KAST Brazil Terms and Conditions of Service

Regional Addendum to Global Platform Terms

Last Updated: 17 September 2026

You (“User” or “Client”) agree that these terms and conditions (“Terms”) regulate your access to and use of the Services. The terms “KAST”, “Company,” “we,” “us” and “our” refer to KAST Prestadora de Serviços de Ativos Virtuais Ltda., a limited liability company incorporated in Brazil, registered with the Brazilian National Registry of Legal Entities (CNPJ) under No. 68.675.443/0001-16, with its registered office at Avenida Brigadeiro Faria Lima, nº 1.461, Torre Sul, 4º andar, conjunto 41, Letra A, Caixa Postal 266, Jardim Paulistano, São Paulo/SP, CEP 01452-921. These Terms govern your access to and use of the KAST website, mobile applications, web applications, and all related products and services (collectively, the “Services”).

The term “Card Issuer” refers to, where applicable, (a) Third National located at 73 Avenida Ponce de León, Estudio 6, San Juan, Puerto Rico 00917, USA with Signify Holdings, Inc. (trading under the name of Rain), a Delaware Corporation located at 2810 N Church St, Suite 59466, Wilmington, Delaware 19802, acting as the programme manager and operational intermediary for cards that are issued internationally.

To access the Services and Platform, all Users must agree to the terms and conditions of the Terms and Privacy Policy. All use of the Services and Platform is subject to these Terms. By accessing or using our Service, including by clicking “I Consent”, “I Accept”, “Continue”, “Register” or any equivalent confirmation button, or by continuing to use the Platform after this feature is made available, you acknowledge that you have read, understood, and agreed to be bound by the Terms. Such actions shall constitute your valid and binding acceptance of these terms, with the same legal effect as a written agreement signed by you.

These Terms and, together with the Supplemental Terms (as updated by KAST from time to time), the Privacy Policy, form a single agreement between you and KAST (together, the “Agreement”). Each Supplemental Term applies only to the specific product, service or feature it identifies, is incorporated into this Agreement by this reference, and forms part of the Agreement as though set out in full herein. By accessing or using any product or service to which a Supplemental Term applies, you agree to that Supplemental Term. A complete list of Supplemental Terms is available here.

If a conflict exists between these Terms and a Supplemental Term, the Supplemental Term controls solely as to the product, service, or feature it governs. Except as set out in this clause, the order of precedence is: (a) the applicable Supplemental Term; (b) these General Terms; and (c) any other document incorporated by reference into the Agreement. This section governs interpretation only and does not create, expand, or waive any right or obligation.

If you do not agree to these Terms, you must not use or stop using the Services immediately.

IMPORTANT DISCLAIMER: THE COMPANY IS NOT A BANK. THE COMPANY IS A VIRTUAL ASSETS SERVICE PROVIDER. YOUR ACCOUNT IS NOT COVERED BY INSURANCE AGAINST LOSSES BY ANY DEPOSIT PROTECTION SCHEME OR OTHERWISE.

Risk Considerations

General Awareness. This segment discusses the inherent risks related to Virtual Assets and using the Services. It's not an exhaustive list, so you should carefully assess whether our Services align with your needs and circumstances.

Legal Considerations. The legal status of Virtual Assets varies significantly across jurisdictions. They might be prohibited or heavily regulated in certain areas, and you are solely responsible for understanding and adhering to any such laws at your own risk and expense. We do not endorse or take a stance on the legal status of any Virtual Assets. You are encouraged to conduct your own research and understand the legal implications of Virtual Assets. Your use of Virtual Assets through our Services is at your own risk, and you should be aware of and prepared to accept these risks.

Understanding Virtual Assets Risks. The value of Virtual Assets may experience extreme volatility and there is a possibility they might become valueless in the future. Trading, swapping or holding Virtual Assets involves substantial risks, including potential severe losses. Valuing them can be challenging due to unpredictable trading patterns and unclear fundamentals. You should carefully consider if trading, swapping or holding Virtual Assets aligns with your financial situation and risk tolerance. Given the inherent risks in Virtual Assets markets and the influence of technological and international market factors, the Company cannot assure the ongoing availability of any particular Virtual Assets as part of the Services. The Company retains the right to discontinue offering trades in certain Virtual Assets, as notified to the User in accordance with these Terms.

Insolvency and funds risks.

1. Individualized payment accounts. Where your fiat currency funds are held in individualized payment or deposit accounts maintained in your name, pursuant to applicable Brazilian Central Bank regulations (Resolution BCB No. 520/2025, Article 28), such funds are segregated from the Company's own assets. These accounts are through financial institutions authorized to operate by the BCB. Because your funds are held in individualized accounts subject to prudential regulation, they do not form part of the Company's estate in the event of insolvency, bankruptcy, liquidation, or regulatory intervention. The insolvency risk to you in respect of your fiat currency balances is therefore very low.
2. Custodied Virtual Assets. Where your Virtual Assets are held under KAST's custody, the Company is required to maintain your Virtual Assets separate from its own Virtual Assets. The Company is further prohibited from using your Virtual Assets to conduct proprietary operations, except in limited regulated circumstances (such as staking with your express consent). Notwithstanding these segregation requirements, your Virtual Assets remain under the Company's operational custody and are not held in individualized accounts at a separate regulated institution. In the event of the Company's insolvency, bankruptcy, liquidation, cessation of operations, or regulatory intervention, you may rank as an unsecured creditor of the Company and may recover little or none of the Virtual Assets held in your account.
3. Self-custody wallet. Once you have activated Self-Custody Mode, your assets are held under your sole control in a non-custodial wallet, and KAST's insolvency, bankruptcy, liquidation, or cessation of operations does not affect your ownership or control of your assets. You are not a creditor of KAST in respect of those assets, and no insolvency proceeding against the Company creates any claim over or impediment to your on-chain holdings. Your continued access to your Account Value depends solely on your retention of your private keys and recovery credentials, not on KAST's continued operation.
4. Absence of Guarantee Fund Coverage. Virtual assets held on the Platform are not covered by: (a) the Credit Guarantee Fund (Fundo Garantidor de Créditos — FGC); (b) the Credit Cooperative Guarantee Fund (Fundo Garantidor do Cooperativismo de Crédito — FGCoop); or (c) any analogous guarantee fund applicable to the virtual asset market
5. Nature of Virtual Assets in Brazil. The User acknowledges that virtual assets do not constitute bank deposits or electronic money (moeda eletrônica). Accordingly, the holding of virtual assets on the Platform does not give rise to any deposit or payment account relationship between the Client and the Company.

1. Onboarding

1.1 Registration. To use the Services available through our Platform, registration is necessary and the payment of a subscription-based account might be applied depending on the Service at the discretion of the Company. Once registered and approved, you'll receive an account allowing you access to our Platform (“Account”), which will allow you to purchase, sell or trade virtual assets. We may, at our sole discretion, refuse to open an Account, authorize the Account activation, suspend, and even close it. By agreeing to these Terms, you confirm both the entity's and your compliance with these conditions.

1.1.1 To create your Account, you will be required to provide the following information: (a) full legal name; (b) individual taxpayer registration number (Cadastro de Pessoas Físicas — CPF); (c) residential address; (d) phone number; and (e) a password of your choosing.

1.2 Eligibility. Use of the Services is contingent upon:

• Your capacity to enter into legally binding contracts, being of legal age to enter legal contracts or representing a legally constituted entity.
• Residency or domicile in Brazil.
• No history of suspension or removal from our Services.
• Authority and non-violation of any other agreements by agreeing to these Terms.
• Not being listed on any sanctions list applicable in Brazil, including but not limited to the sanctions lists maintained by the UN Security Council, the OFAC, the European Union, and any list issued by Brazilian competent authorities under Law No. 13,810/2019;
• Not on any denied persons lists.
• You do not have an existing account with us (under the same or different name).
• Not being under any legal restriction that prevents you from using the Services.
• Complying with all local, national, and international laws applicable to you regarding the use of the Services. Having provided all information and documentation required under the Company's KYC procedures.
• Not being a politically exposed person (PEP) as defined by BCB Circular No. 3,978/2020 without express identification and enhanced due diligence procedures.

1.3 Regulatory and Legal Restrictions. Where a restriction is required by applicable law, sanctions regulation, or order of a competent authority, the Company may implement the restriction immediately and without advance notice. In such cases, the Company will notify affected Users as soon as it is legally permitted to do so and will provide reasonable assistance to enable withdrawal of available balances, subject to applicable legal constraints.

1.4 Identification. To utilize certain Services, you need to create and maintain an Account. Access to the Platform is subject to identification, verification, and screening (“KYC”) following the Anti-money laundering and counter-terrorist financing standard issued by the BCB (“AML/CFT”). Depending on the outcome, additional information might be requested continually. Access to or use of the Services may be denied if you do not provide necessary identity proofs or if the documents provided do not satisfy the Company or Partner's criteria. You must ensure that your information is accurate, complete, and up to date. Failure to do so may lead to restricted access to the Platform or termination of these Terms by the Company. You are allowed only one Account at a time.

1.5 Account Confidentiality and Security. You are responsible for keeping your Account information, including your password, identification, and assets information confidential and overseeing all activities, Instructions and transactions that occur under your Account. You shall observe the following security measures at all times: (a) keep your Account credentials and authentication information secure and confidential; (b) maintain appropriate security measures on the devices you use to access the Services; (c) remain vigilant against phishing, fraud, and other unauthorized activities; (d) promptly notify the Company of any unauthorized access, security breach, loss, or theft affecting your Account, credentials, KAST Card, or devices; and (e) access the Services through secure connections and comply with the Company's security requirements and recommendations.

1.5.1 Should any unauthorized access or security breach occur, you must immediately notify the Company via the provided support channels, including (without limitation) in-app chat and email at support@kastcard.com. You are prohibited from allowing third parties to use your Account and are liable for all activities conducted through your Account, whether authorized or not. Unauthorized access attempts to the Services or aiding others in such activities will lead to the termination of your Account and possible legal action. You must only create and use an Account that is rightfully yours. You bear responsibility for the security and confidentiality of your Account.Any Instruction made with your credential and password, will be assumed to come from you without any obligation to process with further verification. Be aware that Instructions via the Platform, often transmitted over the Internet, are subject to risks like, but not limited unauthorized access. Receipt of Instructions under your login ID and password is confirmed only when we've retrieved and acknowledged them. If vulnerabilities are identified in the use of the Services and the Account by you that may compromise our security, such as the presence of viruses, malware or any other means with a malicious purpose, the Company may adopt preventive measures, such as: blocking access to the Account and Services without engaging its liability.

1.5.2 The Company shall implement the security measures required by applicable regulation, including access control, continuous monitoring, incident response and the private key protection policy set forth in these Terms. Liability for unauthorized transactions shall be determined in accordance with applicable law, including the responsibility of the Client for failures resulting from its own gross negligence in the safekeeping of credentials. The Client retains all rights of access to judicial and administrative review under Brazilian law.

2. Services

2.1 Right to Modify Services. The Company reserves the right to update, modify, suspend, disable, or restrict access to, or discontinue the Services, or any features, components, or content thereof at any time as follows:

2.1.1 Non-material changes. For routine updates, minor feature changes, bug fixes, security patches, and improvements that do not materially affect your use of the Services, the Company may make changes without prior notice. The Company will endeavour to notify Users via the Platform where practicable.

2.1.2 Material changes. For the purposes of this clause, a change is "material" if it (i) discontinues a core Service feature that you actively use, (ii) reduces functionality in a way that significantly impairs your ability to use the Services for their primary purpose, and/or (iii) removes access to the Services entirely. For material changes, the Company will provide not less than 14 days' prior written notice, except where:

• the change is required by applicable law, regulation, or order of a competent authority, in which case the Company will implement the change immediately and notify you as soon as reasonably practicable; or
• the change is necessary to address an urgent security vulnerability, prevent fraud, or protect the integrity of the Services, in which case the Company may act immediately and will provide retrospective notice as soon as reasonably practicable.

2.1.3 The Company does not guarantee that specific services, features, components, or content will always be available.

2.2 Scope of Services. The Company provides the following services under these Terms: (a) Intermediation of Virtual Assets, including the purchase, sale and exchange of Virtual Assets on behalf of the Client; (b) Custody of Virtual Assets, including the safekeeping and control of instruments of access and the maintenance of updated position records for Virtual Assets held on behalf of the Client by a Third-Party Custodian.

2.3 Partner Services. The Company's Services might provide access to various financial services including, but not limited to, on-ramp, off-ramp, card issuance, settlement, custody, and other financial services as might be the case from time to time. These said services are offered directly by General Partners or Relevant Service Providers (“RSP”) ("Partner Services''). It is important to note that Partner Services may necessitate separate registration, identity verification, and agreement processes. If a Partner provides different terms and conditions or a different policy for a specific site, application, or service, that particular policy will take precedence to the extent of any inconsistency with these Terms.

2.3.1 Relevant Service Providers. Certain parties engaged by the Company for the provision of the Services qualify as RSPs within the meaning of Articles 32 and 33 of BCB Resolution No. 520/2025. In connection with such engagements, the Company shall: (i) verify, prior to engagement and on an ongoing basis, each RSP's technical and operational capacity and compliance with applicable legislation and regulation; (ii) maintain robust recovery plans for your Virtual Assets and financial resources; (iii) establish, jointly with the RSP, internal controls enabling the monitoring and identification of sanctions lists; (iv) continuously monitor each RSP's performance and quality standards; (v) ensure that contracted RSPs act under the Company's directions and in accordance with applicable regulation; and (vi) promptly report to the BCB any breach by a RSP of applicable regulation.

2.3.2 The Company shall inform you, at the time of onboarding and through the Platform, of the RSPs involved in the Services, highlighting any engagements that may represent risks to you and indicating the mitigation measures adopted. Additional information regarding the Company's contracted RSPs is available on the Platform.

3. Third-Party Service

3.1 Certain services provided through the Platform (including but not limited to payment processing, digital asset custody, and settlement) are delivered by third-party service providers. By using such services, you acknowledge and agree that:

(a) such services are governed by the respective terms and conditions of the applicable third-party service providers; and

(b) you agree to be bound by the applicable third-party service providers’ terms and conditions, which may be presented to you directly or incorporated by reference.

4. Card Issuance and Pre-Authorization of Card Transactions

4.1 Card Issuance. The KAST Card, facilitated as part of the Card Issuance Services, is a payment card issued by the Card Issuer locally or abroad (as the case may be) that can be used at retailers, merchants, online websites accepting cards from the relevant Card Network. Additionally, it allows for cash withdrawals at ATMs (limited to physical card) provided they accept cards from the same network. The Company acts solely as a platform provider and introducer for the Card Issuance Services and is not the issuer of the KAST Card or a provider of credit. The Company is also responsible for selling and liquidating the Virtual Assets used to settle the transactions for onward settlement to the Card Issuer.

4.1.1 The Card Issuance Services, including the issuance, administration and processing of the KAST Card and the execution of Card Transactions through the applicable Card Network, are provided by the Card Issuer under its own regulatory authorisations and in accordance with the applicable Card Network Rules. The Card Issuance Services do not constitute intermediation, custody or any other form of virtual asset service within the meaning of BCB Resolution No. 520/2025. The Company's role in connection with the KAST Card is limited to: (a) acting as platform provider and introducer for the Card Issuance Services; and (b) facilitating the settlement of Card Transactions by converting and transferring Virtual Assets on the Client's behalf, as further described in clause 4.1.2 below.

4.1.2 When a Card Transaction is initiated using the KAST Card, the Company shall, pursuant to the Client's prior standing authorisation granted under these Terms, sell or convert the necessary amount of Virtual Assets held in the Client's Account and remit the corresponding amount in stablecoin to the applicable Card Issuer for settlement of the Card Transaction.

4.1.3 The respective responsibilities of the Company and the Card Issuer in connection with the KAST Card and Card Transactions are allocated as follows:

(a) the Company is responsible for: (i) the correct and timely conversion of Virtual Assets for settlement purposes, including any loss or delay arising from slippage, on-chain settlement failures, or errors in the conversion process; (ii) the accurate disclosure to the Client of the estimated Settlement Amount, applicable fees and exchange rates prior to confirmation of the Card Transaction; and (iii) the ongoing oversight of its contracted Partners involved in the settlement process; and

(b) the Card Issuer is responsible for: (i) the issuance, activation, administration and cancellation of the KAST Card; (ii) the authorisation, processing and execution of Card Transactions within the applicable Card Network; (iii) the handling of Chargebacks and Transaction Disputes in accordance with the Card Network Rules; and (iv) compliance with the regulatory requirements applicable to the Card Issuer in its jurisdiction of incorporation.

4.1.6 The settlement of Card Transactions involving international remittance constitutes an activity subject to foreign exchange market regulations in Brazil, including BCB Resolution No. 521/2025. In connection with such transactions, the Company shall comply with applicable information and reporting obligations before the BCB and obtain from the Client the information required for the classification and registration of the payment or transfer

4.1.7 Your Account is maintained exclusively for the purpose of the Virtual Asset services provided by the Company under these Terms, including the purchase, sale, exchange and custody of Virtual Assets. The Account is not linked to, and does not function as a payment account for, the KAST Card or any Card Transaction. Card Transactions are settled by the Company through international remittance arrangements with the applicable Card Issuer.

4.1.8 The Client acknowledges that: (a) the Account balance reflects the Client's Virtual Asset position and is not a card-linked spending balance; (b) the settlement of Card Transactions may involve the conversion and transfer of Virtual Assets by the Company on the Client's behalf, pursuant to the Client's prior standing authorisation under these Terms; and (c) the Card Issuance Services and the Virtual Asset intermediation and custody services are operationally distinct, notwithstanding that both are accessible through the Platform.

4.2 Pre-Authorisation of Card Transaction. When you make Card Transactions using your KAST Card, we will settle these transactions on the Card Network. You authorize the Company to temporarily freeze an amount in USD denominated stablecoin(or fiat equivalent) equal to the transaction cost and associated fees. This amount, referred to as the "Settlement Amount”, includes a fee as detailed on the Platform.

4.3 Card Limit. The use of your KAST Card, including the spending limit, maximum value for single transactions, and daily and monthly transaction limits, is subject to the Company-set card limits. The current applicable limits for your Account are displayed in the Platform at all times. The Company may modify these limits at its discretion without prior notice, except for limit reductions which require no less than 7 days’ written notice to the User, unless:

• the reduction is required by applicable law or a regulatory or compliance obligation, in which case the Company may reduce the limit immediately and will notify you as soon as it is permitted to do so; or
• the reduction is made in response to a specific Transaction on your Account that has triggered a compliance alert, in which case the Company may act immediately and will provide retrospective notice as soon as reasonably practicable.

4.3.1 Transactions exceeding limits in place at the relevant time will be declined. You are advised not to exceed the applicable card limits, as transactions surpassing these limits will be automatically rejected.

4.4 Activation. As a registered User, you can request a KAST Card from the Company which will liaise with the Card Issuer. The KAST Card is issued upon the Company's and the Card Issuer’s approval and must be activated via the process set out in the Platform, as may be updated from time to time. The Company and the Card Issuer retain the discretion to decline your card request or revoke an issued KAST Card at any time. To avoid doubt, you can still withdraw your available funds from the Platform in circumstances where your KAST Card is revoked.

4.5 Physical KAST Card. You recognize that the physical KAST Card is our property. You are responsible for its careful handling and use, ensuring it isn't tampered with, not allowing unauthorized use or sharing, avoiding intentional damage or defacement, and refraining from altering its appearance, including attaching anything or modifying its logos or designs.

4.6 KAST Card Validity and Renewal. Unless earlier terminated or canceled, each KAST Card is valid for a period set and shown on the Platform. Automatic renewal notices are sent via email one month before expiration if the card is used. A renewal fee, specified on the Platform, may be charged and debited from your Account Value or billed separately. The same Terms apply to the renewed card. To opt out of renewal, you may cancel at any time by written notice to the Company through the Platform or otherwise. Any cancellation will take effect after the expiry of the current term. The Company and Issuer have the right not to issue a new Card upon the expiry of the Card's validity or the User's application for a new KAST Card. If the User does not accept the KAST Card and/or the KAST Card is not activated within 3 months from the date of issuance of the KAST Card, the Company or Issuer has the right to close, deactivate and destroy the KAST Card without refunding any service charges. The User undertakes not to use the KAST Card and not to allow the KAST Card User to use an invalid, closed or otherwise unusable KAST Card, and to physically destroy it within 3 days after it became closed or invalid or unusable.

4.7 Responsibility and Liability for Card Transactions. As the holder of a KAST Card, you are responsible for ensuring that the card is used in compliance with all applicable laws and is not utilized for any illegal or prohibited activities. Liability for unauthorized, erroneous, or fraudulent Card Transactions shall be determined in accordance with applicable laws, regulations, and the specific terms and conditions provided by the Issuer. To the maximum extent permitted by Applicable Law, you remain liable for transactions resulting from your own gross negligence, willful misconduct, or fraud. You agree to immediately notify the Company and the Partner upon discovering any unauthorized use, loss, or theft of your KAST Card.

4.8 Confidentiality and Security of Card Data. You shall keep your KAST Card Data strictly confidential, only sharing it as necessary for transactions. You must exercise caution when providing Card Data to merchants to maintain its security. Sharing Card Data via unsecured methods, like email or fax, is not safe.

5. Card Transaction Disputes

5.1 Dispute Resolution and Chargeback. If you have any disputes about a Card Transaction or any issue related to our Services or Platform, or need to request a Chargeback (“Transaction Disputes”), contact us at support@kastcard.com promptly, no later than 90 days after the transaction date. We will assist in resolving the dispute or forward your request to the right Partner or relevant Card Network for processing. For dispute resolution or Chargeback requests, you must follow the Card Network Rules. This includes submitting a detailed written explanation, transaction receipts, and other necessary documentation as required by the Issuer or the Card Network. You acknowledge and accept that our Partners might apply a fee for the handling of a Chargeback at their discretion, as notified to you at the relevant time.

5.1.1 Other Complaints and Statutory Rights. For any dispute, complaint, or claim relating to the Services or the Platform that does not qualify as a Chargeback under the applicable Card Network Rules, you may contact us at support@kastcard.com at any time within the periods established under applicable law. Nothing in these Terms shall be construed as limiting or reducing the statutory limitation periods available to you under the Brazilian Consumer Protection Code (Law No. 8,078/1990), including the five-year term for claims arising from defective service or actionable harm (Article 27) and the applicable complaint periods for service defects (Article 26).

