Risk Disclosure Statement

Last updated: 28/07/2026

IMPORTANT NOTICE

This Risk Disclosure Statement (‘Disclosure’) is provided pursuant to the requirements of the Swiss Financial Services Act (FinSA), the Anti-Money Laundering Act (AMLA), and VQF/SRO regulatory guidelines. Please read this document carefully in its entirety before using any services offered by PORTFOLIUM X AG. By proceeding with your onboarding or executing any transaction, you confirm that you have read, understood, and accepted all risks described herein.

PORTFOLIUM X AG is a company incorporated under Swiss law and is not authorized under the Markets in Crypto-Assets Regulation (MiCA) or by any financial supervisory authority of the European Union or European Economic Area. The services described are not offered to EU/EEA residents except under the reverse solicitation exemption as defined in Article 61 of MiCA.

With respect to jurisdictions outside Switzerland, this document is confidential and is intended only for persons who have contacted PORTFOLIUM X AG at their own initiative. It may not be copied, distributed, published, or shared – particularly in jurisdictions such as the European Union (EU) or European Economic Area (EEA), where PORTFOLIUM X AG does not offer or advertise its services.

1. Definitions

For the purposes of this Risk Disclosure Statement, the following terms shall have the meanings set out below. Defined terms appear in bold throughout this document.

Term	Definition
A. Regulatory & Entity Terms
Agreement	All the documents that form the legal relationship between you and the Company, including the General Terms and Conditions, this Risk Disclosure, and any other specific agreements you sign with us.
AMLA	The main Swiss law on anti-money laundering and preventing the financing of terrorism. It sets out the rules that financial companies, including crypto service providers like the Company, must follow to prevent illegal activity.
Services	Everything the Company offers to clients: buying and selling crypto, converting between crypto and fiat, keeping your crypto safe, and processing crypto payments on your behalf.
SRO / VQF	VQF is a Swiss supervisory body recognised by FINMA. Companies that are members of VQF must follow strict anti-money laundering rules and are regularly audited to make sure they comply. The Company is a VQF member, which means it operates under official Swiss oversight.
B. Technology Terms
Blockchain	A type of digital record book that stores transaction history in a chain of connected blocks. Once a transaction is added to the chain, it cannot be changed or deleted. Bitcoin and Ethereum both run on their own blockchains.
Block Confirmation	When you send crypto, the network needs to verify and record your transaction. Each “confirmation” is one more step in that process. The more confirmations a transaction has, the more certain it is that it cannot be reversed. Most transactions are considered final after a set number of confirmations.
Cold Wallet / Hot Wallet	A Cold Wallet is a secure storage method that is completely offline, like a safe that is never connected to the internet. It is harder to hack. A Hot Wallet is connected to the internet, which makes transactions faster but slightly less secure. The Company uses both, depending on the situation.
Distributed Ledger Technology (DLT)	A way of storing and sharing records across many computers at the same time, without any single person or company being in charge. Instead of one central database (like a bank's), thousands of computers around the world each hold a copy, and they all agree on what is true. Blockchain is the most well-known example of DLT.
Fork (Hard Fork / Soft Fork)	An update or change to the rules of a blockchain network. A Hard Fork is a major change that creates a split, effectively producing two separate versions of the blockchain, sometimes with two different coins. A Soft Fork is a smaller update that is compatible with the old rules. Either type of fork can affect the value or availability of your crypto.
Multi-Party Computation (MPC)	A security method used by our custody infrastructure provider where no single person or computer ever holds the complete key to your crypto. Instead, the key is split into several pieces held in different places. To move funds, multiple pieces must be combined, which makes it much harder for a hacker to steal anything.
Private Key / Public Key	Think of a Private Key as the password to your crypto. Anyone who has it can access and move your funds. It must never be shared. A Public Key is like your bank account number, you can share it with others so they can send you crypto. If a Private Key is lost or stolen, the crypto it controls is gone forever and cannot be recovered.
