Whistleblowing Policy

This Whistleblowing Policy establishes a structured mechanism through which employees and stakeholders can raise concerns regarding misconduct, unethical behaviour, regulatory breaches, or any action that may compromise the Company's values or legal obligations.

In accordance with VARA's regulations, virtual asset service providers (VASPs) are required to establish and maintain effective internal whistleblowing mechanisms. These mechanisms must ensure that employees and external stakeholders can report concerns confidentially and without fear of retaliation. VARA mandates that material breaches be escalated in a timely and documented manner and that all relevant records be preserved and made accessible for regulatory review.

The objective of this policy is to encourage the timely and responsible reporting of concerns, to protect individuals who report in good faith from retaliation, to maintain a culture of transparency, deter misconduct, and enable early intervention when risks arise.

This Policy applies universally across the organisation, including all employees, directors, contractors, consultants, and any third-party stakeholders who have a professional relationship with the Company. It also extends to individuals involved in services where access to internal processes, confidential data, or business-sensitive operations is provided.

Reports may be raised regarding internal misconduct, breaches of VARA regulations, violations of UAE laws, or unethical actions taken by individuals or groups within the organisation. These may include — but are not limited to — financial fraud, data manipulation, regulatory evasion, abuse of authority, conflicts of interest, or deliberate non-compliance with applicable laws such as AML/CFT standards.

• Whistleblowing — the act of reporting suspected or actual wrongdoing within the Company.
• Whistleblower — any individual who, in good faith, raises a concern about a possible violation of law, regulation, or Company policy.
• Good faith — an honest belief in the accuracy of the report, even if the concern is later found to be unsubstantiated.
• Material misconduct — any issue with significant financial, operational, reputational, or regulatory implications.
• Fraud — intentional misrepresentation or concealment of information to gain an unfair advantage, causing financial or reputational harm to Tribe or its stakeholders.
• Corruption — the abuse of entrusted power or position for personal or third-party gain, including bribery, kickbacks, or unethical business practices.
• Harassment and Discrimination — unwelcome conduct or bias that creates a hostile, offensive, or unfair work environment based on protected characteristics such as race, gender, religion, or disability.
• Safety Violations — failure to comply with health and safety standards, resulting in actual or potential harm to employees, clients, or the public.
• Market Offences — activities that undermine market integrity, such as insider trading, market manipulation, or unauthorised disclosure of confidential information.
• Retaliation — any adverse employment or professional consequences resulting from a whistleblowing report, such as dismissal, demotion, harassment, or exclusion.

Whistleblowing reports can be submitted via the following channels (available to both internal and external parties):

• Email: compliance@mytribe.ae
• Online portal: tribeinvest.co/contact
• Phone: +971 4 594 3839
• In-person: directly to the Compliance Officer
• Post: 440, Level 3, The Offices 3, Dubai, United Arab Emirates

When submitting a report, individuals are encouraged to include specific information such as the nature of the concern, parties involved, relevant dates, supporting evidence, and potential witnesses. Anonymous reports are accepted, although they may limit the Company's ability to investigate fully if critical information is missing.

All reports submitted under this framework are treated with urgency, impartiality, and discretion. The Company is committed to managing each report in a timely and objective manner, maintaining strict confidentiality throughout the entire process to protect the identities and interests of all parties involved.

Tribe enforces a zero-tolerance policy toward retaliation. Any adverse action taken against individuals who raise concerns in good faith — whether through formal whistleblowing channels or informal internal reporting — will be considered a serious breach of company policy and addressed through appropriate disciplinary or legal action.

Tribe adopts a zero-tolerance approach to all forms of fraud and corruption. The following actions are expressly prohibited:

• Falsification of Records: The intentional alteration, fabrication, or misrepresentation of financial documents, operational reports, time records, or any official company data for personal or organisational gain.
• Financial Misconduct: Misappropriation or unauthorised use of company funds or assets, including theft, embezzlement, or diversion of resources for unauthorised purposes.
• Bribery and Improper Influence: Offering, receiving, soliciting, or giving any form of gift, payment, benefit, or inducement intended to influence business decisions improperly or secure an unfair advantage.

Tribe is dedicated to promoting a respectful, inclusive, and professional working environment, free from all forms of harassment and discrimination. The following behaviours are strictly forbidden:

• Sexual Harassment: Any unwelcome sexual advances, requests for sexual favours, or other verbal, visual, or physical conduct of a sexual nature that creates an intimidating, hostile, or offensive environment.
• Discrimination: Any unfair or unequal treatment of individuals based on race, gender, age, religion, national origin, disability, marital status, or any other characteristic protected under applicable law or company policy.

