Transfer Services Disclosure

Introduction

Zero Hash Europe B.V. ("Zero Hash") and its clients (also referred to as "End Customers") enter into a legal contract through its User Agreement. End Customer are also in legal contract with the consumer-facing business (also referred to as "Platforms").

Zero Hash's transfer services can be broken down into the following:

• Deposits
• Withdrawals
• Internal Transfers ("Peer to Peer")

Deposits

End Customer Deposits

Zero Hash allows End Customers to generate deposit addresses. This allows them to deposit crypto assets on-chain from an external wallet. A successful deposit results in a credit to their balance on the Zero Hash 'ledger'.

Network fees assessed to the End Customer happen outside the Zero Hash ecosystem since the transfer is initiated on a platform unrelated to Zero Hash.

High-Risk Address Detection

Zero Hash will never credit an End Customer's account if it detects that the deposit came from a high-risk address, such as OFAC sanctioned address. If this happens, the following takes place:

• An automatic alert is triggered and notifies our 24/7/365 operations team
• The End Customer's account is not credited and is instead credited to a dedicated 'quarantine' account
• Zero Hash's operations team will collaborate with the Zero Hash compliance team and platform to arrive at a path forward
• No movement out of that quarantine account will take place without an explicit approval from Zero Hash's compliance team

Platform Deposits

Zero Hash also allows its Platforms to initiate deposits. While these can happen via API in the same manner described in the previous section, they can also be initiated via our Client Portal user interface.

The Client Portal can only be accessed by provisioned users (ie, employees that work for the Platform). Zero Hash employs industry-standard security measures such as username + strong password credentials, 2 Factor Authentication for each login attempt, and role-based access controls.

Upon a successful login, a user can generate a deposit address and transfer crypto assets to the address in the same manner described in the previous example.

The network fee and high-risk address procedures described above are also applicable to Platform Deposits.

Withdrawals

End Customer Withdrawals

Zero Hash allows End Customers to withdraw crypto to an external address. Zero Hash will receive a withdrawal request from the Platform with key pieces of information such as, but is not limited to:

• Amount
• Crypto asset
• Destination address
• Participant Code (code used to specify the End Customer)

Programmatic Checks

Zero Hash will go through the following programmatic checks prior to initiating a withdrawal:

• Ensure that the specified participant code is indeed affiliated with the requesting platform
• Ensure that the specified amount is greater than or equal to the current balance of the specified crypto asset
• The destination address is valid per the specified crypto asset
• The destination address passes our risk-checks which includes cross-referencing our internal deny-list of OFAC sanctioned addresses

Withdrawal Fees

Zero Hash may also charge withdrawal fees (separate from network fees). The payor of these fees are configurable and can be incurred by either the End Customer or the Platform. The fees are taken during the withdrawal request. Whether or how such fees are charged is subject to agreement between Zero Hash and the Platform, and will be disclosed to the End Customer in advance of the service being made available to them.

Platform Withdrawals

Zero Hash also allows its Platforms to initiate withdrawal requests. While these can happen via API in the same manner described in the previous section, they can also be initiated via our Client Portal user interface.

The Client Portal can only be accessed by provisioned users (ie, employees that work for the Platform). Zero Hash employs industry-standard security measures such as username + strong password credentials, 2 Factor Authentication for each login attempt, and role-based access controls.

Approval Process

Upon a successful login, a user can queue up a withdrawal request. By default, each platform is configured to require at least one approval for every withdrawal account whitelist and withdrawal request. That means for any one withdrawal request, it requires the following actions and approvals:

1. Employee A whitelists a withdrawal address
2. Employee B approves the whitelist
3. Employee A queues up a withdrawal request to the whitelisted address
4. Employee B approves the withdrawal request

The network fee and high-risk address procedures described above are also applicable to Platform withdrawals.

Internal Transfers

Zero Hash allows End Customers transfer crypto assets to other End Customers within the same Platform. These are referred to as "Peer to Peer Transfers". These do not involve an on-chain movement, rather a ledger movement only.

Transfer Request Information

Zero Hash will receive a withdrawal request from the Platform with key pieces of information such as, but is not limited to:

• Amount
• Crypto asset
• From Participant Code (code used to specify the End Customer that is sending crypto)
• To Participant Code (code used to specify the End Customer that is receiving crypto)

Programmatic Checks

Zero Hash will go through the following programmatic checks prior to initiating an internal transfer:

• Ensure that both of the specified participant codes are indeed affiliated with the requesting platform
• Ensure that the specified amount is greater than or equal to the current balance of the From Participant Code's account for the specified Crypto asset

Risk Mitigation

Zero Hash identifies and manages operational, security and IT risks as part of our regular risk management programme, which includes threat assessments, product and service risk reviews, and an annual SIRA (Systematic Integrity Risk Assessment). We maintain a robust cybersecurity programme and control framework to reduce the likelihood and impact of incidents.

Oversight and Controls

Oversight of transfer service requirements is provided by senior management and the Compliance function.

Automated monitoring and alerting detect operational anomalies and potential cybersecurity threats for rapid investigation and response.

Redundant systems, data backups and failover mechanisms support service continuity.

Advanced key protection using multi-party computation (MPC) removes single points of compromise; private keys are never concentrated on a single device.

Multi-signature controls ensure that wallet operations and non-standard activities require approval from more than one authorised person.

API-driven services significantly reduce the risk of human error (such as incorrect addresses or amounts). Transfers execute programmatically based on the exact instructions provided.

Customer Information

User Agreement Access

End customers are informed of their rights, obligations and procedures through the Zero Hash User Agreement, which must be accepted during onboarding.

You can access the User Agreement online at our website (zerohash.com/[platform-name]) or request a copy at any time by emailing support@zerohash.com.

Transfer Information Provided

For every transfer, we provide:

• The names of the originator and the beneficiary
• The originator's distributed ledger address or crypto-asset account number
• The beneficiary's distributed ledger address or crypto-asset account number
• A reference to help you identify the transfer
• The amount and type of crypto-assets transferred or received
• The debit value date or credit value date
• Any charges, fees or commissions related to the transfer, with a breakdown where applicable

Zero Hash does not charge fees for the transfer services it provides.

Transfer Warnings and Notifications

We provide clear, standardised warnings stating whether and when a crypto-asset transfer becomes irreversible (or sufficiently irreversible in the case of probabilistic settlement). These warnings are provided in line with applicable regulatory standards for platform operators.

If a transfer is rejected, returned or suspended, we will communicate the reason for the rejection, return or suspension and how to remedy the issue, where applicable.

Please note that price limits may apply to transfers.