Risk Assessment Policy

KEM BAHRAIN W.L.L.

AML / CFT / CPF RISK ASSESSMENT POLICY (CBB Volume 6 – Crypto-Asset Services)

1. Introduction

This Risk Assessment Policy (“Policy”) establishes the framework under which Kem Bahrain W.L.L. (the “Company”) identifies, assesses, manages and mitigates risks relating to money laundering (ML), terrorist financing (TF), proliferation financing (PF), sanctions breaches and financial crime associated with crypto-asset activities.

The Company operates as a regulated crypto-asset service provider in the Kingdom of Bahrain and applies a risk-based approach in accordance with:

• The laws and regulations of the Kingdom of Bahrain; and • The Central Bank of Bahrain (“CBB”) Rulebook Volume 6, including the AML and

Crypto-Asset (CRA) Modules.

The Board of Directors retains ultimate responsibility for approving the Company’s risk appetite and ensuring the effectiveness of the risk assessment framework. This Policy shall be reviewed at least annually and whenever material changes occur in the Company’s activities, regulatory environment or risk exposure.

2. Purpose and Scope

The purpose of this Policy is to ensure that the Company: • Identifies inherent ML/TF/PF risks arising from its business model; • Assesses the likelihood and potential impact of those risks; • Determines whether risks fall within the approved risk appetite; • Implements appropriate mitigation measures; and • Applies proportionate customer due diligence and monitoring controls.

This Policy applies to all customers, products, services, jurisdictions, delivery channels and technology platforms used by the Company.

3. Risk Assessment Methodology T he Company conducts and documents a formal enterprise-wide AML/CFT/CPF risk assessment.

The methodology consists of risk identification, risk analysis and risk evaluation. Risk identification involves determining inherent risks arising from the Company’s customers, jurisdictions, products, services, delivery channels and crypto-asset exposure.

Risk analysis involves assessing both the likelihood of occurrence and the potential impact of each identified risk, taking into account the effectiveness of existing controls.

Risk evaluation determines the residual risk after mitigation measures and assesses whether the residual risk aligns with the Company’s approved risk appetite.

The completed risk assessment shall be documented and approved by the Board.

4. Risk Categories

The Company assesses risk across the following primary categories:

4.1 Customer Risk

Customer risk arises from the nature of the customer, ownership structure, political exposure, source of funds, transactional behaviour and overall transparency. Particular attention is given to politically exposed persons (PEPs), complex legal entities, high-volume traders and customers with adverse media exposure.

4.2 Geographic Risk

Geographic risk considers the jurisdiction of residence, incorporation, source of funds and transaction flow. Higher risk may arise from jurisdictions identified by FATF as high-risk or under increased monitoring, sanctioned countries or jurisdictions with weak AML controls.

4.3 Product and Service Risk

Product risk reflects the inherent characteristics of the Company’s crypto-asset services, including exchange services, wallet functionality, fiat on/off ramp capabilities, transaction speed and irreversibility, and stablecoin exposure. New crypto-assets or services must undergo a separate documented risk assessment prior to launch.

4.4 Delivery Channel Risk

Delivery channel risk arises from how services are provided, including fully digital onboarding, non-face-to-face relationships, use of third-party providers and API integrations.

4.5 Crypto-Asset Specific Risk

Crypto-asset risk considers blockchain-related vulnerabilities, including exposure to mixers or tumblers, darknet markets, ransomware-linked wallets, cross-chain transfers, rapid layering activity and tainted wallet exposure.

5. Risk Assessment Scale

Each identified risk factor is assessed using the following scale: Score Risk Level Description

1 Low Minimal likelihood and limited impact

2 Medium Moderate likelihood and/or impact

3 High Significant likelihood and/or impact

4 Prohibited Exceeds the Company’s risk appetite

and is not acceptable Residual risk is determined after consideration of mitigation controls. Risks assessed as “Prohibited” shall not be accepted under any circumstances.

6. Risk Appetite

The Company adopts a conservative risk appetite appropriate for a regulated crypto-asset service provider operating in Bahrain.

The Company does not establish or maintain relationships with sanctioned individuals or entities, prohibited jurisdictions or customers for whom adequate due diligence cannot be completed. It does not knowingly transact with tainted or sanctioned crypto-asset wallets and does not permit anonymous onboarding.

The Board formally approves the Company’s risk appetite annually and reviews it in light of business developments and regulatory expectations.

7. Updating the Risk Assessment

The enterprise-wide risk assessment shall be reviewed at least annually. It must also be updated where material changes occur, including: • Significant growth in transaction volumes; • Rapid increases in customer numbers; • Increase in high-risk customers; • Introduction of new products or crypto-assets; • Material IT system changes; • Regulatory findings or compliance incidents; • Publication of a new National Risk Assessment; or • Changes in key service providers.

A documented risk assessment must be completed prior to launching new products, adopting new technologies or entering new markets.

8. Customer Risk Profiling Model

Each customer is assigned a risk profile at onboarding and is subject to periodic reassessment. The assessment considers customer risk, geographic risk, product exposure, delivery channel risk and crypto-asset exposure.

8.1 Risk Categories and Weighting

To reflect inherent crypto-asset risks, the Company applies weighted scoring: Customer Risk Geographic Risk Product / Transaction Risk Delivery Channel Risk

8.2 Risk Scoring Table Score Meaning

1 Low Risk

2 Medium Risk

3 High Risk

4 Prohibited Risk

8.3 Determination of Customer Risk Profile

The weighted average score (X) determines the customer’s risk level:

Risk Category Weight 2 1 2 1 Crypto-Asset Exposure Risk 2 Final Score (X) Risk Profile X < 2 Low 2 ≤ X ≤ 3 Medium X > 3 High Final Score (X) Risk Profile

Any category scored 4 Prohibited

8.4 Mandatory Overrides

• A customer cannot be classified as Low Risk if any category is scored as High. • A customer must be classified as High Risk if any category is scored as High. • If any category is scored as Prohibited, onboarding must not proceed.

The assigned risk profile determines the level of due diligence, monitoring intensity and review frequency.

9. Governance and Oversight

The Board of Directors is responsible for reviewing and approving the enterprise-wide risk assessment annually. The MLRO is responsible for maintaining the risk assessment framework and ensuring alignment with CBB requirements.

Risk trends, material risk developments and changes in risk exposure shall be reported to the Board on a quarterly basis.

10. Record Keeping

The Company maintains documented records of: • The enterprise-wide risk assessment; • Customer risk scoring methodology; • Version history and updates; • Board approvals and review outcomes.

All documentation shall be retrievable without delay upon request by the CBB or other competent authorities.