All allegations of harassment or discrimination will be investigated promptly and thoroughly, with appropriate corrective action taken where necessary.

Tribe prioritises the health, safety, and well-being of its employees, clients, and business partners. The following safety breaches are unacceptable:

• Disregarding or bypassing established emergency procedures.
• Failing to wear or utilise mandated personal protective equipment (PPE) where required.
• Engaging in reckless, negligent, or intentional acts that endanger the safety of others or violate internal safety protocols.

As a regulated entity under VARA, Tribe is committed to preserving the integrity of virtual asset markets. The following conduct is strictly prohibited:

• Insider Trading: Buying, selling, or otherwise dealing in virtual assets based on material, non-public information obtained through one's role within Tribe.
• Market Manipulation: Engaging in deceptive or manipulative practices that artificially influence the price, volume, or supply of virtual assets, or that mislead market participants.
• Unauthorised Disclosure of Confidential Information: Releasing or leaking sensitive, proprietary, or price-sensitive information without appropriate authorisation or contrary to confidentiality obligations.

Violations of any of the above standards may result in disciplinary action, up to and including termination of employment or contract, notification to VARA or other regulatory bodies, and the initiation of civil or criminal proceedings where applicable.

All whistleblowing reports are subject to a formal and structured investigation process. Upon receipt of a report, an impartial investigator is appointed, typically from the Compliance or Human Resources department. The appointed investigator must have no conflict of interest in the matter and must act independently throughout the process.

The investigation involves gathering and preserving all relevant evidence, interviewing witnesses, and compiling a detailed record of findings and outcomes. Tribe endeavours to conduct investigations within a reasonable timeframe, taking into account the complexity and severity of the matter. Where appropriate and without compromising confidentiality, whistleblowers may be kept informed of the investigation's progress and its eventual outcome.

Tribe enforces a strict zero-tolerance policy against retaliation. Any individual who raises a concern in good faith or participates in an investigation is protected against dismissal, demotion, harassment, isolation, or any form of adverse treatment as a result of their disclosure.

The identity of a whistleblower is protected to the maximum extent permitted by law. Disclosure of a whistleblower's identity, if required, is strictly limited to those directly involved in investigating the matter or to regulators where legal obligations apply.

Tribe applies a structured and proportionate disciplinary framework to address violations of internal policies, regulatory obligations, or ethical standards. Available sanctions may range from verbal or written warnings and formal reprimands to mandatory compliance training, suspension of responsibilities, or termination of employment or engagement.

Where violations involve misuse of resources or financial loss, the responsible party may be required to make restitution. All disciplinary actions are applied consistently and documented thoroughly, both for internal governance and in anticipation of any regulatory inquiries.

Where a breach falls within the regulatory scope of VARA, the matter will be reported in accordance with the timelines and format prescribed under VARA's rulebooks. Should a report contain indications of financial crime or market manipulation, it will be referred to the UAE Financial Intelligence Unit (FIU). If criminal activity is suspected, Tribe will escalate the matter to the appropriate law enforcement authority and provide full cooperation throughout any legal investigation.

The effectiveness of Tribe's whistleblowing programme is assessed through periodic audits. These reviews examine procedural compliance, the adequacy of whistleblower protections, and the Company's responsiveness to reported concerns. Audit findings are presented to senior management and used to drive continuous improvement across relevant areas of governance.

All employees are required to complete training on this Whistleblowing Policy as part of the Company's broader compliance programme. In addition to onboarding training, periodic refresher sessions are conducted to reinforce awareness of ethical and regulatory obligations. The Policy is made easily accessible to all employees through the Company intranet, the employee handbook, and regular compliance briefings.

Tribe is committed to maintaining comprehensive, accurate, and secure documentation of all whistleblower-related activities. This includes the receipt of reports, the conduct and outcome of investigations, and the implementation of any resulting disciplinary or remedial actions.

All whistleblower documentation is securely stored and protected by robust technical and administrative safeguards, including encryption protocols, access restrictions, and audit logs. Access is strictly limited to authorised personnel directly involved in investigations, compliance oversight, or regulatory inspections.

Tribe retains all whistleblowing-related records for a minimum of eight (8) years from the date the investigation is formally closed, in alignment with regulatory requirements.

Tribe's Whistleblowing Policy undergoes formal review at least once per year, led jointly by the Compliance and Legal departments. In addition to the annual review cycle, the policy is also revised on an ad hoc basis in response to regulatory developments or legal changes issued by VARA or other relevant supervisory bodies.