Terms and Conditions of Use of the Zabio Platform

Version 5.2 – May 2026

These Terms and Conditions govern the access, browsing, and use of the Zabio technology platform by users, as well as the processes of onboarding, validation, authentication, issuance of instructions, traceability, and operational execution of operations related to digital assets, stablecoins, and fiat resources.

We recommend that you read this document carefully. By accessing, registering, onboarding, or using Zabio, you accept these Terms and Conditions, as well as the other documents that make up the Zabio contractual ecosystem.

The use of the Platform is governed by these Terms and Conditions, as well as by the Personal Data Processing Policy, the Cookie and Tracking Technologies Policy, and, as applicable to the operating scheme, the B2B Master Mandate Agreement (when the user is an Operating Partner) or the B2C Mandate Agreement (when the user is served at a counter by an Operating Partner). All these documents are published at www.zabio.com and are deemed incorporated by reference into these Terms and Conditions.

In certain operations, Zabio may intervene together with partners, authorized third parties, or related entities, under one of the mandate schemes provided for in this document and developed in the referenced mandate agreements.

1. Identification of Zabio

Zabio S.A.S., a simplified stock corporation incorporated under the laws of the Republic of Colombia, identified with Tax ID (NIT) 901.818.731-6, with principal domicile in Bogotá D.C., Colombia (hereinafter, "Zabio"), is the owner and direct operator of the technology platform identified under the "Zabio" brand.

Zabio combines (i) technology and operational services related to digital assets, stablecoins, and tokenization and detokenization processes; and (ii) fiat currency (FIAT) payment services as a payment service provider, without public deposit-taking and without being an entity supervised by the Financial Superintendence of Colombia.

For the execution of certain operations, Zabio relies on technology partners and independent operators, including, but not limited to, Wagmi S.A.S. (trade name "Minteo"), a stablecoin-based settlement infrastructure provider for Latin America. Such partners do not maintain a corporate relationship with Zabio, and their involvement is carried out under Zabio's instruction within the framework of the operation, without generating a direct contractual relationship between the user and such third parties, unless a specific document provides otherwise.

2. Definitions

For the interpretation of these Terms and Conditions, the following definitions are adopted, whose references will also be used by other documents in the Zabio ecosystem (Personal Data Processing Policy, SAGRILAFT Manual, Disbursement Parameters, mandate agreements, and other contractual or regulatory documents), unless specific definitions are established therein.

Digital Assets: Virtual goods or crypto-assets that have economic value and may be subject to purchase, sale, tokenization, detokenization, exchange, transfer, or settlement operations through the Platform or through authorized third parties.

Partner: A legal entity that maintains a commercial, technological, operational, or contractual relationship with Zabio. Partners are mainly classified as Technology Partners and Operating Partners, without prejudice to other categories that Zabio may define.

Operating Partner: A legal entity that acts vis-à-vis the end user as a physical channel or operational and/or legal counterparty of a specific operation, assuming the capacity of Legal Operator vis-à-vis the end user (including the definition of the Economic Conditions of the Operation) and engaging with Zabio through a mandate agreement under which Zabio acts as Successive Mandatary for backend execution.

Technology Partner: A legal entity that provides Zabio with infrastructure, services, or technological solutions for the execution of operations, including, but not limited to, settlement infrastructure, custody, identity verification, biometrics, KYC, gateways, and technical integrations. Wagmi S.A.S. (Minteo) is included in this category.

CARF: Crypto-Asset Reporting Framework adopted by the OECD, an international framework for automatic exchange of tax information regarding digital asset operations, applicable to Zabio to the extent that Colombian law incorporates it.

Mandate Certificate: A physical or electronic receipt delivered to the user upon onboarding or a specific operation, which provides informational proof of acceptance of the applicable mandate agreement, indicates the access path to said agreement and other related documents, and supports the essential economic information of the operation, authorized inquiries in credit bureaus and other databases, as well as the identification of the intervening parties. The Mandate Certificate does not replace the full content of the mandate agreement but operates as evidence of its acceptance and as a quick reference tool for the user.

Client: For purposes of compliance, due diligence, monitoring, and reporting processes, equivalent to the "End User" defined in these Terms and Conditions.

Economic Conditions of the Operation: Specific terms applicable to a particular operation, including, as applicable, the amount, applicable rate or price, the Fiat Currency involved, the corresponding digital asset or stablecoin, as well as commissions, fees, margins, costs, and other economic variables disclosed and accepted at the time of the operation.

Conversion: A purchase, sale, exchange, tokenization, detokenization, delivery, receipt, transfer, or settlement operation of fiat resources and/or digital assets executed by Zabio on behalf of and by order of the principal.

