Anti-Money Laundering Policy

Item	Detail
Entity	Horde Inc., a Delaware corporation, operating theCollectibles.io (the "Company")
Registered address	2810 N Church St STE 90840, Wilmington, DE 19802
Policy owner	Designated Compliance Officer (Section 3)
Approved by	Board of Directors of Horde Inc.
Version	1.0
Effective date	Oct 14, 2026
Next scheduled review	12 months after the effective date, or sooner on a material change

This Policy takes effect on Board approval and binds all directors, officers, employees and contractors of the Company. Any change requires Board approval, except non-material edits approved by the Compliance Officer and reported to the Board at its next meeting.

The Company will not be used to launder money, finance terrorism or evade sanctions. This Policy sets out how the Company prevents, detects and reports that activity.

The Policy covers all products on theCollectibles.io, including:

• digital pack purchases and reveals;
• buy-backs, account credits and payouts to users;
• physical redemption and shipping of collectibles;
• the Marketplace, where approved third-party vendors list and sell items to users.

The Company designs this program in line with:

• the U.S. Bank Secrecy Act (BSA) and USA PATRIOT Act, and FinCEN guidance;
• U.S. sanctions administered by OFAC;
• applicable U.S. state requirements;
• FATF Recommendations, as the international standard;
• the AML, KYC and sanctions requirements of the Company's payment providers and commercial partners.

The Company applies controls in proportion to the risk of each customer, vendor, product, payment method and jurisdiction.

The Board appoints the following person as the Company's AML Compliance Officer ("Compliance Officer"):

Item	Detail
Name	Alejandro Fiacro Castillo
Title	Director and AML Compliance Officer
Email	legal@hordeinc.com
Reports to	Board of Directors

The Compliance Officer has the authority, independence and resources to run this program. Their duties are to:

1. implement, maintain and update this Policy and the related procedures;
2. own the enterprise AML and sanctions risk assessment;
3. approve high-risk customers and vendors and decide on account restrictions;
4. review escalated alerts and decide whether to file a suspicious activity report;
5. act as the contact point for regulators, law enforcement, banks and payment providers;
6. run the training program and coordinate independent testing;
7. report to the Board at least once a year, and promptly on any material issue.

The Compliance Officer has direct access to the Board and unrestricted access to all Company records and systems needed for the role. If the role becomes vacant, the Board will appoint an interim Compliance Officer within 30 days.

Risk assessment

The Compliance Officer completes a written AML and sanctions risk assessment before launch and at least once a year. It rates risk across customers, vendors, products, delivery channels, payment methods and geographies. The Board reviews the results.

Key risks the Company has identified include:

• buying packs with illicit funds and cashing out through buy-backs or resale;
• use of stolen payment cards, account takeover and chargeback fraud;
• collusion between users and vendors to move value through over-priced listings;
• vendors selling counterfeit or stolen goods;
• users or vendors in sanctioned or restricted jurisdictions;
• multiple accounts controlled by one person.

Core controls

The Company maintains these controls:

• tiered KYC on users, with identity documents verified before any payout, buy-back cash-out or physical order, and KYB on vendors before they can list (Sections 5 and 6);
• sanctions screening at onboarding and on an ongoing basis (Section 7);
• geolocation and IP checks that block restricted jurisdictions;
• age verification, with users required to be 18 or older;
• deposit, purchase and payout limits that scale with the verification level;
• payouts only to a verified account or payment method in the user's own name;
• no cash, and no transfer of funds between users;
• automated transaction monitoring with manual review (Section 8);
• device fingerprinting, duplicate-account detection and 3-D Secure authentication on card payments;
• segregation of duties, so no single person can both approve and execute a payout.

Procedures

The Compliance Officer maintains written operating procedures for each control. Staff must follow them, and exceptions require the Compliance Officer's written approval.

Verification is tiered by risk and activity. Every user passes Standard checks at registration, before any purchase; no identity documents are required to buy or open packs. Identity documents are verified only when a user first requests a payout, buy-back cash-out or physical order, or when a risk trigger applies.