Wallet	A digital tool (app, device, or software) that lets you store, send, and receive crypto. It does not actually hold your crypto, your crypto lives on the blockchain. What the wallet holds is your Private Key, which is what proves you own your crypto and allows you to use it.
C. Asset Terms
CBDC	A digital version of a country's official currency, issued and fully controlled by that country's central bank (for example, a digital Swiss Franc or digital Euro). Unlike crypto, a CBDC is government-backed. The Company does not currently offer CBDC services.
Crypto Asset / Digital Asset/ Virtual Asset	A digital currency or digital asset that exists only online and uses blockchain technology. It is not issued or guaranteed by any government or bank. The Company works with the following crypto assets / digital assets: Bitcoin (BTC), Ether (ETH), USD Coin (USDC), Tether (USDT), and Euro Coin (EURC).
Fiat Currency	Regular government-issued money, such as the Swiss Franc (CHF), Euro (EUR), or US Dollar (USD). Unlike crypto, fiat currency is issued and backed by a government and is accepted as official legal payment.
Stablecoin	A type of crypto that is designed to keep a fixed value, usually equal to one unit of a regular currency (like 1 USDC = 1 US Dollar). However, the word “stable” is not a guarantee. Stablecoins can lose their peg in extreme situations. The Company offers three stablecoins: USDC and USDT (both linked to the US Dollar) and EURC (linked to the Euro).
D. Service Terms
Custody and Administration	Custody means we keep your crypto safe on your behalf, similar to how a bank holds your money. Administration means we manage the day-to-day operations of your account, such as processing transactions and keeping records. Your crypto is kept separately from the Company's own funds.
Exchange / Conversion	The process of swapping one type of currency for another, for example, converting Bitcoin into Swiss Francs, or Euros into USDC. The rate you receive depends on the market price at the moment of your transaction, plus the Company’s applicable fees.
Payment Acquisition	A service for businesses that want to accept crypto as payment from their customers. The Company handles the technical side: it receives the crypto payment, and either converts it to fiat currency or holds it for you, depending on your instructions. It works through our built-in invoicing system.
Settlement / Settlement Finality	Settlement is when a transaction is fully completed and the funds have been received. On a blockchain, once a transaction is settled, it is permanent, it cannot be cancelled, reversed, or refunded. This is different from a bank transfer, which can sometimes be recalled. Always double-check the recipient address before sending crypto.
E. Risk & Compliance Terms
AML / CFT	AML stands for Anti-Money Laundering, and CFT stands for Counter-Financing of Terrorism. These are the rules that financial companies must follow to stop criminals from using their services to hide or move illegal money. As a VQF member, the Company is legally required to apply these rules to all clients.
Enhanced Due Diligence (EDD)	A more thorough check that we carry out for certain clients or transactions that are considered higher risk. It goes further than the standard identity check and may involve questions about where your money comes from and why you are using our services.
Know Your Customer (KYC)	The process of verifying who you are before you can use our services. This typically involves providing a photo ID and proof of address. KYC is required by Swiss law. You must let us know if any of your personal details change.
Source of Funds / Source of Wealth	Source of Funds means where the money for a specific transaction comes from (for example, your salary or the sale of a property). Source of Wealth means where your overall savings and assets come from. We may ask you to explain either of these as part of our legal compliance checks.
Travel Rule	A Swiss and an international rule that requires crypto companies to share information about who is sending and who is receiving funds, for transfers above a certain amount. It works similarly to the information that banks exchange when you make a wire transfer. If we cannot collect the required information and obtain the required proof of control in case of wallets, we will not be able to process your transaction. In accordance with the FINMA Guidance 02/2019 concerning the travel rule requirements, the Company has implemented a process to verify that Clients have the power of disposal over the external wallet address used for transfers to and from their Company accounts. The Client acknowledges and agrees that the Company will only execute transfer requests to or from verified external wallet addresses.

2. Purpose and Scope

This Disclosure sets out the material risks associated with crypto asset services provided by PORTFOLIUM X AG (‘Company’, ‘we’, ‘us’). The Company is a member of the VQF Self-Regulatory Organisation (SRO), which is recognised by the Swiss Financial Market Supervisory Authority (FINMA) under the Anti-Money Laundering Act (AMLA). The Company is not a FINMA-licensed bank or securities dealer. No deposit guarantee scheme or investor compensation scheme applies to assets held with the Company. As a member of VQF, Portfolium X AG is a Swiss financial intermediary within the meaning of Art. 2 para. 3 AMLA, and it is only subject to the application of the AMLA.

This Disclosure applies to all services offered by the Company, including:

Exchange of crypto assets for fiat currency and vice versa
Purchase and sale of crypto assets on behalf of clients
Custody and administration of crypto assets
Payment acquisition services via an integrated invoicing system

This Disclosure constitutes an integral part of the contractual framework governing the relationship between the Client and the Company. It must be read in conjunction with the Company’s General Terms and Conditions and any specific agreements entered into between the Client and the Company, all of which together form the basis of the services provided. The Company reserves the right to revise or update this Disclosure at any time. Any material amendments will be communicated to Clients through the agreed channels prior to taking effect.

3. Regulatory and Legal Framework

The Company operates in compliance with the following Swiss legal and regulatory instruments:

Swiss Anti-Money Laundering Act (AMLA, SR 955.0) and its associated ordinances
VQF Code of Conduct and VQF Directives for Members
Swiss Financial Services Act (FinSA, SR 950.1) — applicable to the extent that services constitute the distribution or provision of financial instruments
Swiss sanctions framework administered by the State Secretariat for Economic Affairs (SECO), including the following main legislation / sources:
- Federal Act on the Implementation of International Sanctions – Embargo Act, EmbA / LEmb, SR 946.231.
- Federal Council sanctions ordinances issued under the Embargo Act, including country- and regime-specific ordinances.
- SECO consolidated sanctions lists / sanctions search tool, used for identifying sanctioned persons, entities and organisations.
Federal Act on Data Protection (nFADP, SR 235.1)
FATF Recommendations on Virtual Assets and Virtual Asset Service Providers (VASPs)

The Company is subject to ongoing supervision by VQF in respect of its Anti-Money Laundering (AML) and Know Your Customer (KYC) obligations. Clients should be aware that the regulatory environment for crypto assets is evolving rapidly, and changes in applicable law or regulation may materially affect the services available, the terms of service, or the Company’s ability to operate in certain jurisdictions.

No Deposit Protection

The Company is not a bank and does not hold a FINMA banking licence. Client assets held in custody are NOT protected by the Swiss depositor protection scheme and are NOT covered by any investor compensation scheme.

In the event of insolvency of the Company or any sub-custodian, clients may lose all or part of their assets.

4. Client Scope and Reverse Solicitation

The Company provides its services to retail clients and corporate clients domiciled in Switzerland. Services may also be made provided to clients domiciled in European Union member states, subject to the conditions described below. The Company does not offer or market its services to residents or citizens of the European Union (EU) or European Economic Area (EEA), unless the Client has initiated contact entirely on their own initiative. Users from jurisdictions where the Company is not authorized should not use the services.

Reverse Solicitation — EU/EEA Clients. The Company does not hold a licence under the EU Markets in Crypto-Assets Regulation (MiCA) and does not actively market, advertise, or solicit clients in the European Union. Services to EU-based clients are provided exclusively on a reverse solicitation basis, meaning that the Client has approached the Company on their own exclusive initiative, without any prior solicitation, promotion, or marketing by the Company directed at that Client or at Clients in their jurisdiction.

Because the Company does not operate under a MiCA licence, it does not benefit from EU/EEA passporting rights and EU/EEA clients do not benefit from the investor protections afforded by MiCA to clients of licensed crypto asset service providers. EU/EEA clients should be aware that the regulatory protections applicable to MiCA-licensed providers, including conduct of business rules, safeguarding requirements, and complaint mechanisms under MiCA, do not apply to services provided on a reverse solicitation basis.

Each EU-based client is solely responsible for ensuring that their use of the Company’s services is permitted under the laws of their own jurisdiction, including any applicable local implementation of MiCA. The Company reserves the right to decline or terminate services to any client if it determines, at its sole discretion, that providing services to that client would be inconsistent with the reverse solicitation framework or with applicable law.

All clients, whether based in Switzerland or the EU, are subject to the Company’s KYC and AML/CFT onboarding requirements under Swiss law. Clients are classified as retail or corporate and are subject to transaction limits determined by their applicable due diligence tier, as communicated during onboarding. The Company applies a risk-based approach and reserves the right to request additional information, adjust limits, or suspend services if a client’s risk profile changes.

5. Crypto Asset Risk Disclosure

The following risks apply specifically to transactions and holdings in crypto assets. This list is not exhaustive, and clients should conduct their own independent research and seek independent professional advice before engaging in any crypto asset activity.

5.1 Market and Price Volatility Risk

Crypto assets are among the most volatile investment instruments available today. Unlike traditional financial markets, such as stocks, bonds, or foreign exchange, the crypto market operates 24 hours a day, 7 days a week, with no circuit breakers, no trading halts, and no central authority to intervene during periods of extreme movement. This means prices can rise or fall dramatically at any time, including overnight, on weekends, and during public holidays, when traditional markets are closed.

Investing in crypto assets carries a substantially higher level of risk than investing in traditional assets. There is no guaranteed return, no minimum value, and no safety net. You should only invest money that you can afford to lose entirely. Unlike bank deposits, crypto assets held with the Company are not protected by any government guarantee or compensation scheme.

Stablecoins (USDC, USDT, EURC) are designed to hold a fixed value relative to a reference currency; however, this stability is not guaranteed. Stablecoins have lost their peg in the past under adverse market conditions, resulting in significant losses for holders. The Company does not guarantee the value of any stablecoin at any time.

Crypto assets may be difficult to value because they may not represent ownership, cash flows, creditor claims, or traditional rights, and traditional valuation models may not apply.

Past performance of any crypto asset is not indicative of future results and should not be relied upon when making investment decisions.

You may lose your entire investment.

Crypto assets are not legal tender. They carry no intrinsic value guarantee and are not backed by any government or central bank (with the exception of the reference asset of stablecoins, which is itself subject to risk).

5.2 Liquidity Risk

Liquidity refers to how easily and quickly an asset can be bought or sold without significantly affecting its price. Crypto asset markets can experience sudden and severe liquidity shortages, and clients should be aware that the ability to buy or sell crypto assets is never guaranteed.

During periods of extreme market volatility or technical disruption, the Company may be unable to execute client orders at the requested price or within a reasonable timeframe. The difference between the buying price and the selling price (known as the bid-ask spread) may widen significantly during such periods, meaning clients may receive a less favourable rate than expected. In extreme cases, clients may be temporarily unable to sell or exit their positions at all.

Crypto markets can appear liquid under normal conditions but become very illiquid very quickly. A single large market event, such as a major exchange failure, a regulatory announcement, or a sudden shift in market sentiment, can cause available buyers and sellers to disappear within minutes. A small number of large holders, sometimes referred to as “whales”, can also significantly disrupt market liquidity through large buy or sell transactions.

Crypto markets are still emerging, less mature, less transparent, fragmented, and may suffer from execution delays, unreliable pricing, or market-structure failures. Liquidity may be fragmented across venues and that fragmentation may make pricing, execution, settlement, or exits difficult or impossible. Crypto markets may be more exposed to fraud, market manipulation, wash trading, insider dealing, pump-and-dump schemes, and other abusive conduct because they may not be subject to the same standards as regulated traditional markets.

Converting crypto assets back into fiat currency (such as CHF, EUR, or USD), known as an “off-ramp”, may also be subject to delays or restrictions during periods of high demand, banking partner constraints, or regulatory intervention. The speed at which funds can be transferred to a client’s bank account is not guaranteed and may vary.

Stablecoins carry their own liquidity risk. During periods of market stress, the issuers of stablecoins may delay, limit, or suspend redemptions, meaning you may not be able to convert your stablecoins into fiat currency immediately or at all. This risk is outside the Company’s control.

The Company does not guarantee that it will always have sufficient liquidity to fulfil all client orders immediately. In extreme or exceptional market conditions, the Company reserves the right to delay, limit, or suspend order execution in order to protect the interests of all clients and maintain operational stability.

5.3 Regulatory Risk

The regulatory and legal environment surrounding crypto assets is one of the least settled areas of modern financial law. Governments, regulators, and courts around the world are still in the process of determining how crypto assets should be classified, regulated, taxed, and treated in legal proceedings. This uncertainty is itself a material risk that clients must understand before engaging with crypto asset services.

Legal Uncertainty and Classification. There is currently no globally agreed legal definition of what a crypto asset is. Depending on the jurisdiction, a crypto asset may be classified as a commodity, a security, a means of payment, a financial instrument, or something else entirely, and this classification can change over time. In Switzerland, the legal treatment of crypto assets has evolved significantly following the enactment of the DLT Act; however, many areas remain unsettled. A reclassification of any of the assets offered by the Company could subject those assets, or the Company’s services, to new regulatory requirements, restrictions, or prohibitions. The Company supports only virtual assets that are classified according to Swiss law as “utility” or “payment” tokens, no tokens that can be classified as securities will be involved.

No Legal Tender Status. Crypto assets are not legal tender in Switzerland or in any European Union member state. No government or central bank guarantees their value, accepts them as a form of tax payment, or requires any person or business to accept them as a means of settling debts. The value of a crypto asset is derived entirely from market demand, and that demand can disappear entirely.

Changing Legislation and Supervisory Measures. Laws and regulations applicable to crypto assets are changing rapidly and unpredictably. Future legislative or regulatory changes, whether in Switzerland, the European Union (including under MiCA), or any other relevant jurisdiction, may restrict or prohibit the holding, transfer, or exchange of specific crypto assets; impose new licensing, reporting, or capital requirements on the Company; require the Company to suspend or terminate services to clients in certain jurisdictions; or significantly increase the compliance burden and cost of operating. Regulatory authorities may also take supervisory measures, including inspections, orders, fines, or licence revocations, against crypto asset service providers, including the Company, which could materially affect the availability of services. This may result in a crypto asset being delisted from an execution venue or no longer being offered for trading by a crypto services provider, or in rights associated with crypto assets no longer being recognized by law. If countries prohibit or restrict trading and/or holding crypto assets, this may result in the inability to sell and/or hold such crypto assets, ultimately affecting their value. The Company will endeavour to provide clients with reasonable prior notice of any material changes affecting their account; however, in some circumstances this may not be possible.

Bankruptcy and Insolvency Treatment. The treatment of crypto assets in insolvency and bankruptcy proceedings remains legally uncertain in many jurisdictions, including Switzerland. In the event of opening of bankruptcy proceedings against the Company in Switzerland, the digital assets of the Client held in segregated custody are secured by the Client’s claims against the bankruptcy estate of the Company to hand over the respective crypto assets based on the Swiss Debt Collection and Bankruptcy Act. Although the Swiss DLT Act introduced provisions intended to protect Client crypto assets held in custody in the event of a service provider’s insolvency, the practical application of these provisions has not been fully tested by Swiss courts. There is no guarantee that Client assets would be fully protected or promptly returned in an insolvency scenario. Recovery may be subject to legal proceedings, significant delay, and partial or total loss.

Tokenization. Where crypto assets are intended to constitute, embed, or represent legal rights and/or obligations, the legal effectiveness of such construct may be subject to differing rules in the potentially relevant jurisdictions, including the jurisdiction of the issuer or the holder of the relevant crypto asset. There is a risk that tokenization of the underlying rights and/or obligations and/or the transfer of such rights and/or obligations by transfer of a crypto asset may not be legally effective and that, consequently, the crypto assets may not include the expected rights and/or obligations, potentially resulting in a full or partial loss of value of the respective crypto assets.

Poor Investor Protection Compared to Traditional Finance. Clients should be aware that the level of investor protection available in the crypto asset sector is significantly lower than that available in traditional regulated financial markets. There is no equivalent of the Swiss depositor protection scheme, no investor compensation fund, no mandatory best execution requirement, and no standardised product disclosure framework comparable to those that apply to regulated securities or bank deposits. Clients bear the full risk of their investment decisions with limited recourse in the event of loss.

5.4 Counterparty Risk and Default Risk

Transactions facilitated by the Company may involve third-party counterparties (e.g. liquidity providers, payment processors, correspondent banks). The Company does not guarantee the performance or solvency of any third party. In the event of default by a counterparty, Client transactions may be delayed, partially executed, or not executed at all.

Default Risk is the possibility that a counterparty will not be able to fulfil their debt obligations. For example, execution venues may not be able to honour withdrawal or settlement requests from their clients.

5.5 Stablecoin-Specific Risk

Stablecoins (USDC, USDT, EURC) present the following additional risks:

De-pegging risk: The stablecoin may lose its parity with the reference fiat currency due to insufficient reserves, run on redemptions, or operational failure of the issuer.
Issuer risk: The Company does not control the issuers of USDC (Circle), USDT (Tether), or EURC (Circle). Any insolvency, regulatory action, or operational failure of the issuer may result in a permanent loss of value. It includes issuer non-performance, failure to deliver, failure to redeem, and risks relating to tokenised or exchange-traded products referencing crypto assets.
Reserve quality risk: The quality, liquidity, and segregation of reserves held by stablecoin issuers are not guaranteed by the Company or any Swiss authority.
Crypto assets linked to fiat currencies, securities, commodities, or other traditional instruments may inherit the risks of those underlying or reference assets.

5.6 General Disclaimer — Non-Exhaustive Risks and No Advisory Relationship

The risks described in this Disclosure do not represent an exhaustive list of all risks associated with crypto asset services. New or unforeseen risks may emerge as the market, technology, and regulatory landscape continue to evolve. This Disclosure does not constitute financial, legal, or tax advice of any kind. Clients who require guidance on any of these matters are encouraged to consult a qualified and independent financial adviser, legal counsel, or tax professional before making any investment decision.

This Disclosure cannot cover all risks and Clients should also review any applicable white papers, issuer documents, factsheets, key information documents, prospectuses, or other product-specific materials.

By accessing the Company’s services or executing any transaction, the Client acknowledges and accepts all risks described in this Disclosure, including the risk of total and permanent loss of the invested capital. Depending on the nature of the transaction, fees, liabilities, or exposure, losses or obligations may in some cases exceed the original amount committed. Crypto assets are highly speculative instruments and may not be suitable for all investors. If any part of this Disclosure is unclear or not fully understood, the Client is strongly encouraged to seek appropriate independent professional advice before proceeding.

6. Custody and Asset Protection Risks

The Company provides crypto asset custody and administration services through an institutional-grade digital asset custody infrastructure provider.

The Company implements robust technical and organizational measures to safeguard client information and digital assets. These include secure encryption, multi-factor authentication, ongoing vulnerability assessments, and infrastructure-level intrusion detection systems. These measures complement client-side security responsibilities outlined in the relevant documentation provided to the Client. The following risks apply.

6.1 Custody Infrastructure

Client crypto assets are held in segregated wallets through Multi-Party Computation (MPC) technology provided by the Company’s custody infrastructure provider. While institutional-grade security measures are employed, clients should be aware of the following:

The Company relies on the continued operation, security, and solvency of its third-party custody infrastructure provider.
In the event of a security breach, insolvency, or service discontinuation by the custody infrastructure provider, Client access to assets may be delayed or impaired.
The Company does not operate smart contracts or DeFi protocols in connection with custody services.
Hot wallet balances required for operational purposes are subject to a higher risk of cyber attack or theft than cold storage.

6.2 Segregation and Insolvency Risk

Client crypto assets are held separately from the Company’s own assets. In the event of the Company’s insolvency, client assets should, in principle, be separable from the bankruptcy estate under Swiss law (Art. 16 et seq. AMLA; Swiss DLT Act). However:

There is no absolute legal certainty that client crypto assets will be fully protected in all insolvency scenarios.
Recovery of assets may be subject to legal proceedings, delay, and partial loss.
The Company does not hold a banking licence, accordingly, the Swiss depositor protection mechanism does not apply.