5.2 Investigation of Transaction Disputes. The Company and Issuer have the authority to investigate any Transaction Disputes. In the event of an investigation, either by the Company, Issuer or a competent authority, you shall cooperate by providing any additional information or documentation as requested. If an investigation reasonably concludes that a Transaction Dispute arose from your wilful default, fraud or negligence, or breach of these Terms, you authorize us to debit your Account Value for the disputed amount along with any associated charges and fees.

5.3 Non-Refundable Fees for Dispute Processing. You acknowledge and accept that any fees reasonably incurred by the Company, Partners or Card Network for processing Transaction Disputes or Chargeback requests, if such disputes or requests are determined to be unfounded, will be charged to the Account Value or billed to you separately, as notified to you at the time through the Platform.

5.4 Administration of Chargeback Requests. You acknowledge and agree that the processing of all Chargeback requests is strictly subject to, and governed by, the applicable Card Network Rules and Issuer guidelines. While the Company and its Partners will reasonably assist you in submitting valid claims, the final determination of any Chargeback lies solely with the relevant Card Network or Issuer, whose decision shall be binding under their respective network rules.

5.5 Limitation of Liability in Disputes and Chargebacks. The Company shall use commercially reasonable efforts to assist you in the resolution of any Chargeback request or Transaction Dispute submitted to a Card Network or Issuer. While the final decision on any Chargeback or Transaction Dispute rests with the applicable Card Network or Issuer, the Company remains responsible for the appropriate selection and ongoing oversight of its Partners and shall not be exempt from liability arising from acts or omissions of such Partners in connection with the processing or resolution of Chargebacks and Transaction Disputes, in accordance with applicable consumer protection law and BCB Resolution No. 520/2025.

6. Custodial Management of Virtual Assets

6.1 Nature of the Custody Service. The Company provides custody services in respect of the Virtual Assets deposited by you on the Platform. The custody of Virtual Assets comprises the safekeeping and control of the instruments enabling the exercise of rights and benefits related to such Virtual Assets (including private keys). The services provided by the Company also include the maintenance of up-to-date position records, the processing of instructions issued by you, and the treatment of events affecting the Virtual Assets.

6.2 Third-Party Custodianship. Where applicable, the Company provides custody services through one or more contracted custodians (each, a "Custodian"), which are engaged by the Company to hold and safeguard the Virtual Assets on your behalf. The Company acts as the intermediary of your interests vis-à-vis the Custodian and remains fully responsible before you for the custody services, regardless of whether such services are performed directly by the Company or through a contracted Custodian.

6.3 Segregation of Virtual Assets. Virtual assets deposited by you remain your property at all times and are held in wallets segregated from the Company's proprietary wallets, under the private key protection and security measures required by applicable regulation. The Company is responsible before you for the safekeeping and control of the custodied assets, including in cases of loss or damage resulting from negligence, incompetence, imprudence or willful misconduct. Where custody is performed through a contracted custodian in Brazil or abroad, the Company remains fully responsible for the service and shall ensure the custodian complies with applicable regulatory requirements, including patrimonial segregation, audit standards and, for foreign custodians, legal representation in Brazil, guarantees, supervisory access and cross-border effectiveness of asset segregation.

6.4 Key Management and Wallet Types. The Virtual Assets are maintained using the following custody model: a combination of cold, warm and hot wallet infrastructure, operated through institutional-grade custody and key-management providers, in which no single person or entity is able to unilaterally move Virtual Assets. Private keys, MPC key shares and other instruments of control are generated inside hardware security modules certified to FIPS 140-2 Level 3 (or higher) within isolated, air-gapped environments, and are never assembled or exposed in plaintext in any single location. Key material is split by secret-sharing techniques and distributed among authorised custodians under split-knowledge and dual-control rules, so that the signature of a transaction always requires the participation of multiple independent parties (multi-signature or multi-party computation). Access to signing infrastructure is subject to multi-factor authentication, role-based access controls, destination address whitelisting, transaction velocity limits and immutable audit logging. Key generation, rotation, recovery and destruction occur only through formal, recorded and independently witnessed ceremonies, and keys are rotated at pre-defined intervals and upon the occurrence of specified events. Key material used for each wallet tier is kept logically, physically and operationally segregated, and the instruments of control relating to the Company's own Virtual Assets are segregated from those relating to the Virtual Assets of clients

6.4.1 Where more than one safekeeping method or wallet allocation strategy is available, the Company shall inform you of the risks associated with each option, and your selection shall be documented.

6.4.2 Where only one safekeeping method is available, your acknowledgment of the associated risks shall be documented.

6.5 Custody Risks and Mitigation. You acknowledge that the custody of Virtual Assets involves the following risks, among others: (i) system risks related to the operation and security of the custodian's systems and platforms; (ii) market risks arising from the volatile nature of Virtual Assets and their fluctuating values; (iii) regulatory risks associated with changing regulations and legal compliance; (iv) security risks, including the potential loss or theft of Virtual Assets due to cyberattacks or breaches; and (v) operational risks arising from failures, errors, or disruptions. The Company maintains a risk mitigation procedures and shall inform you of the documented procedure.

6.6 Actions Solely Under Client Instruction or Benefit. All operations, transactions, and acts performed by the Company or the contracted custodian in relation to your Virtual Assets shall occur exclusively: (a) pursuant to instructions duly issued by you in accordance with these Terms; or (b) for the direct benefit of the Client. The Company is entitled to instruct the custodian to execute actions related to the Virtual Assets for settlement purposes, including freezing, converting, and transferring, solely as necessary to operate the Services, enforce these Terms, or comply with Applicable Law, and always in your interest.

6.7 Authority Over Custodian. The Company shall ensure that the contracted custodian acts under the Company's directions, in your interest, and in compliance with BCB Resolution No. 520/2025. The Company shall: (i) verify the custodian's technical and operational capacity and legal compliance prior to engagement; (ii) maintain robust recovery plans for your Virtual Assets and financial resources in case of incidents involving the custodian; (iii) continuously monitor the custodian's performance and quality standards; and (iv) promptly report to the BCB any breach by the custodian of applicable regulation.

6.8 Identification of Contracted Custodians and Third Parties. The Company shall inform you, at the time of onboarding and on an ongoing basis, of the identity of the custodian(s) engaged to provide custody services, including entities incorporated outside of Brazil, and the criteria observed in selecting such custodian(s). The Company shall promptly notify you of any new engagement or replacement of a custodian. As of the Effective Date, the following custodian(s) have been engaged BitGo Bank & Trust, National Association (contracted as BitGo Trust Company, Inc.) and Fireblocks UK Int'l Limited.

6.9 Prohibited Use of Client Assets. The Company and the custodian are prohibited from using your Virtual Assets to conduct proprietary operations, except: (i) for staking operations, subject to applicable regulation and your prior express consent; and (ii) for operations involving qualified or professional investors, as defined under CVM regulations, with their express consent. Any such operation shall be preceded by the provision of clear, precise, and explicit information regarding the conditions and risks involved.

6.10 Transfer of Custody. You shall have the right, at any time, to request the transfer of all or part of the Virtual Assets held in custody to another custodian or to your own wallet.

6.10.1 Upon receipt of a duly authenticated transfer instruction, the Company shall initiate the transfer within such reasonable time, subject to: (i) completion of applicable security and compliance verification procedures; (ii) confirmation of the destination wallet address; and (iii) settlement of all outstanding fees.

6.10.2 In the event of insolvency, bankruptcy, or resolution proceedings affecting the custodian, the Company shall using reasonable endeavors, upon your express instruction, redeem the custodied Virtual Assets and transfer them to you or engage another custodian, in accordance with applicable regulation.

6.10.3 You acknowledge that the Services are dependent upon the custody of Virtual Assets by the Company or its designated custodian. Accordingly, if you request the transfer of all Virtual Assets held in custody to another custodian or to a self-hosted wallet, you will no longer be able to use the Services and may be required to close your Account.

6.11 Operational Timeframes. The Company shall endeavor using reasonable efforts and subject to its internal compliance controls and policies (in which case, the timeline listed under this clause may be extended materially) to process each type of order within the following maximum timeframes: (a) deposits: confirmation up to 48 hours of blockchain network confirmation; (b) withdrawals: up to 48 hours; (c) transfer of custody to a successor custodian: within a reasonable time period.

6.11.1 The following events may cause delays: (i) network congestion, protocol failures, or other disruptions on the applicable DLT network; (ii) force majeure events; (iii) security, compliance, or fraud-prevention reviews; (iv) compliance with judicial orders, regulatory requirements, or sanctions screening; and (v) technical failures affecting the Company's, the custodian's, or any service provider's systems.

6.11.2 You acknowledge that failure to meet such timelines may result in: (i) inability to access or transfer Virtual Assets during the delay period; (ii) exposure to market volatility; and (iii) operational disruption.

6.12 Position Reports and Transaction Records. The Company shall make available to you, through the Platform, a report that is kept up to date on a timely basis, containing at a minimum: (i) the financial balance of each Virtual Asset attributed to you; (ii) the quantity of each type of Virtual Asset attributed to you; and (iii) the history of movements since the last report. You may access such report electronically at any time through the Platform.

6.13 Notifications. The Company shall endeavor to promptly notify you of any event that creates, annuls, modifies, or otherwise materially affects the rights relating to the Virtual Assets held in custody, including the details of the affected assets and the applicable exchange rates.

6.14 Communications and Authentication. The Company and you shall communicate through: (a) the Platform; (b) email to the addresses registered in your account; and (c) such other secure channels as may be agreed. The Company shall maintain a secure authentication system, including multi-factor authentication, for the transmission of instructions relating to the Virtual Assets.

6.15 Internal Controls and Independent Audit. The Company shall ensure that the custodian maintains internal control procedures and submits its custody service to an independent audit at least biennially, with reasonable assurance, covering segregation controls, reconciliations, systems operations, and incident treatment. Additionally, the custodian shall conduct stress tests at least annually to assess the security of the custodied Virtual Assets, documenting methods and results and retaining records for a minimum of five (5) years.

6.16 Custody Policy. The Custody Services shall be performed in accordance with the Virtual Asset Custody Policy maintained by the Company, which describes its strategies, measures, and procedures regarding: (i) compliance with applicable regulation; (ii) governance and internal controls; (iii) risk management; (iv) system adequacy; (v) cybersecurity; and (vi) order processing timelines. The Custody Policy shall be properly documented, kept up to date, and maintained available to the BCB.

6.17 Liability. The Company shall be liable before you for any losses and damages to the Virtual Assets held in custody arising from negligence, incompetence, imprudence, or willful misconduct, including inability to access or impediment of access to such Virtual Assets. The Company shares with the custodian the same responsibilities attributable to the custodian vis-à-vis you, and shall inform you of the allocation of responsibilities between the Company and the custodian, as well as the instruments available for the Company to seek reparation from the custodian on your behalf.

6.18 Information on Coverage or Insurance. As of the date of these Terms, the Company does not maintain insurance or coverage arrangement(s) applicable to the custody and intermediation of Virtual Assets.

6.18.3 In the event that the Company obtains, modifies or cancels any insurance or coverage arrangement after the date of these Terms, the Company shall notify you through the Platform within 60 days of such change, indicating the updated scope, entity responsible for coverage, triggering conditions, available claiming channels and any applicable exceptions.

