Vasco Terms & Conditions

These Terms and Conditions (the "Terms") are an agreement between ContributionDAO Holding Pte. Ltd. (UEN 202333545C), a company incorporated in Singapore ("CDAO", "Vasco", "we", "us"), with its business address at 38 BEACH ROAD, #23-11, SOUTH BEACH TOWER, SINGAPORE 189767, and the entity or person that accepts them ("Client", "you"). Vasco is a brand of CDAO.

The Terms govern your access to and use of the Vasco websites, applications, application programming interfaces, software development kits and related services made available under the Vasco brand, including Vasco Terminal, Vasco Prime and Vasco Helm (together, the "Services").

You accept the Terms by clicking to accept them, by signing an Order Form that refers to them, or by accessing or using any Service. If you do not agree, you must not use the Services.

If you accept on behalf of an entity, you represent that you have authority to bind that entity, and "you" means that entity.

The Agreement consists of (a) the applicable signed Order Form, (b) each Schedule for a subscribed Service, (c) these Master Terms, and (d) incorporated policies and addenda, including the Fee Schedule, Privacy Policy, and any Security, Data Processing or Execution and Settlement Addendum. In the event of inconsistency, the order listed above prevails, except that a signed amendment explicitly specifying the provisions varied prevails over the stated provision. A bilateral agreement between Vasco and a Custodian does not impose contractual duties on a Client unless the Client separately agrees to them.

Vasco Terminal is available to eligible entities and individuals; Vasco Prime and Vasco Helm are available only to entities acting in the course of business. Entity users represent that they are duly organised and validly existing. Individual users represent that they are at least 18 years old, have legal capacity and act for themselves. Consumer rights that cannot lawfully be excluded remain unaffected.

You must not use the Services if you are, are owned or controlled by, or act for a person who is: (a) located, organised or resident in a jurisdiction in which the applicable Service is not made available, as communicated through the Service or relevant onboarding materials; (b) subject to applicable United Nations, Singapore, United States, European Union or United Kingdom sanctions; or (c) prohibited by applicable law from using the Services. Availability of a website does not mean a Service is offered in every jurisdiction.

You must give us accurate and complete information when onboarding and keep it up to date. We may request further information and documents at any time to meet our legal and compliance obligations, and may refuse, suspend or restrict access until we receive them.

You are responsible for each Authorised User, for the roles and permissions you assign, and for all activity under your account, whether or not you authorised it, except to the extent caused by our breach of the Agreement.

You must keep login credentials, PINs, wallet keys and API Credentials confidential and promptly report any suspected unauthorised access through the security or support reporting channel provided in the Service or by written notice under clause 21.1.

Subject to compliance with this Agreement, we grant a limited, non-exclusive, non-transferable, revocable right to use subscribed Services during the term for the purposes authorised by the applicable Schedule: personal or business trading for Terminal, and internal business and authorised End Client activities for Prime and Helm.

Vasco provides software-based trading interfaces, order management, smart order routing, connectivity and related operational services. Vasco does not operate a digital asset exchange or trading venue, provide an exchange matching engine, or match buyers and sellers in the capacity of a Venue. Orders are submitted to independent third-party Venues through accounts and permissions supplied or authorised under the applicable Service Schedule. Unless expressly agreed otherwise, Vasco is not the proprietary counterparty to Client trades and does not hold or take title to Client Digital Assets solely by offering the Services. Any limited authority to submit, amend or request cancellation of an Order is subject to Client instructions, applicable authorisations and Venue rules. These descriptions do not determine or exclude any agency, arranging, dealing or other regulatory status, or any non-excludable obligation imposed by law.

We may add, change or remove features, supported Venues, Digital Assets, trading pairs and order types at any time. Where a change materially reduces a paid Service, we will give reasonable prior notice where practicable.

We aim to keep the Services available but do not promise uninterrupted or error-free operation. We may carry out maintenance, and will try to schedule planned maintenance outside peak trading hours and give notice of it. Any service levels apply only if set out in an Order Form.

Features identified as beta, preview or coming soon are provided as is, may be withdrawn at any time, and are excluded from any service levels.

You must use the Services in compliance with the Agreement, applicable law, and the rules and terms of each Venue and Custodian you use.

You are responsible for your Authorised Trading Instructions, investment and trading decisions, configuration and approval of your own users, End Client relationships, applicable trading permissions and any licences required for your activities. Vasco remains responsible for performing its own contractual commitments with reasonable skill and care and for obligations imposed directly on Vasco by law. Third-party obligations are governed by the relevant agreements; nothing makes you responsible for a distinct breach by Vasco of its own duties.

You must not, and must not permit anyone to:

• engage in market manipulation, wash trading, spoofing, layering, front-running or any other abusive or unlawful trading practice
• use the Services for money laundering, terrorism financing, fraud, sanctions evasion or other unlawful activity
• copy, modify, reverse engineer, decompile or create derivative works of the Services, except as the law permits despite this restriction
• resell, sublicense or provide the Services to third parties, except as a Schedule or Order Form permits
• bypass or probe security or access controls, or test the vulnerability of the Services without our written consent
• introduce malware, or use the Services in a way that degrades them for others, including by exceeding published rate limits
• scrape or harvest data from the Services, or use them to build a competing product
• remove or obscure proprietary notices.

We may monitor use of the Services to operate, secure and improve them and to meet legal obligations.

You must pay the fees set out in the Fee Schedule or your Order Form. Fees may include subscription fees, volume-based fees, and fees calculated by reference to execution performance, as set out in the Fee Schedule or your Order Form.

Fees charged by Venues, Custodians, blockchain networks and other third parties are separate from our fees and are your responsibility.

The applicable Fee Schedule or Order Form specifies billing frequency, any invoice due date, and the currency or supported payment asset. Where a subscription is billed monthly, invoices may be issued in advance and usage-based charges may be calculated in arrears, as stated in the relevant commercial terms. No fee is payable unless its basis has been disclosed in the applicable Fee Schedule, subscription flow or Order Form.

A fee may be deducted from amounts administered by a Custodian only if the applicable Order Form, Client-Custodian agreement and operational mandate expressly permit that deduction and the Custodian confirms the required authority. Nothing in these Terms by itself grants Vasco unilateral withdrawal or transfer authority over any Connected Account.

We will make reasonable records of trading volume and fee calculations available to support invoicing. You must notify us promptly after discovering a disputed amount, explaining the reasons. Any contractual dispute period may be specified in the relevant Order Form, but no period excludes any non-waivable legal right or correction of manifest error.

Fees are exclusive of goods and services tax, value added tax, withholding tax and similar taxes. You must pay these in addition, and if you are required to withhold, you must gross up the payment so that we receive the full amount invoiced.

Interest on overdue amounts applies only where an applicable Fee Schedule or Order Form expressly states the rate and only to the extent permitted by law. We may suspend a paid Service for an undisputed overdue amount after reasonable notice and an opportunity to remedy non-payment, subject to clause 17 and any contrary Order Form.

We may change a generally applicable Fee Schedule on at least 30 days' prior notice, except where a shorter period is required by law or to address an urgent legal or security requirement. Changes do not affect fees fixed in an Order Form during its committed term.

Fees are non-refundable except where the Agreement or applicable law provides otherwise.

Trading Digital Assets involves a high degree of risk. You acknowledge and accept that:

• Market risk. Prices are volatile and can fall to zero. Liquidity can disappear without warning. You may lose all the value you commit.
• Leverage and derivatives risk. Perpetual contracts and other leveraged products can lead to rapid liquidation and to losses that exceed the amount committed, subject to the Venue's rules.
• Venue and counterparty risk. A Venue or Custodian may suspend withdrawals or trading, change its rules or fees, suffer a security breach, or become insolvent. Vasco does not control Venues and does not guarantee their performance or solvency.
• Execution risk. Orders may be delayed, partially filled, rejected, or filled at a price different from the one displayed, because of latency, slippage, market movement, Venue outages or rate limits.
• Technology risk. Software, networks, application programming interfaces and blockchains can fail, contain defects or be attacked. Blockchain transactions are generally irreversible.
• Regulatory risk. The law on Digital Assets is unsettled and differs between jurisdictions. A change in law or regulatory position may restrict or end your ability to use a Service, or change the tax treatment of your transactions.
• Data risk. Market data, prices, balances and analytics shown in the Services come from third parties and may be delayed, incomplete or inaccurate.

This clause is not a complete list of risks. You should use the Services only if you understand these risks and can bear the resulting losses.

