Risk Classification

Amarium s.r.o. Risk Classification & Customer Risk Assessment

RISK CLASSIFICATION CUSTOMER RISK ASSESSMENT

2025 Edition

Approved on June 20, 2025

CONTENTS

1. GENERALINFORMATION1

2. CUSTOMERRISKASSESSMENT1

3. ONGOINGCDD/EDDPROCESSFOREXISTINGCUSTOMERS5

4. RESPONSIBILITIES6

5. DEFINITIONS6

1. GENERAL INFORMATION

• 1.1 PURPOSE

The purpose of this document is to establish the customer risk assessment procedures that enable Amarium s.r.o., hereinafter referred as the "Amarium s.r.o." or the "Company", to form a reasonable belief that it identifies the risk of each customer, in order to take reasonable and practical risk-based procedures of due diligence process for each customer.

It is the policy of Amarium s.r.o. to implement and maintain an effective methodology in identifying the Customer’s risk and continuously monitor customer transactions and activities against pre-established customer profiles and risk parameters in order to detect unusual transactions or patterns that can be indicators of money laundering or terrorist financing activities.

• 1.2 SCOPE

The Compliance Department must fulfill the requirements of this procedure. Also, the Compliance Officer will be responsible to modify the risk parameters for each client whenever necessary.

1. CUSTOMER RISK ASSESSMENT

Information collected during CDD process will allow Amarium s.r.o. to determine the customer's risk profile at account opening. Amarium s.r.o. should monitor their High/Medium/Lower-risk customers through regular transaction monitoring and customer due diligence processes. If there is indication of a potential change in the customer's risk profile (e.g., expected account activity, change in shareholding structure or business operations), management should reassess the customer risk rating and follow established Amarium s.r.o. policies and procedures for maintaining or changing customer risk ratings.

• 2.1 RISK MATRIX PARAMETERS

The Risk Matrix consists of Four main categories. Each category is divided into several risk factors taking considerations of the risk profiles associated with different types of customers, i.e., Individual and Business customers.

1. Individual customers

   1. Customer Characteristics

Customer Characteristics is the main component of customer’s total risk profile. Considerations should be drawn on customer’s age, contact details, source of income, and purpose of account opening. Customer’s identification should be collected and verified. The Disclosure Level of Information, Business relationship establishment channel and potential Adverse News should also be examined.Name screenings against Sanction lists, PEPs, and adverse media shall be performed to determine whether the customer has been sanctioned by OFAC/UN, and/or identified as PEP, and/ or prosecuted for AML violation or other criminal activities. Amarium s.r.o. will not accept any customer that has been sanctioned by OFAC and/or UN.

b. Geographical Location

Identifying geographic locations that pose a higher risk is essential to assess customer risk. Geographical Risk is evaluated considering international and domestic high-risk geographic location lists including:

• Countries subject to OFAC sanctions, including state sponsors of terrorism. (https://www.treasury.gov/resource-center/sanctions/Programs/Pages/Programs.aspx)

• Countries subject to UN sanctions. (https://www.un.org/securitycouncil/content/un-sc- consolidated-list)

• Countries identified as supporting international terrorism under section 6(j) of the Export Administration Act of 1979, section 40 of the Arms Export Control Act, and section 620A of the Foreign Assistance Act, as determined by the Secretary of State. (https://www.state.gov/state-sponsors-of-terrorism/)

• Jurisdictions determined to be "of primary money laundering concern" by the Secretary of the Treasury, and jurisdictions subject to special measures imposed by the Secretary of the Treasury, through FinCEN, pursuant to section 311 of the Patriot Act. (https://www.fincen.gov/resources/statutes-and-regulations/311-special-measures)

• Jurisdictions/countries identified as High-Risk Jurisdictions subject to a Call for Action and Jurisdictions with Strategic Deficiencies by the Financial Action Task Force on Money Laundering (FATF). (http://www.fatf-gafi.org/publications/high-riskandnon- cooperativejurisdictions/?hf=10&b=0&s=desc(fatf_releasedate)

• Major money laundering countries and jurisdictions identified in the U.S. Department of State's annual International Narcotics Control Strategy Report (INCSR), in particular, countries which are identified as jurisdictions of primary concern. (https://www.state.gov/international-narcotics-control-strategy-reports/)

• Offshore financial centers (OFCs) that could be expected to pose major financial system risks according to the past offshore financial center assessments by IMF (https://www.imf.org/external/np/ofca/ofca.aspx)

