Legal and compliance

1.1 Operator

1.1.1 Sirius Consulting FZCO is a free zone company established in the United Arab Emirates and trading as Cosmos (trade licence number 43190, registered office The Bureau, Opera Grand, Downtown, Dubai, United Arab Emirates). Sirius Consulting FZCO, on behalf of itself and the Cosmos Group (being Sirius Consulting FZCO together with its Affiliates), publishes this page.

1.2 Defined terms

The following terms have the meanings set out below wherever they appear on this page.

Term. Definition‍

Affiliate. In relation to any entity, any other entity that directly or indirectly Controls, is Controlled by, or is under common Control with, that entity, where Control means the ownership of more than fifty per cent of the voting securities or the power to direct the management and policies of an entity.

ADGM. Abu Dhabi Global Market.

ADGM FSRA. The Abu Dhabi Global Market Financial Services Regulatory Authority.

Applicable Data Protection Law. All data protection and privacy laws applicable to the processing of Personal Data, including the UAE PDPL, the ADGM Data Protection Regulations 2021, the EU GDPR, the UK GDPR, the DPA 2018, PECR, and the PDPA.

Bribery Act. The UK Bribery Act 2010.

Complaints Procedure. The process set out in sections 11 to 19 of this page.

Cosmos Group. Sirius Consulting FZCO together with its Affiliates and subsidiaries.

Cosmos Personnel. All persons within the categories set out in section 2.1.3.

Data Subject. An identified or identifiable natural person to whom Personal Data relates.

DPA 2018. The UK Data Protection Act 2018.

EU GDPR. Regulation (EU) 2016/679.

FCPA. The US Foreign Corrupt Practices Act 1977.

ICO. The UK Information Commissioner's Office.

OECD Anti-Bribery Convention. The Organisation for Economic Co-operation and Development Convention on Combating Bribery of Foreign Public Officials in International Business Transactions.

Onboarding Flow. The guided intake process on the Website through which a prospective client submits information to Cosmos.

PDPA. The Singapore Personal Data Protection Act 2012, as amended.

PDPC. The Personal Data Protection Commission of Singapore.

Personal Data. Any information relating to an identified or identifiable natural person.

Privacy page. The Cosmos Group's privacy policy published at https://cosmos.global/privacy.

Services. The corporate services and compliance technology services offered by Cosmos.

UAE PDPL. UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

UK GDPR. The EU GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of the European Union (Withdrawal) Act 2018.

User. Any person who accesses or uses the Website.

Website. The website at https://cosmos.global and any associated pages operated by Cosmos.

2. Position and scope

2.1 Zero-tolerance commitment

2.1.1 Sirius Consulting FZCO, on behalf of itself and the Cosmos Group, adopts an absolute zero-tolerance position on bribery and corruption in all their forms. This commitment applies without geographic limitation, without exception based on local custom or practice, and without qualification by the scale or value of any proposed transaction.

2.1.2 No member of the Cosmos Group will engage in, permit, condone, or fail to report any act of bribery or corruption, whether in connection with dealings with public officials or in a commercial context between private parties, and whether the act is carried out directly by a Cosmos Group person or indirectly through a third party acting on behalf of the Cosmos Group.

2.1.3 This statement applies to:

(a) all directors, officers, employees, and secondees of any Cosmos Group entity;

(b) all consultants, contractors, freelancers, and agency workers engaged by any Cosmos Group entity;

(c) all agents, representatives, introducers, and joint venture partners acting on behalf of any Cosmos Group entity; and

(d) all third-party suppliers and service providers to the extent they act in connection with the Cosmos Group's business.

Persons within categories (a) to (d) are referred to in this page as Cosmos Personnel.

2.2 Business rationale

2.2.1 Bribery and corruption undermine the rule of law, distort markets, and erode public trust. The Cosmos Group is a technology-driven corporate services and compliance business: its product is predicated on helping clients meet their own regulatory obligations. Any involvement by the Cosmos Group in bribery or corruption would be fundamentally inconsistent with the business it is in, in addition to exposing the Cosmos Group and individuals within it to severe criminal and regulatory sanctions.

‍

3. Applicable laws

3.1 The Cosmos Group operates across multiple jurisdictions and is subject to a corresponding range of anti-bribery and anti-corruption laws. The principal instruments to which the Cosmos Group has regard are set out below. This list is not exhaustive; Cosmos Personnel operating in any jurisdiction must also comply with all other applicable local laws relating to bribery and corruption.

