts or hold balances.
• Does not execute, clear, or settle transactions.
• Does not act as a counterparty to any transaction.
• Does not provide fiat-related services.

The actual exchange of crypto assets is performed by independent third party exchange service providers (“Partners”), each operating under its own regulatory status, AML obligations, and compliance frameworks.

Accordingly:

• Primary AML and KYC obligations related to the execution of exchange transactions rest with the Partners.
• SwapBee’s AML obligations are limited to reasonable preventive, monitoring, and cooperation measures, consistent with its role as an aggregator.

3. Risk-Based Approach

SwapBee applies a risk-based approach consistent with international AML standards.

3.1 Identified risks

Potential risks include:

• Misuse of the Services to route illicit crypto assets.
• Attempts to access the Services from sanctioned or prohibited jurisdictions.
• Use of high-risk blockchain addresses.
• Abuse of the Services to facilitate layering or obfuscation.

3.2 Risk mitigation factors

The inherent risks are mitigated by:

• The non-custodial nature of the Services.
• The absence of fiat on-ramps or off-ramps.
• The fact that Partners perform transaction execution and AML screening.
• Technical controls and transaction monitoring measures.

4. Customer Due Diligence (CDD)

4.1 No standard KYC by SwapBee

SwapBee does not perform standard Know Your Customer (“KYC”) procedures on users as part of normal operations, due to its limited, non-custodial role.

4.2 Exceptional information requests

SwapBee reserves the right, on a risk-based and exceptional basis, to request limited information from users where:

• Suspicious activity is detected.
• Required by applicable law.
• Requested by a Partner for compliance purposes.

Failure to provide requested information may result in refusal or restriction of access to the Services.

4.3 Partner KYC

Partners may independently require users to complete KYC or enhanced due diligence procedures. Such procedures are governed solely by the Partner’s policies and regulatory obligations.

5. Transaction Monitoring (KYT)

SwapBee implements Know Your Transaction (KYT) and risk monitoring measures proportionate to its role.

These measures may include:

• Blockchain analytics and transaction risk scoring tools.
• Monitoring for known illicit addresses, sanctioned entities, or high-risk patterns.
• Automated and manual review of alerts.

SwapBee does not have the technical ability to freeze, reverse, or seize funds. Where risk indicators are detected, SwapBee may:

• Restrict access to the Services.
• Refuse to route transactions.
• Notify the relevant Partner.
• Cooperate with competent authorities as required.

6. Sanctions and Restricted Jurisdictions

SwapBee prohibits access to the Services by:

• Individuals or entities subject to international sanctions.
• Users located in jurisdictions where use of the Services is illegal.
• Users attempting to circumvent geographic or technical restrictions.

SwapBee may implement:

• IP and geolocation controls.
• Sanctions screening.
• Address blacklisting.

7. Record Keeping

SwapBee maintains appropriate records in accordance with applicable laws and proportionality principles.

Records may include:

• Technical access logs (such as IP address, device, and browser information).
• Transaction metadata (such as asset pairs, timestamps, and Partner identifiers).
• Compliance-related communications.

Records are retained only for the period required by applicable law or legitimate business needs.

8. Reporting and Cooperation

SwapBee cooperates with competent authorities, Partners, and lawful investigations in accordance with applicable law.

Where required or appropriate, SwapBee may:

• Respond to lawful information requests.
• Provide relevant records.
• Support investigations related to suspected illicit activity.

SwapBee does not provide legal advice and does not act as an enforcement authority.

9. Internal Escalation and Responsibility

SwapBee designates internal responsibility for AML oversight appropriate to its size and role.

Suspected high-risk or suspicious activity is escalated internally and assessed on a case-by-case basis.

SwapBee does not maintain a formal MLRO role where not legally required, but ensures accountability and documented decision-making.

10. Training and Awareness

SwapBee ensures that relevant personnel are:

• Aware of AML risks associated with crypto assets.
• Familiar with this AML Policy.
• Trained to recognize red flags and escalation triggers.

11. Policy Review and Updates

This AML Policy is reviewed periodically and updated as necessary to reflect:

• Changes in law or regulation.
• Changes in business model or risk profile.
• Feedback from Partners or authorities.

Material updates are approved internally and published where appropriate.

12. Contact Information

For AML-related inquiries or lawful requests, contact:

• SwapBee Inc.
• Vía España 1280, Edificio Orión, Suite 7D
• Ciudad de Panamá, República de Panamá
• Email: [email protected]