UAE Regulatory Disclosures

a. Virtual Asset Standards

Triple-A evaluates every virtual asset before it is supported, and on an ongoing basis, against 14 standards:

• Market analysis — market capitalisation, fully diluted value and liquidity, and whether these trend downward over time
• Design & use case — the asset's design, features and use cases, intended or otherwise
• Legal & compliance risk — features that could affect compliance with AML/CFT, sanctions, securities or IP laws
• Regulatory status — regulatory treatment and approvals in the jurisdictions Triple-A operates in
• Jurisdictional prohibitions — whether the asset is prohibited by regulators in those jurisdictions
• Protocol security — security and immutability of the underlying DLT protocol
• Development roadmap — the issuer's or developers' communicated future plans
• Market integrity — susceptibility to price manipulation and available mitigations
• Conflict management — potential conflicts of interest arising from supporting the asset
• Issuer due diligence — the issuer's track record, including any fraud or investigation history
• Rights enforceability — enforceability of any rights the asset represents to other assets
• Obligation fulfilment — sufficient assets available to satisfy obligations
• Physical market alignment — correlation with any underlying physical market, where applicable
• Periodic review — regular reassessment for continued conformance with physical-market terms

Assets that no longer meet these standards are suspended or removed, with VARA notified promptly. Assessment records are retained for eight years.

b. Risk Disclosure Statement Market Conduct Rulebook V.B.1

This statement is informational only — Triple-A UAE does not provide investment, financial, legal or tax advice, and nothing here should be read as a recommendation. Use of Triple-A UAE's services carries material risk. In particular:

• Virtual asset transfers are generally irreversible; errors cannot be unwound and may cause permanent loss of funds
• Virtual assets may be illiquid and are subject to extreme volatility
• UAE flows are restricted to USD-referenced stablecoins (USDT, USDC, PYUSD), which can still lose their peg, become illiquid, or be suspended by their issuer; BTC and ETH, where supported, are subject to sharp short-term price moves
• Cybersecurity risk — hacks, phishing and protocol vulnerabilities can result in irrevocable loss of assets or data
• Where virtual assets are held in a wallet, loss of access credentials or key-management failure can result in permanent loss
• Blockchain network risk — congestion, forks and fee spikes can delay or prevent settlement
• Counterparty risk — Triple-A UAE relies on third-party exchanges and liquidity providers to source and settle virtual assets; the default, suspension or failure of any of them may delay or prevent your transaction
• Financial crime risk — despite AML/CFT controls, exposure to illicit activity cannot be fully eliminated
• Regulatory risk — the legal treatment of virtual assets continues to evolve and may affect service availability

Triple-A UAE's VARA approval is not an endorsement of Triple-A UAE or of any virtual asset it supports. Nothing in this statement guarantees any outcome, and the past performance of any virtual asset is not indicative of future results. Triple-A UAE is not liable for losses arising from these risks unless caused by its gross negligence, wilful misconduct or fraud.

c. Complaints Handling Market Conduct Rulebook III.A, III.B

Complaints can be filed at support.triple-a.io/file-a-complaint, free of charge. Receipt is acknowledged within 2 business days and resolved within 30 business days, or the period prescribed by CBUAE. Where resolution takes longer, Triple-A UAE provides a status update within 4 weeks and resolves the complaint within 8 weeks. Complaints are handled independently of the relevant business function, and rejected complaints come with written reasons and escalation rights.

d. Anti-Bribery and Corruption Policy Compliance & Risk Management Rulebook VI.C.1, VI.D.4

Triple-A UAE has zero tolerance for bribery and corruption across its Board, staff, and third parties acting on its behalf. Offering, giving or accepting payments, gifts or hospitality intended to secure improper advantage is prohibited. Gifts and hospitality above USD 200 must be declared; above USD 1,000 require prior approval. Concerns can be reported via ABC@triple-a.io, in confidence and without risk of retaliation.

e. Second Responsible Individual

Roman Sztergbaum, General Manager, Triple A Technologies FZCO.

f. Licence Number & Approved Activities

In-Principle Approval granted by VARA on 15 July 2026 for Broker-Dealer Services in Virtual Assets. Post-IPA conditions to be satisfied by 30 September 2026.