Nothing in the Services is investment, financial, legal, tax or accounting advice, or a recommendation or solicitation to buy, sell or hold any Digital Asset.

Routing previews, quotes, analytics, savings estimates and performance figures are information generated by software for your own evaluation. Past performance does not indicate future results.

Except to the extent an applicable Schedule, an express appointment or applicable law provides otherwise, the parties are independent contractors and no general fiduciary relationship, partnership or joint venture is created. This clause does not exclude any legal responsibility arising from an actual order-transmission agency or other regulated capacity.

The Services connect to Venues, Custodians, market data providers, charting tools and other third-party services. Your use of each is governed by your own agreement with that third party, and you are responsible for complying with it.

Subject to non-excludable duties and our own contractual obligations, we do not guarantee the solvency, performance, operation or security of any Venue, Custodian or other third party. An act or failure of a third party does not excuse a separate breach by Vasco of its own obligations.

We may add or remove a Venue or other integration at any time, including without notice where the third party changes or withdraws access, or where we consider it necessary for legal, security or risk reasons.

Balances, positions and order statuses shown in the Services reflect data received from third parties. The records of the relevant Venue or Custodian prevail over the display in the Services.

For Prime, the Connected Account Register shall identify for each connection whether the Legal Venue Account Holder is the Custodian or the Client, any sub-account/omnibus arrangement, the relevant Venue, and the permitted execution scope. Title and beneficial rights are determined by the operative Custodian, Client and Venue documents rather than by naming the account model in Vasco.

The provision of API Credentials does not itself prove authority to delegate access or permission under Venue terms. Each enabled connection requires documented Client authority, any required Legal Venue Account Holder approval and confirmation of the applicable permissions.

We and our licensors own all rights in the Services, including software, interfaces, algorithms, routing logic, documentation, designs and the Vasco name and marks. Except for the limited right of use in clause 4.1, no rights are granted to you.

You own your Client Data. You grant us a non-exclusive, worldwide, royalty-free licence to host, process and use Client Data to provide, secure and support the Services and to meet legal obligations.

We may use genuinely aggregated or de-identified service-usage data to operate, secure, benchmark and improve Services, provided we do not identify the Client, End Clients, trading strategies, orders, positions or other commercially sensitive information and do not disclose information from which these can reasonably be reconstructed.

If you give us feedback or suggestions, we may use them without restriction or payment.

Neither party may use the other's name or logo in publicity without prior written consent, except as required by law.

"Confidential Information" means non-public information disclosed by one party to the other that is marked confidential or that a reasonable person would understand to be confidential. Ours includes non-public pricing, documentation, routing methods and security information. Yours includes Client Data, trading activity and positions.

The receiving party must: (a) use Confidential Information only to perform or receive the Services; (b) protect it with at least reasonable care; and (c) disclose it only to its Affiliates, personnel, professional advisers and service providers who need to know it and are bound by equivalent duties.

These duties do not apply to information that: (a) is or becomes public other than through breach; (b) the receiving party already knew or independently developed; or (c) the receiving party lawfully received from a third party without restriction.

The receiving party may disclose Confidential Information where required by law, court order or a regulator, and where lawful will give the other party prior notice.

These confidentiality duties continue for three years after the Agreement ends and, for trade secrets, for as long as the information retains trade-secret protection under applicable law.

Each party shall comply with data protection laws applicable to its activities, including Singapore’s Personal Data Protection Act 2012 where applicable. The application of any other jurisdiction’s law is determined by the facts and that law; these Terms do not assume a Thai contracting entity or a particular Client jurisdiction.

We process personal data collected for our own purposes, including onboarding and account administration, as described in the Privacy Policy made available through the Services. The Privacy Policy must be provided to users before personal data is collected where required by law.

Where we process personal data of your Authorised Users or End Clients on your behalf, the applicable data processing terms agreed with you apply. You must give notices and obtain consents required of you for that processing; neither party is relieved of its own duties under applicable law.

You acknowledge that personal data may be transferred to and processed in countries other than the one in which it was collected, subject to the safeguards the law requires.

Vasco shall maintain administrative, technical and organisational security measures appropriate to the Services and their risks, including access controls, encryption, secure development, monitoring, logging and incident response. Additional security obligations apply where expressly set out in an agreed Security Addendum or Order Form. Any description of certifications or assurance reports must accurately reflect the Services within their verified scope.