6.19 Specification of Virtual Assets and Technical Aspects. The Virtual Assets covered by these Terms, and the distributed ledger technology systems on which they are recorded, are specified at the applicable sections on the Platform. The Company shall keep such information up to date.

6.20 Information Sources. The pricing and valuation data used for the management and reporting of the custodied Virtual Assets are sourced from a number of reputable market sources.

6.21 Notifications on Asset Management. The Company will inform you via the Platform about any actions taken on your Account, such as asset freezes or conversions, including the details of affected assets and the applied exchange rates.

6.22 Cybersecurity Policy. The information provided to you under this Section 6 regarding the safekeeping, custody, and storage of Virtual Assets and the instruments of control thereof (including private keys) is compatible with the cybersecurity culture mechanisms set forth in the Company's Cybersecurity Policy.

7. Intermediation of Virtual Assets

7.1 Request for Quote Model. The purchase, sale and exchange of Virtual Assets carried out through the Platform are executed by means of a request for quote ("RFQ") model, under which the Client requests a quotation for the purchase or sale of a given Virtual Asset and receives a price and quantity proposal for acceptance within a specified period.

7.1.1 Price Methodology. The Company shall disclose to the Client, through the Platform, the methodology adopted for the obtainment and formation of the price of each Virtual Asset offered through the RFQ model, including at a minimum: (a) the pricing sources used to determine the value of the Virtual Asset (e.g., external pricing indices, exchange aggregators, or internal liquidity pools); (b) the factors considered in determining the final price quoted to the Client, including applicable spread, service fees, market volatility adjustments, and liquidity conditions; and (c) the frequency at which pricing data is refreshed and whether the quoted price is indicative or binding for the validity period disclosed under clause 7.4(c).

7.1.2 Execution Model. The Company shall inform the Client of the execution model applicable to RFQ transactions, including: (a) whether the Company acts as principal (i.e., as direct counterparty to the Client) or as agent (i.e., routing the Client's order to a third-party liquidity provider or counterparty); (b) where the Company acts as agent, the identity or category of the third-party counterparty, to the extent permitted by applicable confidentiality obligations; and (c) whether settlement occurs on-chain or off-chain, and the expected settlement timeframe.

7.1.3 Fees and Charges. All fees, charges and costs applicable to RFQ transactions shall be disclosed to the Client through the Platform prior to the confirmation of each transaction, including: (a) any spread or mark-up embedded in the quoted price; (b) any separate service or transaction fee; (c) any network or blockchain fees; and (d) any other charges that may be deducted from the transaction amount or charged separately. The Company shall maintain an up-to-date schedule of applicable fees on the Platform.

7.1.4 Available Virtual Assets. The list of Virtual Assets available for trading through the RFQ model is published and maintained on the Platform. The Company shall apply the eligibility, listing, suspension and delisting criteria set forth in its internal policies, in accordance with Applicable Law and BCB Resolution No. 520/2025, and shall promptly notify Clients through the Platform of any changes to the available Virtual Assets.

7.2 Price Formation Transparency. The Company shall disclose, in a clear and accessible manner through the Platform, the methodology adopted for obtaining and forming the prices of Virtual Assets, including, as applicable: (a) the price reference sources used; (b) the spread or service fee criteria applied; (c) the factors that may influence price variations; and (d) the frequency of price information updates.

7.3 Disclosure of Counterparty Status. The Company shall inform the Client of all situations in which the Company, directly or through an affiliate or entity controlled by or under common control with the Company, acts as counterparty in a transaction involving Virtual Assets. In such cases, the Company shall disclose, in a prior, clear and prominent manner:

(a) its status as counterparty in the transaction;

(b) the prices and conditions applied in the transaction in which it acts as counterparty; and

(c) where applicable, any conditions and prices that differ from those otherwise offered by the Company, so as to enable the Client to make an informed decision regarding the purchase or sale of the Virtual Asset.

7.4 Mandatory Information in RFQ Transactions. In transactions carried out under the RFQ model, the Company will inform the Client, in a clear and transparent manner and prior to acceptance of the offer:

(a) the price quotations available for the purchase or sale of the Virtual Asset;

(b) the quantities available for the purchase or sale;

(c) the maximum validity period of the quotation presented, upon expiry of which the offer shall be automatically cancelled, unless otherwise expressly communicated to the Client;

(d) the term and conditions applicable to the settlement of the transaction, including the means and conditions for the transfer of the Virtual Assets and, as the case may be, the financial resources involved;

(e) the possible participation of the Company, or of an affiliate or entity controlled by or under common control with the Company, as counterparty in the offer presented;

(f) the counterparty and settlement risks associated with the counterparty offering the quotation, including, where applicable, the possibility of default; and

(g) the existence or absence of a guarantee by the Company that the transaction will be completed in the event that the counterparty offering the quotation fails to honour the quotation presented within the terms and conditions indicated.

7.5 Completion Guarantee. Should the Company offer a guarantee for the completion of a transaction carried out under the RFQ model, as set forth in item (g) of clause 7.4 above, the terms, conditions, limits and any exclusions of such guarantee shall be described in a specific document or annex to this Agreement, of which the Client must be made aware prior to the execution of the transaction.

7.5.1 In the absence of a completion guarantee, the Company shall not be liable for any default by the counterparty offering the quotation; provided, however, that the Company shall adopt such reasonable measures as are within its reach to mitigate losses to the Client.

7.6 Transparency in Virtual Asset Exchange Transactions. In transactions involving the direct exchange between Virtual Assets (including Convert transactions between Virtual Asset pairs), the Company shall inform the Client, in an explicit manner and prior to the confirmation of the transaction:

(a) the individual price of each Virtual Asset involved in the exchange, with indication of the currency or reference unit used for the quotation;

(b) the conversion rate applied between the Virtual Assets;

(c) any fees, charges or costs applicable to the transaction, as disclosed on the Platform; and

(d) any other applicable conditions under the terms of this Agreement, including, as the case may be, those relating to settlement terms, counterparty risk and the Company's counterparty status.

8. Self-Custody Mode

8.1 KAST Self-Custody Mode. The Self-Custody Mode is an optional feature that allows eligible Users to hold their KAST spending balance on-chain in a dedicated Self-Custodial Wallet provided through Privy. The Self-Custody Mode operates independently of the standard Account. To confirm, the two structures co-exist within the Platform as described in this section.

8.1.1. Self-custody entails full and exclusive responsibility of the Client for the safekeeping of private keys and recovery information. Loss, destruction or disclosure of such information may result in the irreversible loss of the virtual assets, without any possibility of recovery by the Company, any authority, or any court. Transactions executed on distributed ledger systems are, as a rule, irreversible.

8.1.2 The Client may request the withdrawal of virtual assets from the Platform to a wallet controlled by the Client (self-custody). Upon such withdrawal: (i) the Company executes an on-chain transaction to the wallet address indicated by the Client; (ii) after execution, the assets cease to be under the Company's custody and become subject exclusively to the Client's control; (iii) the Client's custodial liability under Section 6 does not extend to assets withdrawn to self-custody, without prejudice to the Company's continuing responsibility for other services provided under these Terms.

8.2 Spending Account vs Self-Custodial Wallet. The Account and the Self-Custodial Wallet are legally and operationally distinct as follows:

(a) Spending Account: the Account operates on a custodial basis. Virtual Assets obtained by the Client remain the Client's property and are held by the Company in wallets segregated from its proprietary wallets. The Client's Brazilian real balance is held in a payment account in the Client's own name at a payment institution authorized by the Central Bank of Brazil (listed on our platform as per section 2.3.2 and updated from time to time), contracted by the Company under a Banking as a Service arrangement. Card transactions are settled by the automated sale of a portion of the Client's Virtual Assets at the prevailing market rate, upon the Client's prior standing authorization. The Company does not extend credit and does not hold the Client's Brazilian real balance on its own account.; and

(b) Self-Custodial Wallet: is an on-chain smart wallet provisioned by Privy. The User Wallet Key resides exclusively within Privy’s TEE and can only be applied upon completion of the User’s authentication challenge. No party, including KAST, can sign a transaction on behalf of the User without a valid Auth Token. Virtual Assets transferred into the Self-Custodial Wallet are not held by a Custodian on behalf of KAST.

8.3 Wallet Architecture and Signing Model. When the Self-Custody Mode is activated, Privy provisions a new, dedicated on-chain wallet exclusively for that User. This wallet is separate from and does not reuse any existing wallet associated with the User’s Account. The Self-Custodial Wallet is controlled by a single private wallet key (“User Wallet Key”). The User Wallet Key is generated within and held inside Privy’s Trusted Execution Environment (“TEE”), a hardware enclave from which the key cannot be extracted by any party (including Privy’s personnel). Neither KAST nor the User’s device ever holds or has access to the User Wallet Key. The User Wallet Key is the only one signature required to sign all on-chain transactions originating from the Self-Custodial Wallet.

8.4 Authentication and Transaction Authorisation. Since the User Wallet Key is held exclusively inside Privy’s TEE, Privy’s systems will only apply that key to a requested transaction when presented with a valid, User-issued authentication token (“Auth Token”) confirming that the wallet owner has authorised that specific action. To avoid doubt, the Auth Token is not a second signing key, and functions as authenticated proof of the User’s verified intent. Without a valid Auth Token, Privy’s TEE will not sign any transaction, regardless of any instruction from KAST or any other party.

8.5 Credential Requirements. An Auth Token can only come into existence upon successful completion of the User’s authentication challenge. For standard transactions, this requires a one-time passcode (“OTP”) delivered exclusively to the User’s verified email address or phone number. For transactions above a defined value threshold, an additional second factor is required in the form of a time-based one-time passcode (“TOTP”) generated on the User’s own device from a seed enrolled by the User. To confirm, KAST does not generate, receive, or store OTP or TOTP codes, such that KAST cannot unilaterally move funds from a User’s Self-Custodial Wallet without the User’s active participation in the authentication flow.

8.6 Transaction Binding. Each Auth Token is bound at issuance to the precise details of the specific transaction the User has requested. An Auth Token cannot be used to authorise any different transaction, a modified version of the requested transaction, or any other action. It operates as a cryptographically bound receipt of the User’s verified intent for a single, specific action. As per section 8.4, the authentication strength (OTP or OTP plus TOTP) is proportional with the value of the transaction at stake.

8.7 Activation of Self-Custody Mode. Users may activate the Self-Custody Mode by toggling the feature within their Account settings in the Platform or, where available, a temporary widget on the home screen may also provide a direct link to the activation flow. Before activation, the User will be presented with a consent screen (“Activation Consent Screen”) that explains the wallet architecture, the authentication model, and the associated risks. Activation requires the User’s affirmative consent. Upon activation, the User acknowledges and accepts that: (i) the User ’s entire eligible balance is transferred from the Company’s treasury to the User’s Self-Custodial Wallet, following conversion to USDC; and (ii) subsequent deposits and card spend operate in Self-Custody Mode until the User deactivates the feature (or the Company suspends it).