6.3 Private Key and Access Risk

Control over crypto assets depends on the security and availability of cryptographic private keys. Loss, theft, or compromise of private keys, whether at the Company, its custody infrastructure provider, or any sub-custodian, may result in the permanent and irrecoverable loss of the associated assets. There is no mechanism to reverse confirmed blockchain transactions.

6.4 Forks, Replay Attacks, Private Key Loss and Hacking

Blockchain Forks. A fork is a change to the rules of a blockchain network. Hard forks, major changes that split the network into two separate chains, can result in the creation of a new, separate crypto asset. The Company will assess each fork on a case-by-case basis and will communicate its policy to affected clients in a timely manner. The Company does not guarantee that clients will receive any assets created as a result of a fork, and reserves the right to determine how forked assets are handled, including whether they are credited, liquidated, or discarded.

Replay Attacks. Following a hard fork, a risk known as a replay attack may arise. This occurs when a transaction that is valid on one chain is fraudulently rebroadcast and executed on the other chain without the sender’s authorisation, potentially resulting in unintended asset transfers. The Company applies technical safeguards to mitigate this risk; however, complete protection cannot be guaranteed in all scenarios. Clients should be aware that replay attacks are an inherent risk of the blockchain infrastructure and are not within the Company’s full control.

Loss of Private Keys. The Company holds private keys on behalf of clients as part of its custody service. Private keys are the only means by which crypto assets can be accessed and transferred on a blockchain. If private keys are permanently lost, due to a catastrophic technical failure, destruction of key material, or any other reason, the associated crypto assets would be irrecoverably lost. There is no central authority, no password reset, and no recovery mechanism available on public blockchain networks. Although the Company uses Multi-Party Computation (MPC) technology through its custody infrastructure provider specifically to minimise this risk, clients must understand that no custody solution can offer an absolute guarantee against key loss in all circumstances.

Inability to Exercise Connected Rights. Clients may not be able to exercise voting, governance, staking, airdrop, fork, protocol, or other asset-related rights depending on custody arrangements, Company policy, legal restrictions, or operational limitations.

Hacking and Cybersecurity Threats. Despite employing institutional-grade security infrastructure and applying industry best practices, the Company’s systems remain a potential target for malicious actors. Cyber attacks, including hacking, phishing, social engineering, malware, and insider threats, could result in the theft of or unauthorised access to client assets. The crypto industry has historically been a frequent target of sophisticated cyber attacks, and no security system can guarantee immunity. In the event of a successful attack, the recovery of stolen crypto assets is generally not possible, as blockchain transactions are irreversible. The Company maintains security policies and incident response procedures designed to detect, contain, and respond to such threats as quickly as possible, and will notify affected clients in accordance with applicable law.

7. Technology and Operational Risks

7.1 Blockchain and Network Risk

Crypto asset transactions are recorded on public, decentralised blockchain networks. These networks operate independently of the Company. The following technology risks apply:

Network congestion: Transactions may be delayed during periods of high network activity. Transaction fees (gas fees) may increase substantially.
Protocol forks: Blockchain protocols may undergo hard or soft forks, resulting in the creation of new assets, changes in transaction validation rules, or network instability.
51% attacks: Proof-of-work networks may be susceptible to majority hash-power attacks, potentially enabling double-spending.
Protocol manipulation and consensus attacks: Manipulation or concentration of validation power are possible in proof-of-work, proof-of-stake, or other consensus mechanisms, resulting in various types of attacks, such as double-spending and or censoring transactions of third parties.
Smart contract risk: Not applicable to the Company’s current service offering (no DeFi or smart contract exposure). However, some supported assets, stablecoins, or token standards may still depend on smart contracts, which may contain bugs, admin controls, oracle dependencies, upgrade risks, or vulnerabilities.
Technology disruption risk: Crypto protocols may rely on hashing and encryption algorithms that could become faulty, obsolete, compromised, or weakened by future technological developments, including quantum computing.

7.2 Cybersecurity Risk

The Company’s digital infrastructure, including its platform, APIs, and payment systems, is subject to cyber threats including hacking, phishing, malware, and distributed denial-of-service (DDoS) attacks.

Many crypto assets rely on open-source software, which may contain bugs, vulnerabilities, deliberately embedded defects, or discontinued development, potentially affecting asset security, availability, or value.

Although the Company employs industry-standard security practices, no system is immune from compromise. A successful cyber-attack could result in loss of Client assets or unauthorised access to Client accounts.

7.3 System Availability and Operational Risk

The Company’s trading and custody platform may be subject to downtime, maintenance, or technical failures. During such periods, clients may be unable to execute transactions, access their accounts, or withdraw assets. The Company shall not be liable for losses arising from system unavailability beyond its reasonable control.