Vasco shall notify affected Clients without undue delay after becoming aware of a confirmed material security incident involving relevant Client Data or Custodian-Provided Credentials and shall provide reasonably available information and cooperation. Applicable statutory notification duties and any shorter contractual incident-response timelines remain in effect.

Each party is responsible for credentials, systems and controls in its possession or control. Terminal credentials and Prime Custodian-Provided Credentials are handled under different security models described in Schedules 1 and 2. Trade-only API access may still permit loss-generating trades, even where withdrawals are disabled.

For Prime, Vasco may securely receive, process and store Custodian-Provided Credentials in service infrastructure as necessary to provide authorised routing. The browser-only storage representation in Schedule 1 applies only to Terminal and must not be applied to Prime.

The parties shall use least-privilege API scopes, segregated access and a documented process for issuance, rotation, revocation and incident escalation. Unless independently agreed and lawfully permitted in writing, Prime credentials must not enable withdrawals or external asset transfers.

If access permissions, Client authority, account ownership or regulatory status changes, the relevant party must promptly notify the others. Vasco may freeze new submissions until its records and technical permissions are verified. A freeze does not automatically cancel Venue Orders.

Each party warrants that it has the power and authority to enter into and perform the Agreement.

We warrant that we will provide the Services with reasonable skill and care.

Except as expressly stated in the Agreement, the Services are provided "as is" and "as available". To the fullest extent the law allows, we exclude all other warranties, conditions and terms, whether express, implied or statutory, including those of satisfactory quality, fitness for a particular purpose, non-infringement and accuracy of data.

In particular, we do not warrant that: (a) the Services will be uninterrupted, timely, secure or free of errors; (b) any Order will be executed, or executed at a particular price, time or Venue; (c) any routing, quote or execution will achieve the best available price or any level of saving; or (d) any market data is accurate or current.

Nothing in this Agreement excludes or restricts liability for (a) death or personal injury resulting from negligence; (b) fraud, fraudulent misrepresentation or wilful misconduct; or (c) any liability or remedy that cannot lawfully be excluded or restricted, including applicable mandatory consumer rights.

Subject to clause 15.1, neither party is liable for indirect, special or consequential loss or loss of anticipated profits, revenue, goodwill or business opportunities, to the extent such loss is lawfully excludable. This exclusion does not by itself exclude a reasonably foreseeable direct loss established to have resulted from Vasco's breach of an express order-transmission, order-routing, credential-security or other obligation. Any recoverable direct loss remains subject to the limitations in this clause to the extent lawful.

Subject to clause 15.1, Vasco is not responsible to the extent a loss is caused by (a) ordinary market movement, price volatility, funding or liquidation resulting from a properly authorised trading instruction; (b) an independent act, omission or failure of a Venue, Custodian or other third party; (c) an inaccurate or unauthorised instruction originating from the Client or an Authorised User, unless caused by Vasco's breach; or (d) an event outside Vasco's reasonable control. These exclusions do not excuse Vasco's separate breach of its own obligations. Where causes are concurrent, responsibility is allocated according to applicable law and the proven contribution of each party.

Subject to clause 15.1 and any other non-excludable rights, Vasco's aggregate liability arising from the affected Service in any consecutive 12-month period shall not exceed the fees paid or contractually payable to Vasco for that Service in the 12 months before the event giving rise to the claim, unless the applicable Order Form expressly states a different liability cap. For individual consumers of Vasco Terminal, this clause applies only insofar as permitted by mandatory consumer-protection and other applicable law. The parties acknowledge that any applicable test of reasonableness or enforceability must be satisfied; no statement in these Terms alone conclusively establishes such reasonableness.

Clauses 15.2 to 15.4 do not limit the Client's obligation to pay properly due fees or the Client's liability under clause 16, but clause 16 applies only to losses within its express scope and to the extent permitted by law.

A claim must be commenced within the limitation period prescribed by applicable law. A different period agreed in an institutional Order Form has effect only where legally enforceable and does not restrict non-waivable consumer rights.

The parties intend that the allocation of risks and the applicable liability cap reflect the Services, the fees charged, the Client's ability to control trading instructions, and the parties' respective operational responsibilities. This statement does not replace any statutory assessment of reasonableness.

