White paper drafted under the European Markets in Crypto-Assets Regulation (EU) 2023/1114 for FFG 6T49BCSXZ

The FLOW crypto-asset referred to in this white paper is a crypto-asset other than an EMT or an ART and is natively issued on the Flow blockchain and identified by the DTI FFG shown in section F.14, as of 2026-08-20. A total of 1,250,000,000 FLOW were created in the genesis block in October 2020 (source: https://flow.com/flow-tokenomics/technical-overview, accessed 2026-08-20). The protocol does not define a maximum supply. New FLOW is issued to support staking rewards where transaction fees are insufficient, so the total supply may increase over time and is uncapped.

Flow is a layer-1 blockchain designed for consumer-facing applications. It supports both Cadence-based applications and Ethereum-compatible applications through Flow EVM, with both environments operating on the same underlying blockchain. The network uses a proof-of-stake consensus mechanism and specialised validator node roles (source: https://developers.flow.com/protocol/flow-networks, accessed 2026-08-20).

FLOW is used to pay network transaction fees, support on-chain storage, and participate in staking. It may also be used within applications on the Flow network as a medium of exchange or collateral and may be used in certain protocol governance processes. FLOW does not confer ownership, redemption or profit-sharing rights in any legal entity.

The crypto-asset does not grant any legally enforceable or contractual rights or obligations to its holders or purchasers. Any functionalities accessible through the underlying technology are purely technical or operational in nature and do not confer rights comparable to ownership, profit participation, governance, or similar entitlements known from traditional financial instruments.

As defined in Article 3(9) of Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on Markets in Crypto-Assets – amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 – a utility token is “a type of crypto-asset that is only intended to provide access to a good or a service supplied by its issuer”. This crypto-asset does not qualify as a utility token, as its intended use goes beyond providing access to a good or a service supplied solely by the issuer.

Crypto Risk Metrics GmbH is seeking admission to trading on the Payward Global Solutions LTD (“Kraken”) platform in the European Union in accordance with Article 5 of Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on Markets in Crypto-Assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937. The admission to trading is not accompanied by a public offer of the crypto-asset.

Crypto Risk Metrics GmbH is a technical service provider that supports regulated entities in fulfilling their regulatory requirements. Among other services, Crypto Risk Metrics GmbH acts as a data provider for ESG data under Article 66(5). In light of the requirements set out in Articles 4(7), 5(4) and 66(3) of Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on Markets in Crypto-Assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937, Crypto Risk Metrics GmbH aims to provide central services for crypto-asset white papers.

Crypto Risk Metrics GmbH, founded in 2018 and based in Hamburg (HRB 154488), has undergone several strategic shifts in its business focus since incorporation. Due to these changes in business model and operational direction over time, the financial figures from earlier years are only comparable to a limited extent with the company’s current commercial activities. The present business model – centred on regulatory technology and risk analytics in the context of the MiCA framework – has been developed progressively and can realistically be considered fully operational since approximately 2024.

The company’s financial trajectory over the past three years reflects the transition from exploratory development towards market-ready product delivery. Profit or loss after tax for the last three financial years is as follows:

2024 (unaudited): loss of EUR 50,891.81

2023 (unaudited): loss of EUR 27,665.32

2022: profit of EUR 104,283.00

The profit in 2022 resulted primarily from legacy consulting activities, which were discontinued as part of the company’s repositioning.

The losses in 2023 and 2024 resulted from strategic investments in the development of proprietary software infrastructure, regulatory frameworks, and compliance technology for the MiCA ecosystem. During those periods, no substantial commercial revenues were expected, as resources were directed towards preparing the platform for market entry in a regulated environment.

A fundamental repositioning of the company occurred in 2023 and especially in 2024, when the focus shifted towards providing risk management, regulatory reporting, and supervisory compliance solutions for financial institutions and crypto-asset service providers. This marked a material shift in business operations and monetisation strategy.

Based on preliminary unaudited management information for the financial year 2025, revenues are expected to have exceeded EUR 800,000, while preliminary net profit is expected to exceed EUR 100,000.

These figures are not audited and are not based on a finalised annual financial statement. Accordingly, they remain subject to finalisation and may differ from the figures ultimately reported in the annual financial statements.

With the regulatory environment now taking shape and the platform commercially validated, it is assumed that the effects of the strategic developments will continue to materialise in 2026. The company foresees further scalability of its technology and growing market demand for regulatory compliance tools in the European crypto-asset sector.

No public subsidies or governmental grants have been received to date; all operations have been financed through shareholder contributions and internally generated resources. Crypto Risk Metrics GmbH has never accepted any payments in tokens from projects it has worked with and – due to its internal Conflicts of Interest Policy – never will.

The Flow Foundation is a non-profit organisation dedicated to supporting the development and operation of the Flow ecosystem and related technologies. Its activities include supporting the development, scaling, security and decentralisation of the Flow protocol, as well as providing resources and grants to developers and other contributors building on Flow.

Could not be found while drafting this white paper (2026-08-20).

According to publicly available information (sources: https://flow.com/, https://developers.flow.com/, accessed 2026-08-20), Flow is a public layer-1 blockchain network designed for consumer-facing applications that are expected to serve large numbers of users. Its stated objective is to allow such applications to operate on-chain without the transaction costs and capacity constraints that the project associates with general-purpose networks. The network is governed through community-led processes including Flow Improvement Proposals, working groups and community voting, with the Flow Foundation supporting protocol development and ecosystem coordination.

