Criminal compliance policy

1. OBJECTIVE

This Criminal Compliance Policy has been developed in line with the main regulatory references and best practices in regulatory compliance.

At Eurodivisas, we have a firm commitment to ensuring compliance with ethical principles and good governance, which is why one of our priorities is to develop a solid corporate culture of regulatory compliance, in which the company's ethical values constitute central elements of our activity and decision-making.

This Policy defines the roles and responsibilities of all actors involved in the Criminal Compliance Model, from executives and administrators to all employees at all levels.

2. SCOPE

The Criminal Compliance Policy aims to establish a culture of regulatory compliance in accordance with the values and principles assumed by Eurodivisas, so as to allow the development of honest, integral and transparent professional conduct, as well as to show a firm condemnation of the commission of any kind of act contrary to the principles and values of Eurodivisas, without, in any case, its commission being justified on the basis of a benefit for the organization.

In this way, and in line with the provisions of applicable legislation, we have equipped ourselves with internal regulatory instruments and adequate control and management systems in the field of detection and prevention of regulatory risks and non-compliance.

This Policy is one of the main elements of Eurodivisas' Compliance System, applying to all subject persons, regardless of their geographical, hierarchical, functional location or the contractual modality that determines their relationship with the company.

3. DESCRIPTION. GUIDING PRINCIPLES

Eurodivisas promotes respect for legality and ethical behavior at all levels of the company, transmitting this commitment and culture from the members of the Administrative Body and Senior Management to all levels of the company, as well as to all its subsidiaries.

This Policy develops Eurodivisas' general principles and guidelines regarding crime prevention and detection, evidencing and reinforcing the commitment to good corporate governance, an ethical business culture and regulatory compliance. The principles that should guide Eurodivisas' actions in terms of regulatory compliance are detailed below:

• Act and demand that action is taken at all times in accordance with the provisions of current legislation.
• Disseminate the company's commitment to strict compliance with legislation, which is responsible for establishing those values and principles that inspire Eurodivisas' actions. In this way, both the Global Exchange Group and Eurodivisas inspire their actions in the Code of Ethics, the Anti-Corruption Policy and the Manual for the Prevention of Money Laundering and Terrorist Financing.
• Promote a culture of compliance throughout the organization and its components through the dissemination and training of corporate ethical values, regulatory compliance and the declaration of the principle of zero tolerance towards the commission of any illegal act.
• Continuous evaluation of the main sensitive activities likely to be developed in Eurodivisas.

In this sense, the activities developed by Eurodivisas are the following:

• Purchase of foreign banknotes or traveler's checks, with payment in euros.
• Sale of foreign banknotes or traveler's checks for their equivalent value in euros or other foreign bank notes.
• All of this in person at establishments open to the public or through online sales.
• Additionally, the company carries out retail trade activities of various products such as telephone cards, tickets to shows and tourist circuits, mobile internet devices, etc. in establishments open to the public.
• VAT refund to foreign travelers as an agent of authorized entities.
• Promote the implementation, supervision and continuous improvement of the policies, procedures and control mechanisms defined in Eurodivisas' Criminal Compliance Model.
• Disseminate to all members of the company, through appropriate communication and training programs, the importance of complying with their functions and responsibilities in the development of their activity.
• Make available to the entire company the principles and rules that should govern their actions in Eurodivisas.
• Define the functions of the governing bodies in relation to regulatory compliance, with the aim that their management favors compliance with related guidelines and internal regulations.
• Determine the necessary measures to guarantee maximum integrity in the preparation and presentation of financial information, as well as adequate compliance with current legislation and regulations on accounting matters.
• Provide a regulatory and compliance framework with those third parties with whom we may maintain business relationships, in order to ensure integrity and honest practices within the framework of free competition.
• Establish the necessary measures to comply with current legislation and regulations on personal data protection, ensuring the principles of privacy, quality and veracity in data processing.
• Provide the necessary measures to prevent, and where appropriate, report behaviors that may be associated with corruption and/or money laundering and terrorist financing, as well as collaborate with official bodies.
• Provide a safe and healthy work environment, in relation to promoting a culture of occupational safety and health.
• Make available to all members of the company the appropriate communication channels, establishing the duty to inform and report in good faith any irregular conduct of which they have knowledge or suspicion. Eurodivisas guarantees, in any case, the confidentiality and anonymity of those reported and the whistleblowers, as well as the absence of retaliation against whistleblowers acting in good faith.
• Disseminate among all personnel the applicable disciplinary code, according to labor regulations and applicable Collective Agreements, in case of non-compliance with the Compliance System, internal regulations and in the event of commission of acts or behaviors that could be classified as potentially criminal.
• Carry out a periodic verification of this Policy and the implemented Compliance Model and promote its modification when relevant infractions of its provisions are revealed or when changes occur in current legislation, in the control structure or in Eurodivisas' activity that make them necessary.

