Risk Assessment Framework

This Framework sets out how Plaitr, a self-custodial platform whose regulated services are delivered by licensed partner institutions, identifies, assesses, and mitigates financial- crime and operational risk at the enterprise level and for individual Users at the gating layer. Regulated risk management on the underlying rails is performed by Plaitr's licensed partners.

Plaitr conducts an enterprise-wide risk assessment at least annually and on material change (new product, new jurisdiction, new partner, or significant regulatory development). The assessment covers, at a minimum:

• Customer risk: industry mix, complexity, PEP exposure
• Product risk: stablecoin flows, fiat rails, cross-border payouts, cards (when launched)
• Geographic risk: India corridors, UAE, and high-risk jurisdictions
• Channel risk: digital-only onboarding, no face-to-face, partner-mediated flows

The output is a risk heatmap with mitigating controls, presented to senior management.

Each User is scored at onboarding and on refresh across the following factors:

• Industry
• Country of counterparties and jurisdictions served
• Expected monthly volume
• Ownership structure and complexity
• Screening outcome (sanctions, PEP, adverse media)
• Time in business

Scores are aggregated into Low, Medium, or High. High-risk Users require Enhanced Due Diligence and senior sign-off before activation.

Regulated transaction risk scoring on the underlying rails is performed by the licensed partner. Plaitr monitors platform-level activity for consistency with the User's declared business profile and escalates concerns to the relevant partner.

Material changes in risk profile trigger a reassessment. User risk ratings drive periodic-review cadence per the KYC & Customer Due Diligence Policy.

This Framework is owned by the Plaitr Compliance function, approved by senior management, and reviewed at least annually.

Questions: compliance@plaitr.com.