The network operates a multi-role node architecture in which the tasks required to process a transaction are separated across Collection, Consensus, Execution, Verification and Access nodes, rather than each node performing every task. Consensus is reached under a proof-of-stake mechanism in which validators and delegators stake FLOW in order to participate. Flow supports two execution environments in parallel. Flow Cadence uses Cadence, a resource-oriented programming language developed for the network, and Flow EVM is an Ethereum Virtual Machine equivalent environment (chain ID 747 on mainnet) which allows applications written for Ethereum to be deployed on Flow. A protocol-level bridge allows assets to move between the two environments.

The applications built on the network have historically been oriented towards digital collectibles, entertainment and ticketing. More recently the project has extended its stated focus to consumer finance, including decentralised finance applications and an enshrined lending protocol, Flow Credit Markets, which the project states is on track to launch during 2026.

The project does not involve the granting of ownership, profit-participation rights, or legal claims against the Flow network, the Flow Foundation or its contributors. It centres on the operation and development of a technical environment in which the FLOW crypto-asset may serve as a functional and governance input for certain protocol processes. The long-term evolution of the Flow network, including the scope of available features, the governance roadmap, validator and delegator participation mechanisms, and the operational continuity of the infrastructure, may vary based on technical, economic and regulatory considerations. All future developments remain subject to change.

This section provides an overview of the historical developments related to the FLOW crypto-asset and a description of planned or anticipated project milestones as publicly communicated. All forward-looking elements are subject to significant uncertainty. They do not constitute commitments, assurances or guarantees, and may be modified, delayed or discontinued at any time.

The project publishes a roadmap and communicates further plans through its website and public announcements (sources: https://flow.com/flow-roadmap, https://flow.com/post/dec-27-technical-post-mortem, https://flow.com/post/flow-token-burn-summary, https://flow.com/post/flow-foundation-a-commitment-to-flow, https://flow.com/post/transaction-fees-rising-flow-issuance-falling, accessed 2026-08-20).

Past milestones:

- Mainnet launch (October 2020): launch of the Flow blockchain and creation of the crypto-asset in the genesis block.

- Account abstraction and mobile support (2023): account abstraction and account linking, a mobile software development kit, and the release of the Flow Wallet.

- Completion of genesis unlocks (October 2023): the final tranche of the development team allocation unlocked, after which the entire supply of the crypto-asset was in circulation.

- Crescendo upgrade (2024-09-04): activation of the Ethereum Virtual Machine equivalent environment alongside the native Cadence environment, with a cross-environment token bridge and interoperability between assets in both environments.

- Cadence 1.0 (October 2024): deployment of the upgraded version of the network's native resource-oriented smart-contract language.

- Forte upgrade (2025-10-22): protocol upgrade introducing Flow Actions for cross-protocol composability, Scheduled Transactions for autonomous on-chain execution, support for WebAuthn and passkey account credentials, a migration of the underlying data store, account key de-duplication and data integrity hardening.

- Transaction fee update (2025-12-08): an increase in transaction fees intended to fund a greater share of validator and delegator rewards from network activity rather than from newly issued FLOW.

- Security incident and network recovery (2025-12-27 to 2026-01-02): an attacker exploited a vulnerability in the network's smart-contract runtime to duplicate existing token balances, producing 87,960,930,222 counterfeit FLOW and counterfeit units of twelve further tokens. The units were duplicated rather than issued, so the supply recorded by the token contracts did not change and the attack was not detected by standard supply checks. No holder balances were accessed or altered. Validators halted transaction processing approximately six hours after the first malicious transaction, and the realised loss was approximately USD 3.9 million, being the value moved off the network before the halt. Cadence read and write access was restored on 2025-12-29, while Flow EVM remained read-only pending remediation; full network operation resumed on 2026-01-02, with 1,060 accounts associated with the incident temporarily placed in a read-only state and the Community Governance Council granted a revocable power to destroy counterfeit units held in them.

- Destruction of counterfeit units (2026-01-06): 484,434,923 counterfeit FLOW, recovered with the cooperation of trading platforms, were permanently destroyed. These units had been duplicated rather than issued and had never formed part of the recorded total supply, so their destruction did not reduce the supply of validly issued FLOW.

- Destruction of remaining counterfeit units (2026-01-30): a further 87,426,151,401 counterfeit FLOW were permanently destroyed, together with counterfeit units of other affected tokens. As above, this did not reduce the supply of validly issued FLOW.

- Buyback and destruction (2026-02-23): the Flow Foundation permanently destroyed 50,343,896 FLOW, acquired between 2025-12-27 and 2026-02-22 through a combination of open-market purchases and Foundation treasury funds. Unlike the two preceding events, these were validly issued units, and their destruction reduced the supply of the crypto-asset by that amount. The Foundation states that the purpose was to offset an equivalent quantity of counterfeit units which had become indistinguishable from validly issued FLOW through trading on decentralised exchanges.

- Transaction fee recalibration (2026-07-27): a recalibration of the network's execution cost weights, raising fees for most transactions. The project estimates that this reduces newly issued FLOW by approximately 171,000 units per month at the transaction volumes used in its analysis.

Future milestones:

- Flow Credit Markets, a lending protocol integrated at protocol level, which the project has stated is on track to launch during 2026.

- Acquisition of further FLOW by the Flow Foundation. The Foundation has stated that it will acquire a minimum of an additional 50,000,000 FLOW from the open market during 2026, to be held in its treasury. Whether any part of that amount has been acquired cannot be determined from publicly available sources.

