Sanctions & Export Compliance

Last updated: [TBD] · This is a working draft pending legal review.

1. Purpose and scope

Coded B.V. ("Coded", "we", "us") operates an international commerce platform that lets a merchant run one or more branded online shops, with a curated product catalog, built-in payments, and built-in fulfilment. We provide our services to merchants and their customers worldwide.

This Sanctions & Export Compliance Policy ("Policy") explains the trade-control, sanctions, and export-control rules that apply to the use of the Coded platform, the obligations of everyone who uses it, and what happens if those rules are broken. It applies to every Organization, every merchant, every authorised user, and every project (such as the shops and other things users create) on the platform, as well as to the goods, services, and funds that move through it.

This Policy forms part of, and should be read together with, the Coded Terms of Service and the Coded Privacy Policy. Where this Policy and another agreement conflict on a sanctions or export-control point, the stricter requirement applies.

2. Why this matters

Coded is registered in the Netherlands and operates internationally. Because of this, more than one body of trade-control law can apply to a single transaction at the same time — including the law of the country where Coded is established, the law of the country where a merchant or customer is located, and the law of any country whose currency, financial system, technology, or goods are involved.

Sanctions and export-control laws are designed to be far-reaching. Rules such as those administered by the United States can reach transactions outside the United States, and similar reach exists under other regimes. We take a single, conservative, global approach so that the platform stays compliant everywhere it operates, rather than applying different standards in different markets.

3. Sanctions regimes we comply with

We design our controls to meet, at minimum, the requirements of the following regimes, and of any other applicable trade-control law in a market where we or our users operate:

• United Nations (UN) — the UN Security Council Consolidated List and the sanctions programmes adopted by the Security Council.
• European Union (EU) — the EU Consolidated List of persons, groups, and entities subject to financial sanctions, and EU restrictive measures (including those applied through the Netherlands as an EU member state).
• The Netherlands — national measures and the enforcement framework administered by Dutch authorities, as the jurisdiction in which Coded is established.
• United States (US) — the sanctions programmes administered by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC), including the Specially Designated Nationals and Blocked Persons (SDN) List, and U.S. export controls under the Export Administration Regulations (EAR) to the extent they apply.
• United Kingdom (UK) — the UK Sanctions List and financial sanctions administered by HM Treasury's Office of Financial Sanctions Implementation (OFSI).

Where a transaction touches additional jurisdictions, the trade-control rules of those jurisdictions may also apply, and we expect users to observe them.

4. Definitions

• Sanctioned Party — any individual, entity, vessel, aircraft, or organisation that is named on, owned or controlled by a party on, or otherwise the target of, any sanctions list maintained under a regime listed in Section 3. "Owned or controlled" follows the ownership and control tests applied by the relevant authority (for example, the 50%-or-more aggregate-ownership rule applied under OFAC).
• Restricted Jurisdiction — a country or territory subject to comprehensive or territorial sanctions or embargo under any regime listed in Section 3.
• Restricted Items — goods, software, technology, or services whose export, re-export, transfer, or provision is controlled or prohibited under applicable export-control or sanctions law.
• Screening — the process of checking a party, jurisdiction, or transaction against applicable sanctions and restricted-party lists.

5. Restricted Jurisdictions

We do not knowingly make the platform available to, and we prohibit its use to facilitate business with or for the benefit of, any Restricted Jurisdiction.

The set of Restricted Jurisdictions is defined by the regimes in Section 3 and changes over time as governments add, narrow, or lift measures. As of the effective date of this Policy, comprehensively or territorially restricted areas have historically included Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions of Ukraine, among others. This list is illustrative, is not exhaustive, and is not a substitute for checking the current measures of each applicable authority. We update our controls as the underlying designations change.

We may also apply controls that fall short of a full embargo — for example, sector-specific or activity-specific restrictions — where an applicable regime requires them.

6. Prohibited parties and prohibited uses

You may not use the Coded platform, and you may not allow any project on it to be used, to:

• transact with, provide funds or economic resources to, or otherwise deal with any Sanctioned Party;
• carry out, route, or settle any transaction involving a Restricted Jurisdiction, or for the benefit of any person ordinarily resident in or located in a Restricted Jurisdiction;
• export, re-export, transfer, or supply any Restricted Items in breach of applicable export-control or sanctions law;
• evade, circumvent, or attempt to evade or circumvent any sanctions or export-control measure, including by misrepresenting a counterparty, end user, end use, origin, destination, or ownership and control;
• access or use the platform from a Restricted Jurisdiction, or on behalf of a Sanctioned Party, where doing so would breach an applicable regime.

These prohibitions apply regardless of where you, your Organization, your customers, or your end users are located.

7. Screening

We operate Screening that is proportionate to our business as an international commerce platform.

7.1 What we screen

We screen against the consolidated and programme lists maintained under the regimes in Section 3, including the OFAC SDN List, the EU Consolidated List, the UN Consolidated List, and the UK Sanctions List, together with relevant supplementary and restricted-party lists.

7.2 When we screen

We screen at the points where sanctions risk arises, which may include:

• when an Organization or merchant signs up and during identity and business verification;
• when a payout, settlement, or other money movement is set up or processed (including checks performed by our payment partners, Stripe and Mollie, under their own programmes);
• on an ongoing or periodic basis, including re-screening when sanctions lists are updated;
• when we have a specific reason to review a particular party, project, or transaction.

7.3 Payments and payment partners

Payments on the platform are processed by Stripe and Mollie. Coded charges no platform fee on a merchant's payment transactions; merchants pay only the pass-through processing cost charged by the relevant payment provider. Our payment partners run their own sanctions and anti-money-laundering controls, and a transaction may be screened, paused, declined, frozen, or reported by a payment partner independently of any action we take. Use of payments through the platform is also subject to the terms and acceptable-use rules of the relevant payment provider.

7.4 Possible matches and holds

If Screening returns a possible or confirmed match, we may pause, hold, restrict, freeze, or decline the relevant onboarding, project, transaction, payout, or account while we review it, and we may be legally required to block funds or to report the matter to the competent authority. We may not always be permitted to tell you why an action was taken or that a report was made.

8. Your obligations and representations

By using the platform, you represent, warrant, and undertake on a continuing basis that:

• you, your Organization, your owners and controllers, your authorised users, and your customers and counterparties are not Sanctioned Parties and are not located in, organised under the laws of, or ordinarily resident in a Restricted Jurisdiction;
• you will not use the platform, or any project on it, for any prohibited party or prohibited use described in Section 6;
• you will comply with all sanctions and export-control laws that apply to you and to your use of the platform, including those of any jurisdiction in which you or your customers operate;
• the information you give us for verification and Screening is accurate, current, and complete, and you will update it promptly when it changes;
• you will not list, sell, ship, or facilitate the supply of Restricted Items in breach of applicable law, and you are responsible for the trade-control classification, licensing, and end-use compliance of everything you offer through your projects;
• you will cooperate with reasonable requests for information needed for our compliance checks.

You are responsible for your own compliance. Nothing we do — including Screening or allowing a transaction to proceed — relieves you of your own legal obligations or amounts to advice that a given transaction is lawful.

9. Data hosting and privacy

Platform data is hosted in the European Union (Frankfurt, Germany). Screening necessarily involves processing personal data about the parties being checked. We carry out that processing in line with the Coded Privacy Policy and our privacy-by-design approach, including data minimisation and purpose limitation. We do not sell or share personal data for cross-context behavioural advertising. Where law requires us to retain Screening records or to report a match, we will do so for that purpose and for the period required.

10. Consequences of breach

If you breach this Policy, or if we reasonably believe a breach has occurred or is likely, or if compliance with applicable law requires it, we may take any of the following steps, with or without prior notice and at our discretion:

• suspend, restrict, or limit your access to the platform, a project, or a feature;
• hold, freeze, reverse, or decline transactions, payouts, or settlements;
• block or freeze funds where we are required or permitted to do so;
• terminate your Organization, project, or account and our agreement with you;
• retain records and report the matter to the relevant authority;
• take any other action reasonably necessary to comply with applicable law.

We are not liable to you for any loss arising from action we take in good faith to comply with sanctions or export-control law, or from action taken by a payment partner or other provider for the same reason. A breach of this Policy may also expose you to civil and criminal liability under the laws that apply to you.

11. Reporting

If you become aware of any actual or suspected breach of this Policy, or of any sanctions or export-control matter affecting the platform, report it to us at compliance@coded.co or to security@coded.co.

12. Changes to this Policy

Sanctions and export-control measures change frequently, and we update our controls and this Policy as needed. We will post the current version with its effective date. Your continued use of the platform after a change takes effect means you accept the updated Policy.

13. Governing law and jurisdiction

This Policy is governed by the laws of the Netherlands, and the courts of Amsterdam, the Netherlands have jurisdiction over any dispute arising out of or in connection with it, subject to any mandatory consumer-protection, data-protection, or other law of your own jurisdiction that applies to you and cannot be excluded by agreement. Nothing in this Policy limits or overrides any sanctions or export-control law that applies to you; where this Policy is more permissive than applicable law, applicable law prevails.

Contact

Coded B.V. Registered in the Netherlands (KvK no. 42027097; VAT no. NL869368795B01) Registered address: De Taling 15, 2761 SL Zevenhuizen, The Netherlands Parent company: Coded Holding B.V.

Compliance and sanctions queries: compliance@coded.co Security and abuse reports: security@coded.co General legal queries: legal@coded.eu

Effective date: 11 June 2026