Authorized Monthly Quota (CMA): The maximum monthly operation limit assigned to the user or end beneficiary by Zabio, based on objective criteria of documented economic capacity, verifiable economic purpose, historical transactional behavior, and risk profile, in accordance with Zabio's Operational Quota Allocation Methodology. The CMA does not create acquired rights, does not automatically increase, and may be adjusted, restricted, suspended, or withdrawn at any time by Zabio.

Detokenization: The process by which digital assets or stablecoins are converted into fiat resources, in accordance with the instruction given and authorized channels.

Compliance Event: Any alert, inconsistency, match on restrictive lists, lack of information, authority requirement, or legal, reputational, regulatory, or operational risk situation that authorizes Zabio or the Operating Partner, as applicable, to refrain from executing, restricting, suspending, blocking, deferring, or terminating access to the Platform or specific operations.

FIAT: Legal tender currency issued by a monetary authority, regardless of its jurisdiction, including, but not limited to, Colombian peso, US dollar, euro, Mexican peso, or other fiat currencies applicable to a specific operation.

Regulatory Information: Information about identity, tax residence, balances, operations, types of crypto-assets, number of units, source of funds, destination of resources, number of operations, value in legal tender, and other data required by applicable regulations, competent authorities, or internal policies, including that required by frameworks such as SAGRILAFT and CARF.

Valid Instruction: An express, clear, complete, and verifiable order issued by the user or by a legitimated third party through enabled channels, containing sufficient information to execute the requested operation.

Restrictive Lists: A set of national and international lists used by Zabio for person validation, including, but not limited to, lists administered by OFAC (SDN, FSE, SSI, NS-PLC, CAPTA, NS-MBS, NS-CMIC), the United Nations Security Council list, the local Politically Exposed Persons list, and Zabio's Internal Watchlist. The specific composition of lists and the validation methodology are detailed in the SAGRILAFT Manual.

Mandate: The legal structure for the operation, under either of the two schemes provided for in section 3.3 of these Terms and Conditions: (i) direct mandate granted by the user in favor of Zabio; or (ii) successive mandate, in which the user grants a mandate to the Operating Partner, who in turn designates Zabio as Successive Mandatary for backend execution.

Successive Mandatary: A legal entity that, by designation or authorization of a primary mandatary, executes in whole or in part the activities comprised in a mandate, without replacing the contractual position of the primary mandatary vis-à-vis the principal, unless expressly agreed otherwise. Zabio may act as Successive Mandatary of an Operating Partner under the terms of the applicable mandate agreement.

Operation: Each of the purchase, sale, conversion, tokenization, detokenization, transfer, delivery, receipt, or settlement transactions of digital assets, stablecoins, or fiat resources executed through the Platform or through channels authorized by Zabio.

Counter Operation: An operation initiated, handled, or executed at a physical point operated by an Operating Partner or by an authorized third party.

Legal Operator: The capacity assumed by the Operating Partner vis-à-vis the end user when it is responsible for the contractual, commercial, and informational relationship with said user, including the definition of the Economic Conditions of the Operation at the counter or through its authorized channel.

Politically Exposed Person (PEP): A person who holds or has held prominent public functions, as well as their family members and close associates, in accordance with applicable definitions under Colombian and international regulations. PEP status triggers Enhanced Due Diligence and reinforced controls, as set forth in the SAGRILAFT Manual.

Platform: The technology platform operated by Zabio that combines (i) services related to digital assets, stablecoins, and tokenization and detokenization processes; and (ii) fiat currency (FIAT) payment services as a payment service provider. It comprises the digital channels, website, applications, interfaces, APIs, technological tools, and operational flows identified as Zabio, used directly or in integration with Partners, suppliers, or authorized third parties.

Authorized Platforms: Exchanges, wallets, operational accounts, technology providers, custodians, gateways, blockchain infrastructures, and other tools previously approved by Zabio in accordance with its internal risk, compliance, and operation policies.

Operational Protocols: A set of technical, documentary, validation, security, compliance, and risk management procedures defined by Zabio for the execution of operations under Mandate.

SAGRILAFT: Self-Control and Comprehensive Risk Management System for Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction (ML/TF/FPWMD) voluntarily adopted by Zabio as a good corporate governance practice, in accordance with the current SAGRILAFT Manual.

Sisbén: System for Identification of Potential Beneficiaries of Social Programs of the Colombian State, used by Zabio as a complementary indicator of socioeconomic profile consistency of Colombian users for purposes of transaction monitoring and quota allocation, in accordance with the Disbursement Parameters adopted by Zabio.

