APPENDIX: Information of Custody and Administration Services 

Version: 1.0, Last updated: 08.07.2025

Aim: 

The following guidelines were issued by Smart Valor AG (“Smart Valor”) with the aim of establishing coherent, efficient, and effective supervisory practices, as well as ensuring a uniform and consistent application of the provisions of Article 75 of Regulation (EU) 2023/1114 on Markets in Crypto Assets (MiCA). The purpose of this section is, in particular, to specify the regulatory requirements applicable to Smart Valor as a provider of crypto-asset services, insofar as Smart Valor offers custody and administration services on behalf of clients. The focus lies on the development, implementation, and ongoing review of effective procedures and strategies aimed at safeguarding investor interests. This includes, in particular, the protection of client rights in connection with the service, as well as ensuring transparency, traceability, and legal compliance across all related processes. 

Content of the agreement in relation to custody and administration services 

Custody and Administration Service 

SMART VALOR has selected Fireblocks as its digital asset custody provider. Fireblocks is a globally recognized, institutional-grade custody platform offering secure infrastructure for managing and safeguarding digital assets. It leverages multi-party computation (MPC) and advanced key-sharding technology, ensuring that private keys are never fully exposed or stored in a single location. Instead, keys are distributed across multiple secure environments, significantly reducing the risk of compromise.  

Custody service ensures secure storage, protection, and administration of customer digital assets in full compliance with MiCA requirements, specifically Article 75 (1)(a). 

Custody services delivered through Fireblocks are deeply integrated into SMART VALOR’s wallet infrastructure. This integration enables the Company to maintain full operational control, automated transaction workflows, and real-time monitoring, while benefiting from Fireblocks’ robust compliance framework and advanced security protocols. 

All wallets used to hold client crypto-assets, whether individual or omnibus, are created, governed, and monitored within the Fireblocks ecosystem. These wallets are configured to align with SMART VALOR’s internal segregation policies, approval workflows, and custody procedures. 

For a detailed explanation of how SMART VALOR operates its custody process with Fireblocks, including wallet creation, access control, and transaction authorization, please refer to the dedicated SMART VALOR Custody Policy. 

Strategy of Custody 

The strategy of custody is designed to minimize the risk of loss of the client's crypto-assets, the rights associated with these crypto-assets, or the means of access to the crypto-assets due to fraud, cyber threats, or negligence.  

SMART VALOR has very strong authentication to Fireblocks, that insures only internal personnel can connect to the Fireblocks console and access the wallets, containing the crypto assets, after passing multiple authentication levels.  

Connecting to Fireblcks console as a SMART VALOR employee requires initial access to the company cloud infrastructure as the Fireblocks console will reject any authentication attempts not initiated from within SMART VALOR’s internal cloud network. 

In Fireblocks infrastructure, the crypto assets are segregated based on operational functions. SMART VALOR also has TAP (Transaction Authorization Policy) policies deployed that ensure that no single employee can complete a transaction. TAPs are configured to work with quorum approval. 

A summary of the strategy of custody will be provided to clients upon request in electronic format. 

Communication Channels and Authentication 

SMART VALOR ensures secure, efficient, and MiCA-compliant communication channels to protect customer assets, maintain data integrity, and uphold user privacy. 

The following communication methods are provided: 

FAQ Section Customers can access a comprehensive FAQ page (https://smartvalor.com/en/faq) addressing common inquiries and troubleshooting guidelines. 

Email and Support Ticket System Clients may contact SMART VALOR via the official support email (support@smartvalor.com). Emails are automatically converted into support tickets within Freshdesk, a dedicated helpdesk system. Support agents are assigned to tickets, with automated service-level agreements ensuring timely initial responses and resolutions. All sensitive or critical requests, such as account access issues (including two-factor authentication resets or email address changes), require the client to re-verify their account through identity verification, involving a passport and video identification via the integrated KYC system. 

Live Chat on Website SMART VALOR provides a real-time online chat feature directly on the website. If support agents are available, inquiries are addressed promptly. If agents are offline, customers receive a corresponding notification and messages that were left in chat automatically become Freshdesk tickets, ensuring follow-up communication within SLA. 

Customer Settings Management Customers can independently manage basic settings within their accounts, including address, password changes, two-factor authentication (2FA), and biometric access. This facilitates quick resolution of common tasks without direct support intervention. 

Investment Level Requests For changes to investment levels, customers submit requests along with required information through the designated section on the platform. SMART VALOR receives notifications internally (via Slack), promptly reviews submitted information, and contacts customers via email. These interactions also generate corresponding Freshdesk tickets to ensure traceability and effective follow-up. 

