Document 1 — Section 1. Exchange Rules

1. Parties to the Agreement

1.1. This document constitutes a public offer (the “Agreement”) and governs the procedure for providing electronic currency/digital asset exchange services by the exchange service (the “Service Provider”) to an individual (the “Customer”).

1.2. The Customer confirms that they have the necessary legal capacity and use payment details/payment instruments/digital addresses on lawful grounds.

2. Terms and Definitions

2.1. Service Provider — an Internet-based electronic currency/digital asset exchange service, available on the Internet, providing exchange services in accordance with and on the terms of this document.

2.2. Customer — an individual using the Service Provider’s service, creating a Request and/or performing actions constituting acceptance of the offer and execution of an exchange transaction.

2.3. Exchange — a service for converting electronic currencies/digital assets and/or fiat funds within the directions available on the website.

2.4. Request — information generated by the Customer regarding the direction, amount, details and other exchange parameters.

2.5. Digital Asset — an asset/unit of account of the relevant blockchain network or payment systеm.

2.6. Network/Transfer Fee — the actual costs of transfer (network fee/payment systеm fees).

2.7. AML/KYC/SoF — compliance control procedures (see Section 2 of this document for details).

3. Legal Status and Acceptance

3.1. The material terms of the exchange (rate, fees, timeframes, rate-fixation rules, confirmation requirements, AML/KYC/SoF requirements) are displayed in the website interface and/or in the Request.

3.2. Acceptance of the offer shall be deemed the Customer’s actions to complete the Request and/or transfer funds to the details issued under the Request.

3.3. The date/time and parameters of the Request are recorded automatically upon its creation.

3.4. The Agreement for a specific Request enters into force when funds/asset are actually credited to the Service Provider’s details (subject to crediting/confirmation rules).

4. Subject Matter of the Agreement

4.1. The Service Provider shall provide the exchange service under the Request, and the Customer shall provide accurate information and take the actions necessary to execute the Request.

4.2. The Service Provider shall make the payout to the details specified in the Request after the execution conditions are met (including confirmations and AML/KYC/SoF procedures).

4.3. The Service Provider’s remuneration is included in the rate/terms specified in the Request and on the website.

5. Procedure for Creating and Executing a Request

5.1. The exchange is performed strictly under the Request and to the details specified in the Request.

5.2. Requests are processed in automatic/semi-automatic mode. Estimated execution time: from 5 minutes to 72 hours (depending on the direction, confirmations, bank/payment systеm processing rules, and AML/KYC/SoF procedures).

5.3. If a Request is not paid within 30 minutes from creation, the Service Provider may cancel the Request and deem the issued details invalid.

5.4. Directions involving cash withdrawal via QR code

5.4.1. In directions providing for cash withdrawal via ATMs, after the Request execution conditions are met (receipt of funds, confirmations, absence of AML/KYC/SoF restrictions), the Service Provider generates a QR code (or another one-time identifier) to withdraw cash under the relevant Request (the “Withdrawal QR Code”).

5.4.2. The Withdrawal QR Code is generated solely within the framework of a specific Request and is intended for withdrawing cash in the amount and on the terms specified in the Request.

5.4.3. The Withdrawal QR Code is sent to the Customer via the communication channels specified exclusively in the Request (email/messenger/other methods provided by the website interface).

5.4.4. The validity period of the Withdrawal QR Code is specified in the Request (as a rule, no more than 30 minutes, unless a different period is set by the direction’s terms). The Customer shall ensure the safekeeping of the QR code and shall not transfer it to third parties.

5.4.5. Upon expiration of the Withdrawal QR Code or if it is not used within its validity period, the Service Provider may:

• a) issue a new QR code (subject to confirming the Request is still valid and can be executed);
• b) upon the Customer’s request, cancel the cash withdrawal direction and process a refund under Section 8.

5.4.6. Recalculation at a different rate due to expiration of the Withdrawal QR Code shall not apply if the rate was fixed under Section 6.

5.5. Cash Exchange (In-Person Service)

5.5.1. For exchange directions involving cash funds (the Cash Exchange), the Customer shall submit an application on the website and agree on the date and time of the visit with the Service Provider’s representative via communication in a Telegram chat using the contact details published on the website.