If an individual uses Vasco Terminal other than in the course of business, nothing in the Agreement removes any right or remedy that cannot lawfully be excluded under applicable consumer law. The limitation and indemnity provisions apply to that individual only to the extent permitted by law.

The Client shall indemnify Vasco, its Affiliates and their respective directors, officers and personnel against reasonable and properly substantiated losses, liabilities, claims and legal costs arising from third-party claims to the extent caused by (a) the Client's or its Authorised Users' material breach of this Agreement or applicable law; (b) unlawful trading activity or unauthorised instructions originating from the Client; (c) the Client's breach of its obligations to End Clients; or (d) its violation of applicable Venue or Custodian terms. This indemnity does not apply to the extent the relevant loss was caused by Vasco's own breach, negligence, fraud, wilful misconduct or failure to comply with applicable law. Any fines or penalties are included only if and to the extent their indemnification is lawful.

We will defend you against a third-party claim that your authorised use of the Services infringes that third party's intellectual property rights, and pay damages finally awarded or settlement amounts we agree, provided the claim does not arise from Client Data, third-party components, your modifications, or use in breach of the Agreement. If such a claim arises, we may modify the Service, obtain a licence, or terminate the affected Service and refund prepaid fees for the unused period. This clause states our entire liability for intellectual property infringement.

The indemnified party must give prompt notice of the claim, allow the indemnifying party to control the defence and settlement, and give reasonable co-operation at the indemnifying party's cost.

The Agreement starts when you accept these Terms and continues until terminated. Paid subscriptions have the term and renewal conditions disclosed during purchase or in the applicable Order Form. Where a paid term renews automatically, the relevant subscription or Order Form will specify any cancellation notice period.

You may terminate a Service that has no committed term at any time by notice to us or by closing your account.

We may terminate a Service for convenience on 30 days' notice, unless the applicable Order Form provides otherwise. If we terminate a prepaid Service for convenience, we will refund prepaid fees for the unused period, except where law or the Order Form requires a different outcome.

Either party may terminate the Agreement on notice if the other: (a) commits a material breach and does not remedy it within 14 days after receiving a notice reasonably identifying the breach, where capable of remedy; or (b) becomes insolvent, enters liquidation or judicial management, or makes an arrangement with creditors, to the extent termination is allowed by law.

We may suspend or restrict all or part of the Services immediately, with notice where practicable and lawful, if: (a) we reasonably suspect breach of clause 3.2 or 5.3, fraud or unlawful activity; (b) there is a security or operational risk to the Services, you or others; (c) a regulator, court or law requires it; (d) a Venue or Custodian requires it or withdraws access; or (e) fees are overdue under clause 6.7.

Upon termination: (a) the right to initiate new use of the terminated Service ends; (b) accrued fees remain payable; (c) where technically available and authorised, Vasco will use reasonable efforts to request cancellation of unfilled Orders, but a request is not a Venue-confirmed cancellation; (d) termination does not close existing positions, extinguish settlement or funding obligations, or transfer Custodian assets; and (e) on written request made within 30 days following termination, Vasco will make available the Client Data export formats it supports, subject to applicable law, security and necessary retention.

Clauses that by their nature should survive termination do so, including clauses 6, 10, 11, 14, 15, 16, 20 and 21.

We may amend these Terms from time to time. We will identify the updated version and date. For material changes, we will provide at least 30 days' notice through the Services or by email where reasonably practicable, except where a shorter period is required to address law, regulation or an urgent security risk.

Changes required by law, a regulator or a security risk may take effect immediately.

If you do not agree to a material change, you may terminate the affected Service before the change takes effect and receive a refund of prepaid fees for the unused period. Continued use after the effective date is acceptance.

You represent and undertake on a continuing basis that: (a) you comply with all anti-money laundering, counter-terrorism financing, anti-bribery and sanctions laws that apply to you; (b) the assets you trade are not derived from unlawful activity; and (c) you hold every licence and approval your business requires in each jurisdiction in which you operate or serve End Clients.

We may carry out due diligence on you, your beneficial owners and your Authorised Users at onboarding and periodically, screen transactions, and share information with Venues, Custodians, regulators and law enforcement where the law requires or permits.

Where reasonably necessary to comply with applicable law, sanctions, lawful direction or controls, we may refuse, pause, prevent submission of or request cancellation of an instruction, or suspend Services. We cannot guarantee cancellation or reversal of an instruction or transaction already accepted or executed by a Venue; nothing excludes liability for unlawful or bad-faith actions.

