Regulatory and Compliance

Corporate Structure and Operator

The Ruvo Platform is operated by Ruvo Financial Inc., a Delaware corporation.

Ruvo Financial Inc. is wholly owned by Cacao Financial Intermediate Holdings LLC, a Delaware limited liability company, which is wholly owned by Cacao Financial Holdings Limited, a Cayman Islands exempted company.

In this document, "Ruvo," "we," "us," and "our" refer to Ruvo Financial Inc. unless the context indicates otherwise.

Ruvo provides software and technology that enables individuals and businesses to access self-custodial wallet functionality and services provided by independent financial, payment, blockchain, identity-verification, card, and other infrastructure providers.

Ruvo is not a bank and does not provide bank deposit accounts.

Ruvo's Operating Model

Ruvo combines a software interface with services and infrastructure provided by independent third parties.

Depending on the feature used, Ruvo may:

• provide the user interface;
• create or display transaction instructions based on a user's request;
• transmit instructions authorized by users;
• display balances and transaction information;
• display exchange rates, fees, and transaction quotes;
• coordinate transaction workflows;
• facilitate customer and business onboarding;
• integrate self-custodial wallet infrastructure;
• integrate fiat payment rails;
• integrate card functionality;
• integrate blockchain protocols;
• provide customer support.

The fact that a service is accessible through the Ruvo Platform does not necessarily mean that Ruvo itself performs the underlying regulated activity.

Where an integrated service involves banking, payment processing, fiat settlement, card issuance, regulated virtual-asset services, identity verification, or another regulated activity, the relevant portion of that service is performed by the applicable infrastructure provider under the licenses, registrations, authorizations, or other regulatory permissions applicable to that provider.

Specific features and integrations may have different legal and regulatory treatment depending on the activity actually performed.

Nothing in this document should be understood as a statement that a governmental or regulatory authority has approved, endorsed, or adopted Ruvo's characterization of a particular service.

Self-Custodial Wallet Architecture

Certain Ruvo functionality allows users to access digital assets through a self-custodial wallet.

Assets held in a supported self-custodial wallet are not bank deposits with Ruvo and are not held on Ruvo's corporate balance sheet.

Ruvo does not take beneficial ownership of assets held in a user's self-custodial wallet.

Ruvo does not have unilateral control over the cryptographic credentials or authentication mechanisms required to transfer assets from a user's self-custodial wallet.

Users authorize blockchain transactions using the authentication mechanisms associated with their wallet.

The Ruvo Platform may translate a user's requested action into the technical instructions required by a blockchain network, smart contract, or integrated service. This functionality does not by itself cause Ruvo to become the owner or custodian of the user's assets.

Ruvo Account vs. Wallet

A Ruvo Account and a self-custodial wallet are separate concepts.

A Ruvo Account provides access to:

• Ruvo's software;
• account settings;
• transaction information;
• support;
• integrated third-party services.

A self-custodial wallet is the blockchain-based mechanism through which supported digital assets may be held and transferred.

Suspension or termination of a Ruvo Account does not by itself transfer ownership or custody of self-custodial assets to Ruvo.

Blockchain Settlement

Blockchain transactions settle through the applicable blockchain network and may involve smart contracts, validators, RPC providers, stablecoin issuers, protocols, or other third-party infrastructure.

Blockchain transactions may be irreversible once confirmed.

Ruvo generally cannot cancel, reverse, or recover a blockchain transaction that has been validly submitted and finalized.

Fiat and Self-Custody Are Different

Self-custody applies to assets held within the applicable self-custodial wallet.

Fiat funds moving through:

• banks;
• virtual accounts;
• Pix;
• ACH;
• wire transfers;
• RTP;
• SWIFT;
• card networks;
• conversion providers;
• other payment infrastructure

are processed according to the technical, contractual, and regulatory structure of the relevant Infrastructure Partner.

Accordingly, statements regarding self-custody should not be interpreted as describing every intermediate stage of a fiat payment or settlement flow.

Brazil and BRL Settlement

Ruvo may facilitate transactions involving Brazilian reais ("BRL") and supported digital assets, including U.S. dollar-denominated stablecoins.

Where Ruvo facilitates conversion or settlement between BRL and supported digital assets, the underlying regulated activities are performed through licensed, authorized, registered, or otherwise eligible Infrastructure Partners, as applicable.

These providers may include:

• virtual asset service providers;
• payment institutions;
• financial institutions;
• banks;
• other regulated intermediaries.