3.2 UK Bribery Act 2010

3.2.1 The Bribery Act creates four principal offences: bribing another person; accepting a bribe; bribing a foreign public official; and the failure of a commercial organisation to prevent bribery by a person associated with it. The corporate offence under section 7 of the Bribery Act is one of strict liability: a commercial organisation is guilty of the offence if a person associated with it pays a bribe to obtain or retain business or a business advantage for the organisation, unless the organisation can demonstrate that it had in place adequate procedures to prevent such conduct.

3.2.2 The Bribery Act has broad extraterritorial reach. It applies to any company incorporated in the United Kingdom, to any person performing services for or on behalf of such a company, and to any company (wherever incorporated) that carries on a business or part of a business in the United Kingdom.

3.3 US Foreign Corrupt Practices Act

3.3.1 The FCPA prohibits the payment of bribes to foreign government officials, political parties, or candidates for public office to obtain or retain business. The FCPA also imposes accounting and recordkeeping requirements on companies registered with the US Securities and Exchange Commission. The FCPA applies to US persons and entities, to companies listed on US exchanges, and to any person or entity that causes a corrupt act to take place within the United States or uses the US financial system in furtherance of a bribe.

3.3.2 Even where the FCPA does not apply as a matter of law, the Cosmos Group regards the standards it articulates as representing good international practice and incorporates equivalent standards into its procedures.

3.4 UAE Federal Decree-Law No. 31 of 2021

3.4.1 UAE Federal Decree-Law No. 31 of 2021, the Crimes and Penalties Law (as amended and supplemented), criminalises bribery of public officials and private-sector bribery in the United Arab Emirates. Articles 234 to 244 of the Crimes and Penalties Law set out a comprehensive framework of offences covering: the offer, promise, or giving of a bribe to a public official (whether UAE or foreign); the solicitation or acceptance of a bribe by a public official; the offering or acceptance of bribes in the private sector; and the facilitation or intermediation of bribery.

3.4.2 The UAE framework is enforced by the State Audit Institution and relevant federal and emirate-level prosecutors. Penalties include imprisonment and substantial financial penalties, as well as reputational and licensing consequences that could affect the Cosmos Group's ability to operate in the UAE.

3.5 OECD Anti-Bribery Convention

3.5.1 The OECD Anti-Bribery Convention is the principal multilateral instrument establishing standards for the criminalisation of foreign bribery. The Cosmos Group regards compliance with the spirit of the OECD Anti-Bribery Convention as part of its commitment to responsible global business conduct, irrespective of whether the Convention is directly enforceable against it in any given jurisdiction.

‍

4. Key definitions

4.1 Bribery

4.1.1 For the purposes of this page, bribery means the offer, promise, giving, acceptance, or solicitation of a financial or other advantage as an inducement to or reward for the improper performance of a function or activity, or to influence a decision made by a public official in the exercise of their official functions.

4.1.2 The advantage may take any form: cash, gifts, hospitality, entertainment, loans, services, employment opportunities, charitable donations, political contributions, or any other benefit of value to the recipient or a connected person. The advantage need not be of substantial monetary value; the key question is whether it is intended to influence behaviour in a way that is improper.

4.1.3 Bribery is prohibited regardless of whether it is directed at a public official or a private sector counterparty, and regardless of whether it is initiated by Cosmos Personnel or merely facilitated by them.

4.2 Facilitation payments

4.2.1 Facilitation payments (also called grease payments) are small, unofficial payments made to a public official to speed up or secure the performance of a routine governmental action to which the payer is already entitled. Examples include payments to customs officials to clear goods through customs, payments to obtain permits or licences that would otherwise be issued as of right, and payments to utility providers to obtain connections.

4.2.2 Facilitation payments are expressly prohibited by this page, regardless of their size or local prevalence. The Cosmos Group acknowledges that facilitation payments are commonplace in some of the markets in which it operates; this does not make them lawful under the laws applicable to the Cosmos Group, and it does not make them acceptable. Cosmos Personnel who are asked to make a facilitation payment must refuse and must report the request through the channels described in section 8.

4.2.3 Where a Cosmos Personnel member is in a situation where they believe that refusal to make a facilitation payment poses a genuine risk to personal safety, they should take whatever steps are necessary to ensure their safety and should report the matter to the General Counsel (or equivalent senior officer) as soon as it is safe to do so.

