STRK — Terms and Conditions

Last Updated: February 2026

1. About These Terms

1.1 What this document covers

These Terms and Conditions ("Terms") set out the rules that apply when you use the STRK platform, including the STRK website (strk.com), the STRK application available on iOS, Android, and via web browser at app.strk.com (together, the "App"), and all related services we provide to you (together, the "Services").

1.2 Who is a party to this agreement

These Terms form a legally binding agreement (the "Agreement") between:

• you, the individual who opens and uses a STRK account; and
• us, Empyrean Cards - IT Solutions Unipessoal Lda, a company incorporated and registered in Portugal (NIPC: 509 731 813), with its registered office at Rua do Miradouro, nº 19, Belém, Lisboa, 1400-250, Portugal ("Empyrean Cards").

When we say "STRK," "we," "us," or "our," we mean Empyrean Cards - IT Solutions Unipessoal Lda.

1.3 STRK's role — facilitator of services

STRK operates exclusively as a facilitator of services. STRK does not directly execute any regulated financial activities. All regulated services — including the issuance and redemption of electronic money, payment processing, card issuance, and cryptoasset custody — are performed by STRK's regulated counterparty partners as described in Section 2.

STRK acts as a program manager and technology platform that enables you to access services provided by these regulated entities. STRK does not hold, control, or have access to your funds (whether fiat or crypto) or your cryptographic private keys at any time.

All service facilitation is strictly based on your initiation, instruction, and request. STRK will never initiate, execute, or authorise any transaction or action on your account without your prior action, instruction, or consent. Every transaction processed through the STRK platform originates from you.

1.4 How these Terms relate to other documents

These Terms should be read together with the following documents, which also form part of this Agreement:

• Privacy Policy (available at strk.com/legal/privacy-policy) — explains how we collect, use, and protect your personal data.
• Cookie Policy (available at strk.com/legal/cookie-policy) — explains how we use cookies on our website.
• Acceptable Use Policy (available at strk.com/legal/acceptable-use-policy) — sets out prohibited activities and restrictions on use of the Services (incorporated in Section 11 below).
• Editorial Policy (available at strk.com/legal/editorial-policy) — explains how we create and review content on strk.com and the STRK blog.

If there is any inconsistency between these Terms and any other document forming part of this Agreement, these Terms shall prevail unless the other document expressly states otherwise.

1.5 How to contact us

You can contact us at any time by:

• In-app chat: Through the support section of the STRK App
• Email: support@strk.com
• Post: Empyrean Cards - IT Solutions Unipessoal Lda, Rua do Miradouro, nº 19, Belém, Lisboa, 1400-250, Portugal

We will usually communicate with you in English, through the App or by email.

1.6 Please read these Terms carefully

By creating a STRK account, accessing the App, or using any of the Services, you confirm that you have read, understood, and agree to be bound by these Terms. If you do not agree, you must not use the Services.

2. Who Provides the Services

2.1 Overview of the service architecture

STRK connects you with multiple regulated service providers, each responsible for a specific part of the Services. STRK facilitates your access to these services through the App and website, but the regulated activities themselves are performed by the entities described below.

2.2 Payment services — Equals Group PLC

Empyrean Cards - IT Solutions Unipessoal Lda is in partnership with Equals Group PLC (Registered in England & Wales No. 08922461). Equals Money PLC is part of Equals Group PLC. Registered Office: 3rd Floor, Vintners' Place, 68 Upper Thames St, London, EC4V 3BJ.

Equals Money PLC is authorised by the Financial Conduct Authority to provide payment services (FCA No. 488396). You can verify this on the FCA's Financial Services Register at register.fca.org.uk.

Payment services — including the issuance and redemption of electronic money, multi-currency e-money accounts, payment initiation, and related services — are provided and executed by Equals Money PLC. STRK facilitates your access to these services; Equals Money PLC executes them.

2.3 Card issuance — Equals Money International Limited

Cards issued through the STRK platform (where available and subject to eligibility) are issued by Equals Money International Limited pursuant to a licence from Mastercard International Inc. Equals Money International Limited is authorised as an Electronic Money Institution by the FCA with Firm Reference Number (FRN) 900493.

Mastercard is a registered trademark, and the circles design is a trademark of Mastercard International Incorporated.

2.4 Crypto Card services — 28 STRK Limited

Crypto-funded cards ("Crypto Cards") are issued by 28 STRK Limited (二十八視野有限公司), Business Registration Number: 78831699, Registered Address: Unit S-V, R18, 6/F, Valiant Industrial Centre, Nos 2-12 Au Pui Wan Street, Fo Tan, Hong Kong.