- Artificial intelligence infrastructure, listed by the project for 2026 and comprising parallel execution, readiness for artificial intelligence workloads and developer tooling for that purpose.

- Scaling of transaction throughput and of state storage, and the development of the network as an environment for autonomous software agents. The project describes these as directions of development and does not attach dates or defined scope to them.

Note: All future milestones are subject to significant uncertainty, including but not limited to technical feasibility, regulatory developments, market adoption and community governance decisions. The project may modify, delay or discontinue any of these initiatives at any time. Past implementation or performance outcomes do not constitute an indication of future results, and any such changes may materially affect the characteristics, availability or perceived value of the FLOW crypto-asset for its holders.

Based on information from various third-party and industry sources, it is reported that the crypto-asset project associated with the FLOW token has conducted multiple private funding rounds involving venture-capital and strategic financing through Dapper Labs, the company publicly associated with the development of the Flow blockchain.

According to publicly referenced information, Dapper Labs announced a USD 15 million Series A2 financing round in November 2018, led by Venrock, with participation from GV and Samsung NEXT. Public sources further indicate that Dapper Labs raised USD 11 million in September 2019 to support development of the Flow blockchain, with Andreessen Horowitz’s crypto fund, Google and Samsung reported among the participants. In August 2020, third-party reporting described a further USD 12 million financing involving investors including NBA players, reportedly intended to support the consumer-focused Flow blockchain and related digital-collectibles initiatives.

Further public reporting indicates that Dapper Labs completed a USD 305 million private financing round in March 2021, led by Coatue and involving venture-capital investors, professional athletes and other individuals. The reported round was described as supporting the expansion of Dapper Labs’ non-fungible-token and blockchain products. Some public sources state that this financing brought Dapper Labs’ total funding to USD 357 million. In September 2021, public sources further reported a USD 250 million funding round led by Coatue, with participation by existing investors including Andreessen Horowitz, GV and Version One Ventures, alongside BOND and GIC.

The reported funding rounds concern Dapper Labs and its broader business activities, including NFT products and commercial partnerships. Publicly available information does not permit a reliable determination of the proportion of those funds that was allocated specifically to the Flow blockchain or remains available to the FLOW project.

However, all such information is derived exclusively from public announcements, portfolio disclosures, press releases, transparency reports, and third-party publications. Neither Dapper Labs nor other entities associated with the FLOW crypto-asset have independently confirmed the occurrence, precise amounts, valuation, legal structure, or contractual terms of these reported financing rounds. As a result, the referenced investment amounts, investor participation, and any implied cumulative funding figures cannot be independently verified and should be considered indicative only.

The purpose of seeking admission to trading is to enable the crypto-asset to be listed on a regulated platform in accordance with the applicable provisions of Regulation (EU) 2023/1114 and Commission Implementing Regulation (EU) 2024/2984. The white paper has been drawn up to comply with the transparency requirements applicable to trading venues.

The token is intended to be listed on the trading platform operated by Payward Global Solutions LTD ("Kraken"). Access to this platform depends on regional availability and user eligibility under Kraken’s terms and conditions. Investors should consult Kraken’s official documentation to determine whether they meet the requirements for account creation and token trading.

The costs involved in accessing the trading platform depend on the specific fee structure and terms of the respective crypto-asset service provider. These may include trading fees, deposit or withdrawal charges, and network-related transaction fees. Investors are advised to consult the applicable fee schedule of the chosen platform before engaging in trading activities.

Not applicable, as this white paper is written to seek admission to trading, not for the initial offer to the public.

MiCA-compliant crypto-asset service providers shall have strong measures in place in order to manage conflicts of interest. Due to the broad audience this white paper addresses, potential investors should always check the conflicts-of-interest policy of their respective counterparty.

Crypto Risk Metrics GmbH has established, implemented, and documented comprehensive internal policies and procedures for the identification, prevention, management, and documentation of conflicts of interest in accordance with applicable regulatory requirements. These internal measures are actively applied within the organisation. For the purposes of this specific assessment and the crypto-asset covered by this white paper, a token-specific review has been conducted by Crypto Risk Metrics GmbH. Based on this individual review, no conflicts of interest relevant to this crypto-asset have been identified at the time of preparation of this white paper.

Not applicable, as this white paper is written to seek admission to trading, not for the initial offer to the public.

Not applicable, as this white paper is written to seek admission to trading, not for the initial offer to the public.

According to publicly available information (sources: https://flow.com/flow-tokenomics/technical-overview, https://developers.flow.com/, accessed 2026-08-20), FLOW is the native crypto-asset of the Flow blockchain network. Its functions arise from the operation of the protocol itself rather than from any contractual arrangement, and all of them depend on the continued technical operation and governance of the network.

FLOW is the asset in which the network's security is denominated. Validators must stake FLOW in order to operate a node, with the minimum stake set by node role, and holders who do not operate a node may delegate FLOW to a node operator. Staking and delegation rewards are paid in FLOW at a target rate of 5% of the total supply each year, distributed at the end of each weekly epoch. Those rewards are funded first from the transaction fees the network collects, and the protocol issues new FLOW only to the extent that the fees collected fall short of the rewards due. Where the fees collected exceed the rewards due, no new FLOW is issued and the excess is permanently destroyed.

