Know Your Customer (KYC) Policy

Last updated: March 2026

This KYC Policy forms part of the AML/CFT compliance programme of Capitolio Inc. and is incorporated into the AML/CFT Policy. It establishes the standards for customer identification, verification, and due diligence.

Dollar amounts in this Policy are in Canadian Dollars (CAD) unless otherwise stated.

1. Introduction and Purpose

CAPITOLIO INC. is registered as an MSB with FINTRAC (number M24928320) and is obligated to identify and verify customers in accordance with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and FINTRAC regulations.

The purpose of this Policy is to:

• prevent the use of our services for money laundering, terrorist financing, or sanctions evasion;
• establish a standardised framework for customer due diligence;
• ensure compliance with applicable regulatory requirements; and
• protect customers and our business.

2. When Identity Verification is Required

Capitolio is required to verify the identity of a customer when they:

• request a virtual currency exchange of CAD 1,000 or more;
• request a virtual currency transfer of CAD 1,000 or more;
• request a money transfer (EFT) of CAD 1,000 or more;
• request a foreign currency exchange of CAD 3,000 or more;
• receive a remittance of CAD 1,000 or more; or
• enter into a business relationship (as defined under PCMLTFA art. 4.1).

A business relationship is established when a customer transacts for the second time within a 5-year period above applicable thresholds, or when a service agreement is entered into.

3. Individual Customer Verification

Capitolio applies a tiered customer due diligence approach in accordance with applicable FINTRAC thresholds. The level of verification required depends on the nature and volume of the customer’s transactions and the associated risk profile. All customers are subject to identity verification before accessing services above the applicable regulatory thresholds.

Verification is conducted through our KYC provider and may include submission of identity documents, proof of address, and, where required, source of funds documentation. The specific requirements applicable to each customer are determined in accordance with our internal Customer Identification Programme, which is available to customers upon request.

4. Legal Entity (Corporate) Customer Verification

For corporate customers, we collect and verify:

• legal name and trading name (if different);
• registration number and jurisdiction of incorporation;
• registered address and principal place of business;
• nature of principal business activity;
• name, date of birth, and ID documents of directors/authorised signatories;
• name, date of birth, and ID documents of Ultimate Beneficial Owners (UBOs) controlling 25% or more;
• corporate structure chart; and
• AML/CFT policies and licences (if the customer is a regulated entity).

5. PEP and High-Risk Customers

Enhanced due diligence is mandatory for:

• Politically Exposed Persons (PEPs) and their family members and close associates;
• customers from FATF high-risk or non-cooperative jurisdictions; and
• customers for whom the origin of funds is unclear or unusual.

PEP and sanctions screening is conducted at onboarding via SumSub and ongoing monitoring databases.

6. KYC Provider

Capitolio has engaged Sum and Substance Ltd (“SumSub”) as its third-party KYC provider for identity document verification and liveness checks. SumSub processes biometric data as a data processor on our behalf, subject to a Data Processing Agreement and in accordance with applicable data protection law (PIPEDA/GDPR).

7. Ongoing Monitoring and Periodic Review

Customer profiles are subject to ongoing monitoring. Reviews are triggered by:

• significant changes in transaction volume or pattern;
• change in customer risk classification;
• new adverse media or sanctions list hits; or
• reaching a higher transaction tier.

8. Record Keeping

All customer identification records and verification documents are retained for a minimum of 5 years from the end of the business relationship, in accordance with PCMLTFA requirements.

9. Data Protection

Personal data collected during KYC is processed in accordance with our Privacy Policy and applicable data protection law (PIPEDA and, where applicable, GDPR). Customers are informed of our data processing activities at the time of collection.

10. Policy Review

This Policy is reviewed at least annually. Last reviewed: March 2026.

Prepared by: Compliance Officer, Capitolio Inc.