ANTI-MONEY LAUNDERING AND COUNTERING FINANCING OF TERRORISM, PROLIFERATION OF WEAPONS OF MASS DESTRUCTION, AND ABUSIVE PRACTICES

(AML/CFT)

PAGSEGURO INTERNET INSTITUIÇÃO DE PAGAMENTO S.A

Revision and Update Period

This Policy is effective for two (2) years as of the date of the last revision written on the chart at the end hereof. It shall be revised and updated before it expires, in case of changes in the applicable legislation and/or strategic management of PagSeguro Conglomerate.

1.             INTRODUCTION AND OBJECTIVE

This Anti-Money Laundering And Countering Financing Of Terrorism, Proliferation Of Weapons Of Mass Destruction and to Abusive Practices Policy ("AML/CFT" or "Policy") of PagSeguro Internet Instituição de Pagamento S.A. ("PagSeguro"), the leading institution of the Prudential Conglomerate, BancoSeguro S.A. ("BancoSeguro"), PagInvest Corretora de Títulos e Valores Mobiliários Ltda. ("PagInvest") and Wirecard Brazil Instituição de Pagamento S.A. ("MOIP"), was drawn up based on current legislation and best market practices, with the main objectives of establishing guidelines to prevent the involvement of the Conglomerate's companies in activities and transactions aimed at the laundering or concealment of assets, rights, and values, financing terrorism, proliferation of weapons of mass destruction and possible abusive practices related to investment market manipulation, in addition to ensuring that all professionals who provide services to the Conglomerate, suppliers, related companies, partners and relevant service providers are aware of the rules set out in this Policy and be able to apply the appropriate AML/CFT procedures in favor of the PagSeguro Conglomerate.

2.             SCOPE

This Policy covers the interactions and all stages of the relationship between the areas of the PagSeguro Conglomerate and its clients within the AML/CFT Program, and applies to all professionals, regardless of whether they are structured in physical or virtual units and/or forms of access, whether local or remote. This document also applies to its suppliers, related companies, partners, and relevant service providers.

3.             DEFINITIONS

IRA - Internal Risk Assessment: An assessment that makes it possible to identify, analyze, understand, and classify institutions' money laundering risks, focusing on mitigating risks related to critical products and/or processes.

RBA - Risk-Based Approach: A methodology that allows anti-money laundering and counter- terrorist financing (AML/CTF) measures to be applied in proportion to the nature of the risks, to make the implemented procedures more efficient.

Registration: The process of accrediting clients must comply with the requirements established by the applicable internal policies.

Professional: The term refers to all employees, statutory directors, trainees, and/or third parties who provide services to the PagSeguro Conglomerate.

AML/CFT Forum: Forum for Preventing and Combating Money Laundering and Terrorist Financing, on an ordinary basis, at least once a month, to approve rules, procedures, measures, and guidelines related to preventing and combating money laundering, as well as analyze and deciding on the reporting of atypical situations to regulatory and decisions about customer relationship bodies.

AML/CFT Head: The Director responsible for complying with the obligations established by the rules about AML/CFT issues.

PEP: Acronym for Politically Exposed Person, it is any person who holds or has held (applied for the five years following the end of the term of office), in Brazil or abroad, to any relevant public

position, employment or function or if they have, in these conditions, family members, representatives, close collaborators or even people in their close relationship, as defined by BACEN Circular 3.978/20 and in CVM Resolution 50/21;

Money laundering (“ML”): Law No. 9.613/98 defines the crime of money laundering as the concealment or disguise of the nature, origin, location, disposition, movement, or ownership of assets, rights, or values derived, directly or indirectly, from a criminal offense.

Terrorist financing: Terrorist financing can be understood as "the financing for terrorist acts and /or terrorist organizations".

Weapons proliferation: The reproduction of weapons capable of causing a massive number of deaths in a sole use. This designation is given to nuclear, chemical, biological, and radiological weapons.