You must notify us promptly if any representation in this clause ceases to be true, or if a regulator opens an investigation that relates to your use of the Services.

Each party shall perform and remain responsible for the regulatory, AML/CFT, sanctions, record-keeping and reporting obligations directly applicable to its activities. Neither the Custodian’s onboarding nor the Client’s representations substitutes for any regulatory duty imposed on Vasco.

The Agreement and any non-contractual obligations arising from it are governed by the laws of Singapore.

A party raising a dispute shall give the other party written notice reasonably describing the issue. The parties shall attempt in good faith to resolve it within 30 days after that notice, unless urgent interim relief or a shorter legally mandatory process is required.

For institutional Clients using Vasco Prime or Vasco Helm, and persons using Vasco Terminal in the course of business, any dispute arising out of or in connection with this Agreement, including a question concerning its existence, validity or termination, that remains unresolved under clause 20.2 shall be referred to and finally resolved by arbitration administered by the Singapore International Arbitration Centre (SIAC) in accordance with the SIAC Rules in force when arbitration commences, which are incorporated by reference. The seat of arbitration shall be Singapore; the Tribunal shall consist of one arbitrator; the language of arbitration shall be English; and the law governing this arbitration agreement shall be Singapore law. For individuals using Vasco Terminal outside the course of business, the courts of Singapore shall have non-exclusive jurisdiction. Nothing in this clause deprives an individual consumer of the right to bring a claim before another court or authority that has mandatory jurisdiction under applicable law.

Either party may seek urgent interim or injunctive relief from any court of competent jurisdiction.

Notices. We may give notices to you by email to the address associated with your account or through the Services, subject to applicable law. You may give formal legal notices to ContributionDAO Holding Pte. Ltd., Attn: Legal Notices, 38 BEACH ROAD, #23-11, SOUTH BEACH TOWER, SINGAPORE 189767, by tracked post or courier. Security incidents should also be reported promptly through the reporting channel made available in the Service. Written notices delivered to the stated physical address are deemed received when delivery is evidenced.

Assignment. You may not assign or transfer the Agreement without our prior written consent. We may assign it to an Affiliate or to a successor in a merger, acquisition or sale of the relevant business, on notice to you.

Subcontractors. We may use Affiliates and subcontractors to provide the Services and remain responsible for their performance.

Force majeure. Neither party is liable for failure or delay caused by events beyond its reasonable control, including Venue or network outages, cyber attacks, failures of telecommunications or cloud infrastructure, acts of government or regulators, natural disasters, epidemics, war or civil unrest. This does not excuse payment obligations.

Entire agreement. The Agreement is the entire agreement between the parties on its subject matter and supersedes prior discussions and representations. Each party confirms it has not relied on any statement not set out in the Agreement. Nothing in this clause limits liability for fraud.

Third-party rights. A person who is not a party has no right under the Contracts (Rights of Third Parties) Act 2001 to enforce any term, except that our Affiliates and indemnified persons may enforce clauses 15 and 16.

Severability and waiver. If a provision is held invalid, the remainder continues in effect. A failure or delay in exercising a right is not a waiver of it.

Electronic acceptance. The Agreement may be accepted electronically, and electronic records of acceptance are admissible as evidence.

Language. The Agreement is made in English. Any translation is for convenience only, and the English text prevails.

Service. Terminal provides a non-custodial interface to view markets, submit and manage Orders, and monitor supported Venues through accounts the user holds directly. Supported Venues and instruments are shown in the Service or related product documentation.

Direct transmission; no SOR. Terminal transmits user-selected Orders to the selected Venue. Technical formatting, minimum size, rounding and other modifications may be required by Venue APIs and are disclosed where practicable. Terminal does not independently split, aggregate or optimise an Order across Venues. Trades are between the user and Venue or its counterparties.

API Credentials and PIN. For supported integrations, users supply Venue API Credentials, which Vasco Terminal encrypts and stores locally within the user's browser, protected by a user-set PIN. Vasco does not persistently store those Terminal credentials or the PIN on its servers as part of this browser-storage model. Depending on the technical method used to connect to a Venue, credential material may be processed in transit to transmit an authorised request. Users must use minimum trading permissions, disable withdrawals, use IP restrictions where supported and promptly revoke compromised credentials. Local encryption does not eliminate malware, phishing, malicious-extension, browser compromise or trading-loss risk.