8.8 Deactivation of Self-Custody Mode. Users may deactivate the Self-Custody Mode by toggling the feature off within their Account settings in the Platform. Upon deactivation, the User acknowledges and accepts that: (i) the User’s entire USDC balance is transferred from the Self-Custodial Wallet back to the standard wallet; and (ii) the User’s account reverts to the standard Account model with eligible virtual assets available for spending. The maximum number of activation or deactivation operations under a single Account is three (3) times every 24-hour period. Once the daily toggle limit is reached, a 24-hour cool down period applies where activation or deactivation of Self-Custody Mode is restricted.

8.9 Funding Self-Custodial Wallet. The only digital asset that KAST supports for direct deposit into your Self-Custody Wallet is USDC on the Solana blockchain (the “Supported Direct Deposit Asset”). A “Supported Direct Deposit” means a transfer of digital assets sent by you or by a third party directly to a blockchain address associated with your Self-Custody Wallet, otherwise than through the Top-Up process.

8.10 Private Key Export. Where available, eligible Users holding a Self-Custodial Wallet may elect to export their User Wallet Key from Privy’s TEE (“Key Export”). Before a Key Export can be completed, the User must pass through a mandatory multi-screen warning and acknowledgement process (“Export Warning Process”). No key will be revealed until every step of the Export Warning Process has been completed in full. Once a User exports their key, any funds and assets will no longer sit with the Platform. From the moment of Key Export, the User becomes the sole custodian of their assets. Key Export is permanent and cannot be undone.

8.11 KAST’s Liability Following Key Export. From the moment a Key Export is completed: (a) KAST owes no ongoing obligation in respect of the exported wallet or its assets; (b) KAST is not liable for any loss, theft, or inaccessibility of assets in the exported wallet, whether arising from loss of the exported key, theft of the exported key, blockchain network failures, smart contract vulnerabilities, or any other cause; (c) KAST is not able and is not obligated to reverse, cancel, or otherwise intervene in any transaction originating from the exported wallet; and (d) the User’s indemnity obligations under these Terms continue to apply in full to any claims arising in connection with the exported wallet after Key Export.

8.12 User Responsibility & Risks. By activating the Self-Custody Mode the User acknowledges and accepts each of the following risks, each of which will also be disclosed on the Activation Consent Screen that must be affirmatively accepted before activation proceeds:

(i) On-chain irreversibility. On-chain transactions are final and irreversible once confirmed. KAST cannot reverse or recover on-chain transactions;

(ii) Authentication credential risk. The security of the Self-Custodial Wallet depends on the security of the User’s authentication credentials, especially the verified email address or phone number to which OTPs are delivered and the device on which TOTP codes are generated. The User is responsible for maintaining the security of these credentials;

(iii) Privy dependency. The Self-Custodial Wallet is operated through Privy. If Privy experiences an outage, a security incident, or ceases to provide its services, the User ’s ability to transact from the Self-Custodial Wallet may be affected.KAST does not guarantee continuity of access in the event of a Privy service failure;

(iv) Direct deposit risk. Sending assets directly to the Self-Custodial Wallet address may result in permanent loss of those assets. The User assumes full responsibility for any loss resulting from a direct deposit;

(v) Private key export risk. Where available, exporting the private key to the Self-Custodial Wallet carries significant risk, since the private key allows full access to the wallet and all assets held within it. By exporting the private key, the User is solely responsible for security of the private key and wallet. If someone obtains the private key, the User may irreversibly lose all assets and KAST cannot assist with the recovery of assets; and

(vi) Network and conversion risk. Transfers between the Company’s treasury and the Self-Custodial Wallet involve conversion to and from USDC at prevailing market rates and are subject to network fees and delays.

9. Account Funding & Fiat Transactions

9.1 Top-ups with Virtual Assets. To fund your use of the Services, you may acquire and transfer Virtual Assets to the Platform in accordance with the specific instructions available on the Platform. The Platform is designed to accept only certain types of Virtual Assets, referred to as “Acceptable Tokens”.

9.2 Acceptable Tokens. The list of Acceptable Tokens may be altered by the Company at any time with immediate effect where required by law, regulation, or urgent security concerns, and will notify you as soon as reasonably practicable thereafter. The Company may otherwise change the list of Acceptable Tokens in its discretion by no less than fourteen days (14) written notice. You are responsible for ensuring that you only transfer Acceptable Tokens and accept that any non-Acceptable Tokens transferred may be irretrievably lost without liability to the Company where our obligations are met.

9.3 Status of Virtual Assets. You represent and warrant that any Virtual Assets transferred are owned by you, free of any legal claims or disputes, and not tied to illegal activities. The Company and/or Partners reserve the right to reject any transfer if concerns arise regarding the legality, authenticity, or if KYC, KYT, AML, or due diligence checks are not satisfactorily completed, and the Company will use reasonable endeavours to notify you of the rejection in such cases. Any fees applicable to fund your Account will be displayed on the Platform at the relevant time. By initiating a transfer, you confirm that you have reviewed and accepted the applicable fees as displayed on the Platform at the time of initiation.

9.4 Top-ups with fiat. To fund your use of the Services, you may top up your Account using fiat currency, using the methods made available within the Platform from time-to-time. This functionality is provided by independent licensed third-party payment service providers, on-ramp providers, or licensed money transmitters (each a "Fiat Partner").

9.5 Fiat Partners. The Fiat Partner is the regulated entity responsible for receiving and processing your fiat payment. Each Fiat Partner operates under its own regulatory authorisations and is solely responsible for the licensed activities it performs in connection with your fiat payment. The Fiat Partner may impose identity verification requirements or transaction limits before processing your fiat transaction.

9.6 Fiat Partner Terms. When you initiate a fiat top-up through the Platform, the Fiat Partner's own terms and conditions and policies will apply in respect to the fiat on-ramp or off-ramp transactions requested (in addition to these Terms). The Fiat Partner's terms will be made available to you for review before you confirm your fiat transaction. You should not proceed with a fiat transaction unless you have reviewed and are willing to be bound by the Fiat Partner's terms.

9.7 Fiat Partner Responsibility. The Company undertakes to select Fiat Partners that are duly authorized by the BCB and to supervise the performance of contracted fiat services. In the event of failure, delay or loss in a fiat transaction, the Company will assist the Client in seeking resolution with the applicable Fiat Partner and, where applicable, will exercise its rights of recourse against such Fiat Partner. The Company's responsibility to the Client for fiat services offered through the Platform is governed by applicable Brazilian law and by these Terms, and is not excluded by the intermediation of a Fiat Partner.

9.8. Fiat Services and Banking as a Service. The fiat payment and account services made available through the Platform by Fiat Partners are provided in accordance with the Banking as a Service framework established under Joint Resolution No. 16, of November 28, 2025 ("BaaS Regulation"), as applicable. The Fiat Partner remains the regulated entity responsible for the financial and payment services rendered to you, including account opening and maintenance, payment processing, and compliance with applicable AML/CFT, KYC and consumer protection requirements. For the avoidance of doubt, the Fiat Partner may not charge you, in its own name, any tariff, commission, or other form of remuneration for the financial or payment services provided under this arrangement; any applicable fees shall be charged exclusively by the Company in accordance with these Terms and the BaaS Regulation.

10. Account Value and Card Balance

10.1 Balance Limits and Adjustments. The Company or the Partners may set minimum and maximum limits on the amount of Virtual Assets that may be transferred or processed through the Platform for use in connection with the Services, as notified to the User from time to time. These limits, as outlined on the Platform, may be modified at the Company's discretion.

10.2 Authorization for Transaction Settlement and Fee Deduction. When the Company processes Card Transactions or other settlements using the Services, it may convert portions of the transferred Virtual Assets to stablecoins or fiat currencies as required, and deduct corresponding amounts to cover the transaction value and any associated charges. These charges may include transaction and network fees, third-party service fees, foreign exchange variances, and any other customary fees, as notified to the User. All applicable fees will be disclosed to the User prior to confirming the transaction and in the applicable page in the Platform. Using the Services may incur certain fees, as notified to Users within the Platform These fees will be deducted from the relevant Virtual Assets transferred or processed through the Platform or charged separately. Non-payment of fees can result in suspension of Services until all such outstanding fees have been settled. Fees are listed on the Platform and may be updated, removed or new fees introduced at the Company's discretion. All fees are exclusive of taxes, which will be added to the final charge. These fees are final and non-refundable under any circumstances unless otherwise determined by the Company. Partners may assess charges for their services pursuant to Partners terms. The Company is not responsible for Partner’s charges. Additionally, you might incur fees for sending or receiving funds on the Platform.

10.3 Virtual Asset Deposits. You may deposit Virtual Assets into the Platform by transferring Acceptable Tokens to the wallet address indicated on the Platform. Deposits are subject to the following conditions:

1. deposits shall be credited to your Account upon blockchain network confirmations on the applicable distributed ledger;
2. the minimum deposit amount, if any, is displayed on the Platform and may be updated from time to time;
3. the Company reserves the right to delay or reject any deposit that fails to satisfy applicable KYC, KYT, AML/CFT or sanctions screening requirements.

10.4 Virtual Asset Withdrawals. You may request the withdrawal of Virtual Assets from the Platform to an external wallet at any time, subject to:

1. processing within the reasonable hours of confirmation of your instruction, except in the circumstances described in clause 6.11.1;
2. the minimum withdrawal amount and applicable network and service fees, as displayed on the Platform;
3. completion of any required security, compliance, or fraud-prevention verification; and
4. confirmation of the destination wallet address.

10.5 Fiat Withdrawals (Off-Ramp). You may request the withdrawal of your fiat balance to a bank account held in your name, subject to:

1. processing within reasonable Business Days of confirmation of your instruction;
2. any minimum withdrawal amount and applicable processing fees, as displayed on the Platform;
3. the Fiat Partner's own verification and processing timelines; and
4. compliance with applicable AML/CFT and sanctions screening.

10.6 General Provisions on Deposits and Withdrawals.

1. All applicable limits (minimum and maximum amounts, daily and monthly caps) are disclosed on the Platform and may be updated by the Company in its discretion, subject to at least reasonable prior notice for reductions that are not required by law.
2. The Company may suspend deposits or withdrawals temporarily in the event of force majeure, system maintenance, security incidents, or regulatory requirements, and shall notify you as soon as reasonably practicable.
3. The Company shall not withhold or delay processing beyond the timeframes specified above except where required by Applicable Law, court order, or regulatory directive.

10.7 Position Reports, Transaction Records and Statements. The Company shall make available to you, through the Platform, an electronic report that is kept up to date on a continuous basis ("Position Report"), containing at a minimum:

1. the financial balance of each type of Virtual Asset attributed to you and the pricing source used for its valuation;
2. the quantity of each type of Virtual Asset attributed to you;
3. the complete history of transactions and movements since the last report, including for each transaction: (i) the type of operation (e.g., deposit, withdrawal, convert, card settlement, staking reward); (ii) the price or exchange rate applied; (iii) the volume or quantity transacted; and (iv) the date and time of execution; and
4. any pending operations or holds affecting your Account.

10.7.1 You may access the Position Report electronically at any time through the Platform.

10.7.2 In addition to the continuous Position Report, you may request a consolidated statement for any specified period. The Company shall make such statement available within such reasonable time from the date of your request, at no additional charge.

10.7.3 The Company shall retain transaction records for a minimum period of 10 years from the date of the relevant transaction, in accordance with applicable regulation.