Ruvo may provide the technology interface, transmit user instructions, coordinate transaction flows, display pricing and transaction information, and connect the relevant providers within the Ruvo user experience.

Transactions involving BRL may rely on Brazilian payment infrastructure, including Pix, through the applicable providers.

U.S. Dollar Accounts and Payment Infrastructure

Ruvo also integrates HIFI for certain U.S. dollar account and payment functionality.

HIFI is not used by Ruvo for Ruvo's BRL/Pix settlement flow described above.

Through HIFI and the relevant banking and payment infrastructure supporting it, Ruvo may make available functionality including:

• named U.S. dollar virtual-account details;
• ACH;
• Fedwire;
• RTP;
• domestic wire functionality;
• fiat-to-stablecoin conversion associated with supported account flows;
• other U.S. payment functionality.

HIFI publicly describes its virtual-account infrastructure as enabling named virtual accounts and supporting ACH, Fedwire, RTP, and wire, with fiat deposits capable of being converted into stablecoins and delivered to a recipient wallet. HIFI: https://www.hifi.com/cross-border-payments

Ruvo provides the customer-facing technology and integration through which eligible users may access this functionality.

The underlying bank account, payment, settlement, or other regulated functionality is provided through HIFI and/or the applicable financial institution or payment partner, as relevant to the particular service.

Any routing number, account number, virtual account, or similar banking credential accessible through Ruvo does not represent a deposit account maintained by Ruvo.

Wallet Infrastructure

Ruvo uses Crossmint for certain blockchain wallet infrastructure.

Crossmint provides technology that allows applications to integrate blockchain wallets and authentication functionality. Crossmint publicly offers wallet, stablecoin, authentication, and other blockchain infrastructure products. Crossmint Docs: https://docs.crossmint.com/docs

The specific wallet configuration used by Ruvo is designed so that Ruvo does not have unilateral authority to move assets from a user's self-custodial wallet.

Ruvo may use passkeys or related cryptographic authentication methods to enable users to authenticate and approve wallet activity.

The precise technical architecture may evolve as wallet technology, authentication standards, networks, or Infrastructure Partners change.

Brazilian Virtual-Asset Framework

Brazil's current framework for virtual-asset service providers includes Resolution BCB No. 520, dated November 10, 2025, which governs the establishment and operation of virtual-asset service-provider companies and virtual-asset services performed by institutions authorized by the Central Bank of Brazil.

Article 88 establishes a transitional authorization process for companies already conducting covered activities when the Resolution entered into force. Banco Central do Brasil: https://www.bcb.gov.br/estabilidadefinanceira/exibenormativo?numero=520&tipo=Resolu%C3%A7%C3%A3o+BCB

Ruvo evaluates its products and integrations in light of applicable Brazilian law and may modify, restrict, or discontinue functionality as regulations or provider requirements evolve.

Regulatory Evolution

Financial services, digital assets, stablecoins, blockchain technology, payments, and related regulatory frameworks continue to evolve.

Ruvo continuously evaluates:

• changes to its products;
• new integrations;
• provider changes;
• regulatory developments;
• legal interpretations;
• new jurisdictions.

Ruvo may change, restrict, suspend, or discontinue functionality where reasonably necessary to address legal, compliance, security, provider, or operational requirements.

A particular regulatory characterization applicable to one feature should not automatically be assumed to apply to another feature.

Infrastructure Partners

Ruvo integrates independent third-party providers ("Infrastructure Partners") that supply functionality Ruvo does not itself provide.

Depending on the product or transaction, Infrastructure Partners may provide:

• wallet infrastructure;
• identity verification;
• business verification;
• banking infrastructure;
• virtual accounts;
• ACH;
• domestic wire;
• RTP;
• international payment rails;
• Pix;
• fiat-to-digital-asset conversion;
• digital-asset-to-fiat conversion;
• liquidity;
• card issuance;
• card processing;
• blockchain execution;
• yield infrastructure.

Ruvo may add, replace, or change Infrastructure Partners as its services evolve.

The specific provider used for a transaction may depend on the user, jurisdiction, currency, payment rail, transaction type, availability, compliance requirements, or other operational considerations.

BlindPay

Ruvo uses BlindPay infrastructure for certain BRL, Pix, fiat, and digital-asset settlement flows.

Blind Pay, Inc. publicly reports registration with the U.S. Financial Crimes Enforcement Network ("FinCEN") as a Money Services Business under registration number 31000277566153.