Abusive Practices: According to CVM Resolution 62/22, abusive practices are defined as attempts to circumvent the securities market by creating artificial conditions of demand, supply, or price of securities, price manipulation, fraudulent operations, and the use of unfair practices. KYC - Know Your Customer: Process used to identify, classify, and qualify customers.

CVM (Brazilian Securities and Exchange Commission): Entity linked to the Ministry of Economy to supervise, regulate, discipline, and develop the securities market in Brazil.

BACEN (Central Bank of Brazil): The Central Bank is an autonomous body of a special nature, created by Law No. 4,595/1964 and with autonomy established by Complementary Law No. 179/2021. Its mission is to guarantee the stability of the purchasing power of the currency, to ensure a solid, efficient, competitive, financial system, and to promote the economic well-being of society.

4.  GUIDELINES

• Ensuring that the company's activities are in line with current legislation and regulations regarding the prevention of money laundering, the financing of terrorism, and the proliferation of weapons of mass destruction, as well as the prevention of abusive practices, including maintaining the internal regulations duly updated.

• Conduct prior analysis of new products and services to prevent their use for illicit or improper practices, considering the structure and purpose of the product or service, the risks of distribution channels and trading environments, and the application of traceability of resources and counterparties for proper monitoring of transactions.

• Maintaining analysis procedures and controls for hiring and monitoring professionals, clients, service providers, partners, and suppliers, including adopting restrictive measures regarding doing business and maintaining relationships if circumstances are found that may show suspicion of involvement in illegal acts or of dubious reputation.

Failure to provide or register the information required for onboarding should prevent the start of commercial relationships with companies in the Conglomerate.

• Draw up a Risk-Based Approach (RBA) document, the basis for classifying professionals,

clients, service providers, partners, suppliers, distribution channels, and the trading environment into low, moderate, high, critical, and extreme risk levels.

• Based on the analysis of professionals, clients, service providers, partners, and suppliers, greater diligence should be exercised to monitor those with high or greater risk identified according to the framework of the Company's current risk-based approach (ABR), including those identified as politically exposed persons or related to them.

• Ensuring the implementation and management of a robust process for monitoring and selecting transactions, considering as a minimum the parameters established in current legislation, through secure and targeted procedures for identifying suspicious or atypical transactions, including enhanced due diligence for clients with a risk rating of high or higher.

• Cooperate with the competent national and international bodies, where appropriate, by reporting suspicious or atypical transactions arising from the monitoring process.

• Do not maintain relationships with Trust and Shell Bank companies or any client where it is not possible to guarantee the proper identification of the final beneficiaries.

• Provide updated training, at most every two years, on this policy to all professionals and relevant service providers hired by the company, through courses or acculturation actions, including ensuring that the team responsible for carrying out the activities that support the theme undergoes continuous recycling and can identify the mechanisms used by criminals to benefit from the products provided by institutions of the financial system to carry out illegal

• Provide training for service providers, partners, and suppliers in the scope of this policy so that they are aligned with the PagSeguro Conglomerate's principles and guidelines.

• Keeping the internal risk assessment duly updated by the deadline set by current legislation or as soon as there is a meaningful change in the risk profiles considered for measuring risk.

• Elect an AML/CFT Forum for deliberations that, due to their critical nature, are escalated to a higher level.

• Set up a Negative Media Forum to deliberate on clients with relevant adverse news or processes, regardless of the movement presented.

• Manage complaints received via the internal complaints channel, guaranteeing confidentiality and anonymity when so requested by the complainant.
• Keep a file, for at least 10 (ten) years of all supporting documentation related to the

analyses carried out on customers, suppliers, partners, or employees, as well as records of the monitoring of operations with evidence of money laundering and/or financing of the terrorism, including resolutions, if any, counted from the conclusion of the case.

