• Terms of Use
  • KYC and AML policy
  • Privacy policy
  • Cookie policy

Terms of Use

  • Terms of Use
  • KYC and AML policy
  • Privacy policy
  • Cookie policy

TABLE OF CONTENTS

This document constitutes a single legal instrument that the customer accepts by a single action upon registration, or upon the first order following a new edition. The document is structured in three parts:

PART A — MASTER AGREEMENT. Governs access to the Platform, customer identification (KYC/AML), security, and rules common to all services. Party: X AURA LTD (Republic of Cyprus).

PART B — SERVICE SCHEDULES. Govern specific categories of services provided by the relevant operators. Each Schedule is governed by the law of its operator.

  • Schedule 1 — Exchange of fiat currency for digital assets and digital assets for fiat currency. Operator: Buycoin Sp. z o.o. (Poland).

  • Schedule 2 — Exchange of digital assets for digital assets (swaps). Operator: Monocrypt (Costa Rica).

  • Schedule 3 — Storage of digital assets and execution of outbound transfers upon Customer Instruction. Operator: Monocrypt (Costa Rica).

PART C — ANNEXES. Technical, informational and reference documents forming an integral part of these Terms.

  • Annex 1 — Risk Warning

  • Annex 2 — Complaints Handling Policy

  • Annex 3 — List of Prohibited Countries and Territories

  • Annex 4 — Prohibited and Unsupported Services

The following documents are published separately on the website: Privacy Policy, Cookie Policy, KYC/AML Policy (Public Summary).

PART A — MASTER AGREEMENT

Parties

Platform Operator

X AURA LTD (registration number HE448105), 15A Dimostheni Severi Avenue, 1080 Agioi Omologites, Nicosia, Republic of Cyprus (hereinafter — “X AURA”, “Platform Operator”)

E-mail

info@buycoin.online

Customer

A natural person who has registered on the Platform and/or uses its services (hereinafter — “Customer”, “You”)

Under this Master Agreement, X AURA and the Customer set out the terms of access to the buycoin.online Platform and establish a single set of rules applicable to all categories of services provided through the Platform by its operators listed in the Schedules to this Master Agreement (collectively — the “Operators”).

1. Acceptance of terms and scope

1.1. By registering on buycoin.online or signing in to an existing account, You confirm that You have read, understood and fully agree with these Terms.

1.2. Acceptance of these Terms simultaneously constitutes acceptance of Schedules 1, 2 and 3 and Annexes 1–4, as well as the following separate documents published on the website:

  • Privacy Policy;

  • Cookie Policy;

  • KYC/AML Policy (Public Summary);

  • Document Verification Guide (reference instruction for the user interface).

1.3. These Terms govern the relationship between the Customer and X AURA. The relationship between the Customer and each Operator of services is governed by the relevant Schedule to these Terms, which forms an integral part of a single legal instrument.

1.4. If You do not agree with these Terms or any document referenced in clause 1.2, You shall not use the Platform.

1.5. The Platform’s services are available to persons aged 18 or over.

2. Definitions

In these Terms and in the Schedules thereto, the following capitalised terms have the meanings set out below:

  • “Platform” — the buycoin.online website and related interfaces that enable order creation and interaction with the Operators of services.

  • “Account” — the Customer’s electronic account on the Platform.

  • “Order” — the Customer’s request to execute a specific asset-exchange operation, created via the Platform interface.

  • “Digital Asset” — an electronic store of value (including cryptocurrencies and tokens) in respect of which an Operator provides services.

  • “Fiat Currency” — a national currency supported by the Platform and available for selection when placing an Order.

  • “Rate” — the exchange rate applied to the operation once fixed.

  • “Tariff” — the set of fees, mark-ups and network charges applicable to the operation.

  • “KYC/AML” — Know Your Customer identification procedures and Anti-Money Laundering / Counter-Terrorist Financing (AML/CTF) controls.

  • “Travel Rule” — requirements established by applicable law and by providers’ policies for the transmission of originator/beneficiary information.

  • “Operator of services” — a legal entity providing the Customer with a specific category of services through the Platform under the relevant Schedule.

  • “Supported Assets” — fiat currencies and digital assets available on the Platform for the chosen operation type, with the parameters and limits displayed to the Customer before Order confirmation.

  • “Balance” — the Customer’s record in Monocrypt’s storage system reflecting the balance of digital assets held by Monocrypt for the Customer under Schedule 3.

  • “Customer Instruction” — an unambiguous instruction given by the Customer through the Platform interface to perform a specific operation with the Customer’s assets (in particular, an outbound transfer of a digital asset from the Balance).

  • “Payment Request” — an informational message containing payment details (recipient, network, amount, memo/tag where required), generated by a third party and displayed to the Customer in the Platform interface for review. A Payment Request is not an instruction to Monocrypt and does not in itself create any obligations for Monocrypt.

3. Platform role and allocation of responsibilities

3.1. X AURA acts as an interface/marketplace operator: it provides the Customer with an interface for creating Orders and Instructions and technically routes them to the relevant Operator of services.

3.2. X AURA is not a counterparty to any exchange operation, does not perform currency or digital-asset conversion, does not hold Customer funds (fiat or digital), and does not accept or execute payment instructions.

3.3. The counterparty to a specific operation is the Operator of services to which the corresponding Order or Instruction is routed (Schedule 1, 2 or 3).

3.4. Acceptance of these Terms by a single action of the Customer (single acceptance) simultaneously creates contractual relations between the Customer and X AURA (under Part A) and between the Customer and each Operator of services within the scope of services provided by that Operator (under the relevant Schedule). No separate acceptance of the Schedules is required for individual Orders.

4. Account, registration and security

4.1. To access the services, the Customer creates an Account, provides accurate and up-to-date information and completes the procedures set out in Section 5 of this Master Agreement.

4.2. The Customer shall keep credentials confidential, shall not share them with third parties, shall prevent third-party access to the Account, and shall promptly notify support of any suspected compromise.

