Compliance & governance

Corefindex operates as a legally registered entity in Italy. Our regulatory and registration details are as follows:

• Legal entity: Corefindex — Registered in Italy
• Registered office: Corso Como, 15, 20154 Milano MI, Italy
• Business register: Camera di Commercio di Milano — REA Number: MI-2647381
• VAT number: IT11852340964
• Data Protection Officer: Registered with Garante per la Protezione dei Dati Personali

We monitor regulatory developments in all jurisdictions where our investors reside and adapt our operations to maintain compliance with applicable laws and regulations. Investors are responsible for ensuring that their use of our platform complies with local laws in their country of residence.

Corefindex implements a risk-based Know Your Customer (KYC) and Anti-Money Laundering (AML) framework aligned with the Financial Action Task Force (FATF) recommendations and applicable EU directives, including AMLD5 and AMLD6.

Our KYC procedures include:

• Collection and verification of customer identification information at account opening
• Enhanced due diligence for high-value transactions and accounts flagged by our risk scoring system
• Ongoing monitoring of account activity for unusual patterns or transactions
• Periodic review and updating of customer information
• Politically Exposed Person (PEP) screening using recognized international databases
• Sanctions screening against UN, EU, OFAC, and other relevant sanctions lists

Our AML controls include:

• Automated transaction monitoring with rule-based and behavioral analytics
• Mandatory reporting of suspicious activity to relevant authorities
• Documented internal procedures for identifying and escalating suspicious transactions
• Independent annual audit of our AML program by external compliance specialists
• Mandatory AML training for all employees, refreshed annually

Corefindex is fully compliant with the EU General Data Protection Regulation (GDPR) and related data protection laws. Our data protection framework includes:

• Registered DPO: Our Data Protection Officer is registered with the Italian Garante per la Protezione dei Dati Personali and serves as the primary contact for data protection matters.
• Data processing register: We maintain a comprehensive record of all data processing activities as required by Article 30 of the GDPR.
• Data Protection Impact Assessments (DPIAs): Conducted for all new processing activities that may present high risk to individual rights and freedoms.
• Data processing agreements: All third-party processors are bound by written agreements that meet the requirements of Article 28 of the GDPR.
• Data subject rights: Processes are in place to respond to access, rectification, erasure, portability, and objection requests within statutory timeframes.
• Breach notification: Procedures for detecting, investigating, and notifying personal data breaches to supervisory authorities and affected individuals within 72 hours as required.
• International transfers: Where data is transferred outside the EEA, appropriate safeguards are in place, including Standard Contractual Clauses.

Our compliance program is subject to regular independent review. Our audit and assurance framework includes:

• Quarterly external compliance audits: Conducted by accredited independent audit firms specializing in financial services and digital assets.
• Annual ISO surveillance audits: Required to maintain our ISO 27001:2022 (Information Security) and ISO 9001:2015 (Quality Management) certifications.
• Annual AML program audit: Independent review of our anti-money laundering controls, transaction monitoring systems, and suspicious activity reporting procedures.
• Penetration testing: Monthly internal vulnerability assessments and quarterly external penetration tests conducted by certified security firms.
• Financial audits: Annual review of financial records and transaction ledgers to verify accuracy and completeness of investor balances.
• Internal audit function: Our internal audit team conducts continuous monitoring and reports directly to the Board Audit Committee.

Corefindex maintains a formal complaints handling procedure designed to ensure fair, timely, and consistent resolution of investor concerns.

How to submit a complaint:

• Email: Send your complaint to complaints@corefindex.com
• Contact form: Use the contact form on our website, selecting "Complaint" as the subject
• Post: Write to Complaints Department, Corefindex, Corso Como, 15, 20154 Milano MI, Italy

Our complaints process:

• Acknowledgment: All complaints are acknowledged within 2 business days of receipt
• Investigation: Each complaint is assigned to a dedicated case officer who investigates thoroughly and impartially
• Resolution: We aim to resolve complaints within 15 business days. Complex cases may take longer, in which case we provide regular progress updates
• Final response: You will receive a written final response explaining our findings and any remedial action taken
• Escalation: If you are not satisfied with our response, you may escalate your complaint to the appropriate regulatory authority in your jurisdiction

Corefindex operates under a formal corporate governance framework that ensures accountability, transparency, and effective oversight at all levels of the organization.

Board of Directors:

• Comprises four directors, including three independent non-executive directors
• Meets quarterly to review strategy, performance, risk, and compliance
• Oversees three standing committees: Audit, Risk, and Compensation

Audit Committee:

• Chaired by an independent director
• Reviews financial reporting, internal controls, and external audit findings
• Meets at least four times per year

Risk Committee:

• Chaired by an independent director with relevant expertise
• Oversees enterprise risk management framework, including market, credit, operational, and cyber risks
• Reviews risk appetite statements and key risk indicators quarterly

Compliance function:

• Headed by the Chief Compliance Officer, who reports directly to the Board
• Independent from operational functions to ensure objectivity
• Responsible for regulatory monitoring, policy development, training, and internal investigations

Corefindex encourages the reporting of any concerns about potential misconduct, regulatory breaches, or unethical behavior. We maintain a whistleblowing policy that protects individuals who raise concerns in good faith.

What to report:

• Suspected fraud, theft, or financial misconduct
• Violations of laws or regulations
• Breaches of our internal policies or code of conduct
• Money laundering or terrorist financing concerns
• Data protection breaches or misuse of personal information
• Market manipulation or insider dealing
• Any activity that could harm investors or damage the integrity of our platform

How to report:

• Confidential email: integrity@corefindex.com — monitored exclusively by the Chief Compliance Officer and Board Chairman
• Postal address: Marked "Confidential — Board Chairman," sent to our registered office

Protections:

• Reports made in good faith will not result in retaliation, discrimination, or adverse consequences for the reporter
• Anonymous reports are accepted, though providing contact details allows us to seek clarification if needed
• All reports are investigated promptly and treated with strict confidentiality