FLOW is also the means of payment for the use of the network. Transaction fees are payable in FLOW for on-chain operations, including account creation, the deployment of smart contracts, transfers and interactions with applications deployed on the network. Separately, each account must hold a minimum balance of FLOW as a storage deposit, which reserves on-chain storage capacity for that account. Storage deposits are not spent and remain with the account.

The project describes FLOW as the coin used for governance of the network, including voting on protocol upgrades and on the use of ecosystem funding. Protocol changes are proposed and discussed through the network's public improvement proposal process and other community-led governance mechanisms. FLOW does not confer a contractual or legally enforceable right to participate in, or to determine the outcome of, any such decision.

Beyond these protocol functions, FLOW is used as a medium of exchange between participants in the network and as collateral in decentralised finance applications deployed on it. Those applications are operated by parties other than the issuer, and their availability and terms are not determined by the protocol.

FLOW does not confer ownership, redemption or profit-sharing rights in any legal entity, and does not represent a claim against the Flow Foundation, Dapper Labs Inc. or any contributor to the network. Its functionality derives exclusively from its use within the Flow network. The long-term evolution of the Flow network, including the scope of available functions, the fee and reward parameters, the governance roadmap, validator and delegator participation mechanisms, and the operational continuity of the infrastructure, may vary based on technical, economic and regulatory considerations. All future developments remain subject to change.

Future milestones:

- Flow Credit Markets, a lending protocol integrated at protocol level, which the project has stated is on track to launch during 2026.

- Acquisition of further FLOW by the Flow Foundation. The Foundation has stated that it will acquire a minimum of an additional 50,000,000 FLOW from the open market during 2026, to be held in its treasury. Whether any part of that amount has been acquired cannot be determined from publicly available sources.

- Artificial intelligence infrastructure, listed by the project for 2026 and comprising parallel execution, readiness for artificial intelligence workloads and developer tooling for that purpose.

- Scaling of transaction throughput and of state storage, and the development of the network as an environment for autonomous software agents. The project describes these as directions of development and does not attach dates or defined scope to them.

Note: All future milestones are subject to significant uncertainty, including but not limited to technical feasibility, regulatory developments, market adoption and community governance decisions. The project may modify, delay or discontinue any of these initiatives at any time. Past implementation or performance outcomes do not constitute an indication of future results, and any such changes may materially affect the characteristics, availability or perceived value of the FLOW crypto-asset for its holders.

The FLOW token is a crypto-asset other than an EMT or ART and is the native coin of the Flow blockchain. The token is fungible to 8 decimal places, with an initial supply of 1,250,000,000 units created at genesis; its supply is uncapped and may increase over time through protocol issuance. The crypto-asset constitutes a digital representation recorded on distributed-ledger technology and does not confer ownership, corporate governance, profit participation, or any other legally enforceable governance rights. Any functionalities associated with the token are limited to potential technical features within the relevant platform environment. These functionalities do not represent contractual entitlements and may depend on future development decisions, technical design choices, and operational conditions. The crypto-asset does not embody intrinsic economic value; instead, its value, if any, is determined exclusively by market dynamics such as supply, demand, and liquidity in secondary markets.

No such services are currently known to be provided by the issuer. However, it cannot be excluded that additional services exist or may be offered in the future outside the scope of Regulation (EU) 2023/1114.

The crypto-asset does not grant any legally enforceable or contractual rights or obligations to its holders or purchasers. Any functionalities accessible through the underlying technology are of a purely technical or operational nature and do not constitute rights comparable to ownership, profit participation, governance, or similar entitlements known from traditional financial instruments. Accordingly, holders do not acquire any legally enforceable claim against the issuer of the crypto-asset or any third party.

As the crypto-asset does not confer any legally enforceable rights or obligations, there are no applicable procedures or conditions for their exercise. Any interaction or functionality that may be available within the project’s technical infrastructure – such as participation mechanisms or protocol-level features – serves operational purposes only and does not create, evidence, or constitute any contractual or statutory entitlement.

As the crypto-asset does not confer any legally enforceable rights or obligations, there are no conditions or mechanisms for modifying such rights or obligations. Adjustments to the technical protocol, smart contract logic, or related systems may occur in the ordinary course of development or maintenance. Such changes do not alter the legal position of holders, as no contractual rights exist and no rights arise under applicable law or regulation. Holders should not interpret technical updates or governance-related changes as amendments to legally binding entitlements.

Information on future offers to the public of crypto-assets was not available at the time of writing this white paper (2026-08-20).

The crypto-assets themselves are not subject to any technical or contractual transfer restrictions and are generally freely transferable. However, crypto-asset service providers may impose restrictions on buyers or sellers in accordance with applicable laws, internal policies or contractual terms agreed with their clients.

Not applicable.

This white paper is submitted in the context of an application for admission to trading on a trading platform established in the European Union. Accordingly, this white paper shall be governed by the laws of the Federal Republic of Germany.

Any disputes arising in relation to this white paper or the admission to trading may be brought before the competent courts in Hamburg, Germany.

The crypto-asset in scope is native to the Flow network and follows the standards described below.

The crypto-asset in scope is native to the Flow network and follows the standards described below.

The following applies to Flow:

Flow uses a role-specialised distributed-ledger architecture comprising Collection, Consensus, Execution, Verification and Access Nodes. Collection Nodes receive and group transactions; Consensus Nodes order transactions into blocks; Execution and Verification Nodes respectively compute and verify transaction results; and Access Nodes provide network API and RPC access.

