Anti-Money Laundering & CFT Policy

Varo.com (the "Company") is owned and operated by Atlas International Holdings (Mauritius) Ltd, a regulated Foreign Exchange (FX) broker licensed under the Mauritius regulatory framework. The Company is fully committed to the prevention of money laundering (ML), terrorist financing (TF), and the proliferation of weapons of mass destruction (WMD). This Policy establishes the Company's framework for AML and CFT in line with applicable laws, regulations, FATF Recommendations, and the requirements of our Payment Service Providers (PSPs).

The Operating Entity

01 — Purpose

The purpose of this Policy is to:

• Protect the Company from being used to facilitate ML/TF activities
• Ensure compliance with all applicable AML/CFT laws and regulations
• Maintain strong and transparent relationships with regulators, PSPs, and clients
• Promote a compliance culture across the organization

02 — Governance & Responsibility

The Board of Directors has ultimate responsibility for the AML/CFT framework.

A designated Money Laundering Reporting Officer (MLRO) is appointed to oversee day-to-day compliance, reporting, and monitoring.

All employees are responsible for adhering to this Policy and promptly reporting any suspicious activity.

03 — Risk Assessment

The Company maintains a risk-based approach (RBA) to managing ML/TF risk. Risks are assessed and categorized as follows:

• Customer Risk: retail, corporate, PEPs, high-net-worth individuals
• Geographic Risk: countries listed as high-risk by FATF, OFAC, EU, UN
• Product / Service Risk: FX trading, leveraged products, payment channels
• Delivery Channel Risk: online onboarding, third-party PSPs, digital channels

04 — Customer Due Diligence (CDD)

The Company applies CDD measures prior to establishing a business relationship:

• Individuals: government-issued ID, proof of residence, biometric verification (selfie/video), sanctions/PEP screening.
• Corporates: certificate of incorporation, ownership/UBO verification, directors' IDs, proof of business activity.
• Enhanced Due Diligence (EDD): applied to PEPs, high-risk jurisdictions, and unusual client profiles.

Ongoing monitoring is performed to ensure information remains accurate and up to date.

05 — Sanctions & Screening

All clients and transactions are screened against relevant sanctions lists (UN, EU, OFAC, Mauritius regulatory lists).

Screening occurs at onboarding and continuously during the business relationship.

Matches are escalated immediately to the MLRO.

06 — Transaction Monitoring

The Company maintains automated and manual monitoring systems to detect unusual or suspicious activity, including:

• Large, rapid, or unusual transactions inconsistent with the customer's profile.
• Frequent deposits/withdrawals with no economic rationale.
• Payments from or to high-risk or sanctioned jurisdictions.

07 — Reporting Obligations

Employees must immediately report suspicious activity to the MLRO.

The MLRO will investigate and, if warranted, file a Suspicious Transaction Report (STR) with the Financial Intelligence Unit (FIU) or relevant authority.

No client shall be informed of any STR filing (tipping-off prohibition).

08 — Record Keeping

All CDD, transactional, and monitoring records will be maintained for a minimum of 7 years from the end of the client relationship.

Records will be stored securely and made available to regulators or PSPs upon request.

09 — Employee Training

All staff must undergo AML/CFT training at onboarding and annually thereafter.

Training covers legal obligations, internal procedures, red flags, and reporting obligations.

Attendance and comprehension are documented for audit purposes.

10 — Independent Audit & Review

An independent review of the AML/CFT program will be conducted annually.

Findings are reported to the Board and corrective measures implemented.

11 — Data Protection

Personal and financial data collected under this Policy will be handled in compliance with applicable data protection regulations.

Data will be used solely for AML/CFT compliance purposes.

12 — Disciplinary Measures

Failure by employees to comply with this Policy may result in disciplinary action, up to and including termination of employment.

13 — Policy Review

This Policy will be reviewed at least annually, or sooner if:

• Regulatory changes occur.
• New PSP requirements are introduced.
• Material changes in the Company's operations or risk profile are identified.