4.3 Gifts and hospitality

(b) verification of the business rationale for and proportionality of any commission or fee arrangement;

4.3.1 Legitimate and proportionate gifts, entertainment, and hospitality are a normal and lawful part of building business relationships. The Cosmos Group does not prohibit all gifts and hospitality; it requires that gifts and hospitality be reasonable in value, consistent with legitimate business purposes, transparent, and not given with the intent or effect of influencing a business or official decision improperly.

4.3.2 The following principles apply to all gifts and hospitality:

(a) Gifts and hospitality must be consistent with the reasonable and proportionate standards of the industry and jurisdiction in which the relevant relationship operates.

(b) No gift or hospitality may be given to or received from any person during the course of an active procurement, tender, or regulatory process in which that person or their organisation has an interest.

(c) No gift or hospitality may be given to or received from a government official, public servant, or regulatory employee without prior written approval from the General Counsel (or equivalent senior officer), regardless of value.

(d) Cash gifts are prohibited in all circumstances.

4.3.3 De minimis threshold and pre-approval. Gifts and hospitality that are modest in value, infrequent, and proportionate to a normal business relationship do not require pre-approval, but must be recorded in the gifts and hospitality register. Any gift or hospitality that is more than modest in value, that is offered to or received from a government or public official, or that could reasonably create the appearance of improper influence requires prior written approval from the General Counsel (or equivalent senior officer) before it is offered or accepted. The General Counsel maintains internal guidance setting specific monetary thresholds for recording and pre-approval, and reviews that guidance from time to time.

4.3.4 Cosmos Personnel who are uncertain whether a proposed gift or item of hospitality falls within the permitted parameters should seek guidance from the General Counsel before proceeding.

4.4 Political and charitable contributions

4.4.1 The Cosmos Group does not make direct financial contributions to political parties, candidates, or political campaigns in any jurisdiction. This prohibition is absolute and is not subject to a de minimis exception.

‍

4.4.2 Charitable contributions made by the Cosmos Group are subject to prior approval from the General Counsel (or equivalent senior officer) where the proposed recipient is connected to a public official, a regulatory body, or a counterparty with whom the Cosmos Group has or expects to have a commercial or regulatory relationship. All charitable contributions are recorded in the relevant register.

4.4.3 Cosmos Personnel must not make any personal political or charitable contribution in a manner that could reasonably be attributed to the Cosmos Group or that could be construed as an indirect contribution by the Cosmos Group on their behalf.

‍

5. Risk management procedures

5.1.1 The Cosmos Group conducts periodic assessments of its exposure to bribery and corruption risk. The assessment considers:

(a) the jurisdictions in which the Cosmos Group operates or in which it has relevant business relationships, having regard to internationally recognised corruption perception indices;

(b) the sectors and transaction types in which it operates, including corporate services, government filings, and regulated activities;

(c) the nature and complexity of its third-party relationships, including agents, introducers, and joint venture partners; and

(d) the value and strategic importance of relevant contracts and engagements.

5.1.2 The risk assessment is reviewed at least annually and whenever there is a material change in the Cosmos Group's operations, geographic footprint, or third-party relationships.

5.2 Third-party due diligence

5.2.1 The Cosmos Group applies proportionate due diligence to third parties before entering into or materially extending a business relationship with them. The depth of due diligence is calibrated to the assessed risk level of the relationship.

5.2.2 For all third-party engagements, due diligence includes, at a minimum:

(a) verification of the identity, ownership structure, and ultimate beneficial ownership of the counterparty;

(b) a review of publicly available adverse media and sanctions screening; and

(c) confirmation that the counterparty is not a Politically Exposed Person, or, if they are, assessment of the elevated risk and the application of enhanced measures.

5.2.3 For higher-risk engagements (including agents, introducers, and third parties operating in high-risk jurisdictions), enhanced due diligence applies, which may include:

(a) a detailed review of the counterparty's own anti-bribery and corruption policy and practices;

(c) written representations and warranties from the counterparty regarding compliance with applicable anti-bribery laws; and

(d) periodic re-screening and review of the relationship.

5.2.4 The Cosmos Group will not enter into or maintain a relationship with any counterparty where due diligence reveals credible evidence of past or ongoing bribery, corruption, or fraud.

5.3 Contractual controls

5.3.1 The Cosmos Group's standard terms for third-party engagements include:

(a) an obligation on the third party to comply with all applicable anti-bribery and anti-corruption laws;

(b) a prohibition on the third party making, offering, promising, or authorising any payment or benefit that would constitute bribery under the Bribery Act, the FCPA, the UAE Crimes and Penalties Law, or any other applicable law;

(c) a requirement that the third party maintain adequate anti-bribery procedures and, where the engagement carries elevated risk, to provide evidence of those procedures on request;

(d) an audit right exercisable by the Cosmos Group on reasonable notice; and

(e) a right of immediate termination without penalty to the Cosmos Group where a material breach of anti-bribery obligations is confirmed or credibly alleged.