4.3. All actions taken through the Account are deemed to have been taken by the Customer, unless proven otherwise and provided the Customer has timely notified of any compromise.

4.4. The Customer may hold only one Account. The use of others’ accounts or sharing access with third parties is prohibited.

5. Unified identification, AML/CTF and Travel Rule

5.1. Access to operations is granted only after successful identification (KYC) and AML/CTF checks. Identification is performed via authorised verification providers and includes, among other things, document authenticity verification, biometric face-matching with the document photo, and liveness detection.

5.2. KYC/AML data is processed and shared only to the extent necessary to:

  • comply with AML/CTF, sanctions regimes and the Travel Rule;

  • perform the contract relating to an Order or Instruction;

  • prevent fraud and ensure the security of the Platform.

For these purposes, data may be shared with the Operators acting as independent controllers (or, where applicable, processors). A full list of recipients, legal bases and cross-border safeguards is set out in the Privacy Policy.

5.3. For transfers of an amount equivalent to EUR 1,000 or above (or any other threshold set by applicable law), Travel Rule requirements apply: originator/beneficiary information is collected and transmitted; for self-hosted addresses, proof of address control may be required.

5.4. The Operators apply a risk-based approach: the scope of checks is proportionate to the risk profile of the Customer, the operation, the jurisdiction and the products used.

5.5. As part of Enhanced Due Diligence, the Operators may request additional information and evidence concerning the source of assets and the purpose of operations. In the absence of a reasonable level of assurance, the Operator may refuse to provide service.

5.6. The Operators carry out ongoing monitoring of operations, including blockchain analytics, screening against sanctions lists, PEP and adverse-media databases, and high-risk-jurisdiction lists.

6. Acceptable use and restrictions

6.1. The Customer shall not:

  • circumvent technical restrictions of the Platform (geo-blocking, limits, access settings);

  • engage in data scraping, automated content extraction, interference with the Platform’s operation, or distribution of malicious software.

6.2. Services are unavailable to persons located, resident or registered in the jurisdictions listed in Annex 3 “List of Prohibited Countries and Territories”, as well as to persons using payment instruments issued in such jurisdictions, or acting on behalf of persons from such jurisdictions.

6.3. Prohibited purposes and services are set out in Annex 4 “Prohibited and Unsupported Services”.

6.4. Commercial acceptance of customer payments (merchant acquiring), acquiring services and the provision of services to third parties through the Platform are prohibited without a separate written arrangement with the relevant Operator.

6.5. The Customer is solely responsible for compliance with the laws of the jurisdiction of residence, presence or citizenship, including currency, tax and sanctions laws, as well as obligations to declare income and operations involving digital assets.

7. Order/Instruction placement and routing

7.1. The Platform routes the Customer’s request to the relevant Operator of services depending on the chosen operation type:

  • exchange of fiat currency for a digital asset and exchange of a digital asset for fiat currency — Schedule 1 (Buycoin Sp. z o.o., Poland);

  • exchange of a digital asset for a digital asset — Schedule 2 (Monocrypt, Costa Rica);

  • acceptance of digital-asset deposits to the Balance, storage of the Customer’s assets within the Operator’s infrastructure and execution of outbound transfers from the Balance upon Customer Instruction — Schedule 3 (Monocrypt, Costa Rica).

7.2. Before confirming an Order or Instruction, the Customer is shown the key operational parameters: supported assets, indicative rate or payout amount, fees, limits, payment details and other parameters.

7.3. By confirming an Order or Instruction, the Customer enters into a contract with the relevant Operator on the terms of the relevant Schedule. X AURA’s role is limited to providing the interface and technical routing.

8. Fees and limits (general provisions)

8.1. The Operators’ services are fee-based. Fees and mark-ups may be embedded in the Rate and/or shown as a separate line item before confirmation.

8.2. Network fees, minimum and maximum amounts, and other parameters are displayed to the Customer before Order/Instruction confirmation and may be updated.

8.3. Fees of banks, payment providers and blockchain networks are charged by such third parties, are not controlled by the Operators and, where applicable, reduce the amount credited to the Customer.

8.4. Specific fee parameters and structure are set out in the relevant Schedule.

9. Suspension, freezing and termination

9.1. X AURA and/or the relevant Operator of services may temporarily restrict or terminate access to the Platform and/or freeze an operation or assets in the event of:

  • breach by the Customer of these Terms, the Schedules or the Annexes;

  • requirements of applicable law or of a competent authority;

  • AML/CTF checks, sanctions screening or source-of-funds checks;

  • suspected fraud or an operational/security incident;

  • a reasoned request of partners (banks, payment providers) in connection with their regulatory obligations.

9.2. The standard freezing period for operations or assets is up to 30 business days. This period may be extended to 90 business days where necessary to complete a review or investigation.

9.3. The Customer will be notified of the fact of freezing within a reasonable time, except where such notice is prohibited by applicable law or by a competent authority.

9.4. The Operator of services may refuse to provide service without stating reasons in cases where disclosure of reasons is restricted by applicable law, by a competent authority, by obligations to payment/licensing partners, or where disclosure could harm the security or integrity of the service.

9.5. Suspension of access to the Platform does not affect the rights of the relevant Operators of services to suspend or freeze operations or take any other measures under the relevant Schedules.

9.6. The Account may be closed in the event of repeated breaches of these Terms, provision of inaccurate data, circumvention of restrictions, non-compliance with AML/sanctions requirements or failure to return mistakenly received funds. Obligations of the parties that arose prior to closure shall remain in force.

10. Refunds and chargebacks

10.1. Refunds are possible in limited cases, in particular:

  • the Operator has refused to execute the Order or Instruction for compliance reasons;

  • execution of the Order or Instruction is objectively impossible;

  • in other cases expressly provided for in the relevant Schedule.

10.2. Refunds are generally made using the same method as the original payment, net of non-recoverable costs.

10.3. In the event of a chargeback or reversal of a bank payment, the Operator may recover from the Customer the equivalent of the disputed amount and associated costs, set off such amounts against future payouts, and suspend operations on the Account until the dispute is resolved.