Flow accounts use protocol-assigned hexadecimal addresses and may hold multiple keys with weighted signing thresholds. Supported cryptographic standards include ECDSA using the P-256 and secp256k1 curves, with SHA2-256 or SHA3-256 hashing. Network and language changes are documented through the Flow Improvement Proposal process.

Each block includes a header and payload. The header contains, among other elements, the block identifier, parent-block identifier, height, timestamp and payload hash. The block identifier is derived by applying SHA3-256 to the header.

The crypto-asset in scope is native to the Flow network and follows the standards described below.

The following applies to Flow:

Smart contracts may be deployed in Cadence, Flow's resource-oriented programming language. Flow also provides an EVM-compatible environment for Solidity smart contracts. EVM transactions are processed through the Flow network and use the same underlying consensus process. The mainnet EVM environment uses chain identifier 747. A native bridge supports transfers of supported assets between the Cadence and EVM environments.

The crypto-asset in scope is native to the Flow network and follows the standards described below.

The following applies to Flow:

Flow uses a proof-of-stake consensus arrangement with specialised node roles. Consensus Nodes use Jolteon, a Byzantine fault-tolerant protocol in the HotStuff family, to agree on the order of transactions and to finalise blocks.

Jolteon uses pipelined block production and deterministic finality. Once a block has been finalised, its position in the chain cannot subsequently be changed. Finalisation establishes transaction order; transaction results are subsequently computed by Execution Nodes and checked by Verification Nodes before the relevant block is sealed.

The crypto-asset in scope is native to the Flow network and follows the standards described below.

The following applies to Flow:

Operators of nodes in the Collection, Consensus, Execution and Verification roles must stake FLOW, subject to the minimum stake applicable to each role. Subject to the protocol's applicable conditions, those node operators and delegators may receive FLOW-denominated rewards. Direct stake slashing is not currently enforced by the protocol or the staking contract. A node that fails to participate adequately may instead have its rewards for the relevant epoch reduced, without affecting its staked FLOW. Access Nodes are also staked but are not eligible for staking rewards.

Transactions require a fee payable in FLOW. The fee consists of an inclusion component and an execution component, multiplied by a surge factor that may increase under network load. Fees collected by the protocol contribute to the reward pool and reduce the amount of new FLOW required to fund staking rewards.

Accounts must maintain the applicable storage balance. Storage deposits are reserved rather than spent and are released when the associated storage is released. Fee, storage and reward parameters may be amended through the applicable governance process.

Not applicable, as the DLT is not operated by the issuer, the offeror, the person seeking admission to trading, or any third party acting on their behalf.

1. Regulatory and Compliance

Regulatory frameworks applicable to crypto-asset services in the European Union and in third countries are evolving. Supervisory authorities may introduce, interpret, or enforce rules that affect (i) the eligibility of this crypto-asset for admission to trading, (ii) the conditions under which a crypto-asset service provider may offer trading, custody, or transfer services for it, or (iii) the persons or jurisdictions to which such services may be provided. As a result, the crypto-asset service provider admitting this crypto-asset to trading may be required to suspend, restrict, or terminate trading or withdrawals for regulatory reasons, even if the crypto-asset itself continues to function on its underlying network.

2. Trading venue and connection risk

Trading in the crypto-asset depends on the uninterrupted operation of the trading venues on which it is listed and, where applicable, on its technical connections to external liquidity sources or venues. Interruptions such as system downtime, maintenance, faulty integrations, API changes, or failures at an external venue can temporarily prevent order placement, execution, deposits, or withdrawals, even when the underlying blockchain is functioning. In addition, trading platforms in emerging markets may operate under differing governance, compliance, and oversight standards, which can increase the risk of operational failures or disorderly market conditions.

3. Market formation and liquidity conditions

The price and tradability of the crypto-asset depend on actual trading activity on the venues to which the service provider is connected, whether centralised exchanges (CEXs) or decentralised exchanges (DEXs). Trading volumes may at times be low, order books thin, or liquidity concentrated on a single venue. In such conditions, buy or sell orders may not be executed in full or may be executed only at a less favourable price, resulting in slippage.

Volatility: The market price of the crypto-asset may fluctuate significantly over short periods, including for reasons that are not linked to changes in the underlying project or protocol. Periods of limited liquidity, shifts in overall market sentiment, or trading on only a small number of CEXs or DEXs can amplify these movements and lead to higher slippage when orders are executed. As a result, investors may be unable to sell the crypto-asset at or close to a previously observed price, even where no negative project-specific event has occurred.

4. Counterparty and service provider dependence

The admission of the crypto-asset to trading may rely on several external parties, such as connected centralised or decentralised trading venues, liquidity providers, brokers, custodians, or technical integrators. If any of these counterparties fail to perform, suspend their services, or apply internal restrictions, the trading, deposit, or withdrawal of the crypto-asset on the listing crypto-asset service provider can be interrupted or halted.

Quality of counterparties: Trading venues and service providers in certain jurisdictions may operate under regulatory or supervisory standards that are lower or differently enforced than those applicable in the European Union. In such environments, deficiencies in governance, risk management, or compliance may remain undetected, which increases the probability of abrupt service interruptions, investigations, or forced wind-downs.

Delisting and service suspension: The crypto-asset’s availability may depend on the internal listing decisions of these counterparties. A delisting or suspension on a key connected venue can materially reduce liquidity or make trading temporarily impossible on the admitting service provider, even if the underlying crypto-asset continues to function.

