Gold Standard Foundation ("Gold Standard" or “GS”) is dedicated to compliance with all legal and regulatory requirements while fostering transparency and trust. This Know Your Customer (KYC) and Anti-Money Laundering (AML) Policy outlines the framework for identifying and verifying stakeholders, mitigating financial crime risks, and safeguarding the GS’ integrity.

Gold Standard prohibits money laundering, terrorist financing, proliferation financing, and any facilitation, attempt, aiding, or abetting of such offences.

The objectives of this Policy are to set the following principles at organizational level:

• Identification and verification of the identities of customers, partners, vendors or service providers and any other stakeholders GS is working with (“Counterparty(ies)”).
• Prevent GS from being involved directly or indirectly in financial crimes such as money laundering and terrorist financing.
• Ensure compliance with applicable national and international laws.
• Enhance trust in Gold Standard’s operations and transactions.
• Manage reputational and financial risks.

Sanctions refer to restrictions or penalties imposed by one or more countries or international bodies, such as the United Nations, European Union, United States, or Switzerland on individuals, entities, or countries. These sanctions can include travel bans, asset freezes, trade restrictions, and other economic measures intended to achieve foreign policy and national security objectives.

Money laundering is the process of concealing or disguising the origins of illegally obtained money, typically by means of transfers involving foreign banks or legitimate businesses. The goal of money laundering is to make the proceeds from criminal activities appear to be derived from a legitimate source.

Terrorist financing and proliferation financing mean, respectively, the provision or collection of funds with the intention or knowledge that they be used, in whole or in part, to carry out terrorist acts, and the provision of funds or financial services that could support the proliferation of weapons of mass destruction.

The KYC & AML Policy at Gold Standard focuses on practical implementation and operational alignment, ensuring all Counterparties are systematically vetted while meeting compliance standards.

The Policy includes clear processes for identifying, assessing, and mitigating risks associated with Counterparties interactions. This structured approach facilitates actionable insights and decision-making at all levels of the organization, reflecting Gold Standard's emphasis on operational excellence and ethical practices.

The KYC & AML Policy helps Gold Standard achieve its strategic objectives by ensuring all Counterparties are thoroughly vetted and risks are identified early.

Key objectives include:

• Supporting informed decision-making.
• Mitigating risks associated with fraudulent or illicit activities.
• Enhancing compliance with regulatory and ethical standards.

Gold Standard applies a documented risk-based approach that identifies inherent risks by activity, geography, delivery channel, counterpart type, and funding flow; assesses control effectiveness; assigns residual risk ratings; and calibrates due-diligence depth, approvals, and monitoring frequency accordingly.

The risk assessment is refreshed annually and upon material change, and its conclusions are approved by the Board.

Responsibility for compliance with this Policy is the duty of individuals at every level of Gold Standard:

• This Policy applies to all activities of Gold Standard worldwide.
• The Policy applies to Gold Standard and its employees, as well as any third parties acting on its behalf.
• This Policy applies to all Counterparties interacting with Gold Standard, including:
  - Project Owners
  - Project Developers
  - Registry Account Holders
  - Marketplace Participants
  - Validation and Verification Bodies (VVBs)
  - Roster of Experts
  - Consultants and Contractors
  -Donors and partners

The Compliance Officer is the designated person responsible for the day-to-day coordination, supervision, and enforcement of the KYC & AML Policy across Gold Standard.

The Compliance Officer shall serve as the principal point of contact for all compliance matters, both internally and externally, including communication with regulators, auditors, and other competent authorities as required.

The Compliance Officer is appointed by the Executive Management Team, and must possess the necessary expertise within their organisation, independence, and authority to effectively carry out the role. The Executive Management Team shall ensure that the Compliance Officer has sufficient resources, access to information, and organisational standing to fulfill these responsibilities without undue influence or conflict of interest and reports at least annually on risk assessment results, significant investigations and reports, sanctions compliance, training completion, and resource adequacy.

Each Department within Gold Standard is responsible for implementing and adhering to the KYC & AML Policy by developing specific processes and controls relevant to their respective operations, with the Compliance Officer providing support to develop the necessary processes and tools for implementation across functions and oversight for the Policy compliance. This includes:

• Designing and maintaining Standard Operating Procedures (SOPs) tailored to their activities,
• Conducting risk-based due diligence on Counterparties,
• Ensuring timely escalation of potential concerns,
• Integrating appropriate verification steps, maintaining accurate records, and applying ongoing monitoring mechanisms proportionate to the identified risk level.