10.4. Chargebacks and reversals do not apply to outbound transfers of digital assets from the Balance executed upon a Customer Instruction under Schedule 3, since such transfers constitute the performance of an individual instruction of the Customer and are not payment operations within the meaning of card-scheme rules; blockchain operations are irreversible.

11. Risks and absence of investment advice

11.1. The Platform and the materials it contains do not constitute investment, financial or legal advice.

11.2. A detailed description of risks is set out in Annex 1 “Risk Warning”.

11.3. The Customer confirms having read Annex 1 and accepts the risks set out therein, including the specific risks relating to stablecoins and digital assets that are not issued in accordance with Regulation (EU) 2023/1114 (MiCA), as well as risks relating to the storage of assets.

12. Personal data and cookies

12.1. Personal data is processed in accordance with the Privacy Policy, which is published on the website as a separate document in accordance with the requirements of the GDPR.

12.2. The use of cookies and similar technologies is governed by the Cookie Policy.

12.3. X AURA acts as the controller of personal data processed in connection with the operation of the Platform. The Operators, payment providers, banks, verification providers and other contractors act as independent controllers or processors, as determined by law and the relevant contract.

12.4. To fulfil their obligations, the Operators and X AURA may share personal data with each other and with third parties strictly to the extent necessary, in compliance with the GDPR.

13. Intellectual property

13.1. The site, design, content, software and databases of the Platform are the intellectual property of X AURA LTD or are used by it under licence.

13.2. The Customer is granted a limited, non-exclusive, revocable licence to access and use the Platform for personal (non-commercial) purposes in accordance with these Terms.

13.3. Copying, modification, reverse engineering, or resale of access to the Platform without X AURA’s written consent is prohibited.

14. Limitation of liability and warranties

14.1. The Platform is provided on an “as is” and “as available” basis.

14.2. To the extent permitted by applicable law, X AURA and the Operators are not liable for:

  • indirect, incidental or consequential losses or loss of profit;

  • Customer errors in address, network or memo/tag input, or loss of access to wallets, keys or devices;

  • failures or delays of third parties (banks, payment providers, blockchain networks, exchanges) or force majeure;

  • the consequences of the Customer’s use of third-party services and counterparties.

14.3. Nothing in these Terms limits the rights of the Customer under mandatory consumer-protection law.

15. Notices and communications

15.1. Legally significant and operational notices may be sent to the e-mail address associated with the Account and/or shown in the Account interface.

15.2. A notice is deemed received at the moment of sending or posting.

15.3. The Customer shall keep contact details in the Account up to date.

16. Changes to the Terms

16.1. The current version of these Terms is published on buycoin.online.

16.2. Material changes are notified to the Customer through the Account interface and/or by e-mail, with a request for re-acceptance.

16.3. Continued use of the Platform following the effective date of an updated version constitutes acceptance of it.

17. Governing law and jurisdiction of the Master Agreement

17.1. This Part A (Master Agreement) is governed by the laws of the Republic of Cyprus.

17.2. Any dispute arising out of Part A is subject to the exclusive jurisdiction of the competent courts of Nicosia, Republic of Cyprus.

17.3. The law and jurisdiction applicable to each category of services (Schedules 1, 2 and 3) are determined by the relevant Schedule and may differ from the law of the Master Agreement.

18. Final provisions

18.1. If any provision of these Terms is held invalid, the remaining provisions shall remain in force.

18.2. The electronic form of these Terms has the same legal effect as a paper document.

18.3. All Schedules (1, 2, 3) and Annexes (1–4) form an integral part of these Terms.

PART B — SERVICE SCHEDULES

Each Schedule below forms an integral part of a single legal instrument with the Customer, accepted through acceptance of the Master Agreement (Part A). Each Schedule is governed by the law of its Operator of services.

SCHEDULE 1 — EXCHANGE OF FIAT CURRENCY AND DIGITAL ASSETS

Party to Schedule 1

Operator of services

Buycoin Sp. z o.o.

Registered address

Powązkowska 42/U8, Warsaw, Poland, 01-979

Registration numbers

KRS 0001030638, NIP 5252951861, REGON 525035390

VASP register

RDWW-718

Governing law

Republic of Poland

1. Scope of services

1.1. Buycoin Sp. z o.o. (hereinafter — “Buycoin”) provides the Customer with the following services:

  • exchange of fiat currency for a digital asset (purchase of a digital asset for fiat funds);

  • exchange of a digital asset for fiat currency (sale of a digital asset for fiat funds).

1.2. The list of supported assets is shown in the Platform interface before Order confirmation and may be updated.

1.3. Certain technical stages of processing digital assets and fiat payments may be performed by affiliated or third-party providers; this does not affect Buycoin remaining the Customer’s counterparty under this Schedule.

2. Registration, access and KYC/AML

2.1. Access to Buycoin’s services is granted after Account creation and successful identification under Section 5 of Part A.

2.2. Travel Rule applies to transfers of an amount equivalent to EUR 1,000 or above; for self-hosted addresses, proof of control may be required.

3. Order placement and execution

3.1. The Rate is fixed upon Buycoin’s actual receipt of the Customer’s payment.

3.2. Prior to fixation, displayed values are indicative and may vary due to market volatility.

3.3. Payment details and timing are shown in the Order interface. Once paid, the Order cannot be cancelled; blockchain transfers are irreversible.

3.4. The Customer must specify a correct address, network and any other required details (e.g. tag/memo). Errors in details or in the network may result in irretrievable loss of funds.

3.5. Indicative execution timelines:

  • fiat → digital asset: after actual receipt of fiat funds and completion of checks, Buycoin sends the digital asset, typically within 1 business day;

  • digital asset → fiat: after receipt of the digital asset and completion of checks, Buycoin initiates the fiat payout, typically within 1 business day; the actual crediting time depends on banks and payment providers;

  • if the operation is moved to manual review, execution is suspended for the duration of the review.