5.  RESPONSIBILITIES AND ATTRIBUTIONS

All professionals are obliged to know, understand, and apply the guidelines given by this policy within the scope of their functions and responsibilities to protect the PagSeguro Conglomerate from the use of its products and services for illicit activities, especially the areas, and positions indicated below, due to having direct responsibilities assigned either by regulation or by the AML/CFT Program adopted by the Conglomerate:

5.1  Internal Controls area

1. Periodically review the controls of the AML/CFT area to verify compliance with current legislation, supplementary regulations, policies, guidelines, and internal procedures.
2. Evaluate with the R&D team the integrity of the process and stored
3. Prepare an annual effectiveness report covering, at least, but in a limited way, the procedures, inquiries, and records required by the legislation in force; - and
4. Conduct registration tests following current

The conclusions, recommendations, and manifestations contained in this Report must be submitted to PagSeguro's AML/CFT Head and presented by him to the Corporate Governance Committee.

5.2  Registration areas - customer accreditation

These areas are responsible for implementing, guaranteeing, and monitoring compliance, as a minimum, but not limited to:

1. Establish a flow for the complete identification of shareholders in the case of legal entity clients to ensure that 100% of the final beneficiaries, representatives, or attorneys-in-fact are covered, except clients set up as public companies, non-profit entities, cooperatives, investment funds and clubs, provided that the cumulation rules given by Bacen Resolution 119 are complied with, for which the information collected must include the information of the natural persons authorized to represent them, including their controllers, administrators and directors;
2. Automatically screening PEP lists of all customers who go through the registration process to start a relationship, as well as their shareholders, where applicable, keeping a record of the results in the internal system.
3. Automatically screening against sanctions lists of all customers who go through the onboarding process to start a relationship, as well as their shareholders, where applicable, including restricting their transactions in the event of a positive result.
4. Maintain a registration update routine in line with the applicable legislation in force and/or those established internally by the areas responsible and with the appropriate periodicity.

1. For clients who choose to use investment products, the area responsible for formalizing their registration on this front must also conduct an additional search for negative media or legal proceedings that may discredit them.

5.3  Operations Area - Fraud Prevention

1. Maintaining the effectiveness of the process of requesting information, identifying and qualifying the client within the registration flow for the start of the relationship, analyzing the legitimacy of the documentation presented, directing to the Fraud Prevention - Operations areas and to the AML/CFT area the cases with suspicion of providing incorrect data, suspicion of fraud, with indications or suspicions of involvement in money laundering, terrorist financing and/or other directly related matters.
2. Monitor, identify, and block clients and/or operations, means of payment, and access when fraud is found or suspected, conducting a critical analysis, including assessing possible conniving -from the client.

4. Report cases that fall within the scope of Circular Letter 4.001 of the Central Bank of Brazil for further analysis by the AML/CFT area, which will then assess the need to report them to

5.4  Human Resources (HR) area

1. Conduct screening of PEP (Politically Exposed Persons) and sanctions lists for all professionals at the time of hiring.
2. Screening the data of 100% of the active professionals on the PEP and Sanctions lists monthly for continuous monitoring purposes.
3. In case of a positive finding, notify the AML/CFT Team so that further analysis can be conducted, and the proper measures are taken.

5.5  Compliance area

1. Submit this Policy for approval by the Director
2. Facilitate demands from regulatory bodies, providing support to the relevant areas for their accurate and timely response.
3. Supporting the areas in understanding and applying current legislation, ensuring that processes are compliant.

5.6  Commercial area

1. It must maintain a comprehensive understanding of the clients in its portfolios, acting preventively regarding operations and/or situations that exhibit indications of being directly or indirectly related to Money Laundering and Terrorism Financing (ML/TF) crimes.
2. Be aware that establishing or maintaining a relationship with a merchant must always be guided by the perspective of transparency and fairness in their activities, within the 'Know Your Customer' concept, and not solely by the commercial interest and/or profitability that this merchant may offer.