In practice, this means that each Department is accountable for embedding the Policy requirements into daily operations, while the Compliance Officer ensures that these requirements are applied in a harmonized, legally compliant, and auditable manner throughout Gold Standard.

The Executive Management Team holds ultimate responsibility for ensuring that Gold Standard KYC & AML Policy is effectively implemented and adhered to across all functions. In particular, the Executive Management Team shall:

• Approve the appointment, removal, and succession of the Compliance Officer, and ensure that the role is adequately resourced and empowered to act independently.
• Endorse and periodically review Gold Standard risk appetite framework, including the risk matrix and exception process, based on inputs from the Compliance Officer and approved by the Board.
• Oversee the integration of KYC & AML Policy obligations into Gold Standard strategic objectives, operations, and governance structures.
• Review and approve Medium/high-risk or exceptional cases escalated by the Compliance Officer or relevant Departments.
• Ensure that sufficient resources, systems, and training are provided to staff to effectively implement and comply with the Policy.

Gold Standard’s governance framework for implementing the KYC & AML Policy is structured to ensure accountability, robust oversight, and continuous improvement. The governance framework is built on the three-lines-of-defence model:

First Line of Defence: All GS staff members involved with Counterparties, including account managers, registry operations, marketplace operations, or procurement, are responsible for directly managing and mitigating risks in their activities. These teams implement KYC & AML processes to ensure compliance during daily operations.

Second line of Defence: The designated Compliance Officer provides oversight and support, ensuring that first Line of Defence adheres to KYC & AML Policy and procedures. This includes:

• Developing and maintaining the KYC/AML Policy.
• Conducting training and awareness programs for GS’ staff members.
• Monitoring compliance and identifying areas for improvement.
• Reviewing Medium and High-risk cases and support further investigations.
• Escalating open cases or incidents to the Executive Management Team or GS Board, according to GS Risk Management Policy.
• Reporting any confirmed illegal or fraudulent activities to the relevant authorities in accordance with legal and regulatory requirements.

Third Line of Defence: Regular audits may be conducted by independent auditors to assess the effectiveness of the KYC/AML Policy. Audit findings are reported to Executive Management team to address any gaps or weaknesses and to the Board for oversight purposes.

This governance structure ensures that the KYC & AML Policy is effectively implemented, monitored, and enhanced to meet organizational and regulatory expectations.

Before entering a relationship or executing a transaction, Gold Standard:

• Identifies and verifies the counterparty using reliable, independent sources
• Identifies and verifies the beneficial owner for entities
• Establishes and documents the purpose and intended nature of the relationship

Gold Standard requires Counterparties to provide certain data and documentation based on the assessed risk of each Counterparty (i.e.: nationality, geographic, business profile and sector, transactional or other factors):

• For individuals, requested data and documents may include government-issued identification, contact details, proof of address, PEP, and compliance declarations.
• For Entities, requested data and documentation may include legal registration documents, ownership and control structure, business profile, , names of Ultimate Beneficial Owner(s) and authorized signatories, with the supporting documents and compliance declarations.

Where risk factors such as PEP status, complex ownership, high-risk jurisdictions, or adverse findings are present, Gold Standard conducts Enhanced Due Diligence (EDD), including source-of-funds or source-of-wealth enquiries, and more frequent monitoring.

Gold Standard shall not engage with a Counterparty that fails to provide complete, accurate, and verifiable data or documentation as required under this KYC & AML Policy. Incomplete or insufficient information shall result in the suspension or termination of the onboarding or transaction process. Any deviation from this requirement may only be granted in accordance with the Exception Process set out in Article 5.5 below, subject to the prescribed approval and documentation requirements.

The list of data and documents usually required is attached in Schedule 1.

Gold Standard screens all relevant Counterparties at onboarding and on a continuous basis against:

• Sanctions lists and law-enforcement.
• Politically Exposed Persons (PEP) databases.
• Adverse media sources.

Screening is anchored in the Swiss Embargo Act and related ordinances and covers UN, EU, Swiss, UK, and US measures as applicable to Gold Standard’s nexus. Screening hits are reviewed by Gold Standard qualified third party provider using documented match-resolution procedures, with outcomes recorded.

Gold Standard relies on a qualified external provider to:

• Determine risk levels (low, medium, or high) of each counterparty in accordance with a risk matrix developed by Gold Standard, taking into account the results of the screening referred to above using specific screening tools, eventually together with additional relevant risk factors.
• Perform screening of all counterparties on a continuous basis as described above.