Insolvency of counterparties: If a counterparty involved in holding, routing, or settling the crypto-asset becomes insolvent, enters restructuring, or is otherwise subject to resolution measures, assets held or processed by that counterparty may be frozen, become temporarily unavailable, or be recoverable only in part or not at all, which can result in losses for clients whose positions were maintained through that counterparty. This risk applies in particular where client assets are held on an omnibus basis or where segregation is not fully recognised in the counterparty’s jurisdiction.

5. Operational and information risks

Due to the irrevocability of blockchain transactions, incorrect transaction approvals or the use of wrong networks or addresses will typically make the transferred funds irrecoverable. Because trading may also rely on technical connections to other venues or service providers, downtime or faulty code in these connections can temporarily block trading, deposits, or withdrawals even when the underlying blockchain is functioning. In addition, different groups of market participants may have unequal access to technical, governance, or project-related information, which can lead to information asymmetry and place less informed investors at a disadvantage when making trading decisions.

6. Market access and liquidity concentration risk

If the crypto-asset is only available on a limited number of trading platforms or through a single market-making entity, this may result in reduced liquidity, greater price volatility, or periods of inaccessibility for retail holders.

1. Insolvency of the issuer

As with any commercial entity, the issuer may face insolvency risks. These may result from insufficient funding, low market interest, mismanagement, or external shocks (e.g. pandemics, armed conflicts). In such a case, ongoing development, support, and governance of the project may cease, potentially affecting the viability and tradability of the crypto-asset.

2. Legal and regulatory risks

The issuer operates in a dynamic and evolving regulatory environment. Failure to comply with applicable laws or regulations in relevant jurisdictions may result in enforcement actions, penalties, or restrictions on the project’s operations. These may negatively impact the crypto-asset’s availability, market acceptance, or legal status.

3. Operational risks

The issuer may fail to implement adequate internal controls, risk management, or governance processes. This can result in operational disruptions, financial losses, delays in updating the white paper, or reputational damage.

4. Governance and decision-making

The issuer’s management body is responsible for key strategic, operational, and disclosure decisions. Ineffective governance, delays in decision-making, or lack of resources may compromise the stability of the project and its compliance with MiCA requirements. High concentration of decision-making authority or changes in ownership/control can amplify these risks.

5. Reputational risks

The issuer’s reputation may be harmed by internal failures, external accusations, or association with illicit activity. Negative publicity can reduce trust in the issuer and impact the perceived legitimacy or value of the crypto-asset.

6. Counterparty dependence

The issuer may depend on third-party providers for certain core functions, such as technology development, marketing, legal advice, or infrastructure. If these partners discontinue their services, change ownership, or underperform, the issuer’s ability to operate the project or maintain investor communication may be impaired. This could disrupt project continuity or undermine market confidence, ultimately affecting the crypto-asset’s value.

1. Valuation risk

The crypto-asset does not represent a claim, nor is it backed by physical assets or legal entitlements. Its market value is driven solely by supply and demand dynamics and may fluctuate significantly. In the absence of fundamental value anchors, such assets can lose their entire market value within a very short time. Historical market behaviour has shown that some types of crypto-assets have become worthless. Investors should be aware that this crypto-asset may lose all of its value.

2. Market volatility risk

Crypto-asset prices can fluctuate sharply due to changes in market sentiment, macroeconomic conditions, regulatory developments, or technology trends. Such volatility may result in rapid and significant losses. Holders should be prepared for the possibility of losing the full amount invested.

3. Liquidity and price-determination risk

Low trading volumes, fragmented trading across venues, or the absence of active market makers can restrict the ability to buy or sell the crypto-asset. In such situations, it is not guaranteed that an observable market price will exist at all times. Spreads may widen materially, and orders may only be executable under unfavourable conditions, which can make liquidation costly or temporarily impossible.

4. Crypto-asset security risk

Loss or theft of private keys, unauthorised access to wallets, or failures of custodial or exchange service providers can result in the irreversible loss of assets. Because blockchain transactions are final, recovery of funds after a compromise is generally impossible.

5. Fraud and scam risk

The pseudonymous and irreversible nature of blockchain transactions can attract fraudulent schemes. Typical forms include fake or unauthorised crypto-assets imitating established ones, phishing attempts, deceptive airdrops, or social-engineering attacks. Investors should exercise caution and verify the authenticity of counterparties and information sources.

6. Legal and regulatory reclassification risk

Legislative or regulatory changes in the European Union or in the Member State where the crypto-asset is admitted to trading may alter its legal classification, permitted uses, or tradability. In third countries, the crypto-asset may be treated as a financial instrument or security, which can restrict its offering, trading, or custody.

7. Absence of investor protection

The crypto-asset is not covered by investor-compensation or deposit-guarantee schemes. In the event of loss, fraud, or insolvency of a service provider, holders may have no access to recourse mechanisms typically available in regulated financial markets.

8. Counterparty risk

Reliance on third-party exchanges, custodians, or intermediaries exposes holders to operational failures, insolvency, or fraud of these parties. Investors should conduct due diligence on service providers, as their failure may lead to the partial or total loss of held assets.

9. Reputational risk

Negative publicity related to security incidents, misuse of blockchain technology, or associations with illicit activity can damage public confidence and reduce the crypto-asset’s market value.

10. Community and sentiment risk

Because the crypto-asset’s perceived relevance and expected future use depend largely on community engagement and the prevailing sentiment, a loss of public interest, negative coverage or reduced activity of key contributors can materially reduce market demand.