Crypto Card services operate on a gateway model: client funds are handled by regulated entities, with STRK acting as program manager. STRK does not hold, access, or control any funds loaded onto Crypto Cards. Card issuance infrastructure is provided through regulated partners, including a regulated card issuance platform holding TCSP (Hong Kong), MSB (USA), and VASP (Lithuania) licences, and is PCI DSS Level 1 certified.

Crypto Cards are subject to additional terms and conditions specific to the Crypto Card service, which will be presented to you when you apply for a Crypto Card.

2.5 Cryptoasset custody — Safeheron

Cryptoassets accessible through the STRK platform are custodied by Safeheron, a Singapore-based digital asset self-custody infrastructure provider. Safeheron provides institutional-grade multi-party computation (MPC) wallet technology.

Key facts about Safeheron's custodial arrangement:

• MPC technology: Private keys are never held in a single location. Instead, distributed key shares are managed across multiple parties using secure multi-party computation, eliminating single points of failure.
• No single-party key access: STRK does not hold, access, or control any private keys or key shares. Safeheron manages the distributed key infrastructure.
• Security certifications: Safeheron holds SOC 2 Type II certification (audited by Deloitte) and ISO/IEC 27001:2022 certification (audited by DNV).
• Additional security: MPC is combined with TEE (Trusted Execution Environment) technology using Intel SGX for an additional layer of protection.
• AML & KYT: Safeheron integrates anti-money laundering and know-your-transaction tools.

Important: While Safeheron implements institutional-grade security, no custody system is infallible. Cryptoasset custody carries inherent risks (see Section 7).

2.6 STRK's role — platform operator and facilitator

Empyrean Cards - IT Solutions Unipessoal Lda operates the STRK platform (including the App, the website, and the user experience layer). We:

• provide the technology platform through which you access Services;
• facilitate your instructions to regulated service providers;
• manage your account interface and user experience;
• provide customer support; and
• coordinate between you and the regulated entities.

We do not:

• execute regulated financial services directly;
• hold, control, or have access to your fiat funds or cryptoassets;
• hold, control, or have access to any cryptographic private keys;
• initiate any transaction without your instruction; or
• make investment decisions on your behalf.

3. What Type of Account Is Your STRK Account?

3.1 E-money account

Your STRK account is an electronic money ("e-money") account. It is not a bank account. When you or someone else sends money to your STRK account, we facilitate the arrangement for an equivalent value of e-money to be issued and held by the authorised payment service provider (Equals Money PLC) in your account.

E-money is an electronic alternative to cash. It is stored electronically and can be used to make payments, send money, and carry out currency exchanges.

3.2 Your account is not a deposit account

Because your STRK account is an e-money account and not a bank deposit account:

• Your funds are not covered by the Financial Services Compensation Scheme (FSCS) or any equivalent deposit guarantee scheme.
• Your funds do not earn interest.
• Your funds are protected through safeguarding (see Section 4).

3.3 Currencies

Your STRK account may hold e-money in multiple supported currencies at the same time. The number and type of supported currencies depend on your account type, region of residence, and eligibility. A current list of supported currencies is available in the App.

4. How Your Money Is Protected (Safeguarding)

4.1 Safeguarding of fiat funds

Your fiat funds are safeguarded in accordance with the Financial Conduct Authority's safeguarding requirements for e-money and payment services. This means your money is held in segregated bank accounts by the authorised payment service provider (Equals Money PLC), kept separate from our own assets and those of Equals Money PLC.

4.2 What safeguarding means in practice

Safeguarding is designed to protect you if the regulated payment service provider were to become insolvent. In that event, your funds — held in segregated accounts — would be ring-fenced and available for return to you ahead of claims by other creditors (after any costs associated with the insolvency process are covered).

4.3 Safeguarding is not the same as FSCS protection

Please note: Your funds are not covered by the Financial Services Compensation Scheme (FSCS) or any equivalent deposit guarantee scheme. Safeguarding provides a different form of protection from FSCS coverage. You should make sure you understand this distinction before using the Services.

4.4 When safeguarding applies

Safeguarding applies from the time the authorised payment service provider receives your fiat funds until the time you spend, send, or withdraw them.

4.5 Protection of cryptoassets

Cryptoassets held through the STRK platform are custodied by Safeheron using MPC wallet technology (see Section 2.5). Cryptoassets are not protected by FCA safeguarding requirements, the FSCS, or any equivalent scheme. The protection of your cryptoassets depends on the security measures implemented by the custodian (Safeheron). See Section 7 for cryptoasset-specific risks.