5.4 Internal controls and recordkeeping

5.4.1 The Cosmos Group maintains the following registers to support monitoring and accountability:

(a) a gifts and hospitality register, recording all gifts and hospitality given and received by Cosmos Personnel above the de minimis threshold, together with pre-approval records for items above the pre-approval threshold;

(b) a charitable contributions register; and

(c) a third-party due diligence register, recording due diligence conducted on third parties.

5.4.2 Records in each register are retained for a minimum of six years from the date of the relevant transaction or the end of the relevant business relationship, whichever is later, consistent with the recordkeeping framework set out in the Group's broader compliance programme.

5.4.3 The Cosmos Group's financial controls include segregation of duties, multi-level authorisation for payments above specified thresholds, prohibition on cash transactions above de minimis levels, and periodic review of expense claims and payment records for patterns inconsistent with legitimate business activity.

5.5 Training

5.5.1 The Cosmos Group provides anti-bribery and corruption training to all Cosmos Personnel whose roles involve:

(a) interactions with public officials, government bodies, or regulators;

(b) procurement, supplier management, or third-party relationship management;

(c) business development, sales, or the offering and acceptance of gifts and hospitality; and

(d) financial approvals and expense management.

5.5.2 Training is delivered on induction and refreshed at intervals of no more than two years. For higher-risk roles, refresher training is provided annually. Completion is recorded and monitored.

5.5.3 Training content covers, at a minimum: the definitions set out in section 4; the applicable laws set out in section 3; the procedures set out in section 5; the reporting channels set out in section 8; and the consequences of breach set out in section 9.

5.5.4 Senior management and members of the board receive tailored briefings on anti-bribery developments and emerging risks, updated as the regulatory landscape evolves.

‍

6. Gifts and hospitality register procedure

6.1 Every item of gifts or hospitality given or received by Cosmos Personnel must be recorded in the gifts and hospitality register within five business days of the relevant occasion.

6.2 The register entry must record: the date; a description of the gift or hospitality; the estimated value; the name and organisation of the giver or recipient; the business relationship; the name of the Cosmos Personnel member involved; and, where pre-approval was required, evidence that approval was obtained.

6.3 The register is maintained by the legal or compliance function and is available for review by the General Counsel, the Chief Executive Officer, and members of the board.

6.4 Cosmos Personnel who receive an unsolicited gift that they cannot appropriately decline or return should record it in the register and seek guidance on disposal (which may include donation to charity or retention in a common area) from the General Counsel.

‍

7. Conflicts of interest

7.1 A conflict of interest arises when a Cosmos Personnel member's personal interests, financial or otherwise, may improperly influence or appear to influence their judgment in the exercise of their duties to the Cosmos Group. Conflicts of interest create conditions in which bribery and corruption can take root.

7.2 Cosmos Personnel are required to disclose any actual or potential conflict of interest to the General Counsel (or equivalent senior officer) promptly on becoming aware of it. The General Counsel will assess the disclosure and determine appropriate mitigating measures, which may include recusal from the relevant matter or, where a conflict cannot be managed, termination of the relevant relationship.

‍

8. Reporting and whistleblowing

8.1 Reporting channels

8.1.1 Cosmos Personnel who suspect, have reasonable grounds to suspect, or become aware of any breach or potential breach of this statement, or any other act that may constitute bribery or corruption in connection with the Cosmos Group's business, are required to report it promptly through one of the following channels:

(a) directly to the General Counsel (or equivalent senior officer) at legal@cosmos.global;

(b) to a member of the board of directors of Sirius Consulting FZCO; or

(c) where the concern relates to the conduct of the General Counsel, directly to the Chair of the board.

8.1.2 The Cosmos Group is committed to establishing a confidential reporting mechanism (including, where appropriate, an anonymous reporting channel) and will communicate the details of any such mechanism to Cosmos Personnel as it is made available.

8.2 Confidentiality

8.2.1 All reports made in good faith will be treated with the highest practicable degree of confidentiality. The identity of the reporting person will not be disclosed without their consent, except where disclosure is required by law or is strictly necessary to investigate the matter effectively.