Stablecoin: A type of digital asset whose value seeks to remain relatively stable by being referenced to a fiat currency or other underlying asset. For the purposes of these Terms and Conditions, the reference to stablecoins includes any digital asset operationally authorized by Zabio or by applicable third parties, without being limited to a specific issuer, ticker, or jurisdiction.

Conversion Rate: The value relationship applicable to a specific operation between a Fiat Currency and a digital asset, between different digital assets, or between a Fiat Currency and a stablecoin, as applicable to the specific conditions of the transaction.

Authorized Third Party: A natural or legal person authorized by Zabio to intervene in the execution, validation, custody, collection, disbursement, conversion, monitoring, or reporting related to an operation, in accordance with its internal policies and applicable regulations.

Tokenization: The process by which fiat resources are converted into digital assets or stablecoins, in accordance with the instruction given and authorized channels.

User: A natural or legal person who accesses, browses, or uses the Platform, directly or through an Operating Partner, related entity, or authorized third party.

End User: A natural or legal person for whom onboarding, validation, authentication, due diligence, or operational execution processes of an operation are carried out, whether directly or through an Operating Partner, authorized third party, or applicable mandate scheme.

3. Nature of the Relationship

3.1. Nature of the Platform

Zabio is a technology and operational platform that facilitates onboarding, validation, traceability, instruction issuance, and execution of operations related to digital assets, stablecoins, and fiat resources, directly or in integration with strategic partners, specialized providers, or authorized third parties.

3.2. Relationship with Partners and Third Parties

In certain cases, services accessible through the Platform may be provided in coordination with Operating Partners, Technology Partners, mandataries, related entities, collection operators, custodians, technology providers, validation providers, gateways, specialized third parties, or external infrastructures. Among the relevant Technology Partners is Wagmi S.A.S. (Minteo).

When an operation is executed through an Operating Partner or an authorized third party, such operation may be subject to the contracts, mandates, instructions, annexes, or particular terms applicable to that flow. In such cases, Zabio may act as technology provider, validator, operational executor, or Successive Mandatary, as applicable, without thereby assuming the capacity of direct legal counterparty of the user with respect to all operations.

When an operation is channeled through an Operating Partner or handled at a counter, the Economic Conditions of the Operation, including rate, price, amount, Fiat Currency, corresponding digital asset or stablecoin, may be defined and communicated by said Operating Partner at the time of the transaction, in its capacity as Legal Operator vis-à-vis the end user.

In operations channeled through an Operating Partner, the user acknowledges that the rate, price, exchange value, commission, charge, margin, or economic differential applicable to the operation may be communicated by the Operating Partner at the time of the transaction and must be accepted by the user before execution. Such economic conditions may incorporate margins or differentials associated with the operational, technological, exchange, liquidity, channeling, or processing execution of the operation, depending on the applicable flow, without implying a guarantee of a specific rate or a specific economic outcome.

3.3. Nature of Mandate

Operations carried out through the Platform are structured under a mandate arrangement, according to one of the following schemes, depending on the operation channel:

(a) Direct mandate. When the user operates directly on the Platform without the intervention of an Operating Partner, they grant a mandate in favor of Zabio by accepting these Terms and Conditions, which include the clause of this section 3.3 as a direct mandate instrument. Under such mandate, the user authorizes Zabio to, on their behalf and by their order, execute tokenization, detokenization, conversion, transfer, delivery, receipt, or settlement operations of digital assets, stablecoins, and fiat resources, in accordance with the instructions given.

(b) Successive mandate. When the operation is channeled through an Operating Partner (including, but not limited to, counter operations), the user grants a mandate to the Operating Partner pursuant to the B2C Mandate Agreement published at www.zabio.com. The Operating Partner, in its capacity as Legal Operator vis-à-vis the user, assumes the direct contractual relationship with the user. The Operating Partner, in turn, engages with Zabio by accepting the B2B Master Mandate Agreement published at www.zabio.com, under which Zabio acts as Successive Mandatary for backend execution, without implying a direct contractual relationship between the user and Zabio with respect to the specific operation, unless a specific document provides otherwise.

In both schemes, Zabio may additionally rely on Technology Partners, custodians, gateways, providers, and other authorized third parties (including Wagmi S.A.S. – Minteo) for the execution of the Mandate.

The specific conditions of each mandate scheme are governed by the applicable mandate agreement (B2B Master Mandate Agreement or B2C Mandate Agreement, as applicable). These Terms and Conditions shall be deemed complementary to such agreements. In the event of contradiction with respect to a specific operation, the applicable mandate agreement shall prevail, or, when applicable, the Sole Annex of Particular Terms executed between the Parties, pursuant to section 21 (Document Precedence).

