Whistleblower and Anonymous Reporting Policy

Status: Pre-listing governance baseline; intended to take full effect upon adoption by the Board of Directors.

0) Corporate structure and scope

Tanqory PTE. LTD. (Singapore, UEN 202448997H) is the ultimate parent and holding company of the Tanqory group, including its wholly-owned subsidiaries Tanqory Inc. (Delaware, USA) and Tanqory OÜ (Estonia). Tanqory Inc. is the contracting entity and merchant of record for every product and service Tanqory sells to merchants and customers worldwide — Tanqory PTE. LTD. itself does not contract with, bill, or hold a direct customer relationship with any merchant or customer. This document is adopted by Tanqory PTE. LTD. as the group's holding company and applies group-wide, including to Tanqory Inc.'s and Tanqory OÜ's operations, unless a section below states a narrower scope.

1) Purpose

This Policy establishes the channels through which directors, officers, employees, contractors, vendors, customers, and other third parties may report, on a confidential and (where requested) anonymous basis, concerns regarding conduct of TANQORY PTE. LTD., Tanqory OÜ, Tanqory Inc., or any of their personnel (collectively, the "Company") that is, or may be, unlawful, unethical, or contrary to Company policy. The Policy is intended to support a culture in which good-faith reporting is encouraged, retaliation is prohibited, and the Audit Committee receives the information necessary to discharge its oversight responsibilities.

The Policy is designed to satisfy obligations and reflect protections under, without limitation: Section 301 of the Sarbanes-Oxley Act of 2002 (codified at Section 10A(m) of the Securities Exchange Act of 1934) (Audit Committee whistleblower procedures); Sections 806 and 1107 of the Sarbanes-Oxley Act (employee anti-retaliation and criminal anti-retaliation provisions); Section 922 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Section 21F of the Exchange Act and the SEC Office of the Whistleblower); Directive (EU) 2019/1937 of the European Parliament and of the Council on the protection of persons who report breaches of Union law (the "EU Whistleblower Directive"), as transposed into Estonian law (applicable to Tanqory OÜ); Singapore Exchange ("SGX") Listing Rule 720(7) and Practice Note 12.1 (forward compatibility for future SGX considerations, if any); and the Nasdaq listing standards applicable to audit committee complaint-handling procedures.

The Company is not currently a reporting issuer or a listed company. This Policy is a pre-listing baseline and will be refined as the Company progresses toward listing and as the Audit Committee, after appointment, formalizes its complaint-handling charter.

2) Scope

This Policy applies to all entities in the Tanqory group, including TANQORY PTE. LTD., Tanqory OÜ, and Tanqory Inc., and any wholly-owned subsidiary or branch established by them. The Policy covers reports made by:

(a) any director, officer, or employee (whether permanent, temporary, fixed-term, or on probation) of any Tanqory entity;

(b) consultants, contractors, agents, secondees, and individuals working under the supervision of any Tanqory entity;

(c) suppliers, vendors, service providers, partners, distributors, and resellers;

(d) merchants, customers, and end users of Tanqory products and services; and

(e) shareholders, prospective shareholders, and other stakeholders.

The Policy applies to conduct occurring within any Tanqory entity, by any person acting on behalf of a Tanqory entity, or by a third party in connection with the Company's operations.

3) Protected disclosures

A "Protected Disclosure" is a report made in good faith concerning conduct that the reporter reasonably believes constitutes, or may constitute:

(a) a violation of any applicable securities law, including fraud against shareholders, accounting fraud, or any matter that would, if true, render the Company's financial statements materially misleading;

(b) a violation of any rule or regulation of the SEC, of any U.S. federal anti-fraud or anti-bribery statute (including the Foreign Corrupt Practices Act), or of any applicable rule of a securities self-regulatory organization;

(c) mail fraud, wire fraud, bank fraud, or securities fraud as defined under Title 18 of the United States Code (relevant under Section 806 of the Sarbanes-Oxley Act);

(d) a breach of Union law within the material scope of Article 2 of the EU Whistleblower Directive (including financial services, product safety, consumer protection, privacy and personal data protection, network and information systems security, and the protection of the Union's financial interests);

(e) a violation of anti-bribery, anti-corruption, anti-money-laundering, or sanctions laws;

(f) a violation of data-protection laws, including the General Data Protection Regulation (Regulation (EU) 2016/679), Singapore's Personal Data Protection Act 2012, the California Consumer Privacy Act/California Privacy Rights Act, or other applicable privacy laws;

(g) discrimination, harassment (including sexual harassment), or any other conduct that creates a hostile work environment;

(h) retaliation against any person who has made or considered making a Protected Disclosure or who has participated in any related investigation;

(i) breach of Company policy, including the Code of Business Conduct, the Insider Trading Compliance Policy, the FCPA and Anti-Corruption Compliance Policy, or the Anti-Money Laundering and Sanctions Compliance Policy; or

(j) any other unlawful, unethical, or improper conduct, or any cover-up of the foregoing.