• The countries/regions evaluated with a high-risk score and risk ranking as per Basel AML Index (https://baselgovernance.org/basel-aml-index)

• The countries/regions’ public sectors are perceived as highly corrupt as per Corruption Perceptions Index by Transparency International (https://www.transparency.org/en/)

Amarium s.r.o. uses Basel AML Index to rank countries/regions risk level. The Basel AML Index methodology is based on a scientific approach of following the OECD guidelines for the composite index, and it’s being reviewed by externally experts with academic, financial and law enforcement backgrounds. Amarium s.r.o. therefore maintains an internal High AML Risk and Sanction Jurisdictions List and an Offshore Financial Centre for Tax Avoidance for Tax Avoidance List.

c. Transaction Risk

Transaction Risk involves the elements of customer transactional behaviors. For instance, whether the account is opened by an Agency and/or the total number of accounts being opened or cancelled previously should be considered in evaluating the transaction Risk.

d. Occupation

Customer’s occupation is one of the essential factors in the customer risk profiling. In most situations, connections can be found between customer’s occupation / employment and customer’s source of wealth, geographic locations and expected transaction activities. Amarium s.r.o. classifies customer’s occupations into six risk levels (i.e., Extremely High, High, Medium High, Medium, Medium Low and Low) referencing the Occupation Code List issued by U.S. Census Bureau and peer financial institutions’ practices.

1. Business customers

   1. Customer Characteristics

Business customers usually present greater money laundering risks than do individuals because a legitimate business provides a perfect cover for all three phases of the money laundering cycle. Therefore, a broader scope should be placed on the examination of Business customer’s characteristics, which may include customer’s legal structure & ownership, business size and potential related entities. Complex ownership structures often bear higher potential of money laundering. The less transparency that exists in ownership structure, the greater the risk. Name screenings against Sanction lists, PEPs, and adverse media shall be performed to determine whether the business customer and its connected parties, e.g., account holder, authorized signatories, directors, beneficial owners, and any intermediary, etc., have been sanctioned by OFAC/UN, and/or identified as PEP, and/or prosecuted for AML violation or other criminal activities. Amarium s.r.o. will not accept any customer which and/or whose connected parties have been sanctioned by OFAC and/or UN.

b. Geographical Location

Business customer’s geographical risk is impacted by various inputs, especially the customer’s registered address and main business operation location. Other factors, such as the nationality of beneficiary and/or actual controller, should also be considered.

c. Business Factors

Business factors are also important contributors to customer’s overall risk profile. Business factors comprise Product and Service Type, Expected Transaction Activities, Source of Fund and so on. Amarium s.r.o. offers its customers variety of products and services including Certificates of Deposit, Electronic Bill Payment, Deposit Products (Savings/ DDA/ Certificates of Deposit), Commercial Loan, etc. Each type of product and service poses different level of money laundering risk by nature and has been factored in the risk scoring model.The Expected Transaction Activities (e.g., estimated monthly inbound & outbound activities, frequency of transactions, estimated transaction amounts) can be used not only to assess customer’s risk profile in conjunction with the business size at the onboarding stage, but also as a benchmark to ascertain usual/unusual activity in transaction monitoring & ongoing customer due diligence.

d. Industry

Amarium s.r.o. rates business customer’s industry into six risk levels (i.e., Extremely High, High, Medium High, Medium, Medium Low and Low) according to the industry classification in the North American Industry Classification System (NAICS).

• 2.2 RISK LEVEL ASSIGNED

Each risk factor will be scored based on its level of risk. A Customer's overall risk level lies with the total score received (sum of points). Any Customer that is assessed as High Risk must seek the BOD’s final approval.

Customer Risk Score for the Onboarding process

	High	MediumHigh	Medium	MediumLow	Low
Individual customer score	>=35	[30,35)	[30,35)	[20,25)	<20
Business customer score	>=50	[45,50)	[40,45)	[35,40)	<35

Below Exceptions shall be noted:

1. Customer that has one or more risk factor(s) belonging to "Prohibited" will not be accepted regardless of its overall risk score.

2. Customers engaging in high-risk business, regardless of the overall risk, must escalate to the AMLCC for BOD’s approval.

3. Customer with an identified PEP (director/authorized signatory/beneficial owner) shall be regarded as High Risk regardless of the overall risk. Enhanced Due Diligence must be performed on the subject PEP.