3.4. Nature of Framework Acceptance

The user acknowledges that their onboarding, acceptance of these Terms and Conditions, authentication, and acceptance of mandates, authorizations, annexes, or supplementary documents may have the nature of a framework acceptance of ongoing execution, such that subsequent individual operations may be executed through valid instructions, OTP, biometrics, logs, data messages, or other enabled mechanisms, without requiring the execution of an independent document for each transaction, unless Zabio or applicable regulations require otherwise.

3.5. Absence of Automatic Assumption of Financial Relationship or Outcome

Access to or use of the Platform does not, in itself, imply that Zabio is the legal counterparty of all user operations. The capacity in which Zabio intervenes may vary depending on the product, channel, partner, and applicable documents, and may act as technology provider, validator, operational executor, mandatary, or Successive Mandatary, as applicable.

Unless expressly stated otherwise in the specific operation or applicable particular document, Zabio: (i) does not act as a financial institution; (ii) does not guarantee returns; (iii) does not guarantee permanent availability of a rate; (iv) does not assume general custody of user resources; and (v) does not guarantee the economic outcome of the operation.

4. Applicable Regulation and Compliance Frameworks

Zabio is not a financial institution supervised by the Financial Superintendence of Colombia. The Platform provides technology-based and operational services related to onboarding, validation, traceability, and execution of operations, and may interact with partners, providers, or third parties that do carry out activities subject to special regulation.

Zabio may carry out, directly or on behalf of partners or authorized third parties, identification, validation, due diligence, transaction monitoring, documentary preservation, and Regulatory Information management processes, according to the role it assumes in each operation and applicable regulations.

Zabio voluntarily adopts, as a good corporate governance practice, a Self-Control and Comprehensive Risk Management System for Money Laundering, Terrorism Financing, and Financing of the Proliferation of Weapons of Mass Destruction (SAGRILAFT). When applicable under current regulations, Zabio will comply with the Crypto-Asset Reporting Framework (CARF) and international tax reporting obligations associated with digital asset operations.

In application of the risk-based approach, the inclusion of a jurisdiction on the FATF's list of jurisdictions under increased monitoring, commonly known as the grey list, will not, by itself, imply automatic rejection of the user, the operation, or the counterparty, nor the automatic application of full Enhanced Due Diligence. Zabio will evaluate on a case-by-case basis the user's profile, the nature of the operation, the cumulative amount, the channel used, the origin and destination of resources, the existence of red flags, and the economic consistency of the operation, in accordance with the SAGRILAFT Manual and applicable internal technical documents.

Jurisdictions subject to FATF calls for action, binding lists, OFAC sanctions, or equivalent measures may give rise to the rejection, blocking, suspension, or non-execution of operations, in accordance with applicable regulations and internal compliance policies.

The user acknowledges that certain collection, deposit, disbursement, validation, custody, clearing, conversion, or execution flows may be handled by partner third parties and will be subject to the conditions, restrictions, timelines, and procedures applicable to such third parties when appropriate.

5. Scope of Services and the Platform

The Zabio Platform's scope covers enabling onboarding, authentication, validation, instruction issuance, traceability, digital evidence preservation, and operational execution of operations related to digital assets, stablecoins, and fiat resources, directly or through integrations with partners, providers, or authorized third parties.

Zabio may act as technology provider, validator, backend operator, operational executor, mandatary, or Successive Mandatary within the contractual scope applicable to each operation, without implying, in all cases, that Zabio is the direct legal counterparty of the user with respect to the specific operation.

The scope of services accessible through the Platform may vary depending on the type of user, product, channel, partner, jurisdiction, approved validation, transactional profile, technical availability, regulatory requirements, and contractual documents applicable to each operation.

Activities, services, returns, custodies, availabilities, or outcomes that have not been expressly disclosed, enabled, or contractually assumed by Zabio or by the corresponding third party are outside the scope of the Platform.

6. Onboarding and Validation

To access the Platform's services, users must complete the onboarding, validation, and verification process defined by Zabio. This process may be fully or partially automated and may include electronic authentication mechanisms, biometrics, OTP, document validation, identity verification, database cross-referencing, and manual or automatic review of supporting documents.

The onboarding process may include, among others: (a) email and/or mobile number validation; (b) account creation or linking; (c) authentication via OTP or equivalent mechanisms; (d) identity document capture and validation; (e) biometric validation and liveness proof; (f) registration of personal, financial, tax, and transactional information; and (g) for corporate or institutional users, validation of corporate documents, legal representatives, ultimate beneficial owners, powers of attorney, authorizations, and other required supporting documents.

