Risk Disclosure

September 2026

• 1. Purpose and Scope

The purpose of this Risk Disclosure is to provide clear, though not exhaustive, information about some of the main risks associated with the use of the Website, the Platform, and the services made available directly by Luso Digital Assets, Lda. (hereinafter referred to as "Luso"), or accessible through third-party partners.

This document should be read in conjunction with the Terms and Conditions, the Privacy Policy, the Cookie Policy, the notices displayed during the onboarding process, the applicable partner documentation, and, where available, the specific documentation for the cryptoasset, token, protocol, issuer, or blockchain network in question.

Use of the Platform, opening an account, conducting transactions involving cryptoassets, using a non-custodial wallet, interacting with decentralized protocols, or accessing partner services presupposes that the Customer has read, understood, and accepts the risks described in this document and in the other applicable contractual documents.

• 2. General Warning Regarding Cryptoassets

Cryptoassets are high-risk, technologically complex digital assets subject to significant volatility. Their value may rise or fall rapidly, significantly, and unpredictably, or become economically unviable due to a lack of liquidity, technical failures, regulatory changes, a loss of market confidence, or other factors.

Trading, holding, exchanging, receiving, sending, or using cryptoassets may not be suitable for all Clients. Before using the Services, the Client must carefully assess their knowledge, experience, objectives, financial situation, risk tolerance, and ability to withstand losses.

The Client should not use cryptoassets, stablecoins, EMTs, decentralized protocols, or Platform features with amounts that they cannot afford to lose. Past performance, historical prices, simulations, projections, informational content, or marketing materials do not constitute a guarantee of future results.

• 3. Luso's Role and Third-Party Services

Under the terms of the currently applicable contractual documents, Luso provides a technology platform that may enable, among other things, access to a non-custodial digital wallet, features related to electronic money tokens, exchange transactions, or interfaces for interacting with aggregators, decentralized protocols, and other partners.

Unless this is formally amended and reflected in updated contractual documentation, Luso is not a credit institution, payment institution, electronic money institution, investment firm, digital asset custodian, electronic money issuer, or crypto-asset service provider authorized under the MiCA Regulation.

Certain services may be provided by partners, including issuers of electronic money tokens, payment service providers, technology infrastructure providers, identity verification providers, risk analysis providers, aggregators, blockchain networks, and decentralized protocols. These third parties may act on their own behalf, be subject to their own terms and policies, and make independent decisions regarding the provision, suspension, limitation, or termination of their services.

The use of a Luso interface, brand, domain, or digital path does not imply that all underlying services are provided, controlled, guaranteed, or supervised exclusively by Luso.

• 4. No Financial, Legal, or Tax Advice

No information provided by Luso should be construed as investment advice, personalized recommendations, or financial, legal, tax, accounting, or regulatory advice, except where there is an express and separate agreement for a service that legally permits such advice and strictly within the terms under which such service is provided.

The decision to use the Services, select a cryptoasset, make a trade, interact with a protocol, use an EMT, or carry out any transaction rests solely with the Customer. The Customer should seek independent professional advice whenever necessary.

• 5. Market, Price, and Liquidity Risks

The prices of cryptoassets may fluctuate sharply as a result of changes in supply and demand, news, macroeconomic events, regulatory decisions, technical failures, listings or delistings, security incidents, market manipulation, concentration of holders, decisions by issuers, or changes to the underlying protocols.

Liquidity may be limited or nonexistent. Under certain circumstances, the Client may be unable to buy, sell, exchange, redeem, or transfer an asset at the desired time, at the quoted price, in the desired quantity, or at all.

Quotes, simulations, or estimates provided prior to a transaction may differ from the price at which the transaction is actually executed, particularly in volatile markets, for assets with low liquidity, in larger transactions, during periods of network congestion, or when interacting with decentralized protocols. Spreads, price slippage, network fees, aggregator fees, partner commissions, and other costs may apply.

• 6. Risk of Total Loss and Absence of Guarantees

The use of cryptoassets may result in the partial or total loss of the economic value of the assets used. In regulated services where legally required, Luso ensures compliance with best execution obligations, including execution at the best price when applicable. Outside of this scope—specifically when a transaction depends on third parties, markets, blockchain networks, aggregators, or decentralized protocols—Luso does not guarantee profitability, returns, capital preservation, permanent market availability, asset appreciation, the continued existence of any cryptoasset, or the recovery of losses.

Cryptoassets should not be equated with bank deposits. As a general rule, the holding or use of cryptoassets is not protected by deposit insurance funds or investor compensation schemes applicable to traditional financial instruments, unless the law or the documentation for a specific product expressly provides otherwise.

• 7. Specific Risks of EMTs and Stablecoins

Electronic money tokens ("EMTs") and other stablecoins generally seek to maintain a stable peg to an official currency or another reference asset. This stability does not eliminate risks. Redemption failures, operational delays, suspension of issuances or redemptions, regulatory limitations, loss of parity, insufficient or unavailable reserves, insolvency or default by the issuer, legal freezes, or restrictions imposed by partners may occur.