11. Benefits and Modifications

11.1 Benefits and Promotional Offers. The Company may offer, modify, or withdraw various benefits, promotional offers and discounts (“Benefit”) at its discretion. Benefits might include mobile payment options, contactless payment, rewards, installment plans with certain partners, and other benefits as notified from time to time. Some benefits may require a separate application. The Company has the authority to exclude you from Benefits or reverse benefits if you breach any Terms.

11.2 Reversal and Recovery of Benefits. The Company may reverse, forfeit, or recover any Benefit, whether pending or credited, in the following circumstances:

1. Fraud or abuse: the Company has reasonable grounds to conclude that the Benefit was obtained through fraudulent, deceptive, or abusive conduct, including manipulation of the Platform, the creation of multiple accounts in breach of these Terms, or conduct whose primary purpose is to generate, inflate, or accelerate Benefits in a manner not consistent with the ordinary use of the Services. Before reversing a Benefit on this ground (except where immediate action is required to prevent further loss), the Company will notify you of the basis for the proposed reversal and give you 7 days to respond;
2. System error or miscalculation: the Benefit was credited as a result of a technical error, miscalculation, or system malfunction that was not caused or exploited by you. In such cases, the Company will notify you of the correction promptly and the reversal will be limited to the amount erroneously credited;
3. Unauthorised exploitation of system vulnerabilities: the Company determines that the Benefit was obtained, in whole or in part, by knowingly or recklessly taking advantage of a technical error, software bug, system vulnerability, or unintended platform behaviour, where a reasonable User would have understood that the Benefit was not intended to be available in those circumstances. In such cases, the Company will be entitled to immediate clawback and will notify you of the clawback and its basis promptly after the action is taken; and
4. Regulatory compulsion: the Company is required to recover or cancel the Benefit to comply with Applicable Law, a regulatory directive, or an order from a competent authority.

11.3 Exclusion from Future Benefits. Where such a Benefit has already been utilised by being applied to a completed transaction, recovery of that value may be sought under the limited circumstances set out above. The Company will debit your Account Value for the recovered amount and you will be notified of the deduction and its basis before the deduction is made, except where immediate action is required.

11.4 Rewards Program Terms. The Company may exclude you from future Benefits where a Benefit has been reversed for fraud or abuse or the exploitation of system vulnerabilities. To the extent you received Benefits through participation in any rewards, incentive, loyalty, cashback, or promotional program made available through the Platform from time to time, you acknowledge and accept that your participation in such programs is subject to and shall be governed by the Rewards Terms and Conditions (as updated from time to time).

12. ATM Withdrawal Services

12.1 Physical Withdrawal. KAST Card Users can use their physical KAST Cards for cash withdrawals (“Withdrawal Services”) at compatible ATMs. Withdrawals are subject to limits set by the Partners. Fees for these services, which can change without notice, may be charged both by the Partners. Please note that fees may also be charged by ATM providers in respect of any withdrawal, in respect of which the Company and Issuer will have no control and will not be liable. The Company and Issuer are not liable for any losses, damages or liabilities related to ATM withdrawals, or Virtual Asset or currency conversions.

13. KAST Convert Services

13.1 Convert Service and Execution. For the purposes of this Agreement, a “Convert” refers to the exchange of one supported Virtual Asset (including but not limited to Bitcoin, Ethereum, or other digital tokens supported by us) for a fiat-backed stablecoin (such as USDT or USDC), executed at a conversion rate determined at the time of the transaction. Such Convert may be facilitated through KAST’s internal liquidity pool, third-party liquidity providers, or affiliated counterparties, and may involve on-chain or off-chain settlement. The Convert is executed upon a User’s instruction and is subject to applicable fees, market volatility from liquidity providers. The Company reserves the right to restrict or suspend Convert functionality for certain Users or transactions at its sole discretion, including for compliance or risk management purposes.

13.2 Conversion Rates, Fees, and Finality. The conversion rate applicable to each Convert will be determined at the time of execution and may include a spread or service fee. A certain percentage of service fee will be applied to the gross amount of each Convert transaction, which will be calculated and disclosed at time of Convert execution. This fee is deducted from the converted amount at the time of execution and is non-refundable. All applicable fees will be disclosed to the User through the Platform prior to your confirmation of the Convert. Once confirmed, Convert transactions are final and irreversible. You should not initiate a Convert unless you are satisfied with the rate and net amount displayed pre-execution. The net amount of the converted asset (after applicable fees) will be credited to your Account upon confirmation on the relevant blockchain and internal reconciliation.

13.3 Convert Risks and Disclaimers. By using the Convert service, you acknowledge and accept the following risks: (i) prices of Virtual Assets are volatile and may change between the time you initiate a Convert and the time it is executed. The rate displayed at initiation is indicative and the final rate may differ; (ii) blockchain congestion or technical issues may delay execution or confirmation; (iii) the Company does not guarantee that any Convert will be completed at a particular rate or within a specified time; and (iv) transactions may be delayed, declined, or reversed due to AML, sanctions screening, or regulatory requirements.

14. Regulatory Obligation

14.1 KYC, KYT and AML Procedures. Both the Company and Partners reserve the right to conduct comprehensive customer due diligence through Know Your Customer (“KYC”), know your transaction (“KYT”) checks, anti-money laundering and counter terrorism (collectively named “AML”), and other due diligence checks on all transactions and Virtual Assets linked to your Account. You must provide accurate, updated and full information for these checks. If deemed necessary, the Company and Partners may freeze part or all assets in any Custodian Wallet, canceling, restricting or blocking access, Account and transactions of the affected Virtual Assets until unfrozen. The Company and Partners may also refuse asset transactions such as top-ups, transfer particularly if legality or authenticity issues arise, or if compliance checks are unsatisfactory. You agree to cooperate in any investigations related to suspicious activities or transactions. The Partners have a regulatory obligation to keep a record of your information for a period prescribed by the BCB after the closure of your account.

15. Platform

15.1 Use of Platform. The Platform shall allow Users to perform the functions made available by the Company from time to time.

15.2 Limited License. Provided you comply with these Terms, the Company grants you a limited, non-transferable, non-exclusive license to use the Services on your device, and related to Content solely for approved purposes as permitted by the Company from time to time. This license is subject to these Terms and does not extend beyond what is expressly granted. All other rights are reserved.

15.3 Open Source. Certain components within the Platform may be subject to open source or other specific licenses. In cases of inconsistency between these Terms and the licenses of those components, the latter's terms will govern your use of those specific components of the Platform.

15.4 Conditional Use of Services. You acknowledge and agree that your use of the Services is at all times subject to your compliance with these Terms and all other applicable terms and policies (as notified to the User from time to time).

16. Your Device

16.1 Device Security and User Responsibilities. You are responsible for obtaining and maintaining the necessary security, hardware, software, and services for the Platform, including antivirus software and timely updates for the App and your device. In case of loss, theft, or unauthorized access to your device, promptly inform us at support@kastcard.com and reset your device's password. The Company is not liable for losses or damages due to unauthorized use of your device.

17. User Content

17.1 User Content. Users may submit various types of content, such as profile information, comments, questions, and other content or information ("User Content”). While you retain ownership of your User Content, by submitting it through the Services, you grant the Company a royalty-free, sublicensable, transferable, perpetual, irrevocable, non-exclusive, worldwide license to use, reproduce, modify, publish, and display this User Content for the purposes of the delivering the Services, provided that, where User Content constitutes personal data, the Company’s processing of such data remains subject to the Privacy Policy and applicable data protection law.

18. Feedback

18.1 User Feedback and Ideas. You may choose to, or we may invite you to, submit comments or ideas about the Services, including without limitation about how to improve the Services, Platform, procedures or our products (“Ideas”). By submitting any Idea, you agree that your disclosure is gratuitous, unsolicited and without restriction and will not place the Company under any fiduciary or other obligation and that we are free to use the Idea without any additional compensation to you, and/or to disclose the Idea on a non-confidential basis or otherwise to anyone. You further acknowledge that, by acceptance of your submission, the Company does not waive any rights to use similar or related ideas previously known to the Company, or developed by its employees, or obtained from sources other than you.

19. Intellectual Property Rights

19.1 Intellectual Property Rights. You acknowledge and agree that:

• all trademarks, service marks, and logos used in the Platform, associated with the Company and its affiliates, are their exclusive property or that of third-party licensors;
• the Services' intellectual property rights are either owned by or licensed to the Company;
• aside from the specific license granted to you, no additional rights are provided to you regarding the trademarks, the Platform, or the Services;
• any reproduction, distribution, adaptation, modification, or commercial exploitation of any part of the Platform is strictly prohibited without explicit written consent from the Company; and
• you will not sell, license, reverse engineer, modify, publish, or participate in the transfer or sale of, create derivative works from, or in any other way exploit any of the Content, in whole or in part.

20. Prohibited Activities

20.1 Prohibited Activities. You agree not to engage in certain prohibited activities with the Platform, including but not limited to:

• using the Platform for spamming purposes;
• engaging in illegal or immoral activities through the Services, like money laundering; or terrorism financing, fraud or malicious hacking;
• providing false, misleading or inaccurate information;
• using the Platform in ways that infringe on any intellectual property rights;
• damaging, disabling, or impairing the Platform or its Services, interfering with other users, or harming the Company's reputation;
• engaging in activities that the Company deems inappropriate or illegal;
• uploading harmful or illegal content, such as viruses or malicious codes;
• altering, combining, or integrating the Platform or platform with other software;
• attempting to obtain the Platform’s source code through reverse engineering;
• attempting to bypass or circumvent any security features;
• hide or misrepresent the true origin of assets and resources;
• showing abusive or threatening behavior towards Company personnel;
• facilitate any viruses, trojans, malware, worms or other computer programming routines that attempt or may damage, disrupt, corrupt, misuse, adversely interfere with surreptitiously intercept or expropriate, or gain unauthorized access to, any system, data or information;
• use any device, software or routine to bypass or circumvent our robot opt-out protocols, interfere with or disrupt, or attempt to interfere with or disrupt our infrastructure, our websites, software, systems (including any networks and servers used to provide any of the Services) operated by or on our behalf, any of the Services or the use of any of the Services by other users;
• upload, display or transmit any messages, photos, videos or other media that contain illegal goods, pornographic, violent, obscene or copyrighted images, or materials for use as an avatar, in connection with a payment or payment request, or other way;
• weapons of any kind, including but not limited to firearms, ammunition, knives or related accessories
• controlled substances, including but not limited to narcotics, prescription drugs, steroids, related equipment or accessories
• any type of Ponzi scheme, pyramid scheme or multi-level marketing program
• counterfeit products, including, but not limited to, fake IDs;
• purchasing products from Tor onion services marketplaces or “Darknet” marketplaces, or any other service or website that acts as a marketplace for illegal products (although that marketplace may also sell legal products)
• adult content;
• pseudo-pharmaceuticals (including substances that make unsubstantiated pharmaceutical claims) and legal drugs (including chemicals designed to mimic illegal substances); and
• without limiting the foregoing, Users must not direct a disproportionate volume of card spend toward a single merchant or a limited number of merchants for the primary purpose of generating Benefits, where such conduct is inconsistent with ordinary consumer purchasing behaviour.

