1. PURPOSE AND REGULATORY CONTEXT

Cregis Custody FZE

This Policy is adopted in accordance with the expectations of the Dubai Virtual Assets Regulatory Authority (VARA), including the Compliance and Risk Management Rulebook, the Market Conduct Rulebook, and applicable UAE laws.

2. SCOPE AND APPLICABILITY

This Policy applies to:

• all employees of Cregis;
• members of the Board of Directors;
• Senior Management;
• contractors, consultants, secondees, and temporary staff; and
• third parties acting on behalf of Cregis, where relevant.

3. REPORTABLE MATTERS

Concerns that may be reported under this Policy include, without limitation:

• breaches of VARA Regulations, Rules, or Directives;
• violations of UAE laws or regulatory obligations;
• AML/CFT, sanctions, or fraud-related misconduct;
• misuse, loss, or compromise of client Virtual Assets;
• conflicts of interest or unethical conduct;
• cybersecurity incidents, system failures, or data breaches;
• falsification of records or misleading disclosures;
• retaliation against a whistleblower.

4. REPORTING CHANNELS

Reports may be made through any of the following channels:

• Compliance Officer
• a designated senior manager;
• the Chair of the Board or Audit Committee (where appropriate).

Reports may be made confidentially and, where legally permissible, anonymously.

5. CONFIDENTIALITY AND DATA PROTECTION

Cregis shall take all reasonable steps to:

• protect the identity of whistleblowers;
• restrict access to information on a need-to-know basis;
• process personal data in accordance with applicable UAE data protection laws.

Confidentiality may be lifted only where required by law or regulatory authorities.

6. NON-RETALIATION

Cregis strictly prohibits any form of retaliation, victimisation, or adverse treatment against individuals who raise concerns in good faith.

Any employee found to have engaged in retaliation shall be subject to disciplinary action, up to and including termination of employment.

7. INVESTIGATION AND ESCALATION

All reports shall be:

• acknowledged promptly;
• assessed by the Compliance Officer;
• investigated in a fair, independent, and proportionate manner.

Where a matter is material or systemic, it shall be escalated to Senior Management and, where appropriate, the Board of Directors.

Where required under VARA Rules or UAE law, matters shall be reported to VARA or other competent authorities.

8. OUTCOMES AND REMEDIAL ACTION

Following an investigation, Cregis may:

• implement corrective or remedial actions;
• take disciplinary measures against responsible individuals;
• enhance controls, policies, or procedures;
• report outcomes to regulators where required.

9. MALICIOUS OR BAD-FAITH REPORTS

This Policy is intended to encourage genuine reporting.

Knowingly false, malicious, or bad-faith reports may result in disciplinary action.

10. RECORD KEEPING

All whistleblowing reports, investigations, and outcomes shall be documented and retained for a minimum of eight(8) years, in line with VARA record-keeping requirements.

11. GOVERNANCE AND REVIEW

The Compliance Officer is responsible for the implementation and oversight of this Policy.

This Policy shall be reviewed at least annually, or sooner where regulatory changes or internal developments require.