All risk assessment reports conducted by a qualified external provider shall be formally addressed to the Gold Standard team responsible for managing the relevant Counterparty relationship. Notwithstanding the risk level or recommendation assigned by the external provider, the ultimate responsibility for reviewing, evaluating, and making the final determination on the Counterparty shall rest solely with Gold Standard. The external provider’s assessment shall be treated as an advisory input to Gold Standard’s internal risk assessment and processed as follows:

Low-risk Counterparty shall be considered as cleared and engagement can be activated. However, it is the responsibility of the Gold Standard team in charge of the Counterparty relationship to report to the Compliance Officer when a Counterparty risk assessment is medium or high or when the requested data or documentation is incomplete.

Upon receipt of a risk assessment report, the Compliance Officer shall coordinate with the relevant Gold Standard team responsible for the Counterparty relationship, and, where appropriate, external legal counsel, in order to review the risk assessment report and determine an appropriate course of action with respect to the Counterparty. In all cases, any Counterparty assessed as high risk shall be escalated to the Executive Management Team for review.

In the event a Counterparty risk assessment report cannot be satisfactorily resolved through standard compliance procedures, or when the requested data or documentation is incomplete, the Compliance Officer shall escalate the matter to the Executive Management Team or, where applicable, to the GS Board. Such escalation shall be undertaken in accordance with the GS Risk Management Policy, and the Executive Management Team or the GS Board, as the case may be, shall make the final determination with respect thereto.

Upon completion of the screening and risk assessment, GS decides whether to approve, reject, or approve with conditions. Engagement with Counterparty is only activated after the screening and risk assessment process has been completed.

Gold Standard shall not engage with:

• Any Counterparty listed on recognized sanctions lists (e.g., UN, US, UK, CH, EU, OFAC);
• Any Counterparty from a sanctioned jurisdiction or regime, including any individual resident in a sanctioned jurisdiction, or entity headquartered in a sanctioned jurisdiction, or the governments of a sanctioned jurisdiction;
• Any Counterparty engaged in illegal or unethical practices that could undermine Gold Standard’s reputation.

Whilst the following counterparties are not automatically prohibited; they are subject to Enhanced Due Diligence (EDD) and any engagement with such Counterparty shall require prior review and approval by the Executive Management Team:

• Counterparty who resides in, or is a citizen of, any jurisdiction included on the Financial Action Task Force (“FATF”) list of non-cooperative jurisdictions;
• Counterparty who resides in a jurisdiction identified by FATF as requiring the application of countermeasures or enhanced due diligence; or
• Politically exposed person (“PEP”), or any family member or close associate of a PEP.

This commitment reinforces Gold Standard’s dedication to maintaining integrity and aligning its operations with global best practices.

Exceptions to the requirements of this Policy may only be granted under exceptional and well-justified circumstances where strict application of the Policy would be impractical or disproportionate, and where the associated risks can be effectively mitigated.

Any request for an exception must be submitted in writing by the relevant Department, detailing the rationale, supporting documentation, proposed mitigating measures, and duration of the requested exception. The Compliance Officer shall conduct a risk assessment of the request and provide a recommendation.

Final approval of exceptions rests with the Executive Management Team, based on Gold Standard defined risk appetite and in consultation with the Compliance Officer and, where applicable, the Risk Management Department. All approved exceptions must be formally documented, time-bound, periodically reviewed, and reported to the Board as part of the compliance oversight process.

Gold Standard shall conduct on going monitoring of transactions involving Counterparties to detect and report suspicious activities. This includes:

• Reviewing transactions for consistency with the Counterparty's known business profile; or
• Promptly investigating unusual or suspicious transactions, such as large cash movements or complex ownership structures.

If ongoing monitoring suggests that a Counterparty is engaged in activities in or relating to a jurisdiction subject to comprehensive sanctions or otherwise engaged in illicit activity, this is immediately reported to the Compliance Officer.

Upon receipt of a risk assessment report, the Compliance Officer shall coordinate with the Gold Standard team responsible for the Counterparty relationship, and, where appropriate, external legal counsel, to determine an appropriate course of action with respect to the Counterparty.

In circumstances where the Counterparty’s activities remain suspect, or where the assessed risk level changes from low to medium or high, the Compliance Officer shall escalate the matter to the Executive Management Team or, as applicable, the GS Board, in accordance with the GS Risk Management Policy, for final determination.

