1. INTRODUCTION

MK DIGITAL BANK PAYMENT INSTITUTION S/A ("MK BANK"), aims at the best digital experience of customers, therefore, the Cybersecurity Policy ("Policy") has been formulated and published in summary form, so that you can use our products and services, aware that we care about the confidentiality, integrity and availability of our systems.

By structuring a cybersecurity program, we use best practices, technical and administrative measures to mitigate relevant incidents or security incidents with your personal data.

2. COVERAGE

All institutions belonging to MK BANK , as well as their employees and service providers are subject to this Policy.

3. OBJECTIVES

This Policy aims to establish the necessary guidelines to maintain the confidentiality, integrity and availability of the systems and information used by MK BANK.

4. PPROCEDURES AND CONTROLS ADOPTED TO REDUCE VULNERABILITY AND MEET OTHER CYBERSECURITY OBJECTIVES

The procedures and controls adopted by MK BANK to reduce vulnerability and meet other cybersecurity objectives are composed of a set of processes that align administrative and technical measures, which include, for example, authentication, encryption, information leakage prevention, training, periodic testing and scanning for vulnerabilities, access controls, with different permission levels, based on the principle of least privilege, among others.

5. REGISTRATION, RESPONSE AND HANDLING OF CYBERSECURITY INCIDENTS

According to internally defined parameters, cybersecurity incidents will be assessed according to the level of impact caused. In addition, MK BANK has internal flows for prevention, recording, response and handling of cyber security incidents.

6. GUIDELINES

The guidelines of this Policy are based on internationally recognized regulations and best practices.

6.1. Guidelines for the elaboration of incident scenarios considered in business continuity tests

MK BANK has guidelines in the Business Continuity Plan - BCP, which aim to reduce the impacts or losses of assets against possible equipment failures, accidents, intentional actions or significant natural disasters, which may affect the continuity of service provision.

6.2. guidelines for the definition of procedures and controls for the prevention and handling of incidents to be adopted by service providers

Control procedures have been defined for the prevention of incidents that should be adopted by service providers, considering the characteristics of the service and the levels of complexity.

6.3. Guidelines for the classification of data and information according to relevance

MK BANK's information is analyzed and given the appropriate level of protection according to its relevance, criticality and use.

6.4. Guidelines for defining the parameters to be used in assessing the relevance of security incidents

Cybersecurity incidents will be assessed and handled according to specific procedures, whose relevance should be prioritized based on the criticality of the services, combined with the analysis of the compromise of confidentiality, integrity and availability of information.

7. MECHANISMS FOR DISSEMINATING CYBERSECURITY CULTURE AND PERIODIC ASSESSMENT

Employees and service providers are trained through an effective program of awareness and dissemination of the culture of Cybersecurity and privacy of personal data. The periodic evaluation implemented is carried out annually by all employees and service providers, aiming at controlling results, based on established goals.

8. INITIATIVES FOR SHARING INFORMATION ON RELEVANT INCIDENTS

After internal assessment and confirmation of the relevance of the incident, it will be reported to the competent regulatory bodies, in accordance with the applicable regulations.

9. PROVISION OF INFORMATION TO CUSTOMERS AND USERS ON PRECAUTIONS IN THE USE OF FINANCIAL PRODUCTS AND SERVICES

To learn about the information and precautions in the use of MK BANK's financial products and services, please refer to the link to access the "Cybersecurity Guidelines and User Guidelines on the Use of Financial Products and Services".

10. SENIOR MANAGEMENT COMMITMENT

MK BANK Senior Management contributes to strengthening the procedures and controls in place to reduce the institution's vulnerability to incidents and meet other cybersecurity objectives.

11. PROCESSING, DATA STORAGE AND CLOUD COMPUTING

When using cloud services MK BANK will meet the criteria provided for in the applicable resolution, considering the risk assessment they represent for the business.

12. VIOLATION

Please be aware that non-compliance with this Policy constitutes serious misconduct and the responsible person will be subject to administrative and/or contractual penalties, after internal and external investigation, without prejudice to criminal and civil liability.

13. Period of validity

This Policy is valid for one (1) year and shall be reviewed and updated every six months.