5. Eligibility and Account Opening

5.1 Who can open an account

To open a STRK account, you must:

• be at least 18 years old;
• be a natural person (individual) — STRK personal accounts are not available to companies or other legal entities;
• be a resident of a country or territory where STRK Services are available;
• provide accurate, complete, and up-to-date identity and personal information as required during the onboarding process;
• not have been previously suspended or removed from the STRK platform; and
• meet any additional eligibility requirements as determined by us or our regulated partners.

5.2 Identity verification (KYC)

We are required by law to verify your identity before you can use certain Services. This process is known as "Know Your Customer" (KYC). As part of this process, we (or a third-party verification provider acting on our behalf, such as SumSub) may:

• request copies of identification documents (e.g., passport, national ID card, driving licence);
• request proof of address (e.g., utility bill, bank statement);
• carry out electronic identity checks;
• carry out credit reference checks (which may leave a soft footprint on your credit file); and
• request information about the source of your funds.

You must cooperate promptly with all verification requests. Failure to do so may result in restrictions on your account, delayed access to Services, or account closure.

5.3 Ongoing verification

We may need to re-verify your identity or request additional information from time to time in order to meet our legal and regulatory obligations. This may include requests related to anti-money laundering (AML) and counter-terrorism financing (CTF) requirements. Please respond to these requests promptly to avoid disruption to your account.

5.4 One account per person

You may only hold one STRK personal account at a time. Opening multiple accounts is a breach of these Terms and may result in the closure of all accounts held by you.

5.5 Keep your details up to date

You must notify us promptly if any information you provided during onboarding or at any time thereafter changes, including your name, address, email address, phone number, or tax residency.

6. Services

6.1 Overview

Subject to eligibility, verification status, and regional availability, the following Services may be available through your STRK account. In each case, STRK facilitates your access to the service, while the regulated counterparty executes it:

6.2 User-initiated actions only

All transactions and operations performed through the STRK platform are initiated exclusively by you. When you instruct STRK to perform an action (such as sending a payment, swapping currencies, or buying cryptoassets), we relay your instruction to the relevant regulated service provider for execution. We do not act on our own initiative.

6.3 Availability of Services

Not all Services are available to all users. The specific Services available to you depend on factors including:

• your country of residence;
• your verification level;
• regulatory requirements applicable to your jurisdiction;
• product eligibility criteria set by us or our regulated partners; and
• ongoing compliance with these Terms.

We reserve the right to add, modify, or discontinue any Service at any time, subject to giving you reasonable notice where practicable.

6.4 EU and UK account details

Depending on your eligibility and region of residence, you may receive:

• EU account details (BE IBAN): Available for eligible EEA-resident users, supporting SEPA and SEPA Instant payments in EUR and other supported currencies.
• UK account details (GB IBAN): Available for eligible users globally, supporting UK Faster Payments and SWIFT in GBP and other supported currencies.

The provision of account details is subject to eligibility and may require additional verification.

6.5 Fees

Fees apply to certain Services. All applicable fees are set out in the Fees Schedule, which is available in the App and at strk.com. We will always show you any applicable fees and exchange rates before you confirm a transaction.

We may update the Fees Schedule from time to time. We will notify you of material changes in advance. Continued use of the Services after such changes take effect constitutes your acceptance of the updated fees.

7. Cryptoasset Services

7.1 How cryptoasset services work

Where available and subject to eligibility, STRK facilitates your access to cryptoasset services. When you interact with cryptoassets through the STRK App, the following applies:

• Custody: Your cryptoassets are custodied by Safeheron using MPC wallet technology. STRK does not hold any private keys or key shares and has no direct access to your cryptoassets.
• Wallet creation: When you open a crypto-enabled STRK account, STRK facilitates the creation of an MPC wallet via Safeheron's infrastructure. The wallet is secured by distributed key shares managed by Safeheron.
• Transactions: When you initiate a cryptoasset transaction (buy, sell, swap, or transfer), STRK relays your instruction to the relevant service provider. The transaction is executed by the service provider, not by STRK.
• Balances: Cryptoasset balances displayed in the App are retrieved from Safeheron's systems.

7.2 What cryptoasset services are available

Subject to availability:

• Hold supported cryptoassets (such as BTC, ETH, LTC, USDC, and others as listed in the App);
• Swap between supported cryptoassets;
• Convert between supported fiat currencies and supported cryptoassets; and
• Top up a Crypto Card using supported cryptoassets (subject to the terms of 28 STRK Limited).

7.3 Cryptoasset risk warning

⚠️ IMPORTANT: Please read this carefully before using any cryptoasset services.

