Global Cannabis Products (“the Company,” “we,” “our,” or “the Platform”) maintains a comprehensive, enterprise-grade Risk Management Framework designed to identify, assess, mitigate, and continuously monitor risks arising from our global B2B marketplace operations. Our risk governance approach is aligned with applicable international regulatory standards, including AML, KYC/KYB obligations, data protection laws (including GDPR), and financial compliance frameworks relevant to cross-border trade.

1. RISK MANAGEMENT OBJECTIVE

The objective of our Risk Management Program is to:

• Safeguard the integrity, security, and continuity of platform operations
• Ensure full compliance with applicable legal and regulatory obligations
• Protect users, counterparties, and stakeholders from financial, operational, and reputational harm
• Maintain trust in high-risk, regulated international trade environments
• Enable sustainable and controlled business growth through proactive risk oversight

2. RISK GOVERNANCE STRUCTURE

Risk oversight is embedded at all levels of the organization through a structured governance model:

• Board-Level Oversight: Ultimate responsibility for risk appetite and strategic risk direction
• Executive Management: Implementation of risk policies and operational controls
• Compliance & Risk Department: Continuous monitoring, assessment, and reporting of risk exposure
• Data Protection Officer (DPO): Oversight of privacy and data-related risk compliance
• Internal Audit Function: Independent review of risk controls and governance effectiveness

All risk-related decisions are documented, auditable, and subject to periodic review.

3. RISK CATEGORIES

We classify and manage risk across the following key domains:

    3.1 Regulatory & Compliance Risk

Risks arising from failure to comply with applicable laws and regulations, including:

• Anti-Money Laundering (AML) requirements
• Know Your Customer / Business (KYC/KYB) obligations
• International sanctions and trade restrictions
• Taxation and customs compliance

    3.2 Financial Risk

Risks related to financial exposure and transactional integrity, including:

• Counterparty default risk
• Payment fraud and chargebacks
• Escrow settlement failures
• Currency and cross-border transaction volatility

    3.3 Operational Risk

Risks arising from internal processes, systems, or human error, including:

• Platform downtime or service disruption
• Process failures in transaction execution
• Third-party service provider outages
• Internal control deficiencies

    3.4 Cybersecurity & Technology Risk

Risks associated with digital infrastructure and data protection, including:

• Unauthorized access and account compromise
• Data breaches or leakage
• Malware, phishing, and cyberattacks
• System vulnerabilities or exploitation

    3.5 Fraud & Illicit Activity Risk

Risks involving intentional misuse of the platform, including:

• Identity fraud or synthetic identities
• Document forgery or misrepresentation
• Trade-based money laundering
• Suspicious transaction patterns or shell entities

    3.6 Reputational Risk

Risks that may negatively impact trust in the platform, including:

• Regulatory enforcement actions
• Public allegations or misinformation
• Association with non-compliant counterparties

4. RISK ASSESSMENT FRAMEWORK

We apply a structured, risk-based methodology to evaluate all identified risks:

• Likelihood Assessment: Probability of occurrence
• Impact Analysis: Financial, legal, operational, and reputational consequences
• Risk Scoring: Quantitative and qualitative scoring models
• Risk Prioritization: Classification into low, medium, high, and critical risk tiers

Risk assessments are continuously updated based on transaction behavior, user activity, and external threat intelligence.

5. MITIGATION & CONTROL MEASURES

To reduce risk exposure, the Platform implements layered control mechanisms, including:

• Multi-factor authentication (MFA) and secure identity verification
• AI-assisted AML/KYC screening and sanctions monitoring
• Escrow-based payment protection systems
• Role-based access controls (RBAC) and least-privilege access principles
• End-to-end encrypted communications and secure data storage
• Continuous transaction monitoring and anomaly detection systems
• Vendor and third-party due diligence assessments

6. MONITORING & CONTINUOUS IMPROVEMENT

Risk management is an ongoing process supported by:

• Real-time monitoring of platform activity and transactions
• Automated fraud detection and behavioral analytics
• Periodic internal audits and compliance reviews
• Penetration testing and cybersecurity assessments
• Continuous improvement of risk models and detection thresholds

All material risk indicators are escalated to senior management for immediate review.

7. INCIDENT RESPONSE & ESCALATION

In the event of a confirmed or suspected risk incident, the Company follows a structured response protocol:

1. Immediate containment and mitigation of the threat
2. Internal investigation and root cause analysis
3. Suspension of affected accounts or transactions where necessary
4. Notification to regulatory or law enforcement authorities, if legally required
5. Remediation actions and system strengthening
6. Post-incident reporting and documentation

8. THIRD-PARTY & COUNTERPARTY RISK

We apply strict due diligence standards to all external partners, including:

• Identity and legitimacy verification
• Regulatory status validation
• Ongoing monitoring of counterparties and service providers
• Risk-based onboarding and periodic reassessment

Engagement is restricted to verified and compliant entities only.

9. RISK APPETITE STATEMENT

The Platform maintains a low tolerance for regulatory, financial crime, and cybersecurity risks, and a controlled tolerance for operational and technological risk, where such exposure is necessary for innovation and service delivery.

We do not knowingly engage in or facilitate:

• Illicit financial activity
• Unverified or non-compliant counterparties
• Transactions that violate applicable international laws or sanctions regimes

10. POLICY REVIEW

This Risk Management Policy is reviewed periodically and updated to reflect:

• Changes in regulatory requirements
• Emerging threats and risk landscapes
• Technological advancements
• Operational or structural changes within the Platform