Blind Pay, LLC publicly reports FinCEN MSB registration number 31000318334247 and NMLS ID 2745309.

BlindPay's Brazilian entity, Blind Pay Sociedade Prestadora de Serviços de Ativos Virtuais Ltda., publicly identifies itself as a Brazilian virtual asset service provider completing the regulatory adaptation process under Resolution BCB No. 520/2025 and the transitional regime in Article 88. BlindPay: https://blindpay.com/compliance

BlindPay and its applicable regulated partners are responsible for the regulatory obligations associated with the activities they perform.

Identity and Business Verification

Ruvo uses Sumsub for identity-verification and related compliance technology.

Depending on the user, product, and risk involved, verification may include:

• identity-document verification;
• biometric or liveness checks;
• address verification;
• database validation;
• sanctions and watchlist screening;
• politically exposed person screening where applicable;
• business verification;
• corporate-document verification;
• beneficial-owner verification;
• other KYC or KYB controls.

Sumsub publicly describes its products as supporting identity verification, biometric checks, AML screening, KYB, ownership verification, and sanctions/watchlist screening. Sumsub: https://docs.sumsub.com/docs/aml-how-it-works

Sumsub provides technical verification services. Ruvo remains responsible for decisions Ruvo itself makes regarding access to the Ruvo Platform, while individual Infrastructure Partners may separately perform their own KYC/KYB and compliance reviews.

Cards

Card functionality accessible through Ruvo is provided through independent card-program infrastructure.

Depending on the applicable program, this may involve:

• a card issuer;
• program manager;
• processor;
• Visa or another payment network;
• additional compliance and fraud providers.

Ruvo provides software through which eligible users may access card functionality but is not the issuing bank.

Card authorization, settlement, merchant acceptance, restrictions, disputes, reversals, and other card functionality may be determined by the applicable issuer, program partner, processor, or payment network.

Card use is subject to applicable cardholder terms and provider disclosures.

Infrastructure Partner Due Diligence

Ruvo evaluates Infrastructure Partners before and during integrations based on factors relevant to the particular service.

Depending on the provider and relationship, this review may consider:

• corporate identity;
• regulatory status;
• licenses or registrations;
• compliance policies;
• AML/CFT controls;
• sanctions controls;
• security practices;
• operational capability;
• service reliability;
• contractual obligations;
• relevant regulatory or enforcement history.

Ruvo may periodically reassess Infrastructure Partners as its products or applicable requirements change.

Where appropriate, Ruvo may implement provider requirements and controls within its own interface and workflows.

Ruvo's Own Compliance and Risk Controls

The use of independent regulated providers does not mean that Ruvo operates without its own controls.

Ruvo maintains risk-based controls intended to protect the Ruvo Platform, its users, Infrastructure Partners, and the integrity of transactions facilitated through its software.

Depending on the circumstances, these controls may include:

• customer identity verification;
• business verification;
• beneficial-owner verification;
• sanctions screening;
• wallet screening;
• transaction monitoring;
• fraud detection;
• device and account-risk analysis;
• source-of-funds inquiries;
• source-of-wealth inquiries;
• enhanced due diligence;
• transaction review;
• account or functionality restrictions;
• investigation and escalation of suspicious activity;
• recordkeeping.

Ruvo may request additional information concerning:

• a user;
• a business;
• beneficial owners;
• counterparties;
• the source of funds;
• the source of wealth;
• a particular transaction;
• the economic purpose of a transaction;
• expected account activity.

Ruvo does not publicly disclose specific fraud, transaction-monitoring, security, sanctions, or compliance thresholds where doing so could reduce their effectiveness.

Sanctions and Restricted Activity

Ruvo maintains controls relating to applicable sanctions and restrictive measures.

Ruvo may screen users, businesses, wallet addresses, counterparties, or transactions against sanctions and other risk databases.

Access or transaction functionality may be restricted where Ruvo reasonably determines that activity:

• involves a sanctioned or blocked person;
• involves a prohibited jurisdiction;
• may constitute sanctions evasion;
• presents elevated financial-crime risk;
• violates Ruvo's Terms of Use;
• violates an Infrastructure Partner's requirements;
• may violate applicable law.

Restrictions imposed through the Ruvo Platform do not themselves transfer custody of assets held in a self-custodial wallet to Ruvo.