When the Platform allows access to EMTs issued by a third-party entity, the issuance, redemption, convertibility at par, safeguarding of funds, availability, and continuity of such EMTs are the responsibility of the respective issuer and are governed by the contractual and legal documentation applicable to that issuer. The right to redeem is exercised against the issuer, not against Luso, unless otherwise expressly provided by law or contract.

Not all EMTs and stablecoins are equivalent. Stablecoins issued outside the European Economic Area, representative tokens, "wrapped" assets, or assets issued via bridges may present increased risks related to reserves, governance, counterparty, jurisdiction, suspension of redemption, loss of parity, and technical failures.

• 8. Risks of Self-Custody and Loss of Credentials

The digital wallet provided through the Platform may operate on a non-custodial basis. Under this model, Luso does not hold possession, custody, or control of the Client's cryptoassets and has no authority to move assets on the Client's behalf, reconstruct private keys, recover lost credentials, or reverse transactions confirmed on the blockchain.

The loss, destruction, theft, compromise, or improper disclosure of credentials, devices, authentication factors, keys, backups, or recovery mechanisms may result in permanent and irreversible loss of access to cryptoassets. The Customer is responsible for keeping their devices, credentials, passwords, authentication methods, and backups secure, up to date, and inaccessible to third parties.

The Customer is also responsible for verifying destination addresses, the blockchain network, amounts, asset identification, token compatibility, applicable fees, and other parameters before confirming a transaction. Sending assets to an incorrect address, an incompatible network, or an unsupported smart contract may result in the irreversible loss of assets.

• 9. Blockchain Risks, Finalization, and Network Fees

Transactions conducted on blockchain networks rely on distributed technologies that Luso does not control. Blockchain networks may experience congestion, delays, interruptions, attacks, consensus failures, cryptographic vulnerabilities, protocol changes, hard forks, block reorganizations, validator failures, node unavailability, or unexpected increases in network fees.

A transaction that has been validated and confirmed on the blockchain is, as a rule, final and irreversible. Luso cannot cancel, alter, void, or reverse confirmed transactions, even if they result from an error, fraud, customer mistake, sending to the wrong address, selecting the wrong network, or using an unsupported asset.

Network fees, also known as gas fees or network fees, can vary substantially and are not determined by Luso. These fees may be charged even if the transaction fails, is rejected by a protocol, does not produce the intended result, or becomes economically unfeasible.

• 10. Risks Associated with Swaps, Aggregators, and DeFi Protocols

Swap transactions, when available, may be executed through aggregators, liquidity pools, smart contracts, decentralized protocols, or other third-party infrastructure. Luso may provide an access interface, but does not necessarily control the protocol, liquidity, code, governance, validators, oracles, liquidity providers, or the final execution of the transaction.

The use of DeFi protocols and smart contracts involves increased risks, including code errors, vulnerabilities, exploitation by third parties, oracle failures, price manipulation, economic attacks, governance decisions, administrative keys, protocol halts, rug pulls, fake tokens, low liquidity, impermanent loss, front-running, MEV, high slippage, and excessive or unlimited token approvals.

Providing access to a protocol, token, aggregator, or feature through the Platform does not constitute a recommendation, certification, audit, security guarantee, liquidity guarantee, or statement of suitability for the Client.

• 11. Cybersecurity, Fraud, and Social Engineering Risks

The Customer may be exposed to risks such as phishing, spoofing, fake websites, malicious applications, malware, keyloggers, SIM swapping, email compromise, fraudulent messages, fake support teams, urgent transfer requests, investment fraud, asset recovery schemes, and other forms of social engineering.

No technological system offers absolute security. The Customer must ensure that they use official channels, enable strong authentication mechanisms whenever available, keep devices and software up to date, do not share credentials, do not disclose authentication codes, and contact Luso immediately if they suspect unauthorized access, fraud, a security incident, or unauthorized use of the account.

• 12. Operational, Third-Party, and Business Continuity Risks

The provision of the Services may depend on technology infrastructure providers, cloud service providers, authentication systems, identity verification partners, financial institutions, payment service providers, EMT issuers, blockchain analytics providers, aggregators, decentralized protocols, and blockchain networks.

Failures, delays, outages, contractual changes, insolvency, security incidents, maintenance, technical errors, legal restrictions, partner decisions, or the inability to access third-party services may affect the availability, performance, or continuity of the Services. Luso may need to suspend, limit, modify, replace, or discontinue features, assets, partners, or integrations for legal, technical, operational, security, risk, or compliance reasons.