21. Consent to Data Protection Practices

21.1Consent to Data Sharing and Privacy Policy. By utilizing the Services, you acknowledge and consent to our data protection practices as detailed in our Privacy Policy. This includes the collection, use, disclosure, and sharing of your personal data with the Company, Partners, Custodian, service providers, and relevant third parties, as necessary for facilitating your use of the Services. For more detailed information, refer to our Privacy Policy.

22. Regulatory Status

22.1 Classification as Virtual Asset Service Provider. The Company operates as a VASP in the broker category, as defined in Article 10 of Resolution BCB No. 520/2025, which encompasses both the intermediation and custody of virtual assets.

22.2 Transitional Regime and Authorization. As of the date of these Terms, the Company was already providing virtual asset services prior to the effective date of Resolution BCB No. 520/2025 (February 2, 2026) and is therefore subject to the transitional regime set forth in Article 88 of the aforementioned Resolution. In accordance with that provision, the Company will apply, within the applicable deadline, for authorization to operate as VASP before the BCB.

22.2.1 Pursuant to Article 88, paragraph 6, of Resolution BCB No. 520/2025 the Company is permitted to continue providing its virtual asset services while its authorization request is pending.

22.3 Regulatory Status and Public Disclosures. Additional information regarding the Company's current regulatory status, including the status of its authorization request before the BCB, applicable regulatory licenses, its compliance posture with respect to local and international regulations, and the organizational policies, may be consulted at https://www.kast.xyz/pt/brazil.

23. Termination and Limitation Rights

23.1 Termination and Suspension: The Company reserves the right to suspend, limit, or terminate your access to the Services, including freezing, canceling, or closing your Account, or reversing Card Transactions, with immediate effect and without prior notice for any reason, including, without limitation: (i) you breach these Terms; (ii) you fail to pay applicable fees; (iii) we are required to do so by Applicable Law, a court order, or regulatory authority; (iv) we reasonably suspect unauthorized, unlawful, or Prohibited Activities; or (v) a Partner is unable to support your continued use due to compliance or internal risk monitoring policies.

23.2 Post-Termination Liabilities and Balance Return. Upon termination, the Company or its Partners remain entitled to debit your Account Value for any outstanding amounts or charges incurred from Card Transactions executed prior to or as a result of termination. The Company will use its reasonable efforts to return the same any remaining, uncontested Account Value to you via your linked bank account within 14 working days, except where the Company or its Partners are legally prohibited from doing so by law enforcement, anti-money laundering regulations, or court order. The Company will provide you with written notice of termination and the process for retrieving your funds, unless prohibited by law from doing so.

23.3 Account Inactivity. The Company reserves the right to log off or deactivate Accounts that have been inactive for six (6) months or longer. In case of an Account reactivation, the Company might charge a reactivation fee at its discretion. An Account will be considered dormant after 12 months without transaction activity.

23.4 Account Suspension or Closure. If the Company suspends or closes your Account, or terminates your use of the Services for any reason, you will be notified of such action as required by law, unless prohibited by court order or other legal process. The Company may, in its sole and absolute discretion, without liability, suspend and/or terminate your Account, or suspend your use of one or more of the Services if the Company reasonably believes that:

• someone else may be trying to use your Account without your permission;
• the security of your Account has been compromised;
• any disposition in the Terms has been or may have been violated; and/or
• we must do it in accordance with the law.

23.4.1 If your Account remains suspended or inactive for more than one hundred and eighty (180) days and the Company is unable to contact you, we will close the Account.

23.5 Remaining Balance. Withdrawal of the remaining balance from your Account may be subject to additional identification, verification and fraud prevention steps to access funds in a suspended or closed account. If it is possible to release the remaining available amount, our Partner will use reasonable efforts to notify you of the refund options it deems practicable in advance of processing the refund, including via in-app notification, email or other means it deems appropriate. We reserve the right to require the User to provide more information before processing any withdrawal or transfer request, and to extend the deadline for approval or prohibit any withdrawal or transfer in certain circumstances, especially when we detect or there are indications that fraudulent or illegal activity has taken place. If the User is unable to access their Account, the User must contact us at support@kastcard.com to process the transfer of the funds. Both the Company and Partners reserve the right to retain the funds for a specified period under certain conditions.

24. Post-Termination Obligations

24.1 No Liability for Damages. Any suspension or termination does not absolve you of any accrued liabilities, unpaid fees, or responsibilities incurred prior to termination.

24.2 Account Value Refund Process. Upon the termination of your Account, you are entitled to a refund of your remaining, uncontested Account Value. You may initiate a termination and refund request through the Platform at any time. To process your refund and ensure compliance with Applicable Law, the Company may require you to complete identity verification and compliance reviews.

24.3 Refund Conditions and Methods. Refunds are subject to administrative conditions to prevent negative account balances and may incur reasonable processing fees to cover the actual costs incurred by the Company or its Partners. The specific method of refund (e.g., on-chain transfer or bank transfer) will be determined by the Company in accordance with applicable regulations and executed within the timelines prescribed by law.

25. Complaint Resolution Process

25.1 Complaint Resolution Procedure. If you have a dispute with the Company ("Complaint"), you agree to first contact our support team to seek an amicable resolution. This step should precede any arbitration claim or small claims court action. Failing to engage in this initial process may lead to a request for dismissal of your claim until the procedure is followed. The Company will conduct an initial investigation into the dispute. You are expected to reasonably cooperate by providing necessary information. If it is determined that you owe amounts due to error, fraud, or other reasons, you agree to make the appropriate payment within 45 days. Conversely, if the Company owes you, payment will be made to you within the same timeframe. Should the Complaint not be resolved internally within 45 days, or 15 days in the case of urgent matters involving frozen funds or suspended accounts, both parties agree to proceed with Arbitration as detailed in section 29 below.

26. Communication Channels and Support Resources

26.1 Available Channels. The Company makes available the following communication channels for the submission of requests, questions, complaints, and the general support of its clients and Users:

1. In-app chat — accessible through the Platform at any time;
2. E-mail — support@kastcard.com; and
3. such other channels as may be made available on the Platform from time to time.

26.2 Human Support. In addition to any automated or self-service resources available through the Platform, the Company shall ensure that you have the option to be assisted by a human attendant through at least one of the channels listed in clause 25.1. The availability of human support and the applicable hours of operation are disclosed on the Platform.

26.3 Incident Assistance. In the event of a security incident, data breach, service interruption, or any other event that materially affects the availability, integrity, or confidentiality of the Services or your Virtual Assets (whether originating from the Company, a contracted custodian, or any other Partner), the Company shall:

1. notify you through the Platform and, where practicable, by e-mail, as soon as reasonably possible after becoming aware of the incident;
2. provide clear guidance on the immediate steps you should take to protect your Account and assets, including, where applicable, credential rotation, session termination, or temporary suspension of transactions;
3. make available dedicated support resources, including human assistance, to address your questions and concerns in connection with the incident;
4. provide periodic updates on the status of the incident and the expected timeline for resolution; and
5. inform you of the outcome of the incident investigation, including any remedial measures adopted and, where applicable, the channels and procedures for making a claim or complaint arising from the incident.

26.4 Compatibility with Cybersecurity Policy. The support resources described in this Section are maintained in a manner compatible with the Company's Cybersecurity Policy and the mechanisms for dissemination of cybersecurity culture, as required under applicable regulation.

27. Limitation of Liability

27.1 Disclaimer of Warranties. EXCEPT AS EXPRESSLY PROVIDED IN THESE TERMS, TO THE FULLEST EXTENT PERMITTED BY LAW, THE PLATFORM AND SERVICES PROVIDED BY THE COMPANY ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. WE DISCLAIM ALL OTHER REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, MADE TO YOU, YOUR AFFILIATES OR ANY OTHER PERSON, INCLUDING WITHOUT LIMITATION, ANY WARRANTIES REGARDING QUALITY, SUITABILITY, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR OTHERWISE (REGARDLESS OF ANY COURSE OF DEALING, CUSTOM OR USAGE OF TRADE) OF ANY SERVICE OR ANY GOODS PROVIDED INCIDENTAL TO THE SERVICES PROVIDED UNDER THESE TERMS. THE COMPANY'S LIABILITY IN RESPECT OF REPRESENTATIONS AND WARRANTIES THAT CANNOT BE EXCLUDED IS LIMITED, AT ITS OPTION, TO ANY ONE OF RE-SUPPLYING, REPLACING OR REPAIRING, OR PAYING THE COST OF THE RE- RE-SUPPLYING, REPLACEMENT OR REPAIRING, OR PAYING THE COST OF SUPPLYING AGAIN THE SERVICES IN RESPECT OF WHICH THE BREACH OCCURRED.

27.2 Limitation of Liability. NOTWITHSTANDING ANYTHING IN THESE TERMS, TO THE EXTENT PERMITTED BY LAW, IN NO EVENT SHALL THE COMPANY OR ANY OF ITS REPRESENTATIVES BE LIABLE TO YOU: (A) FOR ANY LOSSES OR DAMAGE OR CLAIMS (I) DUE TO AN UNUSUAL OR UNFORESEEABLE EVENT, OUTSIDE THE REASONABLE CONTROL OF US AND THE CONSEQUENCES OF WHICH COULD NOT HAVE BEEN AVOIDED EVEN IF ALL DUE CARE HAD BEEN EXERCISED (INCLUDING BUT NOT LIMITED TO FORCE MAJEURE, EVENTS OF WAR OR CIVIL UNREST, NATURAL DISASTERS, STRIKE, LOCK-OUT, TRAFFIC DISRUPTION, ACTS OF DOMESTIC OR FOREIGN GOVERNMENTAL AUTHORITIES); (II) ARISING FROM OR IN CONNECTION WITH: (A) ANY DELAY, SUSPENSION, DISCONTINUANCE OR FAILURE OF THE PLATFORM OR SERVICES; (B) ANY REJECTION OF THE KAST CARD; (C) ANY REFUSAL TO PROCESS OR AUTHORISE ANY TRANSACTION FOR ANY REASON; (D) YOUR INABILITY TO EFFECT OR COMPLETE ANY TRANSACTION DUE TO SYSTEM MAINTENANCE OR BREAKDOWN / NON-AVAILABILITY OF THE PLATFORM, NETWORK, OUR HARDWARE OR SOFTWARE OR THAT OF ANY THIRD PARTIES; (E) USE OF YOUR ENABLED DEVICE AND THE SERVICES BY THIRD PARTIES, WHETHER AUTHORISED OR UNAUTHORISED BY YOU; (F) ANY THEFT OR LOSS OF YOUR ENABLED DEVICE; (I) CAUSED BY US DUE TO COMPLIANCE WITH APPLICABLE LAWS, COURT ORDERS, AND/OR CARD NETWORK RULES; AND (II) ARISING OUT OF OR IN CONNECTION WITH THESE TERMS FOR LOST PROFITS, LOST REVENUES, LOST BUSINESS OPPORTUNITIES, EXEMPLARY, PUNITIVE, SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES, EACH OF WHICH IS HEREBY EXCLUDED BY AGREEMENT OF THE PARTIES TO THESE TERMS, REGARDLESS OF WHETHER SUCH DAMAGES WERE DIRECT OR INDIRECT, FORESEEABLE OR UNFORESEEABLE, OR WHETHER WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

27.3 Liability for Contracted Service Providers. The Company remains responsible before you for the integrity, reliability, security, and confidentiality of the services and transactions carried out through contracted relevant service providers, as well as for compliance with applicable legislation and regulation in connection with such services. The Company shall exercise due care in the selection, appointment, and ongoing monitoring of such relevant service providers, including by verifying their technical and operational capacity and legal compliance, and shall maintain recovery plans to safeguard your Virtual Assets and financial resources in the event of incidents involving any such provider. The foregoing does not limit or exclude any liability that may be attributed to the Company under applicable consumer protection or financial regulation.