8.2.2 The Cosmos Group acknowledges that it may not always be possible to guarantee complete anonymity, particularly in small teams where the subject matter of a concern may inherently identify the reporter. Cosmos Personnel with concerns about their ability to report confidentially are encouraged to seek guidance from the General Counsel in the first instance.

8.3 Non-retaliation

8.3.1 The Cosmos Group is committed to a strict non-retaliation policy. Any Cosmos Personnel member who makes a report in good faith, or who cooperates with an investigation, will not suffer any adverse employment or contractual consequence as a result of having done so. This commitment applies even where an investigation concludes that the reported concern was not substantiated.

8.3.2 Any act of retaliation against a person who has made a good-faith report is itself a disciplinary offence subject to the sanctions set out in section 9. Cosmos Personnel who believe they have been subjected to retaliation should report this immediately to the General Counsel or to a board member.

8.3.3 The non-retaliation commitment does not protect a person who makes a report that they know to be false or who uses the reporting mechanism in bad faith.

8.4 External reporting

8.4.1 Nothing in this page prevents Cosmos Personnel from reporting a concern directly to a relevant law enforcement authority, regulatory body, or other competent authority, whether in the UAE, the United Kingdom, the United States, or any other relevant jurisdiction. The Cosmos Group will not take any adverse action against a person who makes such a report in good faith.

‍

9. Consequences of breach

9.1 Disciplinary action

9.1.1 Any Cosmos Personnel member who breaches this statement, or who fails to report a known or suspected breach, will be subject to disciplinary action. The severity of the disciplinary response will reflect the seriousness of the breach, the seniority of the person involved, whether the breach was deliberate or reckless, and the degree of harm caused to the Cosmos Group or to third parties.

9.1.2 Disciplinary action may include, without limitation: a formal written warning; suspension pending investigation; demotion; reduction of compensation; and termination of employment or the relevant contractual engagement. In the most serious cases, the Cosmos Group will initiate termination and may take legal action to recover any loss suffered.

9.1.3 For the avoidance of doubt, the Cosmos Group will not treat as a mitigating factor the assertion that a bribe was paid or offered on the instructions of another person, whether that person is a manager, a client, or a third party.

9.2 Termination of third-party relationships

9.2.1 Where a third party is found to have engaged in bribery or corruption in connection with its relationship with the Cosmos Group, or where a third party breaches its contractual anti-bribery obligations, the Cosmos Group will exercise its right to terminate the relevant engagement immediately and without financial penalty to the Cosmos Group.

9.2.2 The Cosmos Group will assess, in each case, whether the finding warrants notification to relevant law enforcement or regulatory authorities in any applicable jurisdiction.

9.3 Referral to authorities

9.3.1 The Cosmos Group recognises that certain acts of bribery and corruption may engage mandatory reporting obligations under applicable law, or may warrant voluntary referral to law enforcement authorities in the interests of justice. Decisions regarding referral to authorities will be taken by the General Counsel (or equivalent senior officer) in consultation with the board and, where appropriate, external legal counsel.

9.3.2 Cosmos Personnel must not take any action to conceal, destroy, or alter evidence relevant to a suspected bribery or corruption matter, and must co-operate fully with any internal or external investigation.

‍

10. Senior management responsibility and review

10.1 Ultimate responsibility for the Cosmos Group's anti-bribery and corruption programme rests with the board of Sirius Consulting FZCO. Day-to-day responsibility for implementing and maintaining the programme is delegated to the General Counsel (or equivalent senior officer).

10.2 This statement is reviewed at least annually. Following each review, the General Counsel reports to the board on the adequacy and effectiveness of the programme, including a summary of any reported concerns and the outcomes of any investigations. The board satisfies itself that the programme continues to constitute adequate procedures for the purposes of section 7 of the Bribery Act.

10.3 Cosmos Personnel with questions about this statement, or who require guidance on a specific situation, are encouraged to contact the General Counsel at legal@cosmos.global before taking any action that may be affected by the provisions of this statement.

10.4 This statement is owned by the senior management of Sirius Consulting FZCO and is reviewed at least annually. Questions about this statement may be sent to legal@cosmos.global.

On behalf of: Sirius Consulting FZCO and the Cosmos Group

Date: 24 May 2026

Related documents

The following Cosmos Group documents are directly relevant to and should be read alongside this statement:

-Terms of use (published at https://cosmos.global/legal)

-Privacy page (published at https://cosmos.global/privacy)

-Data processing addendum (published at https://cosmos.global/legal)

11. Purpose and scope

11.1 Purpose

11.1.1 Sirius Consulting FZCO, on behalf of itself and the Cosmos Group, is committed to resolving complaints promptly, fairly, and transparently. This Complaints Procedure sets out the process by which any person may raise a concern or complaint about the Website, the Services, or the conduct of the Cosmos Group, and explains what the Cosmos Group will do in response.