7.4 Payment Acquisition Risk

The Company’s integrated invoicing and payment acquisition system facilitates the settlement of payments in crypto assets. Clients using this service should be aware that:

Settlement finality depends on blockchain confirmation. Transactions with insufficient confirmations may be subject to reversal risk.
Exchange rate risk arises between the time an invoice is issued and the time of settlement. The Company applies exchange rates at the time of transaction confirmation.
Technical failure of the invoicing system may delay or prevent payment settlement.

7.5 Risk of Sending to an Incorrect Blockchain Address

Blockchain addresses are long strings of letters and numbers. Entering even a single incorrect character will result in funds being sent to a completely different address, or to an address that does not exist. In either case, the funds will be permanently and irrecoverably lost. There is no way to reverse or cancel a confirmed blockchain transaction, and the Company cannot retrieve funds sent to an incorrect address under any circumstances.

Clients are solely responsible for verifying the accuracy of any blockchain address before authorising a transaction. The Company strongly recommends double-checking every address in full before confirming any transfer. Additionally, sending a crypto asset to an address belonging to a different blockchain network (for example, sending BTC to an ETH address) will also result in permanent loss of funds. Always ensure the address and the network match the intended asset.

7.6 Irreversibility of Transactions

Unlike a bank transfer or a credit card payment, a confirmed blockchain transaction cannot be cancelled, reversed, or recalled under any circumstances. Once a transaction has been broadcast to the network and confirmed, it is final and permanent. There is no dispute resolution mechanism, no chargeback process, and no central authority that can intervene to undo a transaction.

This means that if you make a mistake, whether by entering the wrong address, sending the wrong amount, or confirming a transaction in error, the Company cannot help you recover those funds. Clients must review all transaction details carefully before confirming. The Company will not accept liability for losses resulting from client errors in transaction instructions.

7.7 Third Party Dependency Risk

The Company’s ability to provide its services depends on a number of third parties, including its custody infrastructure provider, liquidity providers, banking partners, payment processors, and the underlying blockchain networks themselves. The Company does not control these third parties and cannot guarantee their continued availability, reliability, or solvency.

If any key third party experiences a failure, outage, insolvency, or regulatory action, the Company’s services may be disrupted, delayed, or suspended. In such circumstances, clients may temporarily be unable to access their accounts, execute transactions, or withdraw funds. The Company will endeavour to communicate any material disruptions to clients as promptly as possible and to implement contingency arrangements where feasible, but cannot guarantee continuity of service in all scenarios.

7.8 Data Protection and Privacy Risk

In the course of providing its services, the Company collects, stores, and processes personal data relating to its clients in accordance with the Swiss Federal Act on Data Protection (nFADP, SR 235.1) and, where applicable, the EU General Data Protection Regulation (GDPR). Despite employing appropriate technical and organisational security measures, the Company cannot guarantee that client data will never be subject to unauthorised access, theft, or disclosure as a result of a cyber attack or data breach.

Additionally, due to the transparent nature of public blockchains, transaction data, including wallet addresses and transaction amounts, is permanently and publicly visible on the blockchain. While this data is pseudonymous, it may in some circumstances be linked to a client’s identity. Clients should be aware that blockchain transaction data cannot be deleted or amended once recorded. Full details of how the Company collects, uses, and protects personal data are set out in the Company’s Privacy Policy, which forms part of the Agreement.

8. Additional Risks

8.1 Legal Status and Ownership Risk

The legal status of crypto assets varies significantly across jurisdictions and continues to evolve. In some countries, the ownership, transfer, or use of certain crypto assets may be restricted, taxed in unexpected ways, or prohibited entirely. Future changes in law, whether in Switzerland, the European Union, or any other jurisdiction relevant to the client, could affect a client’s ability to hold, transfer, or benefit from their crypto assets.

For corporate clients, the legal treatment of crypto assets within a company’s balance sheet, its ownership structures, and the authority of individuals to transact on the company’s behalf may raise complex legal questions. Corporate clients are strongly advised to seek appropriate legal counsel in their jurisdiction before engaging the Company’s services.

Where a crypto asset purports to represent legal rights or obligations, the legal effectiveness of the tokenisation and transfer of those rights may be uncertain or not recognised in relevant jurisdictions.

8.2 Sanctions and Geopolitical Risk

The Company is required to comply with Swiss sanctions law and applicable international sanctions regimes, including those administered by the State Secretariat for Economic Affairs (SECO) and, where relevant, the European Union and the United Nations. If a client, a counterparty, a wallet address, or a jurisdiction associated with a transaction becomes subject to sanctions, the Company may be required to freeze assets, block transactions, or terminate the client relationship immediately and without prior notice.