3.6. Fiat-payment processing depends on banks’ working days and hours. Payments received outside working hours are deemed received on the next business day.

4. Specific rules for fiat operations

4.1. Return-to-Source. Fiat payouts are made only to the same payment instrument or account from which the payment was received, save where otherwise required by law or by payment-system rules.

4.2. Name matching. The name of the payer (or the company name) on the fiat payment must match the data in the Customer’s Account.

4.3. Multi-currency accounts. Where credit or payout takes place in a currency other than the Customer’s account currency, conversion is performed by the relevant bank/provider at its rate and rules.

4.4. Customer payment-card data is not stored by Buycoin; payments are processed through secure third-party gateways.

5. Fees, limits and payouts

5.1. Buycoin’s fees may be embedded in the Rate and/or shown as a separate line item before Order confirmation.

5.2. Network fees, minimum and maximum amounts, and other parameters are shown before Order confirmation.

5.3. Specific fees and limits are displayed in the Platform interface before Order confirmation.

6. Refunds and refusal of service

6.1. Refunds are possible in the cases provided for in Section 10 of the Master Agreement.

6.2. Chargebacks and reversals. In the event of a chargeback or reversal of a bank payment, Buycoin may recover from the Customer the equivalent of the disputed amount, set it off against future payouts and recover associated costs.

6.3. Right to refund for prolonged execution. If execution of a confirmed Order is delayed for more than 5 business days after receipt of payment by Buycoin for reasons attributable to Buycoin, the Customer may request a refund. This provision does not apply where the delay is caused by:

  • a lawful freeze under Section 9 of the Master Agreement;

  • requests or reviews by competent authorities;

  • incomplete or incorrect Customer data or documents;

  • incorrect details, networks or addresses;

  • external failures of banks, providers or networks.

7. Right of withdrawal (consumer-protection aspect)

7.1. By confirming an Order, the Customer expressly requests its immediate performance and acknowledges that, in accordance with Article 16(1)(a) of Directive 2011/83/EU, the Customer loses the 14-day right of withdrawal from the contract from the moment performance begins.

7.2. In addition, in accordance with Article 16(1)(b) of Directive 2011/83/EU, the right of withdrawal does not apply to contracts the price of which depends on fluctuations in the financial market beyond the trader’s control and which may occur within the withdrawal period. The exchange of fiat currency for digital assets and of digital assets for fiat currency, as carried out by Buycoin under this Schedule, is a contract of that type.

8. Suspension, freezing and termination

8.1. Buycoin applies the procedures set out in Section 9 of the Master Agreement.

9. Governing law and jurisdiction

9.1. This Schedule 1 is governed by the laws of the Republic of Poland.

9.2. All disputes shall be submitted to the competent courts of the Republic of Poland at the place of Buycoin Sp. z o.o.

9.3. Mandatory provisions of Polish and EU consumer-protection law apply irrespective of the foregoing.

10. Final provisions of Schedule 1

10.1. In the event of a conflict between this Schedule and the Master Agreement regarding the specifics of Buycoin’s services, this Schedule shall prevail.

SCHEDULE 2 — EXCHANGE OF DIGITAL ASSETS FOR DIGITAL ASSETS (SWAPS)

Party to Schedule 2

Operator of services

3-102-952896, S.R.L.

Trading name

“Monocrypt”

Registration details

CE-2026-240463

Jurisdiction of registration

Republic of Costa Rica

Governing law

Republic of Costa Rica

1. Acceptance of Schedule

1.1. By submitting an Order to exchange one digital asset for another through the Platform, the Customer confirms acceptance of this Schedule 2.

1.2. Common rules (KYC/AML, Travel Rule, suspension, freezing) are set out in Part A and apply mutatis mutandis.

2. Definitions (specific)

  • “Swap” — exchange of one digital asset for another.

  • “Source Asset” — the digital asset the Customer sends to Monocrypt (or which is debited from the Customer’s Balance).

  • “Target Asset” — the digital asset the Customer receives as a result of the Swap.

  • “Network Confirmations” — the minimum number of blockchain confirmations required to fix the operation.

3. Scope of services and agency model

3.1. Monocrypt provides crypto-to-crypto exchange services (including operations involving USDT). Fiat operations are not performed under this Schedule.

3.2. A Swap may be initiated:

  • in the classic way — the Customer sends the Source Asset to a Monocrypt transit address and receives the Target Asset at an address provided by the Customer; or

  • using the Balance — the Source Asset is debited from the Customer’s Balance (Schedule 3) and the Target Asset is credited to the Balance or sent to an external address chosen by the Customer.

3.3. Customer’s agent (limited mandate). On the Customer’s instruction, Monocrypt acts as the Customer’s agent solely for the execution of a specific Order and may:

  • exchange digital assets using available liquidity;

  • receive the Source Asset and/or the Target Asset to its transit wallets and send the Target Asset to the address provided by the Customer;

  • where necessary for execution of the Order — send or receive intermediate assets to/from other providers or counterparties.

3.4. The agency mandate is limited to the specific Order.

4. Order and rate fixation

4.1. Indicative Rate values are displayed to the Customer before assets are sent.

4.2. The Rate is fixed once Monocrypt has received the Source Asset (or after debit from the Customer’s Balance) and the required number of Network Confirmations is reached.

4.3. Prior to fixation, the actual amount of the Target Asset may differ due to market volatility.

4.4. The details for sending the Source Asset are provided by Monocrypt in the Order; the Customer must send assets strictly to those details.

4.5. The details for receiving the Target Asset are entered by the Customer when creating the Order. The accuracy of these details is the sole responsibility of the Customer.

5. Execution, cancellation, return

5.1. Non-cancellable. After the Customer has sent the Source Asset or has confirmed a debit from the Balance, cancellation is not possible.

5.2. Timelines. After the required confirmations and AML/sanctions checks, Monocrypt executes the Swap and sends or credits the Target Asset without undue delay, typically within 1 business day.