• 13. Regulatory Risks, Sanctions, and AML/CFT

The legal and regulatory framework governing cryptoassets, stablecoins, EMTs, digital wallets, DeFi, decentralized protocols, payment services, and tax reporting is constantly evolving. Legislative changes, decisions by authorities, new regulatory interpretations, or supervisory requirements may affect the availability of the Services, the admissibility of certain assets, the execution of transactions, relationships with partners, or the ability to provide services in certain jurisdictions.

Luso is required to implement measures to prevent money laundering and terrorist financing, prevent fraud, comply with sanctions, verify identity, assess risk, monitor transactions, conduct enhanced due diligence, refuse transactions, freeze or block relationships, suspend or close accounts, and report to competent authorities, in accordance with applicable law.

Certain banks, payment providers, platforms, issuers, or authorities may refuse, block, delay, or question transfers or transactions related to cryptoassets. The Customer must ensure that their use of the Services is lawful in the country where they reside, are located, or conduct transactions.

• 14. Tax Risks and Reporting Obligations

The holding, purchase, sale, exchange, transfer, receipt, redemption, use, or conversion of cryptoassets, EMTs, or other digital assets may give rise to tax, filing, accounting, or reporting obligations in Portugal or other jurisdictions.

The Client is responsible for determining and complying with their tax and reporting obligations, including maintaining adequate records, calculating gains and losses, reporting income, complying with international obligations, and obtaining independent tax advice. Luso or its partners are legally required to collect, retain, and report tax and transactional information to the competent authorities, including under applicable legal regimes.

• 15. Risks Related to Personal Data and Blockchain Transparency

Public blockchain networks record information in a distributed manner and, as a rule, make it publicly accessible. Wallet addresses, transaction identifiers, amounts, dates, networks, tokens, and other elements may remain visible and technically accessible to third parties, even if they do not directly reveal the Customer's name.

Although information on the blockchain is often pseudonymous, it may constitute personal data when associated with an identified or identifiable individual. Luso does not control public blockchain networks and cannot delete, alter, or reverse data that has been validly recorded on those networks. The exercise of data protection rights may therefore be satisfied only with respect to systems and copies under Luso's control, subject to applicable technical and legal limitations.

Luso may process identification, contact, transactional, technical, financial, tax, risk, AML/CFT, sanctions, fraud, and blockchain analysis data, in accordance with the Privacy Policy. Certain partners may process data as independent data controllers and are subject to their own privacy policies and legal obligations.

• 16. Risks Related to Information, Documentation, and Supported Assets

Documentation regarding cryptoassets, including white papers, websites, technical materials, issuer documentation, or community information, may be incomplete, outdated, incorrect, unaudited, or not approved by a competent authority. The Customer must review the documentation for the asset, issuer, protocol, and network before executing any transaction.

Luso may decide not to support certain assets, networks, forks, airdrops, upgrades, wrapped versions, bridged tokens, smart contracts, or features. Sending unsupported assets, using an incompatible network, or attempting to access features not made available by Luso may result in the loss, freezing, or impossibility of asset recovery.

• 17. Client Responsibilities

Before using the Services, the Client must, at a minimum:

• read and understand the Terms and Conditions, this Risk Disclosure, the Privacy Policy, and the applicable partner documentation;
• assess whether their knowledge, experience, objectives, and financial capacity are compatible with the risks associated with cryptoassets;
• not invest funds that they cannot afford to lose;
• carefully verify the asset, blockchain network, address, amount, fees, and other parameters before authorizing any transaction;
• protect credentials, devices, passwords, authentication factors, keys, recovery mechanisms, and backups;
• verify the authenticity of websites, communications, contacts, email addresses, links, and instructions received;
• keep your personal, tax, professional, and financial information accurate, complete, and up to date;
• comply with all applicable legal, tax, foreign exchange, sanctions, and other obligations;
• seek independent professional advice whenever you have questions regarding risks, suitability, taxation, succession, accounting, legal framework, or regulatory implications;
• promptly report to Luso any suspected fraud, unauthorized access, error, security incident, or misuse of the account.

• 18. Acceptance of Risks

By creating an account, accessing the Platform, using the Services, interacting with partners, or confirming any transaction, the Customer declares that they have read and understood this Risk Disclosure, acknowledges that the risks described are not exhaustive, accepts that there may be other unidentified or currently unforeseeable risks, and assumes responsibility for their decisions and transactions.

The Client further acknowledges that Luso does not guarantee the appreciation, liquidity, absolute security, continuity, suitability, or recovery of any cryptoasset, EMT, stablecoin, protocol, blockchain network, aggregator, partner, or transaction, to the extent permitted by applicable law and the contractual documents in effect.

• 19. Contact Information

Questions regarding services, transactions, account security, or complaints should be directed to: support@lusodigitalassets.com.

Questions regarding privacy and the exercise of data protection rights may be directed to: legal@lusodigitalassets.com.

Contact information for the Data Protection Officer (DPO): dpo@lusodigitalassets.com.