5.5.2. The Customer undertakes to use exclusively the contact details/links published on the Service Provider’s official website. The Service Provider shall not be liable for any consequences arising from the Customer’s interaction with third parties and/or fraudulent (fake) accounts when using unofficial contacts.

5.5.3. The Service Provider is entitled to refuse to enter into and/or perform a transaction with persons who have not reached the age of majority. The Service Provider is also entitled to refuse to enter into and/or perform a transaction with persons over 50 years of age (for risk management and security purposes).

5.5.4. During the in-person visit, the Customer shall complete the agreement form (and any other documents, if required) and present the original passport. Failure to present the original passport constitutes grounds for refusal of service and/or rescheduling of the visit.

5.5.5. The wallet/exchange account (or other payment instruments) used in the transaction must belong to the Customer and be under the Customer’s immediate control at the time of the transaction. The Service Provider may request confirmation of ownership of the wallet/account and/or additional information for security and AML/KYC/SoF purposes.

5.5.6. Transactions involving third parties are not permitted, including (but not limited to) the use of third-party details/wallets/accounts for sending or receiving funds, as well as acting on behalf of third parties without proper confirmation and coordination with the Service Provider.

5.5.7. For Cash Exchange transactions, the exchange rate shall be fixed at the time the application is paid (i.e., upon actual receipt of funds under the application), provided that the crediting/confirmation requirements specified in the application are met and there are no AML/KYC/SoF restrictions. Other rate-fixing rules shall apply in accordance with Section 6 of these Rules, if expressly stated in the application terms.

6. Exchange Rate: Fixation and Recalculation

6.1. The rate-fixation procedure is specified when the Request is created (and may depend, inter alia, on funds crediting and/or the number of network confirmations).

6.2. If the rate is fixed at the time of crediting and/or after network confirmations, no recalculation shall be performed after the rate is fixed, even in case of subsequent delays in processing the payout, provided that the rate was in fact fixed.

6.3. If the rate has not been fixed (incomplete/incorrect receipt, lack of confirmations, payment outside the window, need for clarification of data), the Service Provider may recalculate at the current rate at the moment when it became possible to correctly determine the execution terms, but only until the rate is fixed.

7. Blockchain Network Confirmations

7.1. Execution of the Request (including rate fixation, if applicable) is carried out after the required number of network confirmations is received, unless otherwise expressly stated in the terms of the specific Request.

7.2. Minimum confirmation requirements (unless otherwise stated in the Request):

• BTC — 3 confirmations;
• ETH and USDT ERC-20 — 64 confirmations;
• USDT TRC-20 and TRX — 20 confirmations;
• XMR — 75 confirmations;
• for other directions — after actual crediting and fulfillment of the direction’s conditions.

7.3. In case of discrepancy between this clause and the terms of the Request, the terms displayed in the Request at the time of its creation shall prevail.

8. Refunds, Request Cancellation and Amount Discrepancies

8.1. Amount received differs from the Request amount

8.1.1. If an amount different from the Request amount is received, the Service Provider may: recalculate based on the actual amount, suspend for clarification, or return the funds.

8.1.2. If the amount received exceeds the Request amount by more than 10%, the Service Provider may suspend execution and request information/documents to confirm the circumstances of the transfer and ownership of the funds.

8.1.3. If ownership cannot be confirmed / if information is refused / for compliance reasons, the Service Provider may refuse to execute and return the funds to the sender’s address/details or to the Customer’s confirmed refund address.

8.1.4. Refund under this clause: only the network/transfer fee is deducted. If the situation is an AML case, Section 2 (AML Policy) applies.

8.2. Customer’s refusal after payment

8.2.1. If the Customer paid for the Request and declares refusal before the payout is sent, a refund is made in full minus only the network/transfer fee in 96 hours.

8.2.2. If the payout has been sent or a Withdrawal QR Code has been generated and cash has been withdrawn, cancellation and refund in the original form may be impossible; the request will be considered within technical feasibility.

8.3. Incorrect details / inability to make a payout

8.3.1. In case of incorrect details or inability to make the payout, the Service Provider may request corrected details / confirmation of ownership.