• Cryptoassets are high-risk. The value of cryptoassets can go down as well as up, and you could lose some or all of the money you put into cryptoassets.
• Cryptoassets are volatile. Cryptoasset prices can fluctuate significantly over short periods, including within the time between placing an order and the order being executed.
• No FSCS or equivalent protection. Cryptoassets are not covered by the Financial Services Compensation Scheme (FSCS) or any equivalent investor or deposit protection scheme.
• No guaranteed returns. Past performance of any cryptoasset is not a reliable indicator of future performance.
• Custody risk. Although cryptoassets are custodied by Safeheron using institutional-grade MPC technology, no custody arrangement is completely risk-free. Risks include (but are not limited to) technical failures, smart contract vulnerabilities, security breaches, and operational errors.
• Regulatory risk. Cryptoassets may become subject to new laws, regulations, or restrictions that could affect their value, transferability, or legality.
• Tax obligations. You may be liable for taxes on profits, gains, or transactions involving cryptoassets. You are solely responsible for understanding and complying with your tax obligations. We do not provide tax advice.
• Irreversibility. Blockchain transactions are generally irreversible once confirmed. Transactions sent to incorrect addresses cannot typically be recovered.

You should not invest in cryptoassets unless you fully understand the risks involved and are prepared to lose all of the money you invest.

7.4 How cryptoasset pricing works

When you buy, sell, or swap cryptoassets through the STRK App, the exchange rate and any applicable fees will be shown to you before you confirm the transaction. Cryptoasset prices are derived from third-party liquidity providers and may differ from prices shown on other platforms.

Once you confirm a cryptoasset transaction, it cannot be reversed or cancelled (except where required by applicable law).

7.5 Blockchain transactions

Certain cryptoasset transactions (such as transfers to external wallets, where supported) are processed on blockchain networks. Blockchain transactions are irreversible once confirmed on-chain. Neither STRK nor Safeheron can reverse, cancel, or modify a transaction once it has been submitted to the blockchain network.

Blockchain transactions may take varying amounts of time to confirm and may be subject to network fees (also known as "gas fees" or "miner fees") which are outside our control.

7.6 Restrictions on cryptoasset services

We or our regulated partners may, at our or their sole discretion:

• limit the cryptoassets available for trading, holding, or transfer;
• impose minimum and maximum transaction limits;
• suspend or discontinue any cryptoasset service with reasonable notice;
• refuse to process a cryptoasset transaction if we or they believe it may breach applicable laws or regulations, or if required to do so by a regulatory authority.

8. Cards

8.1 Card availability

Subject to eligibility, verification status, and your region of residence, you may be able to apply for:

• EU Debit Card: A virtual and/or physical card linked to your STRK multi-currency e-money account. Available for eligible EU/EEA residents. Issued by Equals Money International Limited.
• Global Crypto Card: A virtual and/or physical card funded via cryptoasset top-ups. Available globally (subject to eligibility). Issued by 28 STRK Limited via regulated partners.

8.2 Card issuance and the gateway model

Crypto Cards operate on a gateway model:

• Card issuance and funds: Handled by regulated entities (28 STRK Limited and regulated partners).
• STRK's role: Program manager. STRK facilitates your card application, provides the App interface for card management, and relays your instructions. STRK does not hold or access funds loaded onto cards.
• Your role: You initiate all card actions (applications, top-ups, transactions, freezes) through the App.

8.3 Card usage

You may use your STRK card to make purchases online and in-store, and to withdraw cash from ATMs, wherever the applicable card network (e.g., Mastercard) is accepted. Your card may also be added to digital wallets (e.g., Apple Pay, Google Pay) where supported.

8.4 Card security

You are responsible for keeping your card and card details secure. This means:

• Do not share your PIN, card number, CVV, or other card security details with anyone.
• Do not write down your PIN or store it alongside your card.
• Notify us immediately if your card is lost, stolen, or you suspect unauthorised use.
• Use the freeze/unfreeze feature in the App to block your card instantly if needed.

8.5 Card fees and limits

Fees for card issuance, usage, and ATM withdrawals (if applicable) are set out in the Fees Schedule. Transaction and spending limits are displayed in the App and may vary depending on your account type and verification level.

8.6 Card expiry and replacement

Cards have an expiry date, after which they cannot be used. You may request a replacement card through the App. We may charge a fee for replacement cards as set out in the Fees Schedule.

9. Payments and Transfers

9.1 Sending payments

You can initiate payments from your STRK account by:

• @username sends (P2P): Send money to other STRK users by entering their @username. P2P transfers between STRK users are processed in real time.
• Bank transfers: Send money to external bank accounts using the available payment rails (SEPA, SEPA Instant, SWIFT, UK Faster Payments, and others as available). You must provide accurate recipient details (such as IBAN, sort code and account number, or SWIFT/BIC).
• Card payments: Make payments using your STRK card.

