KNOW YOUR CUSTOMER (KYC) & CUSTOMER DUE DILIGENCE POLICY

Last update date: 13th August 2026

BuyUcoin Exchange (Operated by IBlock Technologies Private Limited)

Introduction and Purpose

BuyUcoin Exchange (“BuyUcoin”, “Company”, “we”, or “us”) is committed to ensuring that only legitimate users access and use the BuyUcoin Platform. This Know Your Customer (KYC) and Customer Due Diligence Policy (“KYC Policy”) sets out the principles, procedures, and controls adopted by BuyUcoin to identify, verify, and monitor its users in accordance with applicable laws and regulatory requirements.

The objective of this Policy is to prevent identity fraud, money laundering, terrorist financing, proliferation financing, and other unlawful activities, while maintaining a secure and compliant trading environment for users of the BuyUcoin Platform.

Regulatory Framework

This KYC Policy is formulated in compliance with:

• The Prevention of Money Laundering Act, 2002 and rules framed thereunder;
• FIU-IND AML & CFT Guidelines for Reporting Entities Providing Services Related to Virtual Digital Assets, updated as on 08 January 2026;
• Applicable provisions of the Information Technology Act, 2000;
• Relevant guidance issued by Indian regulatory and law enforcement authorities;
• International best practices, including FATF Recommendations.

This Policy shall be read together with the BuyUcoin AML Policy and Terms of Use.

Applicability and Scope

This Policy applies to all users of the BuyUcoin Platform, including individual users and non-individual users such as companies, partnerships, proprietorships, and other legal entities.

The Policy governs the onboarding process, periodic review of user information, enhanced due diligence requirements, and ongoing monitoring of user activity.

Binding Nature of the Policy

This KYC Policy forms an integral part of the BuyUcoin Terms of Use and is binding on all users. By accessing or using the BuyUcoin Platform, users agree to comply with the requirements of this Policy.

Failure to comply with this Policy may result in restriction, suspension, or termination of the user’s account and may lead to reporting to competent authorities, as required by law.

Customer Identification and Due Diligence

BuyUcoin follows a risk-based approach to customer identification and due diligence. Customer due diligence is conducted prior to permitting any user to trade, deposit, or withdraw funds on the Platform.

No anonymous or fictitious accounts are permitted.

KYC for Individual Users

For individual users, BuyUcoin requires submission and verification of identity and address information, which may include:

• Officially valid identity documents such as Aadhaar card, passport, or other government-issued identification containing proof of identity and address.
• Permanent Account Number (PAN) card, which is mandatory for Indian residents.
• Live selfie and liveness verification to ensure that the user is physically present during onboarding.
• Verified bank account details for linkage with the user’s account.

BuyUcoin may require additional documentation depending on the risk profile of the user or regulatory requirements.

KYC for Non-Individual Users

For non-individual users, including companies, partnerships, LLPs, and proprietorships, BuyUcoin requires submission of documentation to establish the legal existence, ownership, and control of the entity. This may include:

• Certificate of incorporation or registration.
• Memorandum and Articles of Association or partnership deed.
• Corporate PAN and GST registration certificate, where applicable.
• Board resolution or authorisation letter permitting the entity to transact on the BuyUcoin Platform.
• Identification and address proof of authorised signatories, directors, partners, and beneficial owners.
• Ultimate Beneficial Ownership (UBO) declaration identifying all natural persons exercising ownership or control.
• Source of Funds declaration.
• Anti Money Laundering declaration.
• 6 months' bank statement or a cancelled cheque.
• Income Tax Return of the last 3 years (where the entity is established within 3 years, ITR of all directors of the last 3 years).

BuyUcoin reserves the right to seek additional information where ownership structures are complex or opaque.

Ultimate Beneficial Ownership (UBO)

BuyUcoin identifies and verifies the ultimate beneficial owners of non-individual users in accordance with applicable law and regulatory guidance. Where beneficial ownership cannot be satisfactorily determined, BuyUcoin may refuse onboarding or terminate the relationship.

UBO information is periodically reviewed and updated.

Use of Third-Party Verification Services

BuyUcoin may rely on licensed and regulated third-party service providers for KYC verification, document authentication, biometric verification, and database checks. The use of such services does not absolve BuyUcoin of its regulatory obligations, and appropriate oversight is maintained.

Risk Classification of Users

Each user is assigned a risk category at the time of onboarding based on factors such as identity profile, occupation or nature of business, expected transaction behaviour, geographic exposure, and use of external wallets or platforms.

Risk categorisation determines the level of due diligence and monitoring applied to the user.

Enhanced Due Diligence (EDD)

Enhanced Due Diligence is applied to users classified as high risk, including politically exposed persons (PEPs), users engaging in high-value or unusual transactions, users interacting with unhosted wallets, or users with adverse media exposure.

EDD measures may include collection of source of funds information, bank statements, income documentation, and senior management approval.

Ongoing Due Diligence and Periodic Review

KYC is an ongoing process. BuyUcoin periodically reviews and updates user information based on risk classification, transaction behaviour, or regulatory requirements.

Users are required to promptly notify BuyUcoin of any material changes to their personal or business information.

Incomplete or Unsatisfactory KYC

Where KYC information is incomplete, inconsistent, unverifiable, or false, BuyUcoin may restrict account functionality, require re-verification, or terminate the user’s account.

Such actions may be accompanied by regulatory reporting where required.

Record Retention

BuyUcoin retains KYC records, customer identification data, and related documentation for a minimum period of five (5) years from the date of account closure or as otherwise required by law.

Records are stored securely and are made available to competent authorities upon lawful request.

Confidentiality and Data Protection

All KYC information collected by BuyUcoin is treated as confidential and is used solely for compliance and risk management purposes, subject to lawful disclosure requirements.

Policy Review and Amendments

This KYC Policy is reviewed periodically and updated to reflect changes in law, regulation, or business operations. Amendments shall be effective prospectively unless stated otherwise.

Governing Law and Jurisdiction

This KYC Policy shall be governed by and construed in accordance with the laws of India.