A report is made in "good faith" if the reporter has a reasonable basis for the belief expressed in the report, even if the report is later determined to be incorrect. Good faith does not require certainty of wrongdoing.

4) Reporting channels

4.1 Internal channels

A reporter may make a Protected Disclosure to any of the following internal recipients, in any order and without any obligation to follow a chain of command:

(a) the reporter's line manager;

(b) the Head of People / Human Resources (or, pending such appointment, the senior officer designated by management to oversee people matters);

(c) the Head of Legal or General Counsel (or, pending such appointment, the senior officer designated by management to oversee legal matters);

(d) the Chair of the Audit Committee, or, pending the formation of the Audit Committee and the appointment of its Chair, the chair of the Board of Directors;

(e) any independent director;

(f) for matters within the EU material scope, the intake person for Tanqory OÜ designated by management under the Estonian transposition of the EU Whistleblower Directive (or, pending such designation, the senior officer designated by management to receive such reports);

(g) the Audit Committee mailbox at audit@tanqory.com; and

(h) the dedicated whistleblower channel described in Section 4.3.

4.2 External channels

Nothing in this Policy prohibits, restricts, or discourages any person from reporting concerns directly to a governmental, regulatory, or law-enforcement authority. Reporters retain the full right, without any prior notice to or authorization from the Company, to report to:

(a) the SEC Office of the Whistleblower under Section 21F of the Exchange Act, including for the purpose of seeking a whistleblower award under SEC Rule 21F-3;

(b) the U.S. Department of Justice, the U.S. Department of Labor (Occupational Safety and Health Administration, which administers the Section 806 anti-retaliation provisions), the Federal Trade Commission, the Equal Employment Opportunity Commission, and any other U.S. federal or state agency;

(c) competent national authorities established by Member States of the European Union under Article 11 of the EU Whistleblower Directive, including the relevant Estonian competent authority designated under the Estonian transposition law;

(d) the European Public Prosecutor's Office, the European Anti-Fraud Office (OLAF), and other Union institutions, bodies, offices, or agencies competent to receive reports;

(e) the Monetary Authority of Singapore, the Singapore Police Force (Commercial Affairs Department), the Corrupt Practices Investigation Bureau, the Personal Data Protection Commission, and other Singapore regulators; and

(f) other regulators, law-enforcement authorities, or courts of competent jurisdiction.

The Company will not require, request, or accept any waiver of these rights as a condition of employment, settlement, severance, or any other arrangement, consistent with SEC Rule 21F-17.

4.3 Anonymous channel

The Company is establishing an anonymous reporting channel operated by an independent third-party provider. The anonymous channel will accept reports by web form and, where supported, by telephone, in multiple languages, on a 24-hours-per-day, 7-days-per-week basis. The channel will be designed so that, where the reporter elects anonymity, the Company does not receive identifying information from the provider, and the reporter is provided with a case identifier through which two-way communication with the investigator can continue without revealing identity.

5) Confidentiality

The Company will treat all reports as confidential. The identity of a reporter, and any information from which the identity may be inferred, will be disclosed only:

(a) to persons within the Company who have a need to know in order to investigate, evaluate, or remediate the matter, subject to a confidentiality undertaking;

(b) to external counsel, auditors, or investigators engaged in connection with the matter, subject to professional or contractual confidentiality;

(c) where disclosure is required by law, court order, or the lawful demand of a competent authority; or

(d) where the reporter has provided express, written consent.

The Company will, to the extent permitted by law, notify the reporter in advance if disclosure of identifying information is to be made under (c), unless such advance notice would jeopardize the investigation or any related legal proceeding.

6) Non-retaliation

The Company strictly prohibits retaliation against any person for making, in good faith, a Protected Disclosure; for refusing to participate in conduct the person reasonably believes to be unlawful; or for participating in any investigation, hearing, or proceeding related to a Protected Disclosure.