Zabio applies differentiated validation levels based on the user's profile, the operation channel, and the amounts involved, as defined in the SAGRILAFT Manual. When the operation is channeled through a successive mandate via an Operating Partner, identification, validation, and due diligence processes may be executed by the Operating Partner, by Zabio in its capacity as Successive Mandatary, or by both, according to the protocols agreed between Zabio and the Operating Partner, without reducing compliance requirements.

Zabio may request at any time additional information, documents, biometric validations, proof of ownership, source of funds supporting documents, representation evidence, or documentary updates. The user's refusal to provide them, or the detection of inconsistencies, will authorize Zabio to refrain from onboarding, restrict, suspend, block, or terminate access to the Platform or specific operations, without constituting a breach.

The user authorizes that onboarding, validation, authentication, due diligence, and documentary support information may be shared with the Operating Partner, operation counterparty, or compliance third party legitimately involved in the flow, to the extent necessary for the execution of the operation, regulatory compliance, claims handling, and evidence preservation, in accordance with the Personal Data Processing Policy.

7. User Information Verification

To ensure the security, authenticity, and correct identification of users, Zabio will implement verification processes that may include:

Verification of the identity document and its security features.
Validation of document ownership through photograph, biometric, and alphanumeric data cross-referencing.
Mobile number or email validation through verification codes.
Review of commercial, corporate, tax, or legal representation records for institutional users.
Consultation of Restrictive Lists, public sources, risk databases, or internal monitoring systems.
Validation of coherence, completeness, and consistency of the information provided.
For Colombian users, consultation of Sisbén as a complementary profile consistency indicator, in accordance with the Disbursement Parameters.

The correct execution of operations, instructions, authorizations, and onboarding processes will depend on the truthfulness, completeness, accuracy, timeliness, and promptness of the information provided by the user. Consequently, any loss, delay, rejection, suspension, blocking, or consequence arising from false, incorrect, incomplete, inconsistent, or untimely information provided by the user will not constitute a breach by Zabio.

Zabio's inability to execute operations or fulfill regulatory processes due to insufficient information provided by the user will not constitute a breach by Zabio.

8. Operational Quotas

As a risk management and compliance mechanism, Zabio assigns each user an Authorized Monthly Quota (CMA), understood as the maximum monthly operation limit allowed on the Platform or, as applicable, vis-à-vis an Operating Partner.

The allocation, modification, restriction, suspension, or withdrawal of the CMA is governed by Zabio's Operational Quota Allocation Methodology and, when applicable, by the Disbursement Parameters, which may incorporate additional variables such as Sisbén classification, records, source of funds supporting documents, and historical transactional behavior.

The CMA does not create acquired rights, does not automatically increase due to seniority or operational recurrence, and may be adjusted at any time as a result of monitoring, alert detection, relevant inconsistencies, or changes in risk profile. Operations exceeding the CMA or requiring exceptional quota will be subject to enhanced validation and express approval by Zabio, in accordance with the SAGRILAFT Manual.

8A. Tax Treatment and Invoicing

The user acknowledges that the tax, accounting, and invoicing treatment applicable to operations with digital assets, stablecoins, fiat resources, commissions, fees, margins, or economic differentials will depend on the legal and economic nature of the operation, the role assumed by each participant, the tax capacity of the parties, the territory of execution, the applicable accrual rules, and current regulations.

Zabio and Operating Partners will comply with the invoicing, withholding, reporting, and other tax obligations corresponding to them under applicable law. No provision of these Terms and Conditions shall be construed as a definitive tax classification, a certification regarding the accrual or non-accrual of VAT, or as tax advice directed at the user.

9. Rights and Duties

9.1. Zabio's Rights

Zabio shall have the right to:

Modify or update the Platform, its content, processes, functionalities, or operational flows.
Request from the user the information and documentation it deems necessary for their onboarding, validation, permanence, monitoring, or execution of operations.
Refrain from executing operations when there is no Valid Instruction or when Compliance Events occur.
Adjust, restrict, suspend, or withdraw the user's CMA.
Restrict, block, suspend, or terminate access to the Platform in the cases provided for in these Terms and Conditions.
Rely on third parties, providers, partners, specialized infrastructures, or external integrations for the proper provision of its services, including validation, authentication, custody, execution, collection, disbursement, monitoring, analytics, regulatory reporting, and evidence preservation processes.

