Whistleblower Policy

Last updated: October 30, 2026

1. Our commitment

Platiniq is operated by NOVACORE TECHNOLOGIES LTD. (“we”, “us”). We encourage people to raise concerns about suspected wrongdoing involving our business and prohibit retaliation against anyone who reports a concern on reasonable grounds or assists an investigation.

This policy is available to current and former employees, directors, contractors, suppliers, partners, customers and others who become aware of suspected wrongdoing involving our business activities.

2. What to report

Report suspected misconduct, including:

• Fraud, theft, bribery, corruption or misuse of company or customer funds.
• Money laundering, terrorist financing, sanctions evasion or failures in related controls.
• Misleading statements, falsified records, concealed conflicts of interest or regulatory breaches.
• Serious privacy, cybersecurity, safeguarding or operational-control failures.
• Harassment, discrimination, retaliation, or attempts to conceal or obstruct the reporting of wrongdoing.

You do not need to prove the concern or conduct your own investigation. Explain what you reasonably believe happened and distinguish facts from assumptions. Protection under this policy continues if a concern is mistaken or cannot be substantiated.

For ordinary service complaints, use our Complaints Procedure. A customer may still use this policy to report suspected wrongdoing.

3. How to report

Email [email protected] with the subject Confidential Whistleblower Report. This is the company contact address for reports, follow-up and escalation. You do not need a manager’s permission to report.

If the concern involves support staff, management, an owner or the handling of an earlier report, request conflict-free review. The report must be assigned to an unconflicted director or an appropriate external reviewer. Anyone implicated in a concern must not handle or control its investigation. You may also report directly to competent authorities without using the company inbox first.

Include relevant events, dates, people involved, available evidence, any immediate risk and a safe way to contact you, if you wish. Preserve information already lawfully available to you. Do not obtain unauthorized access, alter records or send private keys, recovery phrases or unnecessary sensitive personal information. Ask for a secure way to transfer sensitive evidence before sending it.

You may report without giving your name, and we assess such reports on the information available. However, support email is not an anonymous reporting portal: authorized staff handling the inbox may see your message, sender details and metadata. Omitting your name does not guarantee anonymity, and limited contact information can restrict follow-up.

4. Confidentiality and protection

We restrict access to reports and identifying information to people who need it to assess the concern, investigate, take corrective action or meet legal obligations. We protect identities as far as reasonably possible, but cannot promise absolute confidentiality: disclosure may be required by law or necessary for a fair investigation. Where lawful and practicable, we discuss necessary identification with the reporter first.

Retaliation includes dismissal, demotion, threats, harassment, unfair exclusion, adverse treatment of a customer or supplier, or other disadvantage because someone made a protected report or assisted a review. We investigate suspected retaliation and take appropriate corrective or disciplinary action, up to termination of employment or a contractual relationship, subject to applicable law.

Report retaliation to [email protected] and request conflict-free handling where relevant. The recipient will assess protective measures promptly. Nothing in this policy limits protections available under applicable law, and reporting does not provide immunity for a person’s own misconduct.

5. How we respond

We assess urgency, conflicts of interest and immediate risks, appoint an unconflicted reviewer and preserve relevant evidence. We may use an external investigator where appropriate. Anyone accused will be treated fairly and given an appropriate opportunity to respond, consistent with protecting evidence and people.

Where we have a safe contact method, we acknowledge reports promptly and provide appropriate progress updates, subject to privacy, legal and investigation constraints. We meet any applicable mandatory acknowledgement and feedback deadlines. Urgent protective action and mandatory reporting must not wait for completion of an investigation. Complex investigations may take longer, and we explain delays where we can.

We communicate an appropriate outcome or status to the reporter, subject to privacy, legal restrictions and investigation needs. Corrective action may include control improvements, disciplinary action or referral to competent authorities. If you believe the concern was mishandled, email [email protected] with the subject Whistleblower Escalation and request review by an unconflicted director or appropriate external reviewer. You may also report externally.

6. Reporting outside Platiniq

You may report directly to competent regulators or law enforcement, cooperate with them, or seek independent legal advice. You do not need to report internally first, obtain our approval or tell us that you have reported externally. Confidentiality agreements and this policy do not prevent lawful, protected disclosures.

For concerns within its mandate, including suspected money laundering, terrorist financing, sanctions evasion or relevant business non-compliance, see FINTRAC’s voluntary-information channel. FINTRAC does not resolve individual customer disputes or recover funds. Contact appropriate emergency services for an immediate threat to safety.

7. Records and oversight

We keep a restricted record of reports, assessment, investigation, decisions and follow-up, in accordance with our Privacy Policy and applicable law. We retain information only as needed for these purposes and applicable legal requirements, including any legal hold, then securely delete or anonymize it.

The designated policy owner maintains the process and reports material concerns and remedial action to an unconflicted director or other authorized independent overseer. We review this policy when legal, operational or reporting-process changes make that necessary, and whenever applicable law requires.