11.1.2 The Cosmos Group treats every complaint as a valuable source of information. Complaints are reviewed by senior management and used to improve the Website, the Services, and the Group's operating practices.

11.2 Scope

11.2.1 This Complaints Procedure applies to complaints from:

(a) Users of the Website at https://cosmos.global, including persons who have used or attempted to use the Onboarding Flow;

(b) clients who have received or contracted for Services;

(c) Data Subjects exercising rights or raising concerns under Applicable Data Protection Law, including the UAE PDPL, the EU GDPR, the UK GDPR, and the PDPA; and

(d) any other person with a legitimate interest in raising a concern relating to the Cosmos Group's conduct.

11.2.2 This Complaints Procedure does not apply to:

(a) employment or contractor disputes, which are governed by the relevant employment or engagement agreement and applicable employment law;

(b) disputes under the Master Services Agreement, which are governed by the dispute resolution provisions of that agreement; or

(c) matters that are the subject of active legal proceedings between the complainant and a Cosmos Group entity.

11.2.3 For information about how the Cosmos Group processes Personal Data, please refer to the Privacy page at https://cosmos.global/privacy.

‍

12. How to submit a complaint

12.1 Submission channels

12.1.1 Complaints may be submitted through any of the following channels:

(a) Email: complaints@cosmos.global. Complaints submitted by email should include the information set out in clause 12.2 and be sent from an address to which the complainant has access, as the Cosmos Group's response will be sent to that address unless an alternative is specified.

(b) Post: The Bureau, Opera Grand, Downtown, Dubai, United Arab Emirates. Complaints submitted by post should be marked "Complaints" on the envelope and should include all of the information set out in clause 12.2.

(c) Online form: where a complaints submission form is made available on the Website at https://cosmos.global/complaints, complaints may be submitted through that form. The form will prompt the complainant to provide the required information.

12.1.2 The Cosmos Group does not accept complaints by telephone as the primary channel, as it is important to have a written record of the complaint from the outset. Cosmos Personnel who receive a complaint by telephone will ask the caller to submit their complaint in writing through one of the channels listed above and will assist the caller in doing so where necessary.

12.2 Information required

12.2.1 To enable the Cosmos Group to investigate and respond to a complaint efficiently, the complainant should provide:

(a) their full name and, where applicable, the name of the organisation on whose behalf they are complaining;

(b) contact details, including an email address or postal address to which the response should be sent;

(c) a clear description of the complaint, including the relevant facts, the date(s) on which the relevant events occurred, and the names of any Cosmos Personnel involved (where known);

(d) copies of any relevant documents or correspondence; and

(e) a description of the outcome the complainant is seeking.

12.2.2 Where a complaint relates to the exercise of data subject rights under Applicable Data Protection Law, the complainant should additionally identify the right they are seeking to exercise and refer to the relevant section of the Privacy page. The Cosmos Group may request evidence of the complainant's identity before processing such a complaint, in accordance with the procedures set out in the Privacy page.

12.2.3 A complaint submitted without all of the information listed in clause 12.2.1 will not be rejected on that basis, but the Cosmos Group may need to request additional information, which may extend the time taken to resolve the complaint.

12.3 Complaints on behalf of others

12.3.1 A complaint may be submitted on behalf of another person, for example by a legal representative or an authorised agent. In such cases, the complainant should provide evidence of their authority to act on the other person's behalf. The Cosmos Group may contact the person on whose behalf the complaint is made to verify the authorisation.

‍

13. Acknowledgement

13.1 Timing

13.1.1 The Cosmos Group will acknowledge receipt of every complaint within five business days of receiving it. "Business days" means Monday to Friday, excluding public holidays in the UAE.

13.1.2 The acknowledgement will:

(a) confirm that the complaint has been received and is being reviewed;

(b) provide a reference number that the complainant should use in any subsequent correspondence;

(c) identify the person or team responsible for investigating the complaint, where this has been determined at the time of acknowledgement; and

(d) indicate the anticipated timeframe for a substantive response, in accordance with section 14.

13.1.3 Where the Cosmos Group requires additional information before it can commence a meaningful investigation, the acknowledgement will identify what information is needed and request that the complainant provide it.