8.3.2. If replacement of details is impossible or no response is received, a refund is made with deduction only of the network/transfer fee, unless otherwise follows from the AML Policy.

8.4. Execution delays and cancellation

8.4.1. If the payout is not made within 24 hours after all execution conditions are met (receipt, confirmations, absence of AML restrictions), and the Withdrawal QR Code is not generated within the specified time, the Customer may demand cancellation provided that the payout has not been sent and/or the QR code has not been generated.

8.4.2. Refund upon cancellation: within up to 24 hours from receipt of the demand (plus processing/confirmation time); deduction — only the network/transfer fee, unless otherwise follows from the AML Policy.

9. Technical Terms and Limitations

9.1. The Service Provider shall not be liable for delays caused by the operation of banks, payment systems and/or blockchain networks (processing times, internal rules, confirmation times, etc.).

9.2. The Service Provider shall take reasonable measures to properly execute Requests in accordance with the terms of the Request and this Agreement.

9.3. The Service Provider may apply additional security measures, including requesting supporting information/documents, if required for proper and secure execution.

10. Funds Received Without a Created Request (Outside a Request)

10.1. Funds/assets received without a created Request are treated as “outside a Request” receipts and are held for 30 calendar days for settlement purposes.

10.2. To obtain a refund, the sender shall contact support and provide the data required for identification and confirmation of ownership.

10.3. Upon confirmation of ownership, a refund is made with deduction of the network/transfer fee. If an AML case exists, the provisions of Section 2 apply.

10.4. After 30 days, if no request is received and there is insufficient data for identification, the Service shall not be responsible for the received funds.

11. Reference to the AML/KYC/SoF Policy

11.1. The Customer is informed and agrees that all incoming transactions and provided addresses are subject to AML screening, and if increased risk is identified, the Service Provider may suspend execution and request KYC/SoF documents. The procedure, timeframes and refund terms for AML cases are governed by the AML/KYC/SoF Policy (Section 2 of this document).

12. Customer Obligations and Prohibitions

12.1. It is prohibited to use the service for illegal and/or fraudulent actions.

12.2. The Customer shall provide accurate information and, upon request, provide documents/data required for identification and AML/KYC/SoF.

12.3. It is prohibited to interfere with the operation of the service or attempt to bypass security measures.

12.4. Changes to payment details are allowed only through support by submitting a statement of the requested amendments sent to the Service Provider’s email from the contacts specified in the Request, and, if necessary, with confirmation of identity/ownership of the details.

12.5. Exchange to third-party details is prohibited unless otherwise expressly provided for by the direction’s terms and/or duly confirmed.

13. Disclosure to Competent Authorities

13.1. The Service Provider may provide information to competent authorities where there are lawful grounds/requests, as well as to administrators of settlement systems within their rules.

14. Right to Refuse Service

14.1. The Service Provider may refuse to enter into the agreement and/or execute a Request, including for risk management, inability to execute, suspicion of fraud, and within AML/KYC/SoF, provided this does not contradict applicable law.

14.2. If funds have been received by the Service Provider, refund/settlement is carried out under Section 8 and/or the AML Policy (Section 2).

15. Force Majeure

15.1. In case of force majeure circumstances, execution deadlines are extended for the duration of such circumstances; the parties are released from liability for the force majeure period.

16. Claims and Disputes

16.1. Claims are accepted via the support email indicating the Request number and the essence of the claim.

16.2. Claim review period: up to 7 business days (unless a different period is established by applicable law).

17. Personal Data

17.1. Processing and storage of personal data is carried out in accordance with the Personal Data Processing and Storage Policy (Document 2) published on the website.

17.2. By providing data and documents, the Customer confirms consent to processing to the extent necessary to execute the Request and comply with AML/KYC/SoF.

18. Final Provisions

18.1. The Service Provider may amend these Rules by publishing a new version on the website. The new version applies to Requests created after publication, unless expressly stated otherwise.

18.2. For matters not regulated, the parties shall be guided by the Request terms, the rules of the relevant systems, and applicable law.

Document 1 — Section 2. AML/KYC/SoF Policy

1. General Provisions

1.1. The purpose of this policy is to prevent the service from being used for money laundering, fraud and other illegal transactions; to manage risks and protect users/the service.

1.2. This policy applies to all service operations and is binding on all users.

2. AML Screening and the Analyzer Used

2.1. All incoming transactions and crypto addresses provided by the user are subject to AML screening.

2.2. AML analyzer: the Service Provider is entitled to use several AML analyzers, including GetBlock and Rapira AML. The Service Provider may also rely on its own blockchain analysis to identify links with platforms that are not recommended for cooperation.

2.3. AML analysis results are used to make decisions on transactions (execute/suspend/refuse/refund).

3. Risk Score Model and Thresholds

3.1. Based on AML analytics data, a Risk Score model is applied, including risk levels and/or a numeric Risk Score value.

3.2. Temporary hold threshold: if Risk Score ≥ 60%, the Service Provider may temporarily suspend execution of the Request (AML freeze) for AML control and to conduct KYC/SoF.

3.3. Certain risk categories/tags (e.g., sanctions, stolen funds, mixers, darknet sources, etc.) may serve as independent grounds for suspension regardless of the overall Risk Score within the service’s risk model.

4. Risk-Based Approach

4.1. The Service Provider applies a risk-based approach when providing services and assesses transaction and customer risks taking into account a combination of factors, including (but not limited to):

• a) AML analytics results (including Risk Score), typologies and risk tags;
• b) source of incoming funds/counterparties/intermediary services;
• c) behavioural and operational indicators (frequency, volumes, splitting, inconsistency with profile);
• d) other factors defined by the Service Provider’s internal risk management procedures.

4.2. Depending on the risk level, the Service Provider may apply the following measures:

• a) standard due diligence;
• b) enhanced due diligence (Enhanced Due Diligence), including requesting additional KYC/SoF documents, confirming ownership of address(es), confirming source of funds, enhanced monitoring;
• c) temporary suspension of Request execution (AML Hold);
• d) refusal to execute the Request and/or refusal to provide service, provided that this does not contradict applicable law and/or where there are compliance grounds.

4.3. The Service Provider may restrict access to the service and/or suspend/refuse to execute transactions if they are directly or indirectly related to entities whose activities are prohibited/restricted or designated as undesirable in the territory of the Russian Federation, or with respect to which decisions of competent state authorities of the Russian Federation have been published, as well as where other lawful grounds/restrictions exist.

5. Entities Designated as Undesirable and Related Transactions

5.1. As part of implementing the risk-based approach, the Service Provider does not provide services for (and/or may suspend, restrict, refuse to execute) transactions related to platforms/structures whose activities are designated as undesirable in the territory of the Russian Federation, as well as transactions showing signs of involvement of such platforms/structures (including receipts/transfers through related services, addresses, infrastructure).

5.2. According to information published by the Prosecutor General’s Office of the Russian Federation, a decision has been made to designate the activities of the WhiteBit cryptocurrency exchange, as well as the structure of its affiliated and subsidiary organizations W Group, as undesirable in the territory of the Russian Federation.

5.3. If a connection between a Request/receipt of funds/provided address and the entities specified in cl. 5.2 is identified, the Service Provider may:

• a) suspend execution of the Request (AML Hold);
• b) request from the Customer documents and information within KYC/SoF;
• c) decide to refuse execution and process a refund in accordance with the “Refunds for AML Cases” section of this Policy.

5.4. The list of entities/platforms falling under cl. 5.1 may be updated by the Service Provider based on official publications of competent authorities and other lawful sources. Updates apply from the moment the relevant information/updated version of the Policy is published on the website.

6. Procedure in the Event of an AML Freeze

6.1. When an AML trigger is activated, the Request is moved to review status and execution is suspended.

6.2. The Customer is sent a request to provide KYC/SoF documents/information.

6.3. Until the review is completed, the funds/payout may be delayed.

7. List of Requested Materials (KYC/SoF)

The Service Provider may request (to the extent necessary for the specific case):

• 7.1. An identity document (passport/ID, etc.).
• 7.2. A selfie with the document and the Request number/website page.
• 7.3. Video confirmation of the transaction/payment (unedited): logging into the bank/exchange/wallet application, showing the transaction/history, amount, date, details/addresses and txid/hash, if available.
• 7.4. Confirmation of ownership of the refund address.
• 7.5. Confirmation of the source of funds (SoF/SoW): statements, exchange transaction history, income/trade documents, etc.