5.3. Asset return. In exceptional cases, returns are sent to the source address net of network fees, where this is technically feasible and not prohibited by law or sanctions.

5.4. Address accuracy. The Customer is solely responsible for the accuracy of details for receiving the Target Asset.

6. Fees and limits

6.1. Fees may be embedded in the Rate and/or shown as a separate line item before Order confirmation.

6.2. Specific fee parameters are displayed in the Platform interface before Order confirmation.

7. KYC/AML, Travel Rule and data processing

7.1. Access to services is granted after successful KYC under Section 5 of the Master Agreement.

7.2. Monocrypt may request additional documents, suspend or block the Account and/or freeze assets during a review.

7.3. Travel Rule applies to transfers of an amount equivalent to EUR 1,000 or above.

8. Restrictions and prohibitions

8.1. Services are unavailable to persons in the jurisdictions listed in Annex 3.

8.2. Prohibited purposes and services are set out in Annex 4.

8.3. The service is available to persons aged 18 or over.

8.4. Monocrypt may refuse to provide service without stating reasons in cases provided for in clause 9.4 of the Master Agreement.

9. Risks and legal status of the service

9.1. Operations involving digital assets are subject to significant risks. For details, see Annex 1.

9.2. Services are provided under the law of the Republic of Costa Rica.

9.3. The Customer is solely responsible for its tax obligations.

10. Limitation of liability

10.1. Services are provided on an “as is” and “as available” basis.

10.2. To the extent permitted by applicable law, Monocrypt is not liable for indirect or incidental losses.

11. Governing law and jurisdiction

11.1. This Schedule 2 is governed by the law of the Republic of Costa Rica.

11.2. All disputes shall be submitted to the competent courts of the Republic of Costa Rica at the place of the Operator of services.

12. Final provisions of Schedule 2

12.1. In the event of a conflict between this Schedule and the Master Agreement regarding the specifics of Monocrypt’s services, this Schedule shall prevail.

SCHEDULE 3 — STORAGE OF DIGITAL ASSETS AND EXECUTION OF OUTBOUND TRANSFERS UPON CUSTOMER INSTRUCTION

Party to Schedule 3

Operator of services

3-102-952896, S.R.L.

Trading name

“Monocrypt”

Registration details

CE-2026-240463

Jurisdiction of registration

Republic of Costa Rica

Governing law

Republic of Costa Rica

1. Scope of services

1.1. Monocrypt provides the Customer with the following services:

  • acceptance of digital-asset deposits to the Customer’s Balance;

  • storage of the Customer’s digital assets within Monocrypt’s infrastructure;

  • maintenance of the Balance ledger;

  • execution of Customer Instructions for outbound transfers of digital assets from the Balance — both to the Customer’s own addresses and to third-party addresses indicated by the Customer.

1.2. Services under this Schedule do not include fiat operations (Schedule 1) or swaps (Schedule 2). The Customer may, at its discretion, use the Balance as the source of the Source Asset for a Swap under Schedule 2.

2. Legal nature of the service

2.1. Under this Schedule, Monocrypt acts solely as a holder of assets and a technical executor of Customer Instructions.

2.2. Monocrypt expressly does not act as:

  • a payment institution or an electronic-money institution;

  • an acquirer or a processor of card payments;

  • an entity subject to card-scheme rules (Visa/Mastercard scheme rules);

  • merchant-of-record in respect of any third party;

  • an agent, representative or fiduciary of any recipient of a transfer (including the Customer’s commercial partners, online services or merchants).

2.3. An outbound transfer of a digital asset from the Balance to an address specified by the Customer is solely the execution of an individual Customer Instruction. The Customer alone makes the decision to effect the transfer, determining its recipient, purpose, timing and amount.

2.4. Where the details of a future transfer are pre-populated for the Customer in the form of a Payment Request generated by a third party, the legal characterisation of the operation does not change: Monocrypt acts solely on the basis of the Customer’s confirmation of the Payment Request (the Customer Instruction), and not on the basis of the Payment Request itself. A Payment Request is not an instruction to Monocrypt, does not by itself bind Monocrypt and does not create any contractual relationship between Monocrypt and the third party that generated it.

2.5. Where the Customer uses the outbound-transfer functionality to perform obligations toward third parties (in particular, to pay for goods, services or for other purposes in dealings with commercial services), the Customer acknowledges that:

  • such legal relations exist solely between the Customer and the relevant third party;

  • Monocrypt is not a party to such legal relations;

  • Monocrypt is not responsible for the conduct of the third party, the delivery of goods, the provision of services, their quality, their conformity with the Customer’s expectations, or the performance of any other obligations of the third party toward the Customer;

  • Monocrypt does not accept or handle the Customer’s complaints regarding goods or services of the third party; such complaints are settled by the Customer directly with the third party.

3. Acceptance of deposits and Balance top-up

3.1. The Customer tops up the Balance by sending a digital asset to a unique deposit address or wallet assigned by Monocrypt in the Customer’s profile.

3.2. Crediting to the Balance occurs after:

  • receipt of the asset at the deposit address;

  • the required number of network confirmations is reached;

  • completion of AML/sanctions checks (Travel Rule, blockchain analytics, screening against the list in Annex 4).

3.3. Deposits from addresses or services prohibited by Annex 4, or from suspicious sources, may be frozen, moved to manual review, or returned (where technically feasible) net of network costs.

3.4. A deposit received in a network or token standard other than that designated for the relevant address may be impossible to credit or recover. The Customer alone verifies the correct network and token format before sending.

4. Storage of assets

4.1. The Customer’s digital assets are held within the infrastructure of Monocrypt and its technology partners.

4.2. Monocrypt applies security measures proportionate to the nature and scale of the service. Specific technical solutions may be reviewed by Monocrypt in the interests of security without prior consent of the Customer.

4.3. Customer assets are recorded separately from Monocrypt’s own assets. Customer assets are not the property of Monocrypt and do not form part of its estate in the event of insolvency.