Customer Feedback After each resolved ticket, customers are encouraged to provide feedback on their interactions and the quality of support received, promoting continuous improvement of SMART VALOR’s customer service processes. 

Official Social Channels SMART VALOR uses Telegram (https://t.me/smartvalor_official), Twitter (@smartvalorinc), LinkedIn (https://www.linkedin.com/company/smartvalor), and Facebook (https://www.facebook.com/smartvalorinc) exclusively for general announcements and updates. These channels do not handle sensitive or contract-specific communication, however, clients can reach out to admins or send a message. All customer communications are routed from social media to SMART VALOR's email and integrated support ticketing system, ensuring seamless tracking, timely response, and comprehensive issue resolution. 

Secure Customer Authentication 

SMART VALOR implements stringent Secure Customer Authentication (SCA) protocols aligned with MiCA requirements. Authentication involves multi-factor authentication (MFA), integrating at least two independent authentication factors from: 

Knowledge (password) 

Possession (smartphone-based authenticator apps, security tokens) 

Inherence (biometric identifiers such as fingerprint or facial recognition) 

Additionally, SMART VALOR employs continuous monitoring mechanisms to detect unusual login attempts, suspicious activities, and potential security breaches.  Сustomers receive email notifications for every login attempt, whether successful or not. After five unsuccessful login attempts, account access is automatically blocked, and following a password change, customer withdrawals are temporarily suspended for 72 hours, enhancing overall account security.All authentication measures are regularly audited and updated according to evolving security standards and regulatory guidance to ensure full compliance with MiCA regulations and customer security expectations. 

Security Systems 

SMART VALOR implements layered security defenses using the following systems, but not limited to 

Identity Provider Service (IdP) 

Provides secure, passwordless authentication for the SmartValor platform users. Stytch enforces adaptive Multi-Factor Authentication (MFA), monitors for anomalous login patterns (e.g., IP and device fingerprint mismatches), and supports session expiration policies. All authentication events and identity anomalies are logged and reviewed in coordination with incident triage workflows. 

Web Application Firewall (WAF) 
Serves as the first line of defense for the trading platform’s web traffic. It blocks OWASP Top 10 vulnerabilities (e.g., SQL injection, XSS), rate-limits traffic during DDoS attempts, and filters automated bots. Cloudflare’s managed rulesets are regularly updated, and custom rules are implemented based on application-specific threat models. 

SAST, DAST and SCA 

SAST scans an application's static source code to find security flaws before runtime, while DAST tests the running application from an external, attacker-like perspective to identify vulnerabilities in its operational state. Complementing these, SCA analyzes all third-party and open-source components to uncover known vulnerabilities and potential licensing issues within the software supply chain. 

Fees, costs and charges 

Smart Valor applies following fees: 

2.5.1 Deposit fees 

Fiat- and cryptocurrency deposits are free of charge. 

2.5.2 Withdrawal fees 

2.5.2.1 Withdrawal fees for Fiat 

Withdrawal fees for Fiat are 0,125% of the withdrawal amount. The minimum withdraw amount is equivalent to 100 CHF. 

2.5.2.2 Withdrawal fees for Cryptocurrencies 

Withdrawals to external wallets require specific fee amounts in order for the transaction to be processed. These fees are specially selected to ensure the fastest processing times on the blockchain. When withdrawing funds, the withdrawal form provides information on the amount of the fee. Below is a table that contains all fees for every currency clients can withdraw. 

2.5.3 Fiat-crypto transactions 

Smart Valor charges a service fee to cover transaction expenses for buying or selling crypto assets. Fees are always calculated in Swiss Francs (CHF), regardless of customer’s fiat currency. See the table below for details: 

2.5.4 Trading Fees 

Crypto-to-crypto asset conversions executed via Smart Valor are subject to a 0.29% Taker/Maker fee. 

Reference to the Applicable Law 

These Terms and Conditions shall be governed by and construed in accordance with the laws of the Principality of Liechtenstein, in particular the Liechtenstein Blockchain Act (TVTG) of 3 October 2019, as well as applicable European Union legislation, including the Markets in Crypto-Assets Regulation (MiCAR – Regulation (EU) 2023/1114) and the related technical standards issued by the European Securities and Markets Authority (ESMA). 

Client Position Register 

Smart Valor safeguarding or managing crypto-assets on behalf of clients, ensures that a register is maintained for each client, listing positions that grant the client rights to the crypto-assets. 
SmartValor promptly records any movements in this register resulting from instructions issued by the client. In such cases, it ensures, through its internal procedures, that each movement affecting the registration of the crypto-assets is supported by a transaction regularly recorded in the client's position register. 