8. Review Stages and Estimated Timeframes

8.1. Initial review — up to approximately 24 hours after receiving the complete set of documents.

8.2. Enhanced review — up to approximately 10 business days.

8.3. The timeframe may be extended if clarifications/additional data are required or due to external restrictions (e.g., a block with a counterparty/provider).

9. Decisions Following the Review

Following AML/KYC/SoF, the Service Provider makes a decision to:

• 9.1. Execute the Request;
• 9.2. Refuse service and issue a refund;
• 9.3. Hold the funds until mandatory procedures are completed, where required by applicable law/lawful request.

10. Terms and Timeframes for Refunds in AML Cases

10.1. If execution of a Request is refused, the refund is made to the sender’s address/details or to the Customer’s confirmed refund address.

10.2. Refund dispatch timeframe: up to approximately 24 hours after the decision (plus confirmation/processing time).

10.3. AML-case refund fee: up to 5% of the held amount, but not more than USD 100 equivalent, plus the network/transfer fee.

10.4. Bona fide customers: if, following KYC/SoF, the link of the funds to laundering/criminal activity is not confirmed, deductions are limited to the network fee only.

11. Failure to Provide Documents

11.1. If the requested documents are refused/not provided on time, the Service Provider may refuse service and issue a refund under the terms of Section 8.

Document 2. Personal Data Processing Policy

1. General Provisions

1.1. This Policy defines the procedure for processing and storing the personal data of service users.

1.2. This Policy applies to all personal data obtained through the website, support, as well as within AML/KYC/SoF.

2. What Data Is Processed

2.1. Data provided when creating a Request: contact details (email/phone if necessary), receipt/payout details, Request parameters, transaction data (addresses, txid/hashes, amounts), service technical data (IP, time, cookies — if applicable).

2.2. Data provided within AML/KYC/SoF: identification documents, selfie/video, confirmation of address/wallet ownership, documents confirming the source of funds, and other information upon request.

3. Purposes of Processing

3.1. Execution of Requests and provision of the service’s services.

3.2. Ensuring security, preventing fraud, carrying out AML/KYC/SoF.

3.3. Responding to support requests, resolving disputes and claims.

3.4. Complying with lawful requests from competent authorities (where grounds exist).

4. Processing Principles

4.1. Only data necessary for the stated purposes is processed.

4.2. Access to data is granted only to authorized employees/contractors on a need-to-know basis.

5. Storage and Retention Periods

5.1. Request data and correspondence are stored for 5 years, or for another period necessary for processing purposes and/or established by applicable law.

5.2. KYC/SoF materials are stored for 5 years, or for another period necessary for compliance purposes and to protect the rights/interests of the service.

5.3. Upon expiry of the retention periods, data is deleted or anonymized, unless otherwise required by applicable law.

6. Transfer of Data to Third Parties

6.1. Data may be transferred to:

• an AML provider (for AML analytics/risk assessment);
• payment partners/banks/infrastructure providers (to execute Requests);
• competent authorities — where lawful grounds exist.

6.2. Transfer is carried out to the minimum extent necessary and with appropriate protection measures.

7. Data Security Measures

7.1. Organizational measures: access regulations, staff training, action logging, NDAs/access policies.

7.2. Technical measures: secure storage, access restrictions, backups, integrity control, segmentation of access to KYC materials.

7.3. Storage of KYC/SoF materials is organized within a protected environment with restricted access.

8. User Rights

8.1. The user may submit a request for access/correction of data, as well as other requests within the limits allowed by applicable law and AML/KYC/SoF obligations.

8.2. Requests are sent to the contact specified in the contact information section, with identification of the Request/user.

9. Cookies and Technical Data

9.1. The service may use cookies and technical logs for website functionality and security. The user may restrict cookies in browser settings (some functionality may be lost).

10. Final Provisions

10.1. This Policy may be updated by publishing a new version on the website.

10.2. Questions regarding personal data processing should be sent to the contact specified in the contact information section.