All payment instructions originate from you. STRK relays your instruction to the relevant payment service provider (Equals Money PLC) for execution.

9.2 Receiving payments

You can receive payments into your STRK account from third parties using your account details (IBAN, sort code, account number, or other identifiers as displayed in the App).

9.3 Exchange rates

When a payment or transfer involves a currency conversion, the exchange rate applied will be shown to you before you confirm the transaction. Exchange rates may fluctuate between the time you initiate a transaction and the time it is executed.

We are not responsible for losses resulting from exchange rate fluctuations.

9.4 Payment timing

Payments are processed as quickly as possible. However, processing times depend on the payment method, destination, currency, and the recipient's bank or payment provider. Indicative processing times are displayed in the App before you confirm a transaction.

We are not responsible for delays caused by intermediary banks, correspondent banks, the recipient's bank, or external payment networks.

9.5 Incorrect payment details

It is your responsibility to ensure that payment details (recipient name, account number, IBAN, etc.) are correct before confirming a transaction. If you send money to the wrong account because you provided incorrect details, we will make reasonable efforts to help recover the funds, but we cannot guarantee recovery.

9.6 Refused or returned payments

We or the relevant payment service provider may refuse to process a payment if:

• there are insufficient funds in your account in the relevant currency;
• fraud, money laundering, terrorist financing, or other unlawful activity is suspected;
• the transaction would breach these Terms, applicable law, or the rules of a payment scheme;
• a regulatory authority, law enforcement body, or court order requires refusal; or
• technical issues prevent processing.

Where possible, we will notify you of the reason for refusal (unless prohibited by law).

10. Your Relationship with Regulated Service Providers

10.1 Direct relationship

When you use certain Services, you may enter into a direct contractual relationship with the regulated service provider responsible for that Service (for example, Equals Money PLC for payment services). Where applicable, you will be asked to accept the terms of those providers.

10.2 STRK as intermediary

Where you have a direct relationship with a regulated service provider, STRK acts as an intermediary facilitating communication and instructions between you and that provider. STRK does not assume the obligations of the regulated service provider.

10.3 Regulatory responsibility

Each regulated service provider is responsible for its own regulatory compliance. STRK is responsible for its obligations as a platform operator and facilitator, including compliance with applicable data protection laws, consumer protection requirements, and the accuracy of information presented through the App and website.

11. Acceptable Use and Restrictions

11.1 General obligations

You agree to use the Services responsibly, honestly, and in compliance with all applicable laws and regulations.

11.2 Prohibited activities

You must not use your STRK account or the Services to:

• engage in any illegal, fraudulent, or deceptive activity;
• launder money, finance terrorism, or evade sanctions;
• make or receive payments in connection with illegal goods or services;
• engage in market manipulation, wash trading, or other forms of market abuse involving cryptoassets or fiat currencies;
• circumvent any security measures, transaction limits, or account restrictions;
• open or operate an account on behalf of another person without authorisation;
• use automated systems (bots, scripts) to access or interact with the Services without our prior written consent;
• exploit the Services for speculative foreign exchange trading (i.e., systematically exploiting exchange rate discrepancies for profit);
• use the Services in a manner that harms, disrupts, or interferes with our operations, systems, or other users;
• harass, threaten, or abuse our staff or other users;
• provide false, misleading, or incomplete information; or
• engage in any activity that would cause us or our regulated partners to breach regulatory obligations.

11.3 Consequences of breach

If you breach these Terms or engage in prohibited activities, we may, at our discretion:

• restrict, suspend, or close your account;
• reverse or cancel any transactions (where possible);
• report the activity to relevant authorities; and/or
• take legal action against you.

12. Security

12.1 Your security responsibilities

You are responsible for:

• keeping your login credentials (email, password, PIN, biometric access) confidential and secure;
• not sharing your account access or security details with anyone;
• using a device that is secure, has up-to-date software, and is protected by a screen lock;
• enabling two-factor authentication (2FA) where available;
• notifying us immediately if you suspect any unauthorised access to your account; and
• logging out of the App when not in use.

12.2 Our security measures

We implement industry-standard security measures to protect your account and personal data, including:

• TLS 1.3 encryption for data in transit;
• AES encryption for data at rest;
• two-factor authentication (2FA) via time-based one-time passwords (TOTP);
• biometric authentication (Face ID, Touch ID, fingerprint) where supported;
• 6-digit PIN app lock;
• real-time fraud monitoring;
• PCI-DSS compliant systems and audit trails; and
• card freeze/unfreeze functionality.