Where reasonable grounds to suspect money laundering, a predicate offence, or terrorist financing exist, the Compliance Officer reports with the competent authorities without delay and manages any legal obligations to suspend transactions or maintain the relationship pending instructions. Gold Standard cooperates fully with competent authorities.

A list of usual suspicious activities is attached in Schedule 2.

Gold Standard shall not accept or make payments to or from any party other than a party which Gold Standard has a direct business relationship with, unless the third party provides an acceptable explanation of the business purpose or rationale for the alternative payment method. Such rationale must be documented in writing and retained in accordance with Gold Standard records.

Gold Standard shall maintain accurate and up-to-date records of all KYC and AML activities.

Records will be kept for a minimum period of ten years as required by Swiss law or longer if necessary for regulatory or business purposes. This includes:

• Records of Counterparty identification and verification documents.
• Records of Counterparty due diligence and transaction monitoring activities.
• Records of risk assessments, investigations, training sessions, and audits.

Regular updates on KYC/AML compliance and associated risks are reported to the Executive Management Team and the ORC/Board to ensure strategic oversight.

Gold Standard is committed to refining its KYC/AML processes through periodic reviews, incorporating feedback from audits, and aligning with evolving regulatory standards.

Gold Standard fosters a culture of compliance and ethical behaviour by embedding these principles into its daily operations and strategic initiatives. Specific examples of this commitment include:

• Training and Awareness Programs: Regular sessions are conducted to ensure all staff understand their roles and responsibilities under the KYC & AML Policy.
• Leadership Support: EMT and MT actively promote adherence to compliance practices and sets a tone of integrity.
• Transparent Communication: Open lines of communication are maintained to encourage reporting of concerns and sharing of best practices, including any suspected violations of this KYC & AML Policy, through GSF’s Whistleblower Policy, ensuring that all risk assessment reports can be made safely, confidentially, and without fear of retaliation.

These initiatives ensure that all employees and stakeholders align with Gold Standard’s mission and ethical standards.

Gold Standard shall conduct regular risk assessments to evaluate and mitigate risks related to money laundering and terrorist financing. This involves:

• Identifying and assessing risks associated with different Counterparty types, transactions, and regions.
• Implementing controls proportionate to the level of risk.

Violation of international authorities' measures can result in civil and criminal liability for Gold Standard, its employees, as well as any third parties acting on its behalf. Potential consequences include regulatory investigations, civil penalties, fines, and sanctions, as well as criminal liability, which may result in prosecution, imprisonment, or personal liability for responsible individuals.

Compliance with this Policy is mandatory for all GS staff members, and violations will be taken seriously to protect the integrity and reputation of Gold Standard. Failure to comply with the KYC & AML Policy and procedures may result in disciplinary actions, including:

• Warnings and reprimands.
• Suspension or termination of contract.
• Reporting to relevant authorities for potential legal action.

The Gold Standard Foundation ensures clear accountability and governance for this KYC & AML Policy. The Compliance Officer is responsible for the Policy’s implementation and operational oversight. A formal review of the Policy is conducted annually or as required to address changes in regulatory requirements or organizational priorities.

Policy updates are presented to the EMT and approved by the Board to reinforce strategic alignment and organizational accountability. This periodic review cycle reflects Gold Standard's commitment to robust governance and continuous improvement.

KYC & AML Information & Declaration Request

To be adapted to each category of Counterparty and to the specific circumstances, in accordance with the principles of the Risk-Based Approach (RBA).

1. General Information

·       Full legal name of the counterparty.

·       Registered address and principal place of business.

·       Incorporation / registration number and jurisdiction.

·       Date of incorporation / registration.

·       Legal form (company, foundation, association, trust, partnership, individual, etc.).

·       Contact details (telephone, email, website).

·       Purpose and description of business activities.

2. Corporate Documentation

·       Certificate of Incorporation / Registration extract from the relevant register (not older than 3 months).

·       Articles of Association, By-Laws, or equivalent constitutional documents.

·       Recent commercial register extract or equivalent (less than 3 months).

·       Organizational chart showing ownership and control structure.

3. Ownership & Control

·       List of all shareholders, members, or equivalent with ≥25% ownership or control (direct or indirect).

·       Identification of all ultimate beneficial owners/UBOs (natural persons who ultimately own or control the counterparty, or on whose behalf the transaction is conducted).