4.4. Storage of assets on the Balance may be subject to fees; such fees (if any) are determined by the Tariff available before operation confirmation.

5. Execution of outbound transfers upon Customer Instruction

5.1. The Customer may initiate an outbound transfer of a digital asset from the Balance to:

  • the Customer’s own external address (withdrawal of an asset); or

  • a third-party address indicated by the Customer or shown in a Payment Request that the Customer is reviewing.

5.2. The Customer creates an Instruction through the Platform interface in one of the following ways:

  • (a) Manual entry of details. The Customer enters the recipient details (address, network, memo/tag where required) and the transfer amount, and then confirms the operation.

  • (b) Confirmation of a Payment Request. The Customer reviews a Payment Request shown in the Platform interface and generated by a third party (e.g. a commercial service in respect of which the Customer is considering the performance of its obligations), with the recipient details and the amount pre-populated; the Customer may confirm or decline the Payment Request.

5.3. Legal nature of a Payment Request:

  • a Payment Request is an informational message about payment details and is not an instruction to Monocrypt; in itself, it does not create any obligation on Monocrypt to debit funds from the Customer’s Balance or to effect a transfer;

  • until the Customer confirms the Payment Request, Monocrypt takes no action with the Customer’s Balance on the basis of the Payment Request;

  • only confirmation of the Payment Request by the Customer in the Platform interface creates a Customer Instruction; that Instruction is the basis on which Monocrypt executes the transfer;

  • the Customer alone verifies the details of the Payment Request, assesses whether to pay and consciously decides whether to confirm or decline;

  • the Customer may decline a Payment Request or simply not confirm it; in that case, no outbound transfer is executed and no funds are debited from the Balance.

5.4. A Payment Request may have a limited validity period set by the third party that generated it. If the Customer does not confirm it within that period, the Payment Request lapses; to make the payment, the Customer may approach the relevant third party again for a new Payment Request.

5.5. If the third party has changed details in the Payment Request, the interface displays the up-to-date values; the Customer shall verify them before confirmation. The Customer’s confirmation relates to those details that were displayed to the Customer at the time of confirmation.

5.6. A confirmed Instruction (under either clause 5.2(a) or clause 5.2(b)) is unequivocal, single-use and revocable only until the moment its execution begins (broadcast of the transaction into the relevant blockchain network).

5.7. Monocrypt executes the Customer’s Instruction without assessing the commercial terms of the Customer’s relationship with the recipient, without verifying the purpose of the transfer, and without participating in settlements between the Customer and the recipient. The fact that the details of the Instruction were pre-populated in a Payment Request by a third party does not change the legal nature of the operation: Monocrypt acts solely on the basis of the Customer Instruction.

5.8. Execution of the Instruction may be delayed, suspended or declined in the event of:

  • adverse signals from AML or sanctions checks in respect of the recipient address (including blockchain-analytics data);

  • identification of the recipient or the circumstances of the transfer as relating to prohibitions under Annex 4;

  • requests from competent authorities or requirements of partners;

  • other grounds set out in Section 9 of the Master Agreement.

5.9. Irreversibility. Once execution of the Instruction has begun (broadcast of the transaction into the network), the transfer cannot be cancelled or recalled by Monocrypt; blockchain operations are final.

5.10. The Customer is fully responsible for the accuracy of recipient details — both those entered manually and those contained in a Payment Request the Customer has confirmed. An error in details or confirmation of a Payment Request with incorrect details will lead to irretrievable loss of funds; Monocrypt is not liable for such errors.

6. Chargebacks and refunds

6.1. The acceptance of deposits and the execution of outbound transfers under this Schedule are not payment operations within the meaning of card-scheme rules; the chargeback mechanism does not apply to them.

6.2. Where the Customer has made an outbound transfer to the address of a third party in performance of its obligations (in particular, in payment for goods or services) and considers that the third party has failed to perform its obligations toward the Customer, the Customer settles the matter directly with the third party. Monocrypt does not refund transfers executed on a Customer Instruction.

6.3. Refunds are possible only where the Instruction was not executed or was executed with an error attributable to Monocrypt; refunds are made within the scope of Section 10 of the Master Agreement.

7. Service fees

7.1. Storage and outbound-transfer services are subject to fees; such fees are determined by the Tariff shown before operation confirmation.

7.2. Network fees are borne by the Customer and are deducted from the transfer amount or from the Balance, depending on the network and settings.

8. KYC/AML, Travel Rule, monitoring

8.1. Access to the services under this Schedule is granted after successful KYC under Section 5 of the Master Agreement.

8.2. Outbound transfers of an amount equivalent to EUR 1,000 or above are subject to Travel Rule requirements.

8.3. Monocrypt carries out ongoing monitoring of Balance operations and may apply additional restrictions to Customers with an elevated risk profile, including per-transaction and aggregate transfer limits.

8.4. Deposits and transfers to/from addresses identified by blockchain analytics as belonging to services listed in Annex 4 are blocked in full.

9. Inactivity of the Account and closure

9.1. In the event of prolonged Customer inactivity (no login to the Account for 24 consecutive months), Monocrypt may apply additional measures in respect of the Balance, including enhanced re-verification requirements before any subsequent operations are executed.

9.2. Upon closure of the Account, Monocrypt offers the Customer the opportunity to withdraw the remaining Balance to an external address. If withdrawal is impossible due to acts or omissions of the Customer, the remaining Balance is dealt with in accordance with the applicable law of the Republic of Costa Rica.

9.3. In the event of death of a Customer who is a natural person, the Balance is transferred to the lawful heirs upon confirmation of their rights under the law applicable to succession and completion by them of the KYC procedure.

10. Storage and outbound-transfer risks

10.1. The risks set out in Annex 1 apply to the services of this Schedule, with the following additional aspects:

  • dependence on the infrastructure of Monocrypt and its technology partners;

  • risks relating to the storage of assets (including technological incidents affecting Monocrypt’s keys and wallets);

  • operational risks (delays, interface errors, technical failures).