12.3 Custodian security measures

Safeheron (cryptoasset custodian) implements:

• MPC (Multi-Party Computation) distributed key management;
• TEE (Trusted Execution Environment) via Intel SGX;
• SOC 2 Type II certified security controls (audited by Deloitte);
• ISO/IEC 27001:2022 information security management (audited by DNV);
• Integrated AML and KYT (Know Your Transaction) tools.

12.4 No guarantee

While we and our partners take all reasonable steps to protect your account and assets, no system is completely secure. We cannot guarantee that security measures will prevent every unauthorised access or breach.

13. Intellectual Property

13.1 Our intellectual property

All intellectual property rights in the STRK platform — including the App, website, software, trademarks (including the STRK name and logo), content, designs, graphics, and documentation — are owned by us or our licensors and are protected by applicable intellectual property laws.

13.2 Limited licence

We grant you a limited, non-exclusive, non-transferable, revocable licence to use the App and access the Services for your personal, non-commercial purposes in accordance with these Terms. This licence does not give you any ownership rights.

13.3 Restrictions

You must not:

• copy, modify, reverse-engineer, decompile, or disassemble the App or any part of the Services;
• create derivative works based on the App or Services;
• use the STRK name, logo, or branding without our prior written consent;
• scrape, mine, or extract data from the App or website; or
• sublicence, sell, or distribute access to the Services.

13.4 Third-party intellectual property

Mastercard is a registered trademark of Mastercard International Incorporated. All other third-party trademarks used in connection with the Services are the property of their respective owners.

14. Data Protection and Privacy

We process your personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK Data Protection Act 2018. Full details of how we collect, process, store, and share your personal data are set out in our Privacy Policy (available at strk.com/legal/privacy-policy).

Your personal data may be shared with our regulated service providers (including Equals Money PLC, Safeheron, and other regulated partners) to the extent necessary to provide the Services. Where we share data with providers located outside the EEA, appropriate safeguards are in place (see the Privacy Policy for details).

15. Suspending or Closing Your Account

15.1 When we may restrict, suspend, or close your account

We may restrict, suspend, or close your account, or limit your access to any Service, if:

• we or a regulated partner reasonably suspect fraud, money laundering, terrorist financing, or other unlawful activity;
• you breach these Terms or any applicable law;
• we are required to do so by a regulatory authority, law enforcement body, or court order;
• you fail to provide information required for identity verification or ongoing due diligence within a reasonable time;
• you are abusive or threatening towards our staff;
• we or a regulated partner decide to discontinue the Services (with reasonable notice); or
• there are other valid legal, regulatory, or security reasons.

15.2 Notice

Where possible, we will notify you before or as soon as reasonably practicable after taking any action under this section, and explain the reasons, unless we are legally prohibited from doing so.

15.3 What happens to your funds

If your account is closed:

• You must withdraw any remaining fiat funds within 60 days of closure (or such other period as we specify).
• If cryptoassets are held in your account, you must convert them to fiat currency and withdraw before the deadline, or transfer them to an external wallet (where supported).
• After the withdrawal period, if fiat funds remain, we may arrange for the payment service provider to deduct an administrative fee (as set out in the Fees Schedule) for the costs of ongoing safeguarding and account maintenance.
• We will make reasonable efforts to return remaining funds to you via the payment method used to fund your account or another method determined to be appropriate.

15.4 When you can close your account

You can close your account at any time by contacting us through the App or by email at support@strk.com. You must first withdraw or transfer any remaining funds and settle any outstanding fees or charges.

16. Unauthorised Transactions and Liability

16.1 What to do if you notice an unauthorised transaction

If you believe a transaction was made without your authorisation, or that your account has been compromised, you must notify us immediately through the App or by email. You should also freeze your card immediately using the in-app freeze feature.

16.2 Our liability for unauthorised transactions

Subject to applicable law, if you notify us of an unauthorised fiat payment transaction without undue delay and in any event within 13 months of the transaction date, we will arrange for a refund from the payment service provider, unless:

• you acted fraudulently;
• you intentionally or with gross negligence failed to keep your security credentials safe, failed to notify us promptly, or failed to comply with Section 12; or
• you authorised the transaction (even if you later dispute the amount or the goods/services received).

16.3 Your liability

You may be liable for losses arising from unauthorised fiat transactions up to a maximum of EUR 50 (or the equivalent in your account currency) if the loss results from the use of a lost, stolen, or compromised payment instrument, provided you did not act fraudulently and you notified us promptly.

You will be liable for all losses if the unauthorised transaction resulted from your fraud, intentional breach, or gross negligence in keeping your security credentials safe.