Prohibited retaliation includes, without limitation: dismissal, suspension, demotion, transfer, change in duties, reduction in compensation, denial of promotion or training, negative performance evaluation, coercion, intimidation, harassment, ostracism, blacklisting, and adverse action in respect of contractual relationships.

Section 806 of the Sarbanes-Oxley Act provides a private right of action and remedies (including reinstatement, back pay, and special damages) for covered employees who suffer retaliation. Section 1107 of the Sarbanes-Oxley Act establishes criminal penalties of up to 10 years' imprisonment for knowingly retaliating against a person who provides truthful information to a law-enforcement officer regarding the commission of a federal offense. Section 21F(h) of the Exchange Act provides remedies for retaliation against SEC whistleblowers. Article 19 of the EU Whistleblower Directive prohibits a broad list of retaliatory measures and, as transposed, supplies remedies under Estonian law. This Policy adopts those protections as Company commitments.

Any person who engages in retaliation is subject to discipline under this Policy, up to and including termination of employment, removal from office, or termination of contract, in addition to any civil or criminal liability.

7) Investigation procedure

Each report received under this Policy will be acknowledged to the reporter, where the reporter's identity or a return channel is available, within seven calendar days of receipt, consistent with Article 9(1)(b) of the EU Whistleblower Directive. A diligent assessment will be conducted, and feedback will be provided to the reporter, to the extent legally permissible and where a return channel exists, within three months of acknowledgement, consistent with Article 9(1)(f) of that Directive.

Investigations will be conducted with appropriate independence from the persons whose conduct is the subject of the report. Where a report concerns a director, officer, or member of senior management, the Audit Committee Chair will direct the investigation and may engage external counsel and forensic specialists. Where a report concerns the External Auditor, the Audit Committee will directly oversee the assessment.

Investigation files will be maintained securely and segregated from ordinary personnel records. Findings will be documented in writing, with supporting evidence, and remediation actions (including disciplinary actions, control improvements, restitution, and disclosures) will be tracked to closure.

8) Audit Committee oversight

The Audit Committee, once constituted, will have direct oversight of this Policy and the complaint-handling procedures required of audit committees under Section 10A(m) of the Exchange Act. The Audit Committee will:

(a) approve the design of the reporting channels and the selection of the third-party hotline provider;

(b) receive at each regular meeting (at least quarterly) a report of all matters received since the prior meeting, the status of open investigations, and remediation actions completed during the period (the "Whistleblower Metrics Report");

(c) receive immediate notification of any matter that, in the Compliance Officer's judgment, may be material to the Company's financial statements, may involve a director or executive officer, or may involve a violation of securities law or a serious violation of the Code of Business Conduct;

(d) approve the investigation plan for any matter referred to (c);

(e) report material matters to the Board; and

(f) review this Policy not less than annually.

9) Recordkeeping

The Company will retain records of all reports received under this Policy, the investigation files, and the outcomes for a period of not less than seven years from the date of closure, consistent with Section 802 of the Sarbanes-Oxley Act (18 U.S.C. § 1519) on the preservation of records relevant to potential federal investigations and with applicable record-retention obligations under EU and Singapore law. Records will be retained in a manner designed to preserve confidentiality and to permit retrieval for legitimate investigatory, audit, or legal purposes.

10) Whistleblower Metrics Report

The Whistleblower Metrics Report to the Audit Committee will include, at a minimum: (a) the number of reports received, categorized by subject matter and reporting channel; (b) the number of investigations opened, in progress, and closed; (c) the average time from receipt to acknowledgement and from receipt to closure; (d) substantiation rates; (e) remediation actions, including disciplinary actions taken (in aggregate, without identifying information unless required); and (f) any indicators of retaliation. The Audit Committee may request additional detail at any time.

11) Annual review

The Audit Committee will review this Policy at least annually. The Compliance Officer will report on the effectiveness of the reporting channels, the third-party hotline provider, and the training program, and will recommend amendments as appropriate. Material amendments require Board approval.

12) Adoption

This Policy is adopted as a pre-listing governance baseline. The selection of the third-party hotline provider, the appointment of the Audit Committee Chair, and the formal designation of the EU intake person for Tanqory OÜ are part of the Company's pre-listing readiness and will be completed in due course. This Policy will be re-issued, with operational appendices and named officers, upon completion of those items.