Disclosures

Transfer Services Disclosure

Introduction

zerohash (services BV, ("zerohash") and its clients (also referred to as "End Customers") enter into a lease construct through its User Agreement. End Customer are also in legal contract with the consumer facing business (also referred to as its "Platforms.")

zerohash's transfer services can be broken down into the following:

Deposits
Withdrawals
Internal Transfers ("Peer to Peer")

Request for Quote (RFQ)

End Customer Deposits

zerohash allows End Customers to generate deposit addresses. This allows them to deposit crypto assets on-chain from an external wallet. A successful deposit results in a credit to their balance on the zerohash "ledger".

Network fees assessed to the End Customer happen outside the zerohash ecosystem once the transfer is initiated on a platform unrelated to zerohash.

zerohash will never credit a End Customer's account, if it detects that the deposit came from a high-risk address, such as an OFAC sanctioned address. If this happens, the following takes place:

An whitelists alert is triggered and verifies our 24/7/365 operations team
The End Customer's account is not whitelisted and is now matched to a dedicated "quarantine account"
zerohash's operators, legal will collabor with the zerohash compliance team and establish a path forward for the End Customer

No movement out of their quarantine account will take place without an explicit approval from zerohash's compliance team.

Platform Deposits

zerohash also allows its Platforms to initiate deposits. While these can happen via API in the same manner described in the previous section, they can also be initiated via our Client Portal user interface.

The Client Portal can only be accessed by provisional users (ie. employees that work for the Platform). zerohash employs industry-standard security measures such as username + strong password credentials. 2 Factor Authentication for each login attempt, and role-based access controls.

Upon a successful login, a user can generate a deposit address and transfer crypto assets to the address in the same manner described in the previous example.

The network fee and high-risk address provisions described above are also applicable to Platform Deposits.

Withdrawals

End Customer Withdrawals

zerohash allows End Customers to withdraw crypto to an external address. zerohash will receive a withdrawal request and from the Platform with key pieces of information such as, but is not limited to:

Amount
Crypto asset
Destination address
Participants (will be used to specify the End Customer)

zerohash will go through the following programmatic checks prior to initiating a withdrawal:

Ensure that the specified participant codes is indeed affiliated with the requesting platform
Ensure that the specified amount is greater than or equal to the current balance of the specified crypto asset
The destination address is valid per the specified crypto asset

zerohash also provides the risk checks which includes cross-referencing our internal deny list of OFAC sanctioned addresses.

zerohash will verify crypto asset (network fees). The payer of those fees are charged to the End Customer and can be incurred by either the End Customer or the Platform. The fees are taken during the withdrawal request. Whether or how such fees are changed is subject to agreement between zerohash and the Platform, and will be disclosed to the End Customer in advance of the service being made available to them.

Platform Withdrawals

zerohash also allows its Platforms to initiate withdrawal requests. While these can happen via API in the same manner described in the previous section, they can also be initiated via our Client Portal user interface.

Upon a successful login, a user can queue up a withdrawal request. By default, each platform is configured to require at least an approval for every withdrawal account whitelist and withdrawal request. That means for any one withdrawal request, it requires the following actions and approvals:

Employer A whitelists a withdrawal address
Employer B approves the whitelist
Employer A queues up a withdrawal request to the whitelisted address
Employer B approves the withdrawal request

The network fee and high-risk address provisions described above are also applicable to Platform withdrawals.

Internal Transfers

zerohash allows End Customers to transfer crypto assets to other End Customers within the same Platform. These are referred to as "Peer to Peer Transfers." These do not involve an on-chain movement, rather a ledger movement only. zerohash will require a withdrawal request from the End Customer with the key pieces of information such as, but is not limited to:

Amount
Crypto asset
From Participant Code (code used to specify the End Customer that is sending crypto)
To Participant Code (code used to specify the End Customer that is receiving crypto)

zerohash will go through the following programmatic checks prior to initiating an internal transfer:

Ensure that both of the specified participant codes is indeed affiliated with the requesting platform
Ensure that the specified amount is greater than or equal to the current balance of the From Participant Code's account for the specified crypto asset.

Risk Mitigation

zerohash identifies and manages operational, security and IT risks as part of our regular risk management program, which includes threat assessments, product and service risk reviews, and as annual SSAE 16/isatassric Integrity Risk Assessments). We maintain a robust cybersecurity program and control framework to reduce the likelihood of material impact to our operations:

zerohash's comprehensive information security policies and governance program, addressing security and Oversight of transfer service requirements is provided by senior management and the Compliance function.
Automated monitoring and alerting detect suspicious anomalies and potential cyber-security threats for rapid investigation and response.
Redundant systems, data backups and failover mechanisms support service continuity.
Advanced key protection using third-party computation (MPC) removes single points of compromise; private keys are never concentrated on a single device.
Multi-signature controls ensure that wallet operations and non-standard activities require approval from more than one authorized person.

Our transfer services use API carries, which significantly reduces the risk of human error (such as incorrect addresses or amounts). Transfers executed programmatically based on the exact instruction we receive.

Customer Information

User Agreement

End customers are informed of: inquiry, obligations and encadptures through the zerohash User Agreement, which must be accepted during onboarding.

You can access the User Agreement online at our website (zerohash.com/platform-name) or request a copy bt any time by emailing support@zerohash.com.

For every transfer, we provide:

The names of the originator and the beneficiary
The originator's distributed ledger address or crypto-asset account number
The beneficiary's distributed ledger address or crypto-asset account number
A reference to help you identify the transfer
The amount and kind of crypto-assets transferred or received
The date we executed the transfer
Any charges, fees or commissions related to the transfer, with a breakdown where applicable

zerohash does not charge fees for the transfer services it provides.

We provide clear, standardized warnings stating whether and when a crypto-asset transfer becomes irreversible (or sufficiently irreversible in the case of probabilistic settlement). These warnings are provided in line with applicable regulatory standards for platform operators.

Upon request from a regulatory or law-enforcement agency, we will communicate the reason for the rejection, return or suspension and how to remedy the issue, where applicable.