27.4 Non-Excludable Liability. Nothing in these Terms shall operate to limit or exclude any liability for fraud or for death or personal injury resulting from gross negligence and unlawful misconduct.

28. Indemnification

28.1 User Indemnification Obligations. You agree to indemnify and hold the Company, each of its affiliates, and each of their respective officers, directors, agents, joint venturers, employees and representatives, harmless from any claim or demand (including attorneys’ fees and any fines, fees or penalties imposed by any regulatory authority) arising out of or related to (i) your breach of these Terms; (ii) your unlawful or fraudulent use of the Platform, the Services, the KAST Card, or the Custodian Wallet; and (iii) any transactions and/or Instruction resulting from your wilful default, fraud or gross negligence.

29. Miscellaneous

29.1 Entire Agreement. These Terms, the Schedules the Privacy Policy and all disclosures, notices or policies available on the Platform, comprise the entire understanding and agreement between User and Company as to the Services, and supersedes any and all prior discussions, agreements and understandings of any kind (including without limitation any prior versions of these Terms), and every nature between and among User and Company. Section headings in these Terms are for convenience only and shall not govern the meaning or interpretation of any provision of these Terms. In case of conflict between all the above documents, these Terms shall prevail. These Terms are concluded in the English language and all communications including any notices or information being transmitted shall be in English.

29.2 Amendments. The Company may propose changes to these Terms from time to time. If the Company proposes a material amendment, it shall provide at least thirty (30) days' prior notice to you through the Platform or by email, together with a clear summary of the proposed changes. For the purposes of this clause, “material amendment” shall mean any change that: (i) introduces or increases any fee or charge; (ii) reduces or removes any right or protection available to you; (iii) changes the governing law, dispute resolution mechanism, or liability cap; (iv) alters the asset ownership or custody model; or (v) is otherwise likely to have a significant adverse effect on your use of or rights under the Services. During the notice period, you shall have the right to reject the proposed material amendment by notifying the Company through the Platform. If you reject the amendment, you may terminate your account and withdraw your available balances free of any penalty attributable to the rejection, subject to standard withdrawal procedures and applicable compliance requirements. If you do not reject the amendment within the notice period, the amended Terms shall take effect upon expiry of such period. For changes which are not material amendments, the Company may implement the change to the Terms on immediate written notice to the User.

29.2.1 In addition, we may at any time change, add or remove any feature or functionality of the App without prior notice. By continuing to use the Services after non-material amendments go into effect, the User agrees to be bound by the updated Terms. For material amendments, your continued use of the Services following the expiry of the notice period will only constitute acceptance if you have completed any acceptance step presented to you through the Platform. If no acceptance step is presented, continued use following expiry of the notice period constitutes acceptance. If you do not agree to any of the updated Terms or any future Terms of Service, do not continue to use or access (or continue to access) the Services.

29.2.2 Where an amendment is required by applicable law, a regulatory directive, sanctions obligation, or card network rule with immediate effect, the Company may implement the amendment without advance notice. The Company will notify you of the change as soon as it is legally permitted to do so.

29.3 Force Majeure. The Company is not responsible for delays, failures, or service interruptions stemming from causes beyond reasonable control. This includes but is not limited to, natural disasters, acts of authority, terrorism, wars, labor disputes, fires, technological breakdowns, or any other events outside our reasonable control. Such circumstances will not compromise the validity and enforceability of the remaining provisions of these Terms.

29.4 Assignment. The User may not assign any rights and/or licenses granted under these Terms without the prior written consent of the Company. Any attempted transfer or assignment in violation hereof shall be null and void. Subject to the foregoing, these Terms will bind and insure the benefit of the parties, their successors and permitted assigns.

29.5 Severability. If any provision of these Terms shall be determined to be invalid or unenforceable under any rule, law, or regulation or any governmental agency (local, state, or federal), such provision will be changed and interpreted to accomplish the objectives of the provision to the greatest extent possible under any Applicable Law and the validity or enforceability of any other provision of these Terms shall not be affected.

29.6 Survival. All provisions of these Terms which by their nature extend beyond the expiration or termination of these Terms, including, without limitation, sections pertaining to suspension or termination, Wallet Account cancellation, debts owed to the Company, general use of the Platform, disputes with the Company, and general provisions, shall survive the termination or expiration of this agreement.

29.7 Third Party Rights. No person other than you and us will have any right under the Terms to enforce or enjoy the benefit of any of the provisions of these Terms.

29.8 Governing Law. These Terms, and any dispute or claim arising out of or in connection with them or their subject matter, shall be governed by and construed in accordance with the laws of Brazil.

29.9 Dispute Resolution. Any dispute arising out of or in connection with these Terms shall be resolved as follows: (i) the Parties shall first seek to resolve the dispute amicably through the Complaint Resolution Process described in Section 25; (ii) if the dispute is not resolved within the timeframes established in Section 25, the Client may bring the claim before the courts of the Client's domicile or, at the Client's option, the courts of the city of São Paulo, State of São Paulo, Brazil; (iii) alternatively, the Parties may agree, in writing and after the dispute has arisen, to submit the matter to arbitration under mutually acceptable rules and forum. Nothing in this clause limits the Client's right of access to Brazilian courts under art. 5, XXXV, of the Federal Constitution.

29.10 Arbitration Specifics. The seat of the arbitration shall be São Paulo/SP, Brazil. The language of the arbitration shall be English. This arbitration agreement, and any non-contractual obligations arising out of or in connection with it, shall be governed by the laws of the seat ( Brazil). For claims not exceeding US$10,000, the arbitration shall be conducted solely on the basis of document submissions, unless the arbitrator determines a physical or virtual hearing is strictly necessary.

Definitions

“Acceptable Tokens" refers to the specific Virtual Assets that the Company accepts for deposit into the Custodian Wallet, as may be updated from time to time.

"Account" refers to the account registered by the User to have access to the Platform.

"App" refers to the mobile application software provided by the Company, compatible with Android and Apple iOS devices. It encompasses all content, services, updates, upgrades, supplements, releases, and versions available within or through the application.

“Applicable Law” means all laws, statutes, regulations, rules, directives, guidance, and requirements issued by the BCB or any regulatory authority or government body applicable to the provision or use of the Services in Brazil;

“ATM” means automated teller machines;

"BaaS Regulation" means Joint Resolution No. 16, of 28 November 2025, issued by the BCB and the National Monetary Council, which regulates the provision of Banking as a Service by financial institutions, payment institutions and other institutions authorised to operate by the BCB;

“BCB” means Central Bank of Brazil;

“Card Issuance Services” means the card issuance services provided by a Partner to the Company, which enable the issuance of the Kast Card under the relevant Card Network;

“Card Network” means any international credit, debit and card network that is applicable in respect of your Kast Card;

“Card Data” means the primary account number (PAN), expiration date and security code of a Kast Card;

“Card Transactions” means each transaction effected by using your Kast Card or PIN;

“Chargeback” means a dispute filed by the Company that is sent through the relevant Card Network in accordance with the relevant Card Network Rules relating to a Card Transaction;

“Content” means all written or electronic materials including software, graphics, data, database, text, audio, images, video, photos, or other content;

“Convert” has the meaning specified in the Section titled “KAST Convert Service” in the Terms above;

“Custodian Wallet” means the virtual asset wallet operated by the custodian in which Client virtual assets are held on behalf of the Client, segregated from the Company's own proprietary wallets;

“Custodian” means a Partner designated and appointed by the Company to provide secure wallet services for the holding and management of Virtual Assets;

"Custody Policy" means the document maintained by the Company describing its strategies, measures and procedures for the custody of Virtual Assets, including: (i) compliance with applicable regulation; (ii) governance and internal controls; (iii) risk management; (iv) system adequacy; (v) cybersecurity; and (vi) order processing timelines, as referred to in Section 6.16;

“Enabled Device” refers to the mobile communications or other device successfully registered by you for use in connection with the Platform and Services;

"Instructions" refer to any and all forms of information, communications, directives, or orders associated and initiated by you or your Account, including those related to payments, transfers, or other types of transactions, whether they are automated or manually entered;

"Fiat Partner" means each independent, duly authorised third-party financial institution, payment institution or other institution authorised to operate by the Central Bank of Brazil that is engaged by the Company to provide fiat currency payment, account, on-ramp, off-ramp, settlement or related services to you through the Platform, as further described in Sections 9.4 and 9.5;

“Issuer” means one of our Partner, the ultimate issuer of the Kast Card;

“Kast Card” refers to a payment card, available as either a virtual or physical card, which is issued and distributed in connection with the Platform;

“Key Export” means the irreversible process by which a User exports their wallet key from Privy’s TEE to take sole custody and control of their Self-Custodial Wallet;

“GeneralPartner” means, without limitation, (i) any independent third-party financial institutions, payment processors, card issuers, technology vendors, infrastructure providers, or other operational service providers, and (ii) any affiliates, parent companies, subsidiaries, or related group entities of the Company, in each case that are duly incorporated and authorized under applicable law to carry out their respective activities, and that are engaged by or on behalf of the Company in connection with its operations, ;

"Relevant Service Provider" means any entity that performs functions directly related to the provision of virtual asset services or other regulated activities by the Company, including, without limitation, (i) custodians of virtual assets, (ii) liquidity providers for virtual asset operations, (iii) market makers for virtual asset operations, (iv) electronic money issuers and providers of payment accounts or deposit accounts, and (v) technology service providers whose services are specifically related to the provision of virtual asset services by the Company. For the avoidance of doubt, general IT infrastructure, operational, and ancillary service providers that do not perform functions directly related to the provision of virtual asset services or other regulated activities shall not be considered Relevant Service Providers;

“Platform” means the App and the Website through which the Services are made available;

“Privy” means the third-party digital asset infrastructure provider, as advertised at https://www.privy.io/, used by the Company to provide and operate Self-Custodial Wallets;

“Self-Custodial Wallet” means the on-chain wallet provided exclusively for a User through Privy upon activation of the Self-Custody Mode;

“Self-Custody Mode” means the optional feature available through the Platform that allows a User to hold their KAST spending balance on-chain in their Self-Custodial Wallet, in accordance with these Terms;

“Services'' has the meaning specified in the Terms above.

“USD Spending Account” means the primary transaction ledger or account within the KAST application used for card transactions, funding, transfers and general payments, as further described in the Platform Terms;

“VASP” means Virtual Asset Service Provider;

“Virtual Assets” refer to any digital representation of value that can be digitally traded, transferred or used for payment and includes cryptocurrencies, but excluding: (i) national currency and foreign currencies; (ii) electronic money, as defined under Law No. 12,865 of October 9, 2013; (iii) instruments that grant their holder access to specified products or services, or to benefits arising from such products or services; and(iv) representations of assets whose issuance, bookkeeping, trading, or settlement is provided for by law or regulation, such as securities and financial assets;

“Website” means the Company’s website found at https://www.kast.xyz/pt/brazil, or such other URL the Company may adopt from time to time.