·       Identification of directors, officers, trustees, or persons with signing authority.

·       Declaration if the counterparty is owned or controlled by a publicly listed company (and stock exchange details).

4. Identification Documents

·       For each ultimate beneficial owner, director, or controlling person:

o   Copy of valid passport or national ID card;

o   Proof of residential address (utility bill, bank statement, official government correspondence not older than 3 months).

5. Sanctions, PEP, and Compliance Declarations

·       Written statement confirming that neither the Counterparty, its directors, officers, nor ultimate beneficial owners:

o   Are subject to UN, US, EU, OFAC, UK, or CH sanctions;

o   Are Politically Exposed Persons (PEPs), or if so, provide details;

o   Have been convicted or investigated for financial crime, money laundering, terrorism financing, fraud, or corruption.

·       Statement of compliance with applicable AML/CFT regulations in the Counterparty’s jurisdiction.

·       Confirmation that funds used in transactions with GS are from legitimate sources.

6. Financial & Regulatory Information

·       Bank account details (name of financial institution, IBAN, SWIFT).

·       Recent audited financial statements (if available) or latest management accounts.

·       Licenses or authorizations (if regulated entity).

·       Confirmation of tax residency and tax identification numbers (TINs).

·       Origin of funds and wealth (detailed description and supporting evidence).

7. Purpose of Relationship

·       Description of the nature and purpose of the relationship with GS.

·       Expected volume, frequency, and types of transactions.

·       Geographic scope of Counterparties or beneficiaries involved.

·       Any carbon credit registry account maintained with other organizations (i.e. Verra, ACR, GCR, etc.).

8. Additional Supporting Documents

·       Professional references or banking reference letter.

·       Group structure chart for larger organizations.

·       Trust deed (if counterparty is a trust).

·       Foundation charter or deed (if counterparty is a foundation).

·       Extract of powers of attorney, if applicable.

9. Declaration & Signature

The Counterparty certifies that the information and documents provided are accurate, complete, and up to date, and undertakes to notify GS of any changes without delay.

Usual Suspicious Activities Unusual or Unconnected Sources and Recipients of Funds

• Receipt of unexplained payments from a party other than the Counterparty obligated to remit payment to Gold Standard.
• A request by a Counterparty creditor of Gold Standard that funds be transmitted to an account having no apparent connection to such Counterparty.
• Multiple payments from a Counterparty, through multiple entities, in connection with a single invoice.

Unusual or Non-Transparent Transactions and Instructions

• Payments in currency (including cash or cash equivalents), designed or having the effect of limiting the ability of authorities or financial institutions to monitor transactions.
• Inbound offshore payments from accounts maintained in countries unrelated to the Counterparty’s place of business or residence.
• Requests by Counterparty for non-standard deal structures lacking a legitimate business or economic purpose.
• Lack of transparency regarding beneficial ownership or control of assets or entities, including unwillingness to provide official proof of ownership, the use of nominee shareholders, bearer shares, or complex non-transparent ownership structures, or where beneficial owners are identified as politically exposed persons (PEPs) or government officials.
• Use of shell companies, offshore companies, intermediaries, or post office boxes in lieu of verifiable corporate structures or addresses.

Unusual or Suspicious Behaviors and Counterparties

• Counterparties known to have a poor reputation for business ethics or who otherwise appear to lack integrity.
• Engagement in suspicious activity of any nature, including but not limited to:
  - “Round-tripping,” whereby large or frequent credits, refunds, or overpayments are made in order to recycle funds and disguise their source.
  -“Structuring,” whereby large payments are broken into smaller transactions, often through different parties, for the purpose of evading financial controls.
• Circumstances in which a Counterparty:
  - Provides false, misleading, or materially inaccurate information concerning its identity, ownership, sources of funds, or operations;
  - Engages in transactions that lack commercial justification or deviate from its ordinary business practices; or
  - Refuses to respond to reasonable due diligence requests, challenges Gold Standard compliance requirements, or otherwise resists transparency.

Higher-Risk Jurisdictions

• Transactions involving jurisdictions that are subject to sanctions imposed by the United Nations, United States, the European Union, Switzerland or the United Kingdom.
• Transactions involving jurisdictions identified by the UN, EU, CH, UK or US government, the Financial Action Task Force (FATF), or other competent authorities as presenting elevated money laundering or terrorist financing risk.
• Transactions involving banking relationships in non-transparent or high-intensity financial crime jurisdictions.