Holds, Delays, and Transaction Restrictions

Transactions accessible through Ruvo may be:

• delayed;
• declined;
• returned;
• recalled;
• reversed;
• charged back;
• subject to additional review.

This may occur because of:

• payment-network rules;
• bank requirements;
• sanctions screening;
• KYC/KYB review;
• suspected fraud;
• compliance review;
• insufficient or inconsistent information;
• provider requirements;
• legal process;
• technical failure;
• blockchain conditions.

Ruvo may restrict its own interface or transaction-initiation functionality when reasonably necessary.

Infrastructure Partners may separately restrict the services they provide.

Ruvo may not always be permitted to disclose the reason for a restriction.

Restrictions involving the Ruvo Platform do not mean that Ruvo has taken ownership or custody of self-custodial assets.

Tax and Regulatory Reporting

Users are responsible for understanding and complying with tax and reporting obligations applicable to them.

Ruvo does not provide individualized tax advice.

The reporting obligations applicable to a transaction may depend on:

• the user's tax residence;
• the nature of the transaction;
• transaction value;
• the assets involved;
• the service provider involved;
• the jurisdiction in which the activity occurs.

Ruvo evaluates reporting obligations applicable directly to it and provides information to governmental or regulatory authorities where required by applicable law or valid legal process.

Infrastructure Partners are separately responsible for reporting obligations applicable to the services they perform.

Users remain responsible for any tax returns, declarations, or reporting obligations imposed directly on them.

IOF and Taxes on Brazilian Transactions

The tax treatment of a transaction depends on its legal and operational structure and applicable law at the time the transaction occurs.

Where Ruvo displays information concerning IOF or other taxes, that information reflects Ruvo's understanding of the treatment applicable to the transaction structure at that time and may change as legislation, regulation, administrative interpretation, or the underlying transaction structure changes.

Ruvo does not withhold, calculate, or provide individualized advice concerning a user's Brazilian income-tax obligations unless expressly stated otherwise.

Users should consult an appropriate tax professional regarding their own circumstances.

Deposit Insurance

Whether any fiat funds associated with a particular U.S. account structure qualify for FDIC insurance or pass-through deposit insurance depends on the applicable bank, account structure, recordkeeping, beneficial ownership, and other requirements.

Ruvo does not represent that all funds accessible through Ruvo are FDIC-insured merely because an Infrastructure Partner uses an FDIC-insured bank.

Where applicable, account-specific deposit-insurance disclosures will be provided in connection with the relevant product or provider.

Yield and On-Chain Financial Products

Ruvo may provide optional access to third-party blockchain protocols or financial infrastructure through which users can seek to earn yield on supported digital assets.

Where available, Ruvo's role may include:

• presenting the feature in the Ruvo interface;
• displaying estimated yields;
• preparing technical instructions based on the user's request;
• facilitating interaction with the relevant smart contracts or providers;
• displaying balances and activity.

Yield may depend on:

• smart contracts;
• decentralized protocols;
• vaults;
• liquidity markets;
• stablecoin issuers;
• third-party managers or curators;
• borrowers or counterparties;
• blockchain networks.

Displayed annual percentage yields or similar rates are estimates and may change.

Yield is not guaranteed.

Principal may be subject to loss.

Digital assets used in an Earn or yield feature are not bank deposits merely because the feature is accessible through Ruvo and are not automatically protected by the FDIC, FGC, SIPC, or another deposit or investor-protection scheme.

Liquidity may also be subject to protocol, vault, market, provider, blockchain, compliance, or technical constraints.

Where applicable, product-specific terms and risk disclosures govern these features.

Morpho and Vault Infrastructure

Where offered through Ruvo, yield functionality may involve the Morpho protocol and third-party vault infrastructure or curators, including products identified in the Ruvo interface or applicable product disclosures.

Ruvo does not guarantee the performance, continued availability, security, or solvency of any third-party protocol, smart contract, vault, curator, or counterparty.

Continuity and What Happens if Ruvo Stops Operating

Assets held in a user's self-custodial wallet exist on the applicable blockchain independently of Ruvo and are not dependent on Ruvo's continued operation.

If Ruvo ceases operations, ownership of those assets remains with the user and does not transfer to Ruvo, its affiliates, or its creditors.

Users may export the cryptographic credentials associated with their self-custodial wallet and use them to access the wallet through compatible third-party wallet software or other supported interfaces independently of Ruvo.

