1. INTRODUCTION AND CODE OF ETHICS
VASP BRT conducts its activities based on integrity, ethics, and legal compliance. This manual consolidates our guidelines to ensure a safe, transparent, and resilient environment in the provision of technology services, business intermediation, and financial support. The use of the platform for any unlawful activity or for any activity that violates regulatory or foreign exchange rules is strictly prohibited.

2. KNOW YOUR CUSTOMER (KYC) AND AML/CTF POLICY
VASP BRT adopts strict identification and monitoring protocols, in full compliance with Law No. 9,613/1998.
• Onboarding: The collection of data (personal/corporate) and documents (identification, corporate formation documents, supporting documents) is mandatory. We use biometric verification technologies to validate the authenticity of account holders.
• Risk Management: We assess financial capacity and classify users according to risk profiles (history, economic activity, and location).
• Active Monitoring: We monitor transactions to identify atypical behavior. In the event of inconsistencies, VASP BRT reserves the right to suspend or terminate the contractual relationship.
• Source of Funds: We reserve the right to request proof of the lawful origin of funds.
• Reporting: We will report to COAF and other competent authorities all transactions with signs of irregularities, without prior notice to the user, as required by law.
• Crypto Traceability: The transfer of digital assets is permitted exclusively between accounts under the same ownership, ensuring full traceability.

3. PRIVACY POLICY AND LGPD
In compliance with Law No. 13,709/2018 (LGPD), we ensure the protection of our partners’ and users’ data:
• Purpose: We process data strictly for contractual performance, compliance with legal obligations (including AML/CTF), and information security.
• Data Subject Rights: We guarantee access, correction, deletion (except where legal retention applies), and information regarding data sharing.
• Technical Security: We adopt state-of-the-art administrative and technological measures to protect information against unauthorized access, loss, or leakage, taking into account the inherent risk of financial activities.

4. BEST PRACTICES AND DIGITAL SECURITY
VASP BRT maintains continuous monitoring of its technological systems in order to:
• Availability: Prevent failures and ensure that services remain fully operational at all times.
• Cybersecurity: Identify and neutralize attempted attacks or fraud.
• Communication: Maintain clear and objective communication channels, ensuring that the user understands the conditions and risks of each transaction.

5. GENERAL PROVISIONS
• Registration Updates: It is the client’s duty to report any change in their data or corporate structure.
• Confidentiality: All information collected is confidential and will be shared only for service execution purposes or by judicial/regulatory order.
• Manual Review: This document will be reviewed periodically. Continued use of VASP BRT services implies tacit acceptance of the updated versions of these policies.