Decentralised Venues. Supported decentralised protocols carry smart-contract, on-chain settlement, irreversible transaction, wallet, gas-fee and congestion risks.

Order types. Order type support and whether conditional triggers operate in Vasco or at the Venue must be described in the product documentation. Stop-loss and other orders may fail to trigger or execute; derivatives create leverage, funding and liquidation risk.

Fees. Terminal fees are calculated on executed notional at the published Fee Schedule rate unless a separate Order Form applies. Venue, network, funding and other external fees are separate.

Service. Prime is a smart order routing, connectivity and execution-instruction processing service that can submit Client-authorised Orders to supported Venues according to Execution Parameters. Prime may be operated together with Helm and/or a Custodian. Its availability and instrument scope are subject to the Order Form.

Two Account Models. (a) Custodian-named: the Custodian is the Legal Venue Account Holder; relevant Client economic interest, segregation, allocation and entitlements are determined by the separate Client-Custodian and Custodian-Venue agreements. (b) Client-named: the Client is the Legal Venue Account Holder; Custodian may provision access only under valid documented Client authority and compatible Venue terms. (c) Vasco does not infer account ownership, asset title or authorisation from possession of API Credentials.

Conditions before activation. Each connection requires an approved Connected Account Register entry and evidence reasonably satisfactory to Vasco of (i) Legal Venue Account Holder identity and authority, (ii) Client consent and authorised trading instructions, (iii) Custodian permission to provide credentials, (iv) Venue approval where required, (v) precise instruments, scopes and limits and (vi) settlement allocation. Vasco may refuse activation or suspend access pending verification.

Capacity; no exchange or proprietary trading. Vasco Prime is an order-transmission and smart order routing technology service, not a Digital Asset exchange, order-matching venue or central counterparty. Vasco submits authorised instructions through Connected Accounts within approved Execution Parameters and delegated permissions and does not trade against Client Orders as principal or for its own account. Vasco's limited operational authority is not a custody mandate. The parties acknowledge that legal characterisation, including agency, dealing, arranging or other regulated status, depends on the actual activities and applicable law rather than this description.

Credential delegation and security. Custodian-Provided Credentials may be transmitted to, stored in, and used by Vasco production systems where necessary for the Service, subject to agreed safeguards. Credentials shall be limited to the authorised accounts and trading functions; withdrawal or external transfer permission is prohibited unless expressly agreed in a separate approved mandate and lawfully permitted. The Custodian must issue or arrange issuance and revoke or procure revocation of credentials, and notify authority changes; Vasco shall protect credentials within its control and cease use promptly after valid revocation. Credential possession alone is not evidence of authority.

Orders and routing. Prime processes only validly authorised Orders or documented standing instructions. Routing may consider price, fees, liquidity, fill probability, latency, account restrictions and Venue availability. Previews are indicative; fills, costs and allocations may differ. Orders may be partial, rejected, delayed or executed before cancellation is confirmed. An API timeout may leave order status unknown, requiring reconciliation before retransmission.

Helm configuration. Where enabled, Prime uses the applicable approved Helm Execution Parameters after their acknowledged effective time. Changed limits, suspensions or Venue configurations do not necessarily apply retroactively or cancel Orders already received by a Venue. Approvals and configuration authority are governed by Schedule 3.

Algorithmic and conditional Orders. If supported by the Order Form or documentation, Prime may handle conditional, time-sliced or automated Orders. The Client must approve their parameters and the relevant operational trigger location (Vasco or Venue). Failures, stale data or disconnections may cause a trigger not to fire, trigger late or produce an incomplete execution. No permanent monitoring or failover is promised except in the agreed SLA.

Execution standards. Prime is designed to seek favourable execution outcomes on accessible and authorised Venues; it does not guarantee best price, lowest all-in cost, complete fill or savings. No term waives any best-execution or comparable duty imposed by applicable law. Any conflicts relating to fees, rebates, routing incentives or Venue priority must be disclosed in the applicable Execution Policy.