Level	When it applies	What the Company collects and checks
Standard	All users, at registration	Email address; age 18+ check; geolocation
Enhanced identity	Before the first payout, buy-back cash-out or physical order (redemption or Marketplace purchase), or when a monitoring alert or other risk trigger applies	Full name, date of birth, residential address, email, phone; age 18+ check; geolocation; government-issued photo ID with liveness check through a third-party KYC provider; shipping address, screened before dispatch; name matched to the payment method or payout account; proof of address where needed
Enhanced due diligence (EDD)	High-risk users: PEPs, adverse media hits, unusual volumes, higher-risk geographies, or alerts	Source of funds or wealth, additional documents, Compliance Officer approval, closer monitoring

Ongoing due diligence. The Company keeps user data up to date and re-screens all users against sanctions and PEP lists on an ongoing basis. It refreshes verification when risk changes, data looks inconsistent or documents expire.

Refusal and exit. The Company refuses or closes an account if a user cannot be verified, provides false information, is in a restricted jurisdiction, or presents risk it cannot manage. If a user fails or refuses verification, any refundable balance is returned only to the original payment method. It does not tell the user if an exit relates to a suspicious activity report (Section 9).

Third-party providers. The Company may use vetted KYC and screening vendors. It remains responsible for the result and reviews each provider's performance at least once a year.

Only vendors that pass KYB and are approved by the Company may list on the Marketplace. Vendors set their own listing prices, ship items directly to buyers, and are responsible for returns.

Onboarding checks. Before approval, the Company collects and verifies:

1. legal name, registration number, jurisdiction and registered address, with incorporation documents;
2. ultimate beneficial owners holding 25% or more, and at least one controlling person, each verified as in Section 5;
3. directors and authorized signatories;
4. tax identification number (e.g. EIN or W-9 / W-8BEN-E);
5. a business bank account in the vendor's own name;
6. nature of business, product categories, sourcing of inventory and expected volumes;
7. sanctions, PEP and adverse media screening on the entity, owners and directors;
8. for collectibles and branded goods, evidence of authenticity controls and of the right to sell the goods.

Approval. Each vendor receives a risk rating. High-risk vendors require EDD and the Compliance Officer's written approval. Every approved vendor signs a vendor agreement covering AML, sanctions, authenticity, returns and cooperation with information requests.

Ongoing monitoring. The Company re-screens vendors on an ongoing basis and monitors:

• listing prices against market value, to detect over- or under-pricing;
• repeated purchases between the same buyers and vendors;
• spikes in sales, returns, disputes or chargebacks;
• changes in ownership, bank account or business activity.

Vendors must notify the Company of any change in ownership or control within 10 business days. KYB is refreshed at least annually for high-risk vendors and every two years for others.

Suspension. The Company may suspend listings, hold payouts or terminate a vendor that fails KYB, breaches the vendor agreement, or presents unmanaged AML, sanctions or fraud risk.

The Company does not deal with sanctioned persons or with comprehensively sanctioned countries and regions.

• Users, vendors, beneficial owners and payout recipients are screened against the OFAC SDN and other OFAC lists, and against UN, EU and UK consolidated lists, at onboarding and on an ongoing basis.
• Shipping addresses are screened before any physical item is dispatched.
• Access is blocked by geolocation and IP from comprehensively sanctioned countries and regions, and from any other jurisdiction the Company or its partners designate as restricted.
• VPN, proxy and location-spoofing use is detected and blocked where it hides a restricted location.
• Potential matches are frozen pending review. Confirmed matches are blocked, and the Compliance Officer handles any required OFAC report within the legal deadline.

The Compliance Officer keeps the restricted jurisdictions list current and implements partner-notified changes promptly.

All purchases, buy-backs, payouts, Marketplace sales and redemptions pass through automated monitoring. Alerts go to a reviewer, and the reviewer escalates them to the Compliance Officer where needed.