10.2. Assets in storage are not covered by deposit-insurance schemes or investor compensation funds of the EU or other jurisdictions.

11. Suspension and freezing of the Balance

11.1. The rules of Section 9 of the Master Agreement apply.

11.2. In addition, Monocrypt may freeze the Balance in whole or in part on reasoned AML or sanctions grounds, source-of-funds checks, or in connection with identified suspicious operations.

12. Governing law and jurisdiction

12.1. This Schedule 3 is governed by the law of the Republic of Costa Rica.

12.2. All disputes shall be submitted to the competent courts of the Republic of Costa Rica at the place of the Operator of services, unless otherwise provided for by a separate arbitration agreement between the parties.

13. Final provisions of Schedule 3

13.1. The electronic form of this Schedule has the same legal effect as a paper document.

13.2. In the event of a conflict between this Schedule and the Master Agreement regarding the specifics of storage and execution of Instructions, this Schedule shall prevail.

PART C — ANNEXES

Annexes 1–4 below form an integral part of these Terms. They may be updated independently; current editions are published on buycoin.online.

ANNEX 1 — RISK WARNING

1. General

Use of the Platform and the services of its Operators (the “Services”) is undertaken solely at the Customer’s risk.

Digital-asset markets are volatile and carry specific technological and legal risks.

This document does not constitute investment advice, a recommendation, an offer or an invitation to enter into transactions.

2. Market risks

  • Price swings and loss of value. Prices of digital assets can change rapidly; partial or total losses are possible.

  • Liquidity. Temporary lack of liquidity may make it impossible to execute an operation at an expected price.

  • Pegged assets. Assets marketed as “pegged” to a reference may temporarily deviate from the target value.

3. USDT and the MiCA Regulation — additional risks

  • EU regulatory context. In the EU, asset-referenced and e-money tokens are governed by MiCA (Regulation (EU) 2023/1114). USDT is not offered as a token issued under MiCA.

  • No traditional protections. USDT is not a bank deposit and is generally not covered by EU deposit-insurance schemes.

  • Reliance on the issuer and reserves. The stability of USDT depends on the issuer’s policies and the quality/structure of its reserves.

  • Operational constraints. Issuer and venue requirements may affect the timing of operations.

  • Address blocking. Issuers or venues may block or freeze specific addresses for compliance reasons.

4. Blockchain-transaction risks

  • Irreversibility of blockchain transfers.

  • Errors in address, network or memo/tag may cause permanent loss of funds.

  • Network congestion may cause delays and increases in fees.

  • Incompatibility of networks, tokens or address formats.

  • Cross-chain and bridge protocols carry additional risks.

  • Tokens of the same name on different networks are not compatible (ERC-20, TRC-20, BEP-20).

5. Technological and cyber risks

  • Compromise, phishing and malware may cause losses.

  • Loss of private keys, seed phrases or devices results in total loss of the Customer’s self-hosted assets.

  • Failures of third parties may cause delays.

6. Storage risks

  • Assets on the Balance are held within Monocrypt’s infrastructure; their availability depends on Monocrypt’s operational continuity and security.

  • Technological incidents affecting the holder’s keys or wallets may affect access to assets.

  • Assets in storage are not covered by deposit-insurance schemes or compensation funds.

  • Movement of funds between storage and external wallets may be temporarily restricted for security reasons.

7. Legal and compliance risks

  • Regulatory changes may affect availability of services and the value of assets.

  • AML, sanctions and Travel Rule checks may cause delays and temporary freezes.

  • Outside the MiCA framework and traditional finance, there are no mandatory state guarantees of value preservation.

8. Third-party services and counterparties

  • Exchanges, wallets, payment providers and other suppliers operate independently.

  • Delistings and suspensions of deposits/withdrawals may affect timing.

  • Fraudulent sites, bots and “helpers” pose a risk; the Customer assesses their reliability independently.

  • Payments made by the Customer to third-party addresses (commercial services, merchants, other users) are a matter of the Customer’s trust in those third parties; the risk of non-performance by third parties is borne by the Customer.

9. Customer’s obligations

The Customer confirms that they:

  • verify the address, network, memo/tag and other details before sending assets and before confirming Instructions;

  • protect their devices, e-mail, authentication factors;

  • comply with the laws of their jurisdiction (including tax);

  • understand and accept the risks described herein, including storage risks and the specifics of USDT outside the MiCA framework;

  • independently assess the reliability of third parties to whose addresses the Customer makes transfers from the Balance.

10. Limitation of liability

The Operators of the Platform do not warrant error-free operation of networks or providers, price stability or preservation of asset value, and are not liable for:

  • indirect or consequential losses or loss of profit;

  • Customer errors in address, network or memo/tag, or loss of access to wallets;

  • delays or failures of providers or networks, and force majeure;

  • consequences of the Customer’s use of third-party services and counterparties;

  • acts or omissions of third parties to whose addresses the Customer has made a transfer pursuant to their Instruction.

Mandatory consumer-protection rules are not limited by this section.

11. Updates and acceptance

11.1. Annex 1 may be updated; the current version is published on the website.

11.2. By using the Services, the Customer confirms having read this Annex and accepted the risks described herein.

ANNEX 2 — COMPLAINTS HANDLING POLICY

1. Scope

This Policy sets out the procedure for submitting and handling complaints relating to the Platform and the services of its Operators (X AURA LTD, Buycoin Sp. z o.o., Monocrypt, and engaged providers).

2. How to submit a complaint

Complaints may be submitted to info@buycoin.online. Each complaint should include:

  • the Customer’s full name and the e-mail linked to the Account;

  • Order/Instruction ID, date and time, assets, amount;

  • a description of the issue and circumstances;

  • the resolution the Customer proposes;

  • supporting materials.

Support hours: 10:00–18:00 (CET/CEST), on business days.

The complaints procedure is free of charge.

Complaints may be submitted in Ukrainian, English, Polish and Russian.