9.2. Zabio's Duties

Zabio undertakes to:

Inform, through reasonable means, of relevant changes to these Terms and Conditions when appropriate.
Process personal data in accordance with the Personal Data Processing Policy and applicable regulations.
Apply reasonable security, validation, traceability, and control procedures.
Act with diligence within the scope of its expressly assumed obligations.
Handle, directly or in coordination with the corresponding Operating Partner or third party, claims related to the use of the Platform and operations in which Zabio has involvement, within the scope of its expressly assumed obligations.

9.3. User's Rights

The user shall have the right to:

Be informed about the contractual documents and general rules applicable to the use of the Platform.
Know, through reasonable means, relevant modifications to these Terms and Conditions.
Access the support and service channels enabled by Zabio.
Exercise the rights conferred by law as a personal data subject, in accordance with the Personal Data Processing Policy.
File claims or requests related to the use of the Platform.

9.4. User's Duties

The user undertakes to:

Provide truthful, complete, accurate, and up-to-date information.
Maintain the confidentiality of their credentials, OTP, access, authentication mechanisms, and devices.
Use the Platform only for legitimate and authorized purposes.
Refrain from issuing ambiguous, contradictory, or insufficiently supported instructions.
Cooperate in validation, due diligence, monitoring, verification, and regulatory requirement processes.
Promptly report any unauthorized use, security event, or detected inconsistency.
Keep required information and documentation up to date.
Guarantee the legitimacy, ownership, and lawful origin of the resources and assets involved.
Comply with the economic, operational, and contractual terms applicable to their operations.

10. Personal Data Processing

The processing of the user's personal data is governed by Zabio's Personal Data Processing Policy, which forms an integral part of the relationship between the user and Zabio. By accepting these Terms and Conditions, the user acknowledges having read and accepted the Personal Data Processing Policy and expressly authorizes Zabio to collect, use, store, circulate, transmit, and, when necessary for the execution of the Mandate and other authorized purposes, share with Operating Partners, Technology Partners, compliance third parties, and other Authorized Third Parties their personal, financial, transactional, tax, and biometric information, in accordance with the purposes and conditions described therein.

The user acknowledges that data processing may have purposes of regulatory compliance, fraud prevention, authority requirement handling, operation execution, claims handling, regulatory reporting (including SAGRILAFT and CARF), transaction monitoring, and digital evidence preservation.

11. Information Preservation and Digital Evidence

Zabio will preserve information, records, logs, transactional traceability, authentication evidence, OTP, biometric validations, documentary evidence, receipts, data messages, browsing records, instructions, and other elements related to the use of the Platform, in accordance with its internal policies and applicable regulations, during the periods required by such regulations and, in any case, for a minimum period of ten (10) years from the end of the relationship with the user.

The user acknowledges and accepts that such records may be used as evidence of operations, instructions, authentications, acceptances, user actions, requests, claims, and other activities carried out through the Platform or its authorized channels.

The foregoing includes evidence related to the acceptance of terms, mandates, authorizations, annexes, instructions, enhanced authentications, onboarding processes, and any other legal or technical act carried out through the Platform or through associated electronic channels.

12. Limitation of Liability

Zabio shall be liable only for direct damages arising from the breach of obligations expressly assumed by Zabio, as well as for willful misconduct or gross negligence. Zabio shall not be liable for losses or damages arising from:

Market fluctuations.
Exchange rate variations.
Blockchain network congestion.
Failures, unavailability, or restrictions of third-party providers, custodians, gateways, partners, operators, or authorities.
Hacking, malware, or technological failures beyond its reasonable control.
Force majeure or acts of God.
False, incomplete, outdated, or inconsistent information provided by the user or by legitimated third parties.
Decisions adopted by Zabio in compliance with legal, regulatory, security, or fraud prevention obligations.

When Operating Partners or authorized third parties are involved in an operation, each participant shall be liable only for the acts, omissions, and obligations corresponding to them under the applicable document and the law. Consequently, Zabio shall not be liable for acts attributable to the Operating Partner, the counter third party, the custodian, or any other third party beyond its control, unless it has expressly assumed such liability.

The foregoing limitation shall not apply in cases of willful misconduct or gross negligence by Zabio, breach of Valid Instructions accepted by Zabio, execution errors attributable to Zabio, breach of authentication protocols under its responsibility, or breach of obligations expressly assumed by Zabio.

In no event shall Zabio be liable for lost profits, loss of opportunity, indirect, incidental, special, or consequential damages. To the extent permitted by law, Zabio's total cumulative liability to the user for a specific operation shall not exceed the amount actually charged by Zabio for that operation or, when applicable, the amount actually charged by Zabio to the user during the three (3) calendar months immediately preceding the event giving rise to the claim.