11. Macroeconomic and interest-rate risk

Fluctuations in interest rates, exchange rates, general market conditions, or overall market volatility can influence investor sentiment towards digital assets and affect the crypto-asset’s market value.

12. Taxation risk

Tax treatment varies across jurisdictions. Holders are individually responsible for complying with all applicable tax laws, including the reporting and payment of taxes arising from the acquisition, holding, or disposal of the crypto-asset.

13. Anti-money-laundering and counter-terrorist financing risk

Wallet addresses or transactions connected to the crypto-asset may be linked to sanctioned or illicit activity. Regulatory responses to such findings may include transfer restrictions, reporting obligations, or the freezing of assets on certain venues.

14. Market-abuse risk

Due to limited oversight and transparency, crypto-assets may be vulnerable to market-abuse practices such as spoofing, pump-and-dump schemes, or insider trading. Such activities can distort prices and expose holders to sudden losses.

15. Legal ownership and jurisdictional risk

Depending on the applicable law, holders of the crypto-asset may not have enforceable ownership rights or effective legal remedies in cases of disputes, fraud, or service failure. In certain jurisdictions, access to exchanges or interfaces may be restricted by regulatory measures, even if on-chain transfer remains technically possible.

16. Concentration risk

A large proportion of the total supply may be held by a small number of holders. This can enable market manipulation, governance dominance, or sudden large-scale liquidations that adversely affect market stability, price levels, and investor confidence.

As this white paper relates to admission to trading of the crypto-asset, the risk description below reflects general implementation risks typically associated with crypto-asset projects and relevant for the crypto-asset service provider. The party admitting the crypto-asset to trading is not involved in the project’s implementation and does not assume responsibility for its governance, funding, or execution.

Delays, failures, or changes in the implementation of the project as outlined in its public roadmap or technical documentation may negatively impact the perceived credibility or usability of the crypto-asset. This includes risks related to project governance, resource allocation, technical delivery, and team continuity.

1. Key-person risk: The project may rely on a limited number of individuals for development, maintenance, or strategic direction. The departure, incapacity, or misalignment of these individuals may delay or derail the implementation.

2. Timeline and milestone risk: Project milestones may not be met as announced. Delays in feature releases, protocol upgrades, or external integrations can undermine market confidence and affect the adoption, use, or value of the crypto-asset.

3. Delivery risk: Even if implemented on time, certain functionalities or integrations may not perform as intended or may be scaled back during execution, limiting the crypto-asset’s practical utility.

As this white paper relates to admission to trading of the crypto-asset, the following risks concern the underlying distributed ledger technology (DLT), its supporting infrastructure, and related technical dependencies. Failures or vulnerabilities in these systems may affect the availability, integrity, or transferability of the crypto-asset.

1. Blockchain dependency risk

The functionality of the crypto-asset depends on the continuous and stable operation of the blockchain(s) on which it is issued. Network congestion, outages, or protocol errors may temporarily or permanently disrupt on-chain transactions. Extended downtime or degradation in network performance can affect trading, settlement, or the usability of the crypto-asset.

2. Protocol and software vulnerability risk

The protocol rules, client software implementations, execution environments, consensus components, or other technical elements relevant to the crypto-asset that is the subject of this white paper and transactions on its underlying network may contain coding errors or security vulnerabilities. Exploitation of such weaknesses could result in loss of crypto-assets, unauthorised or unintended transactions, disruption of network functionality, or other unintended effects. Security reviews, audits and testing may not identify all vulnerabilities before they are exploited.

This risk has materialised (source: https://flow.com/post/dec-27-technical-post-mortem, accessed 2026-08-20). On 27 December 2025 a type confusion vulnerability in the Cadence runtime was exploited to duplicate 87,960,930,222 FLOW and further fungible tokens, causing a realised loss of approximately USD 3.9 million. Because the exploit duplicated existing units rather than invoking minting functions, the additional units were not recorded in contract-level supply accounting. Validators halted the network within six hours of the first malicious transaction, the vulnerability was patched, and write access was restored on 2025-12-29 and full operation resumed on 2026-01-02. No legitimate holder balances were accessed.

3. Wallet and key-management risk

The custody of crypto-assets relies on secure private key management. Loss, theft, or compromise of private keys results in irreversible loss of access. Custodians, trading venues, or wallet providers may be targeted by cyberattacks. Compatibility issues between wallet software and changes to the blockchain protocol (e.g. network upgrades) can further limit user access or the ability to transfer the crypto-asset.

Outdated or vulnerable wallet software:

Users relying on outdated, unaudited, or unsupported wallet software may face compatibility issues, security vulnerabilities, or failures when interacting with the blockchain. Failure to update wallet software in line with protocol developments can result in transaction errors, loss of access, or exposure to known exploits.

4. Network security risks

Attack risks: Blockchains may be subject to denial-of-service (DoS) attacks, 51% attacks, or other exploits targeting the consensus mechanism. These can delay transactions, compromise finality, or disrupt the accurate recording of transfers.

Centralisation concerns: Despite claims of decentralisation, a relatively small number of validators or a high concentration of stake may increase the risk of collusion, censorship, or coordinated network downtime, which can affect the resilience and operational reliability of the crypto-asset.

5. Bridge and interoperability risk

Where tokens can be bridged or wrapped across multiple blockchains, vulnerabilities in bridge protocols, validator sets, or locking mechanisms may result in loss, duplication, or misrepresentation of assets. Exploits or technical failures in these systems can instantly impact circulating supply, ownership claims, or token fungibility across chains.