1. Report to the AML/CFT area any undue positioning of the client or atypicality found in their transactions.

5.7  Statutory Director Responsible for Client Accreditation

1. Implement, review, and approve Policies that ensure rules, principles, and guidelines for Know Your Customer ("KYC") processes and the complementary legislation and regulations applicable to the National Financial System's Customer Register.
2. Implement and supervise the process of updating customer registration information, by conducting registration verification tests in compliance with the requirements of current legislation, to ensure that customer registration data is proper.
3. To keep all record-keeping documentation relating to closed registrations for the period determined by current legislation.

5.8  Prevention of Money Laundering and Terrorist Financing Area

1. Drawing up, reviewing, and applying the policies, procedures, routines, and controls that ensure that BancoSeguro complies with the Legislation and regulations in force and with the internal guidelines applicable to AML/CFT and abusive practices.
2. Complying with the monitoring of operations to identify transactions with signs of suspicious activity in the field of money laundering, terrorist financing, the proliferation of weapons of mass destruction, or abusive practices, establishing enhanced due diligence for those with special attention due to high risk about money laundering, including PEP clients or those related to them.
3. Signal to the AML/CFT Forum all matters of relevance and submit atypical clients and/or operations or those that show signs of irregularity for evaluation and deliberations about communication to the regulator and continuation of the business relationship.
4. Reporting to COAF, when necessary, operations and clients with indications of money laundering and/or terrorist financing, following regulatory guidelines. Suspicious transactions must be reported within one (1) business day of the decision.
5. To accomplish the communications established in the sanctions resolutions of the United Nations Security Council (UNSC) when the client is identified on the sanction’s lists, ensuring the immediate blocking of assets and attempts to transfer them related to natural persons, legal entities, or sanctioned entities, following Law 13.810/19 and COAF Resolution No. 31 of June
6. Reporting to COAF and/or CVM, when applicable, the non-occurrence, in the previous calendar year, of situations, operations, or proposed operations that may be communicated, in compliance with the information and deadlines established by current legislation.
7. To put in place routine procedures and analysis criteria for initiating relationships and monitoring professionals, clients, service providers, partners, and suppliers. As with the transaction monitoring process, any atypicality found should be reported to the AML/CFT Forum for deliberation.
8. Ensure the monitoring and selection of operations for monitoring within a maximum period of 45 days from the date of occurrence of the transaction or situation and conduct the appropriate analysis of alerts within 45 days of the date of selection.

1. To record-keeping and analyze reports for the period established in current regulations of the analyses, monitoring, and reports conducted for the minimum period established in
2. Ensure that all the company's professionals undergo training at the appropriate intervals and with the appropriate content.
3. Analyze and follow up on reports received regarding suspicious behavior by customers, suppliers, business partners, and employees themselves, made by third parties via the AML/CFT Whistleblower Channel.

5.9.  BancoSeguro Board of Directors

The Board of Directors is the sponsor of this Policy, thus guaranteeing senior management's commitment to the effectiveness and continuous improvement of the policy, procedures, and internal controls related to the prevention of money laundering terrorist financing, and abusive practices.

It is also up to these Directors to determine institutional guidelines based on the values and principles established in this Policy, the internal control rules, the rules issued by regulatory and self-regulatory bodies and entities, as well as applicable best practices.

5.10.  Internal Audit

It is the area's responsibility to review and evaluate the implementation and controls of the AML/CFT Policy to ensure its effectiveness and compliance, including: (i) the definition of processes, tests, and audit trails; (ii) the definition of appropriate metrics and indicators; and

(iii) the identification and correction of any deficiencies.