14. Investigation and response

14.1 Investigation process

14.1.1 Following acknowledgement, the Cosmos Group will investigate the complaint fairly and impartially. The investigator will:

(a) gather and review all relevant documentation and records;

(b) speak with relevant Cosmos Personnel, where appropriate;

(c) consider applicable law, policy, and any relevant contractual provisions; and

(d) assess whether the complaint is substantiated in whole or in part and, if so, what remedial action (if any) is appropriate.

14.1.2 The Cosmos Group will keep the complainant informed of material developments during the investigation, including any delay and the reasons for it.

14.2 Final response

14.2.1 The Cosmos Group will provide a written final response to the complainant within 30 calendar days of receiving the complaint.

14.2.2 The final response will:

(a) summarise the complaint as understood;

(b) set out the findings of the investigation;

(c) state whether the complaint is upheld in whole, in part, or not at all;

(d) explain the reasons for the finding; and

(e) where the complaint is upheld in whole or in part, describe the remedial action that the Cosmos Group will take or has taken, including any apology, correction, or other appropriate measure.

14.3 Extension of the response period

14.3.1 Where the Cosmos Group is unable to provide a final response within 30 calendar days, it will, before that period expires, send the complainant a written notice that:

(a) explains the reasons why the investigation cannot be completed within the standard period;

(b) provides an estimate of the additional time required; and

(c) confirms that a final response will be provided within a further 30 calendar days (making a maximum investigation period of 60 calendar days from receipt of the complaint).

14.3.2 Extensions beyond 60 calendar days from receipt of the complaint will not be taken without the complainant's agreement, save where the matter is subject to legal proceedings or a formal regulatory investigation that prevents the Cosmos Group from disclosing its findings.

14.3.3 Where the complaint concerns the exercise of data subject rights under Applicable Data Protection Law, the response periods applicable under the relevant law apply (and may differ from the periods set out above). In particular:

(a) under the EU GDPR and UK GDPR, the Cosmos Group must respond within one month of receiving the request, extendable by two further months in cases of complexity or high volume, with notification of the extension within the first month;

(b) under the UAE PDPL, the Cosmos Group must respond within 30 days; and

(c) under the PDPA, the Cosmos Group must respond within 30 days.

Where a data subject right request is submitted through the complaints channel rather than directly to privacy@cosmos.global, the Cosmos Group will route it to the privacy team for handling under the applicable regime.

15. Confidentiality and data protection

15.1 The Cosmos Group processes the Personal Data of complainants for the purpose of investigating and resolving complaints. This processing is carried out on the basis of the Cosmos Group's legitimate interests in managing its business and resolving disputes, and, where applicable, on the basis of legal obligations.

15.2 The Cosmos Group will treat the contents of a complaint in confidence to the extent reasonably practicable. Disclosure of complaint details within the Cosmos Group will be limited to those persons who need to know in order to investigate and resolve the complaint. The Cosmos Group will not disclose complaint details to third parties outside the Group without the complainant's consent, except where required by law or by a regulatory authority.

15.3 Full details of how the Cosmos Group processes Personal Data in connection with complaints, including data subject rights, retention periods, and the legal bases for processing, are set out in the Privacy page at https://cosmos.global/privacy.

16. Records

16.1 The Cosmos Group retains all complaint records, including the original complaint, all correspondence, investigation notes, and the final response, for a minimum of six years from the date on which the complaint was finally resolved or closed.

16.2 Complaint records are maintained in a secure complaints register and are accessible to the General Counsel, senior management, and, for audit purposes, the board of Sirius Consulting FZCO.

16.3 The Cosmos Group uses anonymised and aggregated complaint data to identify patterns, assess systemic issues, and improve the Website, Services, and operating practices. Individual complainants are not identified in any aggregate reporting.

17. Escalation rights

17.1 Internal escalation

17.1.1 If a complainant is not satisfied with the final response, or if the Cosmos Group has failed to provide a final response within the applicable period, the complainant may request that the matter be escalated to a senior officer of the Cosmos Group by writing to legal@cosmos.global and marking the correspondence "Escalation Request" with reference to their complaint reference number.

17.1.2 An escalated complaint will be reviewed by the General Counsel (or equivalent senior officer) who was not involved in the original investigation, where this is practicable given the size of the Cosmos Group. A response to the escalation will be provided within 15 calendar days of the escalation request.