  4. ORGANIZATIONAL MEASURES: ROLES AND RESPONSIBILITIES

Eurodivisas' commitment to regulatory compliance and ethical values is integrated at all levels of the company, involving and being transmitted to all subject persons. This policy describes the organizational measures regarding regulatory compliance implemented in Eurodivisas, and defines the roles of the parties involved (4.1.CEC, Administrative Body and Employees) in the Criminal Compliance Model and their main functions and responsibilities.

4.1. ETHICS AND COMPLIANCE COMMITTEE

The Ethics and Compliance Committee of Eurodivisas (hereinafter, the "CEC") is a collegiate body whose composition, functions and operating regime are regulated in its own Operating Regulations. The CEC is responsible for the supervision, control and evaluation of the correct functioning of Eurodivisas' Compliance Model.

In the exercise of its functions, the CEC may request the support and collaboration of other areas or a third party, to whom it may entrust the execution of certain activities within the scope of its functions. In order to ensure maximum effectiveness of its activities, the CEC will have free access to all Eurodivisas documentation that may be useful to it. In this sense, those responsible for any area or department of Eurodivisas will be obliged to provide any information requested about the activities of the area or department related to the possible commission of a crime.

Finally, the CEC will have the necessary human and technical resources for the development of its function in the most efficient way. Likewise, they must receive the necessary training to be perfectly qualified and updated for the development of the activities defined in this document.

4.2. ADMINISTRATIVE BODY

The Board of Directors, with the continuous support of Senior Management, assumes a leadership and commitment role based on responsibility, transparency, integrity and observance, in order to reinforce and adopt those initiatives that allow strengthening the organizational culture of Eurodivisas.

4.3. OBLIGATIONS OF ALL EURODIVISAS EMPLOYEES

Employees are responsible for understanding, observing and applying the values and principles of the Compliance Model, proclaimed in this Policy, the Ethical Channel Regulations, the Anti-Corruption Policy and the Manual for the Prevention of Money Laundering and Terrorist Financing, as well as the rest of the existing Policies in Eurodivisas.

5. CONTROL MEASURES

Eurodivisas' Compliance Model has different measures aimed at preventing and detecting criminal risks, with said Model being supervised annually or when circumstances arise that advise reducing this period and subject to a continuous improvement policy.

5.1. PREVENTION CONTROL

Prevention controls are understood to be all those internal regulations and policies of the company, of a general nature (Disciplinary Code, Code of Ethics, training, etc.) or specific (controls designed and implemented for the prevention of specific criminal risks), which contribute to mitigate ex ante the risk of bad practices or regulatory non-compliance in the development of the activity.

The prevention of the commission of crimes constitutes a fundamental element in Eurodivisas' Compliance Model, being aware of the importance of implementing preventive measures in order to minimize exposure to risks and avoiding their materialization.

5.2. DETECTION CONTROL

Complementary to the prevention controls implemented in Eurodivisas, the Compliance Model has controls designed for the ex post detection of non-compliance, unlawful conduct or bad practices contrary to the policies, procedures or values of the company. In this context, Eurodivisas has general detection controls such as the Ethical Channel, through which subject persons and third parties with legitimate interest can communicate irregular practices.

The Ethical Channel is accessible to all members of the organization and to Eurodivisas, S.A's stakeholders, through which the non-compliance with this Criminal Compliance Policy and other policies belonging to the Compliance System can be reported.
The aforementioned Ethical Channel can be accessed through the following URL: https://eurodivisas.globalsuitesolutions.com/ethicalchannel

5.3. REVIEW CONTROL

Eurodivisas' Compliance Model is subject to continuous supervision and improvement, with an annual review being carried out in accordance with the provisions of internal policies and procedures, modifying it in case:

• There are relevant regulatory, legal or jurisprudential changes that affect the Model.
• Relevant violations of the provisions of the Model are revealed.
• Changes are made to the organization, control structure or activity carried out by Eurodivisas.

6. ACCEPTANCE AND COMPLIANCE

This Policy is disseminated to all subject persons.
All subject persons are obliged to comply with the Criminal Compliance Policy from the moment of their incorporation into the company and during their professional performance.

Non-compliance with this Policy compromises the reputation and image of the company, so all subject persons are obliged to inform the CEC of any conduct that contravenes or could contravene it. Non-compliance with this Policy could lead to the application of the Disciplinary Code, which could result in the termination of the employment relationship or other sanctions provided for in the Workers' Statute or in the corresponding collective agreements, without prejudice to any administrative or criminal sanctions that may arise.

7. VALIDITY

This Policy has been approved by the Administrative Body of Eurodivisas, incorporating it into the company's internal regulations and remaining in force until its cancellation or modification is approved. Any modification of this Policy must have the approval of the Administrative Body of Eurodivisas.