The corresponding procedures are as follows: 

Each client has dedicated wallets clearly separated from company-owned assets to prevent co-mingling. Assets from these individual wallets may periodically be consolidated into omnibus wallets for operational efficiency. 

Automated real-time ledgering systems ensure accurate transaction tracking and reconciliation. These systems continuously synchronize wallet balances with internal accounting records, enabling precise and immediate detection of any discrepancies. 

Strict role-based access control ensures segregation of duties, restricting employees from performing incompatible transactions. 

Automated transaction validation systems enforce technical rules that prevent unauthorized asset transfers between client and corporate wallets. 

Immutable audit trails record every wallet transaction, including source and destination wallets, transaction initiators, timestamps, and transaction purposes. 

Periodic compliance oversight reviews are conducted to confirm accuracy and integrity of wallet segregation, transaction validation, and reconciliation processes. 

Smart Valor facilitates the exercise of rights associated with the crypto-assets, as any event expected to create or modify a client’s rights will be immediately recorded in the client’s position register. In the event of changes to the underlying distributed ledger technology or other occurrences that are expected to create or modify a client’s rights, the client will retain full rights to the crypto-assets or rights granted based on their positions at the time the change or event occurs, unless explicitly stated otherwise in a valid agreement signed with Smart Valor before the event. Any modifications or specific terms concerning the creation or alteration of rights related to crypto-assets must be explicitly detailed in a separate, valid written agreement executed by both parties prior to the relevant event. This ensures mutual understanding, acceptance of exceptional conditions, and the full protection of the client's rights as agreed upon by the parties. 

Smart Valor ensures that clients whose crypto-assets are held or managed by the company receive a statement of their positions at least once every three months, as well as upon request. These statements are provided in electronic format and include details of the relevant crypto-assets, their balances, their values, and any transfers of crypto-assets that occurred during this period. SmartValor ensures that clients whose crypto-assets are held or managed by the company are promptly informed of any activities related to their crypto-assets that require action or a response on their part. 

Return of Crypto Assets 

Smart Valor ensures that appropriate procedures are in place to enable the prompt return of any crypto-assets held on behalf of clients, or the means of access thereto, to the respective clients upon request or as required. 

These procedures include: 

Maintaining client assets in segregated wallets to prevent co-mingling. 

Automated verification of wallet balances immediately upon initiation of a withdrawal request by the client. If the requested amount exceeds the client's available balance, the withdrawal transaction will not be processed. 

Client identity confirmation through two-factor authentication (2FA) and email verification for each withdrawal request. 

Post-verification, withdrawal requests undergo comprehensive compliance checks, wallet risk scoring, and adherence to Crypto Travel Rule requirements. 

Immediate processing of withdrawals upon successful completion of all checks. 

Automatic alerts are sent to the support team if any checks fail, prompting immediate internal investigation or direct client communication to request additional information. 

Separation and Safeguarding of Client Crypto-Assets 

Smart Valor ensures a clear and effective segregation between crypto-assets held on behalf of clients and its own proprietary crypto-assets. Access credentials and means to client-held crypto-assets are distinctly identified and appropriately labeled to avoid any confusion or commingling. 

Furthermore, Smart Valor ensures that client crypto-assets are maintained separately on the distributed ledger from the company's own assets. This segregation is implemented both at the technical and operational levels. 

In accordance with applicable law, Smart Valor guarantees that client crypto-assets held in custody are legally segregated from the company’s estate. This legal separation ensures that, in the event of insolvency, creditors of Smart Valor have no claim to the crypto-assets held on behalf of clients. 

Operationally, Smart Valor also maintains strict separation of client-held crypto-assets from its own assets, applying processes, internal controls, and governance to safeguard client interests at all times. 

Liability 

Smart Valor is liable to its clients for any loss of crypto-assets or means of access to such assets resulting from incidents attributable to the company. The liability of Smart Valor is limited to the market value of the lost crypto-assets at the time of the loss. 

Incidents that are not attributable to Smart Valor include those where the company can demonstrate that they occurred independently of the provision of the relevant service or the company's activities, such as issues related to the operation of the distributed ledger, which are beyond the company’s control. In such cases, Smart Valor shall not be liable for any loss. 

Engagement of Third-Party 

Smart Valor may engage third-party crypto-asset service providers for the custody and administration of client crypto-assets only if such providers are duly authorized in accordance with Article 59 MiCAR of the applicable regulatory framework. 

In all such cases, Smart Valor shall inform its clients that a third-party provider is involved in the custody and administration of their crypto-assets.