1. ONGOING CDD/EDD PROCESS FOR EXISTING CUSTOMERS

Another critical component of a risk assessment is having a process to re-evaluate risks and determine when the customer risk rating should be raised or lowered. Identifying the key factors that should trigger such a re-evaluation is essential to efficient allocation of limited resources.In addition to the initial assessment of the inherent risk of a customer, it is important to consider how a customer’s relationship — and risk — with the institution changes over time. The most important consideration driving a customer’s risk rating is probably the actual activity that the customer conducts. The customer must have an existent account with Amarium s.r.o. in order to obtain the approval of any additional product or service offered by the Amarium s.r.o.. Unless the Identifications or any other applicable document is expired, the customer does not have to pass through the account opening requirements once again.Sanctions verification (e.g., OFAC search), Politically Exposed Persons Screening and other blacklists checking should be performed when doing customer due diligence.If the Compliance Department detects any material changes of a customer, customer’s nature of business and transactions which may significantly affect the customer’s risk profile, the customer’s risk should be re-evaluated. Change of customer’s risk level must be recorded by the Compliance Department and reviewed by BOD for final approval.

1. RESPONSIBILITIES

1. COMPLIANCE ANALYST- Reviewing all applicable CIP, CDD, and EDD documentation for individuals and entities. Complete an Onboarding Risk Assessment for each customer in order to determine the type of risk, in terms of tendency to commit money laundering, terrorism financing and/or any other type of suspicious activity. Determine if the customer overall risk is extremely high and whether or not should escalate to BOD. Discuss any suspicious account applications with the Chief Compliance Officer and/or AMLCC, prior approving the profile.

Ongoing monitor the customers’ profile, transaction and nature of the customer’s business, detect if any material changes occur compared to the bank’s knowledge about the customer’s background, and determine if such change(s) will impact the customer’s overall risk.

• 4.1.1 CHIEF COMPLIANCE OFFICER AND ANTI-MONEY LAUNDERING COMPLIANCE

COMMITTEE (AMLCC) - Supervise the overall compliance functions. Assist the Compliance Analyst with regard any doubt or clarification in the account opening process. Evaluate escalated cases and make authoritative decisions on the customer’s risk profile. Report to BOD for any material compliance matters.

1. BOARD OF DIRECTOR (BOD)- Delegate AMLCC members. Make final approval on Extreme-high Risk customer, customer’s business and transactions, changes to a customer’s risk profile, and any other material compliance matters.

1. DEFINITIONS

1. CUSTOMER DUE DILIGENCE (CDD) - The concept of CDD begins with verifying the customer’s identity and assessing the risks associated with that customer. Processes should also include enhanced due diligence for higher-risk customers and ongoing due diligence of the customer base.

1. CUSTOMER IDENTIFICATION PROGRAM (CIP) – The CIP is intended to enable Amarium s.r.o. to form a reasonable belief that it knows the true identity of each customer. The CIP must include account opening procedures that specify the identifying information that will be obtained from each customer. It must also include reasonable and practical risk-based procedures for verifying the identity of each customer. Amarium s.r.o. should conduct a risk assessment of their customer base and product offerings, and in determining the risks.

1. ENHANCED DUE DILIGENCE (EDD) – It is the process in which the Compliance Department must conduct further research on identified high risk customers to better assess the risk they pose with regards to money laundering and/or any other type of suspicious activity.

1. OFAC- Office of Foreign Assets Control ("OFAC") of the U.S. Department of the Treasury administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals against targeted foreign countries, terrorists, international narcotics traffickers, and those engaged in activities related to the proliferation of weapons of mass destruction.

1. PLC- Members of the Palestinian Legislative Council (PLC) who were elected to the PLC on the party slate of Hamas, or any other Foreign Terrorist Organization (FTO), Specially Designated Terrorist (SDT), or Specially Designated Global Terrorist (SDGT), provided that any such individuals are not named on OFAC's list of Specially Designated Nationals and Blocked Persons (SDN List).

1. POLITICALLY EXPOSED PERSONS (PEP’s) – Senior political figure is defined as a "senior official in the executive, legislative, administrative, military or judicial branches of a foreign government (whether elected or not), a senior official of a major foreign political party, or a senior executive of a foreign government-owned corporation." The term also includes "any corporation, business or other entity that has been formed by or for the benefit of, a senior political figure." Immediate family is defined as the senior foreign political figures "parents, siblings, spouse children and in-laws." Close associates are defined as "a person who is widely and publicly known to maintain an unusually close relationship with the senior foreign political figure, and includes a person who is in a position to conduct substantial domestic and international financial transactions on behalf of a senior foreign political figure."