IPA reference: IPA/26/06/004

Restrictions: Broker-Dealer Services in Virtual Assets, full scope upon completion of the licensing process.

a. Conflicts of Interest Rule I.B.1(a)

Triple-A identifies, prevents and manages conflicts of interest between: a customer's interests and Triple-A's own; a customer's interests and the personal interests of someone connected to Triple-A; and the interests of one customer against another. This is overseen by the Compliance Officer and Audit and Risk Committee. Transactions between Triple-A UAE and a connected person are conducted at arm's length and reported to VARA monthly. Where a conflict cannot be avoided, affected clients are notified before the service is provided.

b. Data Privacy, Whistleblowing & Complaints Rule I.B.1(b)

Data privacy — Triple-A UAE processes personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Data is retained for eight years, transferred internationally only with comparable safeguards, and any incident affecting personal data is reported to VARA within 24 hours. Contact the Data Protection Officer at dpo@triple-a.io. Full policy: triple-a.io/privacy-policy.

Whistleblowing — Concerns about suspected misconduct can be reported via whistleblowing@triple-a.io. Reports are received by the Group Head of Compliance and the Audit and Risk Committee, handled confidentially, and made without risk of retaliation.

Complaints — see Complaints Handling above.

c. Offered Virtual Assets Rule I.B.1(c)

Triple-A UAE currently offers the following virtual assets under Broker-Dealer Services. Live market data for each is available via the linked sources.

Last updated 7 September 2026.

d. Pricing Methodology Rule I.B.1(d)

Triple-A UAE determines the exchange rate applied to each virtual asset conversion using reference prices drawn from multiple independent sources, including Coinbase, Kraken and Circle, cross-checked against additional market data providers to detect anomalies. Data points that deviate by more than 20% from the midpoint are excluded as outliers; the remaining valid prices are used to calculate a median, and the final applied rate is the average of the remaining valid data points, calculated automatically with no manual intervention. The rate quoted is locked for 25 minutes to allow the customer to complete payment. Triple-A UAE does not make or receive reciprocal payments to or from any market data provider in exchange for pricing information, and retains a commission on each conversion, disclosed to the merchant as part of the transaction record. The methodology is reviewed quarterly against available alternatives.

e. Routing Practices Rule I.B.1(e)

Triple-A UAE acts as principal, converting virtual assets to fiat using its own inventory. It does not execute client orders, route transactions to third-party execution venues, or participate in multi-VASP execution arrangements.

f. Holding of Client Assets & Clearing Services Rule I.B.1(f)

Triple-A UAE does not hold virtual assets or funds on behalf of, or provide clearing services to, other broker-dealers or virtual asset service providers.

g. Protection of Clients' Ownership of Assets Rule I.B.1(g)

Triple-A UAE acts as principal, not custodian: virtual assets received from a payer are converted to fiat using Triple-A UAE's own inventory immediately following successful compliance screening. Triple-A UAE does not offer custody as a business activity; any holding of client money is ancillary to its exchange services, and where it occurs, client money is held in accounts segregated from Triple-A UAE's own funds with a bank licensed by the Central Bank of the UAE, reconciled daily, and would not form part of Triple-A UAE's assets in an insolvency.

h. Referral and Introduction Arrangements Rule I.B.1(h)

Triple-A UAE does not currently operate any referral or introduction arrangements.

i. Third-Party Accounts Rule I.B.1(i)

Triple-A UAE's own fiat funds are held with Zand Bank in the UAE. Virtual asset wallet infrastructure is provided by Fireblocks. Virtual asset inventory is also held at third-party exchange accounts, including Kraken, used for liquidity management and rebalancing.

Convictions & Prosecutions Rule I.B.2(a)

Neither Triple-A UAE nor any member of its Senior Management or Board has any past or pending criminal convictions or prosecutions, before the courts of the UAE or any other jurisdiction.