13. Blocking, Suspension, and Termination Policies

Zabio may reject, restrict, suspend, block, defer, or terminate the user's access to the Platform or specific operations when:

There is false, incomplete, inconsistent, or unverifiable information.
Requested documents are not updated promptly.
Improper, unauthorized, or illegal use is detected.
There are indications of illicit activity, fraud, impersonation, or irregular use of resources.
There are requirements from a competent authority.
Compliance alerts, matches on Restrictive Lists, or reputational, operational, or regulatory risks arise.
There is insufficient support for the instruction, the Mandate, or the authority to act.
Applicable economic obligations are breached.
These Terms and Conditions or related contractual documents are breached.
It becomes unfeasible to continue the relationship for regulatory, legal, operational, reputational, or compliance reasons.
There is insufficient information to complete due diligence, validation, monitoring, or regulatory reporting processes, including that required for compliance frameworks such as SAGRILAFT or CARF.

When reasonably possible, Zabio will inform the user of the decision adopted and its general cause. However, Zabio may omit specific details when there are legal, regulatory, security, or fraud prevention restrictions.

For the purposes of these Terms and Conditions, a material breach shall mean any breach of an essential obligation that materially affects the execution of operations, the trust between the parties, or applicable legal and regulatory compliance.

When at the time of blocking, suspension, or termination there is an ongoing operation, Zabio or the applicable third party may: (i) refrain from executing it; (ii) place it on hold until additional validations are completed; (iii) reverse it when technically and legally possible; or (iv) maintain the resources or assets subject to preventive retention, immobilization, return, or deferred delivery when required by law, a competent authority, a compliance protocol, or the applicable particular document.

14. Prohibitions

The user undertakes to refrain from:

Creating, using, or attempting to use false identities or inauthentic documents.
Transmitting or uploading viruses, trojans, malware, worms, logic bombs, or other harmful programs.
Using protected materials, confidential information, or content that infringes third-party rights without authorization.
Interfering with or disrupting networks, systems, or services connected to the Platform.
Attempting unauthorized access to services, accounts, networks, or systems.
Interfering with the legitimate use of the Platform by other users or third parties.
Accessing, using, or disclosing third-party information without authorization.
Performing acts that cause harm or damage to persons or entities.
Using the Platform or its services to conceal the origin, destination, ownership, or traceability of resources or assets.
Using identities, powers of attorney, mandates, authorizations, or documents for which they do not have sufficient authority.
Using the Platform for illicit activities, including money laundering, terrorism financing, fraud, or related conduct.

15. User Representations and Warranties

The user represents and warrants that:

They have full legal capacity to accept these Terms and Conditions and use the Platform.
The information and documentation provided are truthful, complete, accurate, and up to date.
The resources and assets involved in their operations are of legitimate origin and destination.
They have the authority, legitimacy, and, when applicable, sufficient authorizations to issue instructions or act on behalf of third parties.
They will not use the Platform for illicit or unauthorized purposes.
They will cooperate with Zabio in handling regulatory, legal, tax, operational, or compliance requirements.
They acknowledge that operations with digital assets, stablecoins, or blockchain infrastructures may involve technological, operational, and market risks.
The tax information, tax residence, and, when applicable, ultimate beneficial owner or control structure information provided to Zabio is truthful, sufficient, and up to date.
They will promptly provide the information required for compliance with applicable regulatory, due diligence, or reporting processes.
They acknowledge that certain operations may be executed through Operating Partners or authorized third parties, under a successive mandate scheme, and that such operations may be subject to particular documents, mandates, instructions, or specific conditions that will be disclosed or made available to them before confirmation.

These representations constitute an essential basis of the relationship between the user and Zabio. The falsity, inaccuracy, insufficiency, or untimeliness of such information will authorize Zabio to adopt the measures provided for in these Terms and Conditions.

16. Indemnification

The user shall hold harmless Zabio, its directors, employees, partners, contractors, and licensors against claims, losses, penalties, fines, costs, expenses, fees, and contingencies arising from:

The falsity, inaccuracy, insufficiency, or untimeliness of the information provided.
The improper, illegal, or unauthorized use of the Platform.
The infringement of third-party rights.
The lack of legitimacy of the resources or assets involved.
The breach of these Terms and Conditions or related contractual documents.
Acts or omissions of the user or third parties related to the user.
The breach of information, cooperation, or update obligations required for compliance, validation, or regulatory reporting processes.

Zabio shall be liable to the user for direct damages arising from willful misconduct, gross negligence, or breach of expressly assumed obligations, within the limits provided for in these Terms and Conditions and applicable documents.

17. Modification of Terms and Conditions

Zabio may modify these Terms and Conditions for legal, regulatory, operational, technological, security, or business reasons.