16.4 Unauthorised cryptoasset transactions

Due to the nature of blockchain technology and MPC custody, unauthorised cryptoasset transactions may not be reversible. If you report an unauthorised cryptoasset transaction, we will investigate with Safeheron and take all reasonable steps available, but we cannot guarantee recovery.

17. Liability and Disclaimers

17.1 STRK's liability as facilitator

STRK acts as a facilitator and does not directly execute regulated services. Our liability is therefore limited to losses that result from our failure to perform our obligations as platform operator and facilitator under these Terms.

We are liable to you for direct losses resulting from:

• our failure to correctly relay your instructions to a regulated service provider;
• errors or malfunctions in the STRK App or website that are within our reasonable control; or
• our breach of data protection obligations.

17.2 Regulated service providers' liability

For losses arising from the execution of regulated services (payment processing, card issuance, cryptoasset custody), liability rests with the regulated service provider responsible for that service. We will assist you in pursuing claims with the relevant provider.

17.3 What we are not liable for

To the fullest extent permitted by applicable law, we are not liable for:

• any indirect, incidental, consequential, special, or punitive damages;
• loss of profits, revenue, business, data, or anticipated savings;
• losses arising from exchange rate fluctuations;
• losses arising from the volatility, depreciation, or loss of value of cryptoassets;
• losses arising from blockchain network failures, delays, or congestion;
• losses caused by your provision of incorrect payment or wallet details;
• losses caused by your failure to keep your security credentials safe;
• actions, omissions, or insolvency of third parties (including regulated service providers, banks, payment processors, custodians, or blockchain networks);
• interruptions to the Services due to maintenance, upgrades, or technical issues; or
• losses arising from circumstances beyond our reasonable control (force majeure).

17.4 Nothing in these Terms excludes liability for:

• death or personal injury caused by our negligence;
• fraud or fraudulent misrepresentation by us; or
• any other liability that cannot be excluded or limited under applicable law.

17.5 Services provided "as is"

The Services are provided on an "as is" and "as available" basis. While we endeavour to provide a reliable and uninterrupted service, we do not guarantee that the Services will be available at all times, free from errors, or free from viruses or other harmful components.

18. Changes to These Terms

18.1 How we may change these Terms

We may change these Terms from time to time. Reasons for changes may include:

• changes in applicable law or regulation;
• changes in our Services or the way we operate;
• changes required by our regulated partners;
• improvements to clarity or readability; or
• changes in market conditions, technology, or industry practice.

18.2 How we will notify you

We will give you at least 30 days' notice before material changes take effect, by email and/or through the App. Minor or non-material changes (such as corrections to typographical errors or formatting) may take effect immediately.

18.3 Your right to reject changes

If you do not agree to the proposed changes, you may close your account free of charge at any time before the changes take effect. If you continue to use the Services after the changes take effect, you will be deemed to have accepted the updated Terms.

19. Complaints

19.1 How to make a complaint

If you have a complaint about any aspect of the Services, please contact us:

• In-app chat: Through the support section of the STRK App
• Email: complaints@strk.com
• Post: Complaints, Empyrean Cards - IT Solutions Unipessoal Lda, Rua do Miradouro, nº 19, Belém, Lisboa, 1400-250, Portugal

19.2 How we will handle your complaint

We will acknowledge receipt of your complaint within 5 business days and aim to provide a final response within 15 business days (or 35 business days in exceptional circumstances, in which case we will notify you of the delay and the reason for it).

19.3 If you are not satisfied

If you are not satisfied with our final response, or if 35 business days have passed without a response, you may refer your complaint to:

• For payment services provided by Equals Money PLC: The Financial Ombudsman Service (UK), Exchange Tower, London E14 9SR. Website: www.financial-ombudsman.org.uk. Phone: 0800 023 4567 (from the UK).
• For issues relating to your relationship with Empyrean Cards: The relevant consumer dispute resolution body in Portugal, or through the European Commission's Online Dispute Resolution platform at ec.europa.eu/consumers/odr.

19.4 Complaints about Crypto Card or custody services

For complaints relating to Crypto Card services (28 STRK Limited) or cryptoasset custody (Safeheron), contact us using the details in Section 19.1 and we will coordinate with the relevant entity.

20. Tax

20.1 Your tax responsibilities

You are solely responsible for determining, reporting, and paying any taxes that may apply to you in connection with your use of the Services, including (but not limited to) income tax, capital gains tax, value-added tax, and any other taxes or duties imposed by the authorities of your country of residence or any other relevant jurisdiction.