Crypto assets may be traceable to illicit activity and may be frozen, rejected, blocked, seized, delayed, or rendered unusable if considered tainted by service providers, analytics providers, authorities, or courts. Moreover, crypto assets may be received at a blockchain address without the recipient’s ability to reject the transfer, potentially causing legal, sanctions, AML, tax, accounting, or operational issues.

Geopolitical events, including armed conflicts, diplomatic tensions, and changes in international relations, can also affect the availability of services, access to banking infrastructure, and the ability to process cross-border transactions. These risks are outside the Company’s control. Clients are responsible for ensuring that their use of the Company’s services complies with all applicable sanctions and laws in their own jurisdiction.

8.3 Insurance Risk

The Company does not hold insurance coverage for Client crypto assets against theft, hacking, loss of private keys, or other risks. Unlike bank deposits, which benefit from the Swiss depositor protection scheme up to CHF 100,000, crypto assets held with the Company carry no equivalent insurance or guarantee. In the event of a loss, whether through a security breach, operational failure, or any other cause, clients may not be able to recover their assets or receive any compensation. Clients who wish to obtain their own insurance coverage for crypto asset holdings are advised to consult a specialist insurance provider.

8.4 No Cooling-Off Period

Unlike certain financial or consumer products, transactions executed through the Company are immediate and irreversible. There is no cooling-off period, no right of withdrawal, and no cancellation option once a transaction has been confirmed. Clients should consider all transactions carefully before authorising them, as there is no mechanism to undo a completed transaction regardless of the circumstances.

8.5 Conflicts of Interest

As a company that provides both exchange and custody services, the Company may in certain circumstances have commercial interests that could potentially conflict with the interests of individual clients. For example, the Company earns fees on transactions and may have relationships with liquidity providers. The Company maintains a conflicts of interest policy designed to identify, manage, and where necessary disclose such conflicts. Clients who have questions about potential conflicts of interest are encouraged to contact the Company directly.

8.6 Inheritance and Estate Risk

Crypto assets present unique challenges in the context of inheritance and estate planning. If a client passes away without having made appropriate arrangements, including ensuring that their heirs or estate executor are aware of their crypto holdings and know how to access them through the Company, those assets may become permanently inaccessible. Unlike traditional bank accounts, crypto assets cannot always be identified or recovered by authorities or family members without the necessary account credentials and documentation.

Clients are strongly encouraged to include their crypto asset holdings in their estate planning documentation and to inform a trusted person of their account details with the Company. The Company has procedures in place to assist verified heirs or estate executors in accessing a deceased client’s account, subject to applicable legal requirements. Clients should contact the Company for further information on its estate and succession procedures.

9. Limitation of Liability

To the maximum extent permitted by applicable law, the Company shall not be liable for any loss, damage, or expense, whether direct, indirect, special, consequential, or otherwise, arising from:

Price movements, volatility, or illiquidity of any crypto asset
Actions or omissions of third-party service providers, including the custody infrastructure provider, liquidity providers, or blockchain networks
Regulatory changes, government actions, or force majeure events
System downtime, cybersecurity incidents, or technological failures beyond the Company’s reasonable control
Errors, delays, or failures in blockchain transaction processing
Client’s failure to comply with KYC/AML requirements or to provide accurate information

The Company is not obliged to notify clients of the materialisation or possible materialisation of every crypto-asset risk, except where required by applicable law or contract.

Nothing in this Disclosure limits the Company’s liability for fraud, wilful misconduct, or gross negligence, or for any statutory liability that cannot be excluded under applicable Swiss law.

10. Client Acknowledgement

By signing or digitally acknowledging this document, the client confirms that they have:

Read and understood this Risk Disclosure Statement in its entirety
Had the opportunity to seek independent legal, financial, and tax advice
Acknowledged that crypto asset investments carry the risk of total loss
Acknowledged that the Company is not a bank and that no deposit protection applies
Understood the applicable KYC/AML obligations and transaction limits
Consented to the collection, processing, and (where required) reporting of their data in accordance with the Company’s Privacy Policy and applicable AML law
Acknowledged that holding, buying, selling, transferring, or using crypto assets may trigger tax, reporting, licensing, sanctions, AML/CFT, or other legal obligations in their jurisdiction, and non-compliance may result in civil, administrative, or criminal consequences

If you are a natural person who is a resident or citizen of the European Union (EU) or European Economic Area (EEA), or if you are a legal entity established or registered in the EU/EEA, you confirm that you are engaging with the Company entirely at your own initiative and not as a result of any direct or indirect marketing, solicitation, or advertising by the Company or any of its representatives. You further acknowledge that the Company’s services are made available to you solely under the reverse solicitation exemption as defined in Article 61 of the Markets in Crypto-Assets Regulation (MiCA).

The Client guarantees to comply with and act within all legal boundaries within the applicable jurisdiction to the business relationship, particularly in relation to MiCA regulations applicable in the EU/EEA, and especially including but not limited to tax laws.