Compliance

Version 1.1 Date: 16 February 2026 Jurisdiction: Republic of South Africa

Bro Cabs (Pty) Ltd (“Bro Cabs” or “the Company”) is a South African technology platform facilitating connections between independent drivers and riders for transportation services. The Company operates strictly as a technology intermediary and does not directly provide transport services. This document outlines regulatory, financial, operational, cybersecurity, and anti-fraud compliance controls relevant to banking institutions and payment processors.

Legal Entity: Bro Cabs (Pty) Ltd Registration: Registered with CIPC(2025/129848/07) Jurisdiction: Republic of South Africa No undisclosed beneficial ownership The Company maintains statutory filings and annual returns.

Bro Cabs:

Does not own vehicles Does not employ drivers Does not act as a transport operator Does not store raw card data Does not operate as a bank Drivers are independent contractors compliant with NTLA requirements. Revenue streams include:

• Driver subscription fees

All drivers must:

Be 21 years or older Hold valid South African driver’s license Hold Professional Driving Permit (PrDP) Hold valid NTLA operating permit Maintain roadworthy vehicles Maintain required insurance Documentation is verified at onboarding. Non-compliance results in suspension.

Bro Cabs does not operate as a financial institution but implements the following safeguards:

Government-issued ID verification License validation Permit verification Bank account validation for payouts

Mobile verification Card verification through payment gateway Fraud pattern monitoring

Wallet freezing ability Transaction monitoring Chargeback review process Account suspension for irregular behavior

Bro Cabs ensures:

PCI-DSS compliant payment gateway integration Tokenized card storage No storage of CVV data Encrypted HTTPS transmission Secure API connections All card data is processed via certified third-party providers. The Company does not store raw payment credentials.

Controls include:

Pre-trip authorization (where enabled) 3D Secure support Dispute documentation retention Trip logs and GPS evidence Driver and rider history tracking The Company cooperates fully with gateway fraud investigation procedures.

The Bro Wallet:

Is a stored value mechanism Is not a deposit-taking facility Does not accrue interest Is not a substitute for banking Funds are held via regulated payment partners. Higher transaction thresholds may trigger enhanced KYC.

Security measures include:

Encrypted databases Secure cloud infrastructure Access control protocols Role-based permissions Activity logging Password encryption Firewall protection

Bro Cabs complies with the Protection of Personal Information Act (POPIA). Controls include:

• Data minimization
• Secure storage
• Consent mechanisms
• Data subject access procedures
• Secure third-party integrations
• Personal data is not sold to any third party.

All disputes are subject to:

Mediation Binding arbitration (AFSA rules, Johannesburg)

The Company’s liability is contractually capped. Drivers and riders indemnify:

• Bro Cabs
• Its directors
• Its officers
• Its investors
• Its technology partners

The Platform includes:

Trip tracking SOS functionality Emergency routing integration Bro Cabs is not an emergency service provider.

Where applicable:

Zero-rating is provided via telecom partners Subject to telecom network availability Does not alter regulatory or financial obligations

The Company maintains risk oversight across:

Fraud Chargebacks Regulatory change Platform uptime Driver compliance Financial liquidity

Bro Cabs affirms:

It does not facilitate illegal transactions It does not operate as an unlicensed financial institution It implements reasonable fraud controls It ensures driver regulatory compliance It complies with South African laws The Company welcomes enhanced due diligence procedures.