20.2 Tax reporting

We may be required to report certain information about you and your account to tax authorities under applicable law, including under the Common Reporting Standard (CRS), the Foreign Account Tax Compliance Act (FATCA), or other automatic exchange of information (AEOI) frameworks. You consent to such reporting and agree to provide us with any information we reasonably require for this purpose.

20.3 No tax advice

We do not provide tax, legal, or financial advice. You should seek independent professional advice on your tax obligations.

21. Governing Law and Disputes

21.1 Governing law

These Terms, and any dispute or claim arising out of or in connection with them (including non-contractual disputes or claims), shall be governed by and construed in accordance with the laws of Portugal, without regard to its conflict of law provisions.

21.2 Jurisdiction

The courts of Lisbon, Portugal shall have non-exclusive jurisdiction to settle any dispute arising out of or in connection with these Terms. This does not affect any mandatory rights you may have under the laws of your country of residence to bring proceedings in that jurisdiction.

21.3 Payment services disputes

Disputes specifically relating to payment services provided by Equals Money PLC may also be subject to the jurisdiction of the courts of England and Wales and the supervisory authority of the Financial Conduct Authority.

22. General Provisions

22.1 Entire agreement

These Terms (together with the documents referred to in Section 1.4) constitute the entire agreement between you and us in relation to the Services, and supersede all previous agreements, representations, and understandings.

22.2 Severability

If any provision of these Terms is found by a court or competent authority to be invalid, illegal, or unenforceable, that provision shall be modified to the minimum extent necessary to make it valid and enforceable, or if not possible, severed from these Terms. The remaining provisions shall continue in full force and effect.

22.3 No waiver

Our failure or delay in exercising any right or remedy under these Terms does not constitute a waiver of that right or remedy.

22.4 Assignment

You may not assign, transfer, or delegate any of your rights or obligations under these Terms without our prior written consent. We may assign or transfer our rights and obligations under these Terms to a third party, provided that such assignment does not materially reduce the protections available to you.

22.5 Third-party rights

These Terms do not confer any rights on any person or entity other than you and us. No third party has any right to enforce any provision of these Terms.

22.6 Force majeure

We shall not be liable for any failure or delay in performing our obligations under these Terms to the extent that such failure or delay is caused by circumstances beyond our reasonable control, including (but not limited to) natural disasters, war, terrorism, pandemics, strikes, government actions, sanctions, power failures, internet outages, blockchain network congestion, or failures of third-party systems or networks.

22.7 Language

These Terms are written in English. If they are translated into any other language, the English version shall prevail in the event of any inconsistency.

22.8 Survival

Sections that by their nature should survive termination of these Terms (including, without limitation, Sections 7.3, 13, 14, 16, 17, 20, 21, and 22) shall survive termination.

23. Regulatory Disclosures

23.1 Partnership and FCA authorisation

Empyrean Cards - IT Solutions Unipessoal Lda is in partnership with Equals Group PLC (Registered in England & Wales No. 08922461). Equals Money PLC is part of Equals Group PLC. Registered Office: 3rd Floor, Vintners' Place, 68 Upper Thames St, London, EC4V 3BJ. Equals Money PLC is authorised by the Financial Conduct Authority to provide payment services (FCA No. 488396).

23.2 Safeguarding statement

Your funds are safeguarded in accordance with the FCA's safeguarding requirements for e-money and payment services. This means your money is held in segregated bank accounts and protected in case of insolvency. Please note: your funds are not covered by the Financial Services Compensation Scheme (FSCS).

23.3 Operating entity

STRK is operated by Empyrean Cards - IT Solutions Unipessoal Lda. Rua do Miradouro, nº 19, Belém, Lisboa, 1400-250, Portugal. NIPC: 509 731 813.

23.4 Crypto Card entity

Crypto cards are issued by 28 STRK Limited (二十八視野有限公司). Business Registration Number: 78831699. Registered Address: Unit S-V, R18, 6/F, Valiant Industrial Centre, Nos 2-12 Au Pui Wan Street, Fo Tan, Hong Kong.

23.5 Cryptoasset custodian

Cryptoassets are custodied by Safeheron, a Singapore-based digital asset self-custody infrastructure provider. Safeheron is SOC 2 Type II certified and ISO/IEC 27001:2022 certified.

23.6 Card network

Cards (where applicable) are issued by Equals Money International Limited pursuant to licence by Mastercard International Inc. Equals Money International Limited is authorised as an Electronic Money Institution by the FCA with FRN 900493. Mastercard is a registered trademark, and the circles design is a trademark of Mastercard International Incorporated.

© 2026 Empyrean Cards - IT Solutions Unipessoal Lda. All rights reserved.

STRK is a trademark. Empyrean Cards - IT Solutions Unipessoal Lda has the right to use the STRK trademark.