6. Forking and protocol-upgrade risk

Network upgrades or disagreements among node operators or validators can result in blockchain “forks”, where the blockchain splits into two or more incompatible versions that continue separately from a shared past. This may lead to duplicate token representations or incompatibilities between exchanges and wallets. Until consensus stabilises, trading or transfers may be disrupted or misaligned. Such situations may be difficult for retail holders to navigate, particularly when trading platforms or wallets display inconsistent token information.

7. Economic-layer and abstraction risk

Mechanisms such as gas relayers, wrapped tokens, or synthetic representations may alter the transaction economics of the underlying token. Changes in transaction costs, token demand, or utility may reduce its usage and weaken both its economic function and perceived value within its ecosystem.

8. Spam and network-efficiency risk

High volumes of low-value (“dust”) or automated transactions may congest the network, slow validation times, inflate ledger size, and raise transaction costs. This can impair performance, reduce throughput, and expose address patterns to analysis, thereby reducing network efficiency and privacy.

9. Front-end and access-interface risk

If users rely on centralised web interfaces or hosted wallets to interact with the blockchain, service outages, malicious compromises, or domain expiries affecting these interfaces may block access to the crypto-asset, even while the blockchain itself remains fully functional. Dependence on single web portals introduces a critical point of failure outside the DLT layer.

10. Decentralisation claim risk

While the technical infrastructure may appear distributed, the actual governance or economic control of the project may lie with a small set of actors. This disconnect between marketing claims and structural reality can lead to regulatory scrutiny, reputational damage, or legal uncertainty – especially if the project is presented as ‘community-governed’ without substantiation.

None.

The crypto-asset in scope is native to the Flow network and follows the standards described below.

The following applies to Flow:

Flow uses a proof-of-stake consensus arrangement with specialised node roles. Consensus Nodes use Jolteon, a Byzantine fault-tolerant protocol in the HotStuff family, to agree on the order of transactions and to finalise blocks.

Jolteon uses pipelined block production and deterministic finality. Once a block has been finalised, its position in the chain cannot subsequently be changed. Finalisation establishes transaction order; transaction results are subsequently computed by Execution Nodes and checked by Verification Nodes before the relevant block is sealed.

The crypto-asset in scope is native to the Flow network and follows the standards described below.

The following applies to Flow:

Operators of nodes in the Collection, Consensus, Execution and Verification roles must stake FLOW, subject to the minimum stake applicable to each role. Subject to the protocol's applicable conditions, those node operators and delegators may receive FLOW-denominated rewards. Direct stake slashing is not currently enforced by the protocol or the staking contract. A node that fails to participate adequately may instead have its rewards for the relevant epoch reduced, without affecting its staked FLOW. Access Nodes are also staked but are not eligible for staking rewards.

Transactions require a fee payable in FLOW. The fee consists of an inclusion component and an execution component, multiplied by a surge factor that may increase under network load. Fees collected by the protocol contribute to the reward pool and reduce the amount of new FLOW required to fund staking rewards.

Accounts must maintain the applicable storage balance. Storage deposits are reserved rather than spent and are released when the associated storage is released. Fee, storage and reward parameters may be amended through the applicable governance process.

For the calculation of energy consumption, the so-called 'bottom-up' approach is used. The nodes are considered to be the central factor in the energy consumption of the network. These assumptions are made on the basis of empirical findings obtained through the use of public information sites, open-source crawlers and crawlers developed in-house. The main determinants for estimating the hardware used within the network are the requirements for operating the client software. The energy consumption of the hardware devices was measured in certified test laboratories.

The information regarding the hardware used and the number of participants in the network is based on assumptions that are verified on a best-effort basis using empirical data. In general, participants are assumed to be largely economically rational. As a precautionary principle, we make conservative assumptions when in doubt, i.e. making higher estimates of the adverse impacts.

To determine the proportion of renewable energy usage, the locations of the nodes are determined using public information sites, open-source and in-house-developed crawlers. Where no information is available on the geographic distribution of nodes, comparable reference networks are used, taking into account similarities in incentivisation structure and consensus mechanism. This geographic information is then combined with publicly available data from Our World in Data. The resulting intensity is calculated as the marginal energy consumption with respect to one additional transaction.

Ember (2025); Energy Institute, Statistical Review of World Energy (2024), with major processing by Our World in Data. “Share of electricity generated by renewables - Ember and Energy Institute” [dataset]. Underlying sources: Ember, “Yearly Electricity Data Europe”; Ember, “Yearly Electricity Data”; Energy Institute, “Statistical Review of World Energy”. Retrieved from: https://ourworldindata.org/grapher/share-electricity-renewables

To determine GHG emissions, the locations of the nodes are determined using public information sites, open-source crawlers, and crawlers developed in-house. Where no information is available on the geographic distribution of nodes, comparable reference networks are used, taking into account similarities in incentivisation structure and consensus mechanism. This geographic information is then combined with publicly available data from Our World in Data. The resulting intensity is calculated as the marginal emission intensity with respect to one additional transaction.

Ember (2025); Energy Institute, Statistical Review of World Energy (2024), with major processing by Our World in Data. “Carbon intensity of electricity generation – Ember and Energy Institute” [dataset]. Underlying sources: Ember, “Yearly Electricity Data Europe”; Ember, “Yearly Electricity Data”; Energy Institute, “Statistical Review of World Energy”. Retrieved from: https://ourworldindata.org/grapher/carbon-intensity-electricity. Licensed under CC BY 4.0.