17.2 External escalation: data protection matters

17.2.1 Where a complaint relates to the processing of Personal Data and the complainant is not satisfied with the Cosmos Group's response, the complainant has the right to lodge a complaint with the relevant supervisory authority. The applicable authority depends on the complainant's location and the law under which the complaint arises:

(a) UAE PDPL matters: the UAE Data Office, the supervisory authority for UAE Federal Decree-Law No. 45 of 2021, contactable at https://uaedataoffice.gov.ae;

(b) UK matters (UK GDPR and DPA 2018): the **Information Commissioner's Office (ICO), contactable at https://ico.org.uk/make-a-complaint;

(c) EU and EEA matters (EU GDPR): the relevant lead supervisory authority under the EU GDPR one-stop-shop mechanism. Where the Cosmos Group's lead supervisory authority in the EU has been designated, details will be published in the Privacy page. In the interim, complainants may contact the supervisory authority of their country of residence, which will co-ordinate with the relevant lead authority as appropriate;

(d) Singapore matters (PDPA): the Personal Data Protection Commission (PDPC), contactable at https://www.pdpc.gov.sg; and

(e) ADGM matters (ADGM Data Protection Regulations 2021): where the matter arises under the ADGM DP Regulations, the relevant supervisory authority is the ADGM Registration Authority; details are available at https://www.adgm.com.

17.2.2 The right to lodge a complaint with a supervisory authority is without prejudice to the complainant's right to seek an effective judicial remedy under applicable law.

17.3 External escalation: regulated services

17.3.1 Where a complaint relates to regulated financial services or regulated activities provided by a Cosmos Group Affiliate that holds a licence from the ADGM FSRA, and the complainant is not satisfied with the Cosmos Group's response, the complainant may escalate the matter to the ADGM FSRA.

17.3.2 Details of the ADGM FSRA's complaints process are available at https://www.fsra.adgm.com. The Cosmos Group will indicate in its final response whether the subject matter of the complaint falls within the ADGM FSRA's jurisdiction.

17.3.3 For the avoidance of doubt, not all Cosmos Group entities hold a licence from the ADGM FSRA. The right to escalate to the ADGM FSRA is available only in respect of complaints touching regulated services provided by a licensed Affiliate.

17.4 Legal proceedings

17.4.1 The existence of this Complaints Procedure does not prevent any complainant from commencing legal proceedings in a court of competent jurisdiction. Nothing in this Complaints Procedure is intended to operate as a bar to, or limitation on, the exercise of any legal right.

18. Accessibility

18.1 The Cosmos Group is committed to making this Complaints Procedure accessible to all persons who may need to use it. Complainants who have accessibility requirements that affect their ability to use the standard channels described in clause 12.1 should contact the Cosmos Group at complaints@cosmos.global to discuss alternative arrangements.

18.2 This Complaints Procedure is available in English. Where a complainant writes to the Cosmos Group in another language, the Cosmos Group will endeavour to communicate in that language where it has the capacity to do so, but reserves the right to respond in English where it does not.

19. Contact

All queries relating to this page should be directed to:

Email: legal@cosmos.global (general legal and anti-bribery queries)

Email: complaints@cosmos.global (complaints)

Email: privacy@cosmos.global (Privacy page queries)

Post: The Bureau, Opera Grand, Downtown, Dubai, United Arab Emirates

Online form: https://cosmos.global/complaints (complaints, where available)

20. Governing law and jurisdiction

20.1 This page and any non-contractual obligations arising out of or in connection with it are governed by the law of the Abu Dhabi Global Market (ADGM). The ADGM Courts have non-exclusive jurisdiction to settle any dispute arising out of or in connection with it.

20.2 Nothing in this clause deprives a consumer resident in the European Union, the European Economic Area, the United Kingdom, or Singapore of the protection of mandatory provisions of the law of their country of residence, and such a consumer may also bring proceedings in, and benefit from the mandatory consumer protection laws of, that country where local law so requires.

21. Variation and severability

21.1 The Cosmos Group may vary this page at any time. Material changes will be reflected in an updated version published at https://cosmos.global/legal, with the version number and effective date updated accordingly.

21.2 The version of this page in force at the time a complaint is received governs the handling of that complaint, unless applicable law requires a different approach.

21.3 If any provision of this page is found by a court or other competent authority to be invalid or unenforceable, that provision will be severed and the remaining provisions will continue in full force and effect.

22. Version control

Version: v1.0

Date: 24 May 2026

Summary of changes: Initial publication (consolidation of anti-bribery statement and complaints procedure)

Appendix A: Defined terms

The defined terms applicable to this page are set out in the table in section 1.2.