Custody, settlement and allocation. Vasco does not, solely by providing Prime, acquire legal title to or custody of Client assets. Relevant rights and obligations for pre-funding, settlement, segregation, omnibus allocation, margin and Client subaccounts rest in the applicable Client-Custodian/Venue documentation. Vasco may transmit settlement data or instructions only where separately authorised, and may not independently withdraw or transfer assets. On inconsistency, the parties must reconcile against authoritative Venue and Custodian records.

Fees. Prime fees and pass-through third-party costs are stated in the applicable Order Form or Fee Schedule, including treatment of rebates and changes to fills. Custodian deductions are permitted only with documented Client authority and compatible Custodian terms. Clients should notify Vasco promptly of execution-data discrepancies; this does not limit any non-waivable right.

Order errors, duplicate prevention and incidents. The parties shall cooperate in good faith to investigate duplicate Orders, unknown statuses, inconsistent allocations, misrouted instructions and credential misuse. Vasco shall use agreed order identifiers and reasonable reconciliation controls. No completed Venue transaction is reversible solely by notice to Vasco. Liability is allocated under Part A to the extent lawful, including responsibility for each party’s own breach.

Disconnection and wind-down. A suspension, credential revocation or termination may stop new submissions but may not cancel previously accepted Orders or close open positions. The Client and Custodian must retain lawful alternate access and contingency procedures. Vasco shall provide available execution records and reasonable transition cooperation in accordance with the Order Form.

Service. Helm is an institutional order and execution management and configuration system. It provides, where subscribed, user roles, permissions, sub-account settings, tradable instruments, Client/End Client markups, execution parameters, risk limits, suspensions, audit records and reporting. Helm supplies approved configurations to Prime; it does not itself determine legal ownership of Venue accounts or Client assets.

Organisation and administrators. The Client appoints administrators and controls their delegated rights. Administrator and Authorised User actions within assigned permissions are treated as Client instructions subject to Vasco’s duties. Material settings may require maker-checker approval. The Client must promptly revoke leavers and compromised access.

End Clients and regulatory responsibility. Client (not Vasco) establishes its End Client contracts, onboarding, suitability where applicable, disclosures, licence position and complaint process for its own activities. Client must validly authorise End Client Orders and data processing. These terms do not shift to Client any regulatory duties imposed directly on Vasco.

Execution Parameters and effective time. The Client is responsible for accurate configuration and approvals. Changes take effect upon acceptance and processing by the relevant Service, not merely submission in the UI. Orders submitted earlier may remain active under prior parameters. Audit records will be maintained and made accessible as described in the Order Form or documentation.

Trading fees, markups and rebates. The Client may set permitted End Client charges within agreed limits. The Order Form must explain fee bases, spread/markup treatment, rebates, Venue fees, Custodian charges, Prime fees, rounding, beneficiaries and timing. All End Client disclosures and tax obligations remain with the party to whom they apply.

Risk controls. Helm may provide permitted controls to suspend trading, apply thresholds and restrict instruments or subaccounts. Controls affect only functions confirmed as successfully processed. They do not guarantee cancellation of live Venue Orders, liquidation of positions or prevention of losses already incurred. Emergency escalation routes are identified in the incident procedure.

Custodian and account mapping. Helm may display Client and End Client allocations mapped to Custodian-named or Client-named Connected Accounts. The Client and Custodian are responsible for legal account mapping, sub-account/omnibus books and entitlements under their agreements. Vasco will not treat a display as conclusive ownership evidence.

API, SDK and webhooks. Where enabled, Helm integration interfaces are licensed only for approved use consistent with documentation, agreed rate limits, permitted users and instructions. The Client must not embed Custodian-Provided Credentials in End Client applications unless separately and expressly authorised. The Client is responsible for its own frontend security and End Client disclosures.

Reporting and notifications. Unless stated otherwise, reports and settlement windows use UTC. Reports and notifications are operational aids and may lag Venue or Custodian records. Parties remain responsible for independent monitoring and reconciliation according to their allocated duties.

Fees. Any Helm subscription, Prime usage, performance, routing or third-party charges will be identified in the relevant Order Form or Fee Schedule before they become payable.

Termination. The Client is responsible for notifying its End Clients and arranging orderly wind-down. Vasco shall provide reasonable transition assistance for a period and at rates agreed in the Order Form, and supported data exports, subject to applicable law, security and outstanding fees. Termination does not by itself cancel all external Orders or close open positions.