KYC Policy

KEM BAHRAIN W.L.L.

KNOW YOUR CUSTOMER (KYC) POLICY

(Category 2 Crypto-Asset Service Licensee | CBB Volume 6)

1. Purpose

This Know Your Customer (KYC) Policy establishes the framework under which Kem Bahrain W.L.L. (the “Company”) conducts customer identification, verification and due diligence in accordance with:

• The laws of the Kingdom of Bahrain; • The Central Bank of Bahrain (“CBB”) Rulebook Volume 6 (AML Module and CRA Module); • Applicable AML/CFT/CPF and sanctions obligations.

This Policy forms part of the Company’s broader AML/CFT/CPF framework and must be read alongside:

• The AML/CFT/CPF & Sanctions Policy; • The Risk Assessment Policy; • The Transaction Monitoring Framework.

2. Objectives

The objectives of this Policy are to:

• Prevent money laundering, terrorist financing and proliferation financing; • Ensure customers are properly identified and verified; • Apply a risk-based approach to onboarding and monitoring; • Identify beneficial ownership structures; • Detect and mitigate sanctions exposure; • Ensure regulatory compliance and record integrity.

3. Scope

This Policy applies to:

• All new customers prior to onboarding; • Existing customers during periodic review; • Occasional transactions where applicable; • All employees involved in customer onboarding or monitoring; • Third-party service providers assisting with identity verification.

No customer relationship shall be established unless required KYC measures are completed.

4. Customer Identification and Verification

4.1 Natural Persons

The Company shall obtain and verify the following information: • Full legal name; • Date of birth; • Nationality; • Residential address; • Identification number; • Occupation and source of funds.

Verification shall be conducted using: • Valid government-issued identification (passport, national ID); • Proof of address (recent utility bill, bank statement or equivalent); • Biometric or video verification for non-face-to-face onboarding.

Non-face-to-face verification must include enhanced safeguards, including liveness detection and multi-factor authentication.

4.2 Legal Entities

For corporate customers, the Company shall obtain:

• Legal name and registration number; • Registered address; • Articles of incorporation or equivalent; • Details of directors and authorised signatories; • Ownership and control structure; • Identification of beneficial owners.

Verification shall include: • Official registry extracts; • Constitutional documents; • Identification and verification of directors and authorised representatives.

5. Beneficial Ownership

The Company shall identify and verify the ultimate beneficial owner(s) (UBOs) of all legal entity customers.

A beneficial owner is the natural person who ultimately owns or controls the entity, directly or indirectly.

Where ownership exceeds 25%, such individuals must be identified and verified. Where no individual meets this threshold, senior managing officials shall be identified.

The Company shall not establish a relationship if beneficial ownership cannot be adequately determined.

6. Risk-Based Approach (RBA)

Customer risk classification shall be determined in accordance with the Company’s Risk Assessment Policy.

Customers shall be assessed across the following categories:

• Customer risk; • Geographic risk; • Product and transaction risk; • Delivery channel risk; • Crypto-asset exposure risk.

Customers shall be classified as:

Risk Level Description

Low Minimal inherent risk

Medium Moderate risk exposure

High Elevated risk requiring enhanced controls

Prohibited Risk outside Company risk appetite

No relationship shall proceed if the risk classification is “Prohibited.”

7. Due Diligence Measures

7.1 Standard Due Diligence (CDD)

Applied to all customers and includes:

• Identity verification; • Beneficial ownership identification; • Sanctions screening; • Purpose of relationship assessment; • Source of funds assessment; • Risk rating assignment.

7.2 Enhanced Due Diligence (EDD)

EDD shall be applied where higher risk is identified, including:

• Politically Exposed Persons (PEPs); • Customers from high-risk jurisdictions; • Complex ownership structures; • High transaction volumes; • Adverse media findings; • Crypto-asset exposure to high-risk wallets; • Suspicious transaction behaviour.

EDD measures may include:

• Source of wealth verification; • Enhanced source of funds documentation; • Senior management approval; • Increased monitoring frequency; • Blockchain analytics review.

8. Sanctions Screening

All customers, beneficial owners and authorised representatives shall be screened against:

• United Nations sanctions lists; • Bahrain sanctions lists; • Other applicable sanctions lists.

Wallet addresses shall be screened using blockchain analytics tools where applicable. Any confirmed sanctions match shall result in immediate account restriction and escalation to the MLRO.

9. Ongoing Monitoring

KYC is not a one-time process.

The Company shall: • Monitor transactions continuously; • Review customer profiles periodically; • Update risk ratings where necessary; • Re-verify identification where required; • Apply enhanced monitoring to high-risk customers.

High-risk customers shall be reviewed at least every six months.

10. Refusal and Termination

The Company shall refuse to establish or continue a relationship where: • Required KYC documentation cannot be obtained; • Information provided is false or misleading; • Beneficial ownership cannot be identified; • Risk exceeds the Company’s risk appetite; • Sanctions exposure is confirmed.

Termination decisions shall be documented and escalated appropriately.

11. Suspicious Activity Reporting

Employees must immediately escalate suspicious behaviour to the MLRO.

The MLRO shall assess and, where appropriate, file a Suspicious Transaction Report (STR) with the competent Bahraini authority.

Employees must not inform customers of such reporting.

12. Record Retention

The Company shall retain:

• Identification documents; • Risk assessments; • Transaction records; • Monitoring logs; • STR documentation.

Records shall be retained for a minimum of ten (10) years or such period as required by Bahraini law.

13. Data Protection

Personal data collected for KYC purposes shall be processed in accordance with:

• Bahrain Personal Data Protection Law; • The Company’s Privacy Policy.

Access shall be restricted to authorised personnel.

14. Training and Accountability

All relevant employees shall receive periodic training on:

• KYC procedures; • AML/CFT/CPF obligations; • Sanctions compliance; • Crypto-asset risks.

The Compliance Officer and MLRO are responsible for oversight of this Policy. Senior Management and the Board are responsible for ensuring adequate resources and implementation.

15. Governance and Review

This Policy shall be: • Reviewed annually; • Updated to reflect regulatory changes; • Approved by the Board of Directors.