Any material modification will be communicated to the user through reasonable means. When the modification affects essential user rights or obligations, it must be accepted through the mechanisms enabled for that purpose, unless the modification derives directly from a legal or regulatory requirement of immediate application.

Continued use of the Platform after the entry into force of duly communicated modifications will imply acceptance thereof to the extent permitted by law.

18. Complaints, Disputes, and Dispute Resolution

Claims related to the use of the Platform may be handled by Zabio directly or in coordination with the corresponding Operating Partner or third party, depending on the nature of the operation and the scope of obligations assumed by each participant. The receipt or management of a claim by Zabio will not, by itself, imply the assumption of liability for acts attributable to third parties.

The parties shall endeavor to resolve any dispute through direct settlement within fifteen (15) calendar days following written notification of the conflict. In the absence of agreement, disputes arising from these Terms and Conditions shall be submitted to the competent ordinary jurisdiction in the city of Bogotá D.C., Republic of Colombia, unless a specific document establishes a different mechanism and it is legally applicable.

This clause is without prejudice to financial consumer rights and special consumer protection mechanisms provided for in Colombian regulations, when applicable.

19. Intellectual Property Rights

The trademarks, trade names, designs, logos, texts, interfaces, developments, content, and other elements associated with Zabio are the property of Zabio or of third parties that have authorized their use.

Any unauthorized use, reproduction, exploitation, distribution, modification, transmission, publication, or appropriation of said elements without the prior written consent of their owner is prohibited.

20. Notifications

All notifications, requests, or communications that must be made in connection with these Terms and Conditions may be made by electronic means through the channels provided by the user or enabled by Zabio.

Notifications sent by email, data messages, notifications within the Platform, or equivalent electronic mechanisms shall be deemed received on the date of sending or availability, provided there is reasonable proof of sending or availability.

The user shall be responsible for keeping their contact channels up to date and acknowledges that the failure to update their information will not invalidate notifications sent to the last email address, mobile number, or channel registered on the Platform.

21. Document Precedence

The following documents make up the Zabio contractual ecosystem and are deemed complementary to each other, incorporated by reference into these Terms and Conditions:

(i) Terms and Conditions of Use of the Zabio Platform (this document).
(ii) Personal Data Processing Policy.
(iii) Cookie and Tracking Technologies Policy.
(iv) B2B Master Mandate Agreement (applicable to Operating Partners that onboard to the Platform as legal entities).
(v) B2C Mandate Agreement (applicable to End Users served by Operating Partners at counters or through their authorized channels).
(vi) Sole Annex of Particular Terms (when expressly executed between Zabio and an Operating Partner to regulate specific commercial conditions).
(vii) SAGRILAFT Manual (Zabio's internal document governing compliance processes that may affect user operations).

In the event of contradiction with respect to a specific operation, the particular document executed or individually accepted shall prevail (Sole Annex of Particular Terms, when applicable, or the mandate agreement applicable to the channel). For matters not covered by particular documents, these Terms and Conditions, the Personal Data Processing Policy, and the Cookie Policy shall prevail, in that order, without prejudice to compliance with mandatory regulations and the SAGRILAFT Manual with respect to compliance processes.

The user's acceptance of these Terms and Conditions entails adhesion acceptance of the other ecosystem documents listed in this section, to the extent applicable to the corresponding operating scheme, except for those documents that require additional express execution (in particular, the Sole Annex of Particular Terms).

For purposes of compliance, ML/TF/FPWMD prevention, user validation, quota allocation or restriction, blocking, suspension, rejection, preventive retention, or operation monitoring, mandatory rules, the SAGRILAFT Manual, and applicable internal technical documents shall prevail, even when an operation has particular commercial conditions in a Sole Annex of Particular Terms. No Annex or commercial agreement may limit Zabio's powers regarding compliance, risk management, regulatory reporting, or handling of authority requirements.

22. Acceptance

The user acknowledges that acceptance of these Terms and Conditions may be made by physical or electronic means, including checkboxes, digital acceptance, OTP, biometrics, system logs, electronic signature, data messages, or any other suitable mechanism.

When the operation is handled at a counter through an Operating Partner, the user's acceptance may be manifested verbally or by physical or electronic mechanisms, provided that such manifestation is supported by the corresponding Mandate Certificate and by other physical or electronic records or evidence that reasonably demonstrate the operation and its acceptance. The Mandate Certificate will be delivered to the user as informational proof of the operation and the access path to the applicable mandate agreement and other related contractual documents, without replacing their full content.

The user accepts that such mechanisms shall have full evidentiary and binding validity with respect to their onboarding, authentication, document acceptance, instruction issuance, and use of the Platform.