5.11.  Statutory Officer Responsible for AML/CFT Duties

1. Ensure the implementation of procedures that guarantee the adherence of products and services to the legislation and regulations in force and applicable to AML/CFT and related practices, in addition to those established by internal policies.
2. Ensure that the company maintains an adequate workforce to support the AML/CFT
3. Respond to the competent bodies for reports of situations with signs of money laundering or terrorist financing.
4. Follow up on AML/CFT monitoring indicators, effectiveness reports, and improvement plans, as well as evaluate any communications made to regulatory bodies during the period.
5. Validate and approve the Internal Risk
6. Implement and ensure the observance of this

5.12.  Technology Information area

1. Ensure that the Conglomerate's systems are working properly, including resolving any faults in the shortest possible response time.
2. Establish and control mechanisms for the exchange of information between areas to guarantee the security of the information transmitted.

1. Report to the AML/CFT, Compliance, Internal Controls, and Risks areas any problem or unavailability that prevents adequate compliance with the guidelines of this Policy.

5.13.  Professionals, service providers, and other areas

1. Maintain absolute secrecy, especially in a public place, regarding all information about a client, their proposals, operations, values, and/or communications made to regulatory bodies.
2. Participate in training programs provided by the Company that enable them to: i.Know the legislation and complementary rules applicable to AML/CFT.

ii.Identify situations considered uncommon, atypical, or suspicious. iii.Know the practices for applying proper KYC.

iv.Identify attempts to circumvent the internal controls and regulations in force applicable to AML/CFT.

1. Use the whistleblowing channel to report any atypical behavior or suspicious

Any of the aforementioned areas must report to the AML/CFT, Compliance or Internal Controls and Risks area any problem or unavailability that prevents proper compliance with the guidelines covered in this Policy.

6.  QUESTIONS

Any questions about the content of this Policy or any situations that may involve suspicions of LD/FT should be forwarded to the Prevention and Combating of Money Laundering and Terrorist Financing and Abusive Practices department, via e-mail to pld_pagseguro@uolinc.com.

7.  FINAL CONSIDERATIONS

This Policy was approved by the PagSeguro Board of Directors at a meeting held on May 5, 2023.

8.  LEGAL SUPPORT

Law No. 9.613/98: Provides for the crimes of "laundering" or concealment of assets, rights, and values, and the prevention of using the financial system for illicit acts and creates the COAF. Law No. 12.683/12: Amend Law No. 9.613/98 to make the prosecution of money laundering crimes more efficient.

Law No. 12.846/13: Anti-Corruption Law.

Law No. 13.260/16: Regulates the provisions of item XLIII of Art. 5 of the Federal Constitution, disciplining terrorism, dealing with investigative and procedural provisions, and reformulating the concept of terrorist organization.

Law No. 13.810/19: Provides, among other things, for compliance with sanctions imposed by United Nations Security Council resolutions, including the unavailability of assets.

Circular No. 3,978/20: Provides for the policy, procedures, and internal controls to be adopted by institutions authorized to operate by the Central Bank of Brazil to prevent the use of the financial system to commit the crimes of "laundering" or concealment of assets, rights, and values, dealt with in Law No. 9,613, of March 3, 1998, and terrorist financing, provided for in Law No. 13,260, of March 16, 2016.

Circular Letter No. 3,977/19: Provides for operational aspects of the procedures established in Circular Letter No. 3,942/19, for the implementation of measures determined by Law No. 13,810/19.

Circular Letter No. 4,001/20: Discloses a list of operations and situations that may constitute evidence of the crimes of "laundering" or concealment of assets, rights, and values, referred to in Law No. 9,613, of March 3, 1998, and terrorist financing, provided for in Law No. 13,260, of March 16, 2016, which may be reported to the Financial Activities Control Council (Coaf).

CVM Resolution No. 50/21: Provides for the prevention of money laundering, the financing of terrorism, and the financing of the proliferation of weapons of mass destruction – AML/CFT within the scope of the securities market.

CVM Resolution No. 62/22: Prohibits the practice of creating artificial conditions for the demand, supply, or price of securities, price manipulation, fraudulent transactions, and the use of unfair practices.

9. CONTROL AND CHANGES

PAGSEGURO INTERNET INSTITUIÇÃO DE PAGAMENTO S.A. - AML/CFT AND COMPLIANCE