The monitoring rules flag:

• purchase or payout volumes out of line with the user's profile or history;
• rapid buy-and-cash-out patterns, such as opening packs and immediately selling everything back;
• many accounts sharing devices, IPs, payment methods, addresses or payout accounts;
• structuring, meaning many small transactions kept just under a limit or threshold;
• repeated trades between the same buyers and vendors, or listings priced far from market value;
• payment methods not in the user's name, or many cards on one account;
• high chargeback, refund or dispute rates;
• activity from high-risk or restricted locations.

Review

Reviewers document every alert, the evidence and the outcome. Alerts are reviewed within 5 business days, or sooner for high-risk alerts. The Company may delay or hold a payout while an alert is open.

Tuning

The Compliance Officer reviews rules and thresholds at least every six months and after any new product, vendor category or market, and records the reasons for each change.

Any director, officer, employee or contractor who suspects money laundering, terrorist financing, sanctions evasion or fraud must report it to the Compliance Officer right away, through legal@hordeinc.com or the internal case tool.

The Compliance Officer then:

1. investigates and documents the facts and the decision;
2. files a Suspicious Activity Report (SAR) with FinCEN where required or where the Company files voluntarily, within 30 calendar days of initial detection (up to 60 days if no suspect is identified);
3. notifies affected payment providers and partners where the contract requires it and the law allows;
4. decides whether to restrict, freeze or close the account;
5. reports any matter needing immediate attention, such as terrorist financing, to law enforcement at once.

Confidentiality

No one may tell a user, vendor or any third party that a SAR has been filed or is being considered ("tipping off"). SARs and their supporting records are kept confidential and are shared only as the law allows.

Protection

No one will face retaliation for making a good-faith report.

The Company keeps the following for at least five years after the account or vendor relationship ends, or after the transaction date, whichever is later:

• KYC and KYB records, including verification results and screening hits;
• transaction, payout, buy-back and redemption records;
• alert reviews, investigations and decisions;
• SARs and supporting documentation;
• risk assessments, training records and independent test reports.

Records are stored securely, access is limited to authorized staff, and they can be produced promptly to regulators, law enforcement or auditors on lawful request. Personal data is handled in line with the Company's privacy policy and applicable data protection law.

All directors, officers, employees and relevant contractors complete AML and sanctions training within 30 days of joining and at least once a year after that.

Training covers:

• this Policy and the related procedures;
• money laundering, terrorist financing and sanctions risks specific to collectibles, packs and the Marketplace;
• recognizing red flags and how to escalate them;
• KYC, KYB and screening procedures for staff who perform them;
• confidentiality and the ban on tipping off.

Customer support, payments, vendor onboarding and compliance staff receive additional role-specific training. The Compliance Officer receives specialist training each year. Completion is recorded and tracked, and the results are reported to the Board.

A qualified party independent of the Compliance Officer tests this program at least once a year. The tester is an external auditor or AML consultant, or an internal reviewer with no role in running the program.

The test checks:

• whether the risk assessment is current and complete;
• whether KYC, KYB, screening and monitoring work as written, using sample testing;
• the quality and timeliness of alert reviews and SAR decisions;
• training completion;
• recordkeeping;
• whether earlier findings have been fixed.

The tester reports findings directly to the Board. The Compliance Officer prepares a remediation plan with owners and deadlines, and reports progress to the Board until every finding is closed.

This Policy is reviewed at least once a year. It is also reviewed after a material change in law, products, vendor categories, markets or partner requirements, or after a significant test finding.

The Board of Directors of Horde Inc. approved and adopted this Anti-Money Laundering Policy, version 1.0. It also appointed Alejandro Fiacro Castillo, as the Company's AML Compliance Officer.

Director: Mikko Puustinen, 10/14/2026.

Acknowledged by the Compliance Officer: Alejandro Fiacro Castillo, 10/14/2026.