Accordingly, the continued existence and ownership of assets held in the self-custodial wallet do not depend on the continued availability of the Ruvo Platform.

Ruvo does not guarantee that every Ruvo interface, integration, or third-party service will remain available indefinitely. Fiat, banking, card, payment, yield, and other services provided by Infrastructure Partners remain subject to the applicable provider's systems, terms, availability, and continuity arrangements.

Consumer Support and Transaction Issues

Ruvo provides customer support regarding the Ruvo Platform and coordinates with Infrastructure Partners where necessary.

Users may contact Ruvo concerning:

• account access;
• identity verification;
• transaction status;
• failed payments;
• card issues;
• suspected fraud;
• unauthorized activity;
• product functionality;
• provider-related issues.

The ability to cancel, reverse, refund, recall, or recover a transaction depends on the transaction type and applicable infrastructure.

For example:

• a blockchain transaction may be irreversible once finalized;
• a Pix, ACH, card, or wire transaction may be governed by the applicable provider and payment-network rules;
• card disputes and chargebacks may be governed by the issuer and card network.

Ruvo does not guarantee that every completed transaction can be reversed or recovered.

Service Restrictions and Account Suspension

Ruvo may restrict or suspend access to all or part of the Ruvo Platform where reasonably necessary for:

• compliance;
• fraud prevention;
• sanctions;
• security;
• provider requirements;
• suspected unauthorized activity;
• violation of Ruvo's Terms;
• legal requirements;
• technical protection.

An Infrastructure Partner may separately restrict the service it provides.

Suspension of Ruvo Platform access does not itself transfer ownership or custody of self-custodial assets to Ruvo.

Data Protection and Privacy

Ruvo processes personal data in accordance with its Privacy Policy and applicable data-protection requirements.

Depending on how a user interacts with Ruvo, data processed may include:

• account information;
• contact information;
• identity-verification information;
• business information;
• transaction information;
• device and security information;
• information required by Infrastructure Partners;
• support communications.

Ruvo may share information with Infrastructure Partners where reasonably necessary to:

• provide requested services;
• verify users or businesses;
• process transactions;
• prevent fraud;
• conduct AML/CFT or sanctions screening;
• provide cards or payment functionality;
• comply with legal requirements.

Information may be processed outside the user's country of residence.

Public blockchain transactions are generally immutable, and information written to a public blockchain may not be technically capable of deletion or alteration by Ruvo.

LGPD

Ruvo processes personal information relating to Brazilian users in accordance with applicable requirements under Brazil's Lei Geral de Proteção de Dados Pessoais — LGPD (Law No. 13,709/2018).

Users may exercise applicable data-protection rights through the channels described in Ruvo's Privacy Policy.

Other Data-Protection Regimes

Other data-protection laws may apply depending on the location of the user and the nature of the processing.

Ruvo assesses these obligations as its services and geographic availability evolve.

Privacy Contact

For data-protection inquiries:

dpo@ruvo.com

Security

Ruvo maintains technical and organizational measures intended to protect user information, account access, and the Ruvo Platform.

Depending on the relevant system, controls may include:

• encryption in transit;
• encryption at rest;
• access controls;
• authentication controls;
• passkeys;
• monitoring;
• fraud detection;
• security logging;
• secure cloud infrastructure;
• provider-level security controls.

Ruvo may also rely on security measures maintained by Infrastructure Partners.

No technology system can guarantee absolute security.

Users are responsible for protecting:

• their devices;
• email accounts;
• telephone numbers;
• passkeys;
• authentication credentials;
• wallet authentication mechanisms.

Users should immediately contact Ruvo if they believe their account or device has been compromised.

Relationship to Ruvo's Legal Documents

This page is intended to provide a transparent explanation of Ruvo's operating model and compliance approach.

It does not replace:

• Ruvo's Terms of Use;
• Privacy Policy;
• applicable cardholder terms;
• product-specific disclosures;
• Infrastructure Partner agreements;
• other terms applicable to a particular product.

Where those documents conflict with this page, the applicable legal agreement or policy will control.

Contact

Ruvo Financial Inc.

A Delaware corporation wholly owned by Cacao Financial Intermediate Holdings LLC, a Delaware limited liability company, which is wholly owned by Cacao Financial Holdings Limited, a Cayman Islands exempted company.

Customer Support: ajuda@ruvo.com

Legal: legal@ruvo.com

Data Protection: dpo@ruvo.com

Website: http://www.ruvo.com