Internal Reporting Channel – BITX, S.L.

1. What the channel is for

1.1 BITX, S.L. ("BITX") has an internal reporting system through which information may be submitted about breaches of European Union or Spanish law committed within BITX, including breaches of Regulation (EU) 2023/1114 (MiCA) and its implementing rules, of Regulation (EU) 2022/2554 (DORA), of the rules on the prevention of money laundering and terrorist financing (Law 10/2010 of 28 April) and of other rules on financial services, as well as serious or very serious criminal or administrative offences. The system is established in accordance with Law 2/2023 of 20 February regulating the protection of persons who report breaches of law and the fight against corruption, and with BITX's obligations as a crypto-asset service provider.

1.2 The channel is not intended for complaints by Clients about the service they receive, which are handled under the Complaints-Handling Procedure published on this website, nor for general enquiries.

2. Who may use it

2.1 The channel is open to any person who has obtained information about a breach in a work or professional context with BITX, including employees, members of the management body, self-employed persons, contractors and subcontractors and their staff, providers, shareholders, volunteers, trainees, persons whose employment relationship has ended and candidates whose relationship has not yet begun.

3. How to submit a report

3.1 Reports may be submitted in writing, in English or in Spanish, by any of the following means:

• by e-mail to legal@bitx.es, indicating "Internal reporting channel" in the subject line;
• by post to BITX, S.L., Passeig de Gràcia 53, Ático, 08007 Barcelona, Spain, in an envelope marked "Confidential – Internal reporting channel";
• verbally, at a meeting with the person responsible for the system, which is arranged within seven (7) days of a request made through either of the above means.

3.2 Reports may be made anonymously. Where the reporting person provides contact details, BITX uses them only to acknowledge receipt, request information and communicate the outcome.

3.3 A report should describe the facts as precisely as possible, including what happened, when and where, the persons involved and any documents or witnesses that may support it. Reports that are manifestly unfounded, that concern matters outside the scope of section 1 or that lack sufficient information are not admitted; the reporting person is informed of the reasons where contact details are available.

4. How reports are handled

4.1 Receipt of a report is acknowledged within seven (7) calendar days, unless doing so could jeopardise the confidentiality of the report or the reporting person has asked not to be contacted.

4.2 The person responsible for the system assesses whether the report is admissible and, if so, conducts or supervises an impartial investigation, gathering the necessary information and evidence while preserving the confidentiality of the identity of the reporting person and of the persons concerned. Reports relating to the prevention of money laundering and terrorist financing are handled by BITX's representative before the Spanish Financial Intelligence Unit (SEPBLAC).

4.3 The investigation is completed, and a reasoned decision is adopted and communicated to the reporting person, within three (3) months of the acknowledgement of receipt, or within a further three (3) months where the complexity of the matter so requires. Where the facts may constitute a criminal offence, BITX refers them to the Public Prosecutor or the competent authority.

5. Guarantees

5.1 Confidentiality. The identity of the reporting person and of any third party mentioned in a report, and the content of the report, are confidential and are disclosed only to the persons involved in handling it, and to judicial, prosecuting or administrative authorities where the law so requires.

5.2 Protection against retaliation. Any form of retaliation against a person who reports in good faith, including dismissal, demotion, discrimination, intimidation or damage to reputation, is prohibited and will be sanctioned. The same protection extends to persons who assist the reporting person and to persons connected with him or her.

5.3 Rights of the persons concerned. Persons to whom a report refers are informed of the facts attributed to them, at the time and in the manner that does not compromise the investigation, and have the right to be heard, to the presumption of innocence and to the protection of their identity.

5.4 Personal data. Personal data processed through the channel are used only for the purposes of handling the report, in accordance with Law 2/2023 and the Privacy Policy published on this website. Data that are not necessary for the handling of a report are not collected or are deleted without delay; where a report is not admitted or no action is taken within three (3) months, the data are deleted unless they are needed to evidence the functioning of the system or for legal proceedings. Access to the data is restricted to the persons who need it for their functions.

6. External reporting channels

6.1 Reports may also be made directly, or after an internal report, to the Independent Authority for the Protection of Whistleblowers (Autoridad Independiente de Protección del Informante, A.A.I.) or to the competent authority of the relevant Autonomous Community, under Law 2/2023. Breaches of MiCA may be reported to the Comisión Nacional del Mercado de Valores (CNMV), www.cnmv.es, and breaches of anti-money laundering rules to SEPBLAC, www.sepblac.es. The protections described in section 5 also apply to persons who use these external channels.