3. Actions upon receipt

  • Acknowledgement of receipt — within 2 business days.

  • Registration and routing.

  • Where necessary — a request for additional information.

4. Handling stages

  • Acknowledgement of receipt (2 business days).

  • Review and response — within up to 30 business days.

  • Re-review — based on additional arguments submitted.

  • Final response.

5. Timelines

The target time for a final response is 30 business days.

Where objectively necessary, the period may be extended to 90 business days with notice to the Customer.

The period may be paused while awaiting information from the Customer.

6. If the Customer is not satisfied

The Customer may apply to a certified out-of-court dispute resolution body in the EU in accordance with applicable consumer-protection law and Article 21 of Regulation (EU) 2022/2065 (DSA).

7. Complaint records

Records are kept for at least 5 years from receipt.

8. Confidentiality and data protection

Data is processed in accordance with the GDPR and the Privacy Policy.

9. Operators’ commitments

The Operators handle complaints objectively and impartially.

10. Updates

The current version is published on the website.

ANNEX 3 — LIST OF PROHIBITED COUNTRIES AND TERRITORIES

1. Scope

The Platform does not provide services to persons who:

  • are located, resident or registered in the jurisdictions listed below;

  • use payment instruments issued in such jurisdictions;

  • act on behalf of persons from such jurisdictions;

  • are subject to applicable sanctions regimes.

2. Prohibited countries

Afghanistan, Bahamas, Barbados, Botswana, Cambodia, Ghana, Iran, Iraq, Jamaica, Democratic People’s Republic of Korea (DPRK), Mauritania, Mauritius, Martinique, Mozambique, Myanmar, Nicaragua, Pakistan, Panama, Belarus, Russian Federation, Syria, Trinidad and Tobago, Uganda, Vanuatu, Yemen, Zimbabwe, Samoa, American Samoa, British Virgin Islands, U.S. Virgin Islands, Guam, Libya, State of Palestine, Puerto Rico, Somalia, Northern Mariana Islands, United States of America, Sudan, South Sudan, Western Sahara, Kosovo, Venezuela, Albania, Burkina Faso, Cayman Islands, Cuba, Republic of the Congo, Democratic Republic of the Congo, Gibraltar, Haiti, Jordan, Kenya, Lebanon, Mali, Morocco, Nigeria, Senegal, United Republic of Tanzania, United Kingdom.

3. Occupied / non-recognised territories

Autonomous Republic of Crimea, temporarily occupied territories of the Donetsk, Luhansk, Kherson and Zaporizhzhia regions of Ukraine, Pridnestrovian Moldavian Republic, Nagorno-Karabakh / Republic of Artsakh, Republic of Abkhazia, Republic of South Ossetia, Turkish Republic of Northern Cyprus, Sahrawi Arab Democratic Republic.

4. Notes

  • Restrictions apply to all services (Schedules 1, 2, 3).

  • Individual Operators may impose additional restrictions; the stricter regime applies.

  • The Platform may block or suspend operations upon detection of breaches.

5. Updates

The list may change; the current edition is published on the website.

ANNEX 4 — PROHIBITED AND UNSUPPORTED SERVICES

1. Scope

This list applies to the entire buycoin.online Platform and to all Operators. It covers all operations (fiat–crypto, crypto–crypto, deposits, withdrawals, transfers from the Balance).

2. What is prohibited

Operations are prohibited where they involve, directly or indirectly, interaction with:

  • transaction-mixing services (mixers/tumblers);

  • darknet marketplaces and associated wallets/escrow;

  • sanctioned or high-risk exchanges, OTC venues, payment providers;

  • services/addresses linked to cybercrime, hacks, fraud, malware, ransomware;

  • services/addresses linked to terrorism or terrorist financing;

  • services/addresses linked to drug trafficking;

  • services/addresses linked to child exploitation;

  • fraudulent exchanges and illegal services;

  • services/addresses linked to stolen coins or illicit proceeds;

  • services/addresses listed on sanctions lists and/or on the negative lists maintained by our compliance and blockchain-analytics partners.

3. Services with which the Platform does not interact

The Platform and its Operators will not accept or send funds or digital assets from or to:

  • Garantex

  • Capitalist.net

  • Tornado Cash

  • Hydra

  • Blender.io

  • Lazarus Group

  • Genesis Market

  • ChipMixer

  • Sinbad.io

  • CommEx

  • Rapira.net

  • Trocador.app

  • Anonexch.io

  • Bitpapa

  • Nobitex

  • Grinex.io

  • Payeer.com

  • meer.kg

  • 1xBet

  • Aifory.pro

  • terminal.cash

  • SkyCrypto.net

  • FlashObmen.com

  • 60cek.net

  • hd-change.com

  • CoinBlinker.com

  • Metka.cc

  • AlfaBit.org

  • Heleket

  • Bitzlato

  • netex24.net

  • BTC-e / FinCEN

This list may be expanded without prior notice. Inclusion of a service means a strict prohibition on any operations with it.

4. Consequences and measures

  • Blocking or freezing of payments, assets and access to operations for up to 30 business days, extendable to 90 business days.

  • Requests for additional verification, documents or source-of-funds explanations.

  • Refusal of service; where technically feasible, return net of network costs.

  • Notification of competent authorities in accordance with the law.

5. Technical and compliance basis

  • EU/UN/OFAC lists, internal policies, partner requirements, blockchain-analytics data.

  • Proof of control over self-hosted addresses and additional information for Travel Rule and AML/CTF purposes.

6. Updates

The list is regularly reviewed. Where restrictions diverge, the stricter regime applies.

FINAL PROVISIONS AND SEPARATE DOCUMENTS

This document (“Customer Terms”) constitutes a consolidated legal instrument that the Customer accepts by a single action upon registration or upon the first order following a new edition.

The following documents are published as separate files on buycoin.online and form part of the legal relations between the Customer, X AURA LTD and the Operators of services (Buycoin Sp. z o.o., Monocrypt):