1. Overview

GaulBridge Ltd. ("GaulBridge") is committed to maintaining the highest standards of integrity, transparency, and ethical business conduct. This Whistleblowing Policy provides a secure and effective framework for employees, contractors, clients, and other stakeholders to raise genuine concerns about misconduct, wrongdoing, or regulatory breaches — without fear of retaliation.

We take every report seriously. All concerns raised under this policy are handled confidentially, fairly, and proportionately.

2. Scope

This policy applies to anyone who interacts with GaulBridge, including:

• Employees, executives, and directors
• Contractors, consultants, agents, and third-party service providers
• Clients, vendors, and other external stakeholders

This policy is not intended to replace normal grievance or complaints procedures for routine employment or service-related matters. For client service complaints, please refer to the complaints process in our Terms and Conditions.

3. What to report

You can use this policy to report concerns about:

• Breaches of laws or regulations, including AML/CTF, sanctions, and financial crime obligations
• Fraud, theft, financial misconduct, or misuse of company or client assets
• Conflicts of interest, bribery, corruption, or improper inducements
• Harassment, discrimination, bullying, or serious workplace misconduct
• Data breaches, unauthorised disclosures, or mishandling of confidential information
• Any conduct that may materially harm GaulBridge's integrity, clients, or regulatory standing

4. How to report

You can raise a concern through any of the following channels:

• Email (dedicated compliance inbox): compliance@gaulbridge.com
• Post (including anonymous submissions): GaulBridge Ltd., Office 301, 410 W Georgia St, 5th Floor, Vancouver, BC, V6B 1Z3, Canada
• Direct reporting: You may also raise concerns directly with the Compliance Officer or a designated senior officer, in writing or via an arranged meeting

To help us investigate effectively, please include (where possible):

• A clear description of the concern or suspected misconduct
• Names of individuals involved, if known
• Relevant dates, times, and locations
• Any available supporting evidence — documents, emails, screenshots, or transaction references

You are not required to provide all of this information. Anonymous reports are accepted.

5. Confidentiality and anonymity

All whistleblowing reports are treated as strictly confidential and handled with discretion.

You may submit a report anonymously. If your identity is known to us, it will be protected to the fullest extent permitted by law. We will not disclose your identity without your consent, except where:

• Disclosure is required by law or regulatory obligation
• Disclosure is necessary to enable a lawful investigation to proceed

Where contact details are provided, we will acknowledge receipt of your report within 2 business days and, where feasible, keep you informed of progress.

6. Investigation process

Initial assessment

When a report is received, we will carry out an initial assessment to determine whether the concern falls within the scope of this policy and whether a formal investigation is required.

Formal investigation

Where appropriate, a formal investigation will be conducted by the Compliance function or an independent investigator. Investigations may include:

• Review of relevant records, systems, and communications
• Interviews with relevant individuals
• Independent analysis by personnel not involved in the reported matter

Where concerns involve suspected criminal conduct, serious regulatory breaches, or legal violations, GaulBridge may escalate the matter to relevant regulators or law enforcement authorities, as required or permitted by law.

Resolution

Following an investigation, GaulBridge will determine appropriate action, which may include disciplinary measures, process improvements, regulatory notifications, or legal action. Where lawful and appropriate, the whistleblower may receive a high-level update on the outcome, subject to confidentiality constraints.

7. Whistleblower protection

GaulBridge has a zero-tolerance policy toward retaliation against anyone who raises a concern in good faith.

Retaliation includes but is not limited to: termination, demotion, suspension, adverse role changes, harassment, intimidation, threats, or unjustified disciplinary action.

Anyone who experiences or witnesses retaliation should report it immediately through the channels in Section 4. Allegations of retaliation will be investigated and may result in disciplinary action.

8. Record-keeping

All whistleblowing reports, investigation records, and outcomes are securely stored with restricted access. Records are retained for a minimum of 8 years, or longer where required by law or regulatory obligations.

Anonymised summaries may be provided to senior management or the Board for governance and oversight purposes. Information may be disclosed to regulators or authorities where legally required.

9. Policy review

This policy is reviewed at least annually and updated as necessary to reflect changes in law, regulatory expectations, or GaulBridge's business. Staff training promotes awareness of reporting channels and ethical conduct. Periodic audits support the effectiveness and confidentiality of the whistleblowing framework.

10. Contact

For questions about this policy or whistleblowing procedures: