AML Policy

1.1. Purpose

This Anti-Money Laundering, Counter-Terrorist Financing, Sanctions Compliance and Know Your Customer Policy (the "Policy") establishes the principles, procedures, responsibilities and internal controls adopted by (the "Company") to prevent, detect and mitigate the risks associated with money laundering, terrorist financing, proliferation financing, financial sanctions violations, fraud and other financial crimes.

The Company is committed to conducting its business transparently, responsibly and in accordance with applicable laws, regulatory requirements and internationally recognised AML/CFT standards.

1.2. Objectives

The principal objectives of this Policy are to:

1. a) Prevent the Company's products, services and infrastructure from being used for unlawful purposes;
2. b) Establish appropriate customer identification and verification procedures;
3. c) Identify and assess money laundering and terrorist financing risks associated with customers, products, transactions and geographical locations;
4. d) Implement a risk-based approach to customer onboarding and ongoing monitoring;
5. e) Establish procedures for identifying and escalating suspicious activities;
6. f) Ensure compliance with applicable financial sanctions and restrictive measures;
7. g) Define the responsibilities of the Company and its external financial service providers;
8. h) Establish appropriate recordkeeping, reporting and confidentiality standards;
9. i) Promote a culture of compliance throughout the Company.

1.3. Scope

This Policy applies to:

• All directors, officers, employees and relevant contractors of the Company;
• All individuals applying for or using the Company's services;
• All legal entities applying for or using the Company's services;
• All payment card products made available through the Company's platform;
• All customer onboarding, account management and transaction-related activities within the Company's operational responsibility;
• Third-party service providers performing AML/KYC-related functions on behalf of the Company, to the extent governed by contractual arrangements.

2.1. Business Activities

The Company operates a financial technology platform that facilitates access to payment card products and related services.

Such products may include virtual payment cards, physical payment cards, prepaid cards, debit cards and other card-based payment solutions, depending on the arrangements with the Company's financial partners.

The Company may provide:

1. a) Customer registration and account management interfaces;
2. b) Access to payment card issuance and management functionality;
3. c) Technical integration with financial institutions and payment service providers;
4. d) Customer support and operational assistance;
5. e) Transaction information and card management tools;
6. f) Other ancillary services permitted under applicable law and relevant contractual arrangements.

2.2. Third-Party Card Issuance

Payment cards made available through the Company's platform are issued by duly authorised third-party financial institutions, electronic money institutions, payment institutions or other eligible issuing entities, as applicable.

The Company does not represent itself as the legal issuer of payment cards unless it has obtained the relevant authorisation.

The issuing institution remains responsible for the regulatory obligations legally assigned to it, including those relating to card issuance, regulated payment services and applicable AML/CFT requirements.

The Company's role and responsibilities are determined by its actual activities, applicable legislation and contractual arrangements with the relevant partners.

2.3. Regulatory Classification

The Company's regulatory obligations shall be determined by its actual business activities, applicable legislation and contractual arrangements with its financial partners.

The Company shall comply with the requirements applicable to its role and shall not assume regulatory responsibilities assigned to financial partners solely by virtue of facilitating access to their services.

2.4. Reliance on Financial Partners

The Company may rely on authorised financial partners or qualified external providers to perform certain customer identification, verification, screening and monitoring functions, where legally and contractually permitted.

Such reliance shall not automatically transfer or eliminate the Company's own statutory responsibilities.

The Company shall maintain sufficient oversight to ensure that relevant compliance requirements are satisfied.

3.1. General Framework

The Company is committed to conducting its business in accordance with applicable anti-money laundering, counter-terrorist financing, sanctions compliance and financial crime prevention requirements.

The Company's compliance framework is based on internationally recognised principles and standards, including:

1. a) The recommendations and guidance issued by the Financial Action Task Force (FATF);
2. b) International standards relating to customer due diligence, beneficial ownership transparency and risk-based financial crime prevention;
3. c) Applicable anti-money laundering and counter-terrorist financing legislation;
4. d) Applicable financial sanctions and restrictive measures;
5. e) Relevant regulatory guidance and supervisory expectations;
6. f) Applicable data protection and confidentiality requirements;
7. g) Compliance requirements established by the Company's financial institutions, card issuers, payment service providers and other regulated partners.

3.2. Application of Legal Requirements

The Company shall comply with all laws and regulatory requirements applicable to its activities, taking into account its business model, regulatory status, geographical operations and contractual relationships.

The Company shall implement appropriate compliance controls proportionate to the nature, scale and complexity of its operations.

3.3. Regulatory Developments

The designated person responsible for compliance shall monitor relevant regulatory developments and assess their impact on the Company's operations.

This Policy and related internal procedures shall be updated where necessary to reflect changes in applicable requirements or identified financial crime risks.

3.4. Conflicts of Requirements

Where applicable legislation imposes stricter requirements than those established under this Policy, the applicable legal requirements shall prevail.

Additional requirements imposed by financial partners shall be implemented to the extent consistent with applicable law and the Company's contractual obligations.

4.1. Senior Management

The Company's senior management is responsible for establishing and maintaining an appropriate compliance framework.

Its responsibilities include:

1. a) Approving this Policy and material amendments;
2. b) Establishing an appropriate risk appetite;
3. c) Allocating adequate compliance resources;
4. d) Ensuring effective oversight of AML/CFT risks;
5. e) Reviewing material compliance incidents and deficiencies;
6. f) Ensuring that corrective measures are implemented.

4.2. Compliance Responsibility

The Company shall assign responsibility for coordinating compliance-related matters to an appropriate employee, officer or other authorised person, taking into account its organisational structure and applicable legal requirements.

A formally designated Compliance Officer or Money Laundering Reporting Officer shall be appointed where required by applicable law.

The designated person may perform or coordinate the following functions, as applicable:

1. a) Maintain and update AML/KYC procedures;
2. b) Oversee customer risk assessment and screening arrangements;
3. c) Review escalated compliance alerts;
4. d) Coordinate with issuing institutions and verification providers;
5. e) Maintain relevant compliance records;
6. f) Coordinate staff training;
7. g) Report material compliance issues to senior management;
8. h) Coordinate legally required communications with competent authorities;
9. i) Review the effectiveness of internal controls.

4.3. Employees

All relevant employees must:

• Comply with this Policy;
• Complete required compliance training;
• Identify and escalate suspicious circumstances;
• Maintain confidentiality;
• Avoid facilitating transactions or relationships prohibited by applicable law;
• Cooperate with compliance reviews and investigations.

4.4. Internal Decision-Making

The Company shall organise compliance-related decision-making in a manner appropriate to its size, operational structure and risk exposure.

Additional review or approval procedures may be applied where necessary or required by applicable law or contractual obligations.

5.1. General Principle

The Company adopts a risk-based approach to AML/CFT compliance.

The level of customer due diligence, verification and monitoring shall be proportionate to the risks identified.

5.2. Business-Wide Risk Assessment

The Company shall assess relevant financial crime risks associated with its business activities using an approach proportionate to its role, operational capabilities and applicable requirements.

Formal risk assessments and periodic reviews shall be conducted where required by applicable law, contractual obligations or the nature of identified risks.

The assessment shall consider:

1. a) Customer types and characteristics;
2. b) Geographical exposure;
3. c) Card product functionality;
4. d) Transaction channels and payment methods;
5. e) Transaction values, frequency and velocity;
6. f) Distribution and onboarding channels;
7. g) Reliance on external financial institutions;
8. h) Exposure to fraud, identity theft and misuse of payment instruments;
9. i) Emerging financial crime typologies.

5.3. Customer Risk Classification

Customers shall be classified into the following categories:

Low Risk: Customers presenting limited identifiable risk factors and meeting the criteria for lower-risk treatment under applicable law.

Standard Risk: Customers whose characteristics and anticipated activities fall within the Company's normal risk appetite.

High Risk: Customers presenting elevated money laundering, terrorist financing, sanctions, fraud or other financial crime risks.

5.4. Risk Indicators

Relevant indicators may include:

• Country of residence or incorporation;
• Citizenship and geographical connections, assessed in a non-discriminatory manner;
• Customer occupation or business activity;
• Complexity of ownership and control;
• Source of funds;
• Expected transaction activity;
• Political exposure;
• Adverse media;
• Unusual card usage patterns;
• Transactions involving higher-risk jurisdictions;
• Inconsistent or unverifiable information.

No single risk factor shall automatically determine the customer's overall risk classification unless a mandatory legal restriction or specific risk rule requires such treatment.

5.5. Risk Acceptance

The Company shall not establish or continue a relationship where the relevant risk cannot be adequately mitigated or where the relationship would violate applicable law.

High-risk relationships shall be subject to additional review or approval where required by applicable law, contractual obligations or the Company's internal procedures.

6.1. Customer Due Diligence

The Company shall ensure that appropriate Customer Due Diligence (CDD) measures are performed before a customer is permitted to access regulated card functionality, except where applicable law expressly permits deferred verification.

CDD measures shall include, as applicable:

1. a) Identifying the customer;
2. b) Verifying the customer's identity using reliable and independent information;
3. c) Understanding the purpose and intended nature of the relationship;
4. d) Assessing the customer's risk profile;
5. e) Conducting sanctions and PEP screening;
6. f) Obtaining additional information where necessary.

6.2. Identification Information

For individual customers, the following information may be collected:

• Full legal name;
• Date of birth;
• Nationality;
• Residential address;
• Country of residence;
• Identity document type and number;
• Document issuing country;
• Document expiration date;
• Contact information;
• Occupation or economic activity;
• Intended purpose of card usage;
• Expected transaction activity.

Additional information may be required based on risk assessment, applicable law or issuing partner requirements.

6.3. Identity Verification

Identity verification may be performed through:

1. a) Government-issued identification documents;
2. b) Electronic identity verification systems;
3. c) Document authenticity checks;
4. d) Biometric verification and liveness detection, where lawful and appropriately safeguarded;
5. e) Qualified third-party identity verification services;
6. f) Other reliable and legally permitted verification methods.

The Company shall ensure that verification methods are appropriate to the relevant risk level.

6.4. Incomplete or Unsuccessful Verification

Where required verification cannot be completed, the Company shall not activate the relevant card functionality.

The Company may request additional information, reject the application or refer the case for manual compliance review.

Any legally required suspicious activity reporting obligations shall be considered separately.

6.5. Periodic Review

Customer information shall be reviewed and updated as appropriate, taking into account applicable legal requirements, identified risks and the Company's operational responsibilities.

Examples include:

• Material changes in personal information;
• Expiration of identification documents;
• Unusual transaction activity;
• New sanctions or PEP matches;
• Material changes in geographical exposure;
• Requests from competent authorities or issuing partners.

7.1. Corporate Customer Due Diligence

The Company shall apply appropriate Know Your Business (KYB) procedures to legal entities seeking access to its services.

The purpose of KYB is to establish the customer's legal existence, ownership and control structure, authorised representatives and legitimate business purpose.

7.2. Corporate Information

The Company may collect:

1. a) Full registered legal name;
2. b) Registration number;
3. c) Country and date of incorporation;
4. d) Registered office address;
5. e) Principal business address;
6. f) Legal form;
7. g) Nature of business activities;
8. h) Corporate website, where available;
9. i) Expected use of card products;
10. j) Expected transaction volumes;
11. k) Details of directors and authorised representatives;
12. l) Ownership and control information;
13. m) Beneficial ownership information.

7.3. Corporate Documents

Relevant supporting documents may include:

• Certificate of incorporation or equivalent;
• Recent company registry extract;
• Constitutional documents;
• Register of directors;
• Shareholder register or ownership structure chart;
• Authorisation documents for persons acting on behalf of the entity;
• Identification documents of relevant individuals;
• Additional evidence of business activities where required.

Equivalent reliable electronic registry information may be accepted where legally permissible.

7.4. Ultimate Beneficial Owners

The Company shall identify the natural persons who ultimately own or control a corporate customer.

Beneficial ownership identification shall follow applicable legal thresholds and control tests, including indirect ownership and control through other means.

Where no beneficial owner can be identified after reasonable and documented measures, the Company shall follow the applicable legal procedure for identifying relevant senior managing officials.

Such identification does not eliminate the obligation to investigate unusual or opaque ownership structures.

7.5. Authorised Representatives

The Company shall verify the identity and authority of individuals acting on behalf of corporate customers.

Appropriate evidence of authority may include corporate resolutions, powers of attorney, registry information or other legally acceptable documentation.

7.6. Business Purpose

The Company shall establish a reasonable understanding of the corporate customer's business model and intended use of card products.

Particular attention shall be paid to:

1. a) Companies with unclear commercial activities;
2. b) Complex or opaque ownership structures;
3. c) Entities incorporated in higher-risk jurisdictions;
4. d) Businesses involving elevated fraud or financial crime risks;
5. e) Unexplained discrepancies between declared activities and actual card usage.

8.1. Application

Enhanced Due Diligence (EDD) shall be applied where required by law or where the customer's risk profile warrants additional controls.

8.2. Enhanced Measures

EDD may include:

1. a) Obtaining additional identity or corporate documentation;
2. b) Establishing source of funds and, where relevant, source of wealth;
3. c) Obtaining further information about the intended relationship;
4. d) Reviewing the customer's business activities;
5. e) Conducting enhanced adverse media checks;
6. f) Increasing transaction monitoring intensity;
7. g) Obtaining senior management approval;
8. h) Applying additional transaction or product restrictions.

8.3. Politically Exposed Persons

The Company shall implement procedures to identify politically exposed persons (PEPs), relevant family members and known close associates, in accordance with applicable law.

Where required, the Company shall:

• Obtain appropriate senior management approval;
• Establish source of wealth and source of funds;
• Apply enhanced ongoing monitoring;
• Review the relationship periodically.

PEP status shall not automatically result in rejection where the relationship is lawful and the associated risks can be adequately managed.

8.4. High-Risk Jurisdictions

The Company shall apply the legally required enhanced measures to customers or transactions involving jurisdictions designated as high-risk under applicable requirements.

Additional geographical risk factors may be considered based on FATF publications, sanctions exposure and reliable risk intelligence.

9.1. General Requirements

The Company shall maintain controls designed to prevent prohibited dealings with sanctioned persons, entities and other restricted parties.

9.2. Screening Subjects

Screening shall cover, as appropriate:

1. a) Individual customers;
2. b) Corporate customers;
3. c) Beneficial owners;
4. d) Directors and authorised representatives;
5. e) Relevant transaction counterparties, where information is available;
6. f) Other persons or entities required by law or partner agreements.

9.3. Sanctions Lists

The Company shall apply all sanctions and restrictive measures legally binding upon it, including applicable United Nations sanctions and relevant national or regional sanctions regimes.

Other sanctions regimes, including those maintained by the European Union, United Kingdom and United States, may be considered where legally applicable, contractually required or relevant to the Company's risk exposure.

The Company shall assess potential conflicts of laws and applicable restrictions on compliance with extraterritorial measures.

9.4. Screening Frequency

Sanctions screening shall be conducted at appropriate stages of the customer relationship, taking into account applicable legal requirements, identified risks and the screening arrangements maintained by the Company's financial partners.

The Company may rely on screening performed by relevant financial partners where such reliance is legally permissible and consistent with applicable contractual arrangements.

9.5. Potential Matches

Potential sanctions matches shall be reviewed to determine whether they represent true matches or false positives.

Where a match cannot be cleared, the Company shall restrict the relevant activity pending compliance review.

Confirmed matches shall be handled in accordance with applicable sanctions legislation, including any asset-freezing, non-availability, reporting or other mandatory requirements.

10.1. General Principles

The Company shall maintain a risk-based framework for monitoring activities conducted through its platform, proportionate to its access to transaction data and its operational responsibilities.

Transaction monitoring may be conducted by the Company, the issuing institution or another authorised service provider.

10.2. Monitoring Parameters

Relevant monitoring parameters may include:

1. a) Transaction frequency;
2. b) Transaction value;
3. c) Transaction velocity;
4. d) Geographic location;
5. e) Merchant category;
6. f) Transaction type;
7. g) Repeated failed authorisations;
8. h) Unusual payment patterns;
9. i) Changes in customer behaviour;
10. j) Activity inconsistent with the customer's declared profile.

10.3. Card-Specific Risk Indicators

Particular attention shall be given to:

• Multiple cards associated with the same customer or related customers;
• Rapid issuance and immediate high-volume use of cards;
• Unusual transaction velocity;
• Repeated transactions of similar amounts;
• Transactions structured to avoid established limits;
• Unexpected cross-border usage;
• Unusual concentration of transactions with specific merchants;
• Repeated refunds or reversals inconsistent with normal activity;
• Use of cards inconsistent with the customer's stated business purpose;
• Unusual funding or withdrawal patterns, where such functionality exists;
• Potential use of cards by unauthorised third parties.

These indicators shall be assessed in context and shall not automatically establish suspicious activity.

10.4. Monitoring Alerts

Monitoring alerts shall be reviewed according to their risk and urgency.

Where necessary, the Company may request additional information, refer the matter to the issuing partner, impose lawful restrictions or escalate the case for further investigation.

10.5. Partner Monitoring

Where transaction monitoring is performed by the issuing institution or another financial partner, the Company shall cooperate with such partner in accordance with the applicable contractual arrangements and its operational responsibilities.

Relevant cooperation arrangements may address:

1. a) Monitoring responsibilities;
2. b) Relevant alert-sharing procedures;
3. c) Escalation channels;
4. d) Emergency restrictions;
5. e) Information requests;
6. f) Incident handling;
7. g) Cooperation with competent authorities.

11.1. Identification

The Company shall maintain procedures for identifying circumstances that may indicate money laundering, terrorist financing, sanctions violations or other financial crime.

11.2. Internal Escalation

Employees shall promptly report suspicious circumstances to the designated person responsible for compliance through designated internal channels.

Reports shall include available relevant facts and supporting documentation.

11.3. Investigation

The designated person responsible for compliance shall assess reported circumstances and determine appropriate next steps.

The assessment may involve:

1. a) Reviewing customer information;
2. b) Examining available transaction history;
3. c) Requesting additional documentation;
4. d) Consulting relevant financial partners;
5. e) Assessing whether further restrictions are necessary;
6. f) Determining applicable reporting obligations.

11.4. External Reporting

Where the Company is legally subject to suspicious transaction or suspicious activity reporting requirements, reports shall be submitted to the competent Financial Intelligence Unit or other designated authority in accordance with applicable law.

Where the Company is not independently subject to such reporting obligations, it shall promptly escalate relevant information to the responsible regulated financial partner in accordance with applicable law and contractual procedures.

Partner notification shall not replace a direct statutory reporting obligation where one applies to the Company.

11.5. Tipping-Off Prohibition

The Company and its personnel shall not disclose the existence or content of suspicious activity reports or related investigations where such disclosure is prohibited by applicable law.

11.6. Cooperation with Authorities

The Company shall cooperate with competent authorities in accordance with applicable legal requirements.

Requests for customer information shall be assessed for legal validity, scope and confidentiality.

12.1. General Approach

The Company may obtain information regarding the source of funds used in connection with its services.

The extent of verification shall depend on applicable legal requirements, the customer's risk profile and the relevant product functionality.

12.2. Individual Customers

Relevant sources of funds may include:

• Employment income;
• Business income;
• Savings;
• Investment proceeds;
• Sale of assets;
• Inheritance or gifts;
• Other legitimate sources.

12.3. Corporate Customers

Relevant sources may include:

1. a) Operating revenue;
2. b) Shareholder contributions;
3. c) Business financing;
4. d) Investment proceeds;
5. e) Other legitimate corporate funding sources.

12.4. Supporting Evidence

Where appropriate, the Company may request bank statements, financial statements, employment evidence, contractual documentation or other reliable evidence.

The Company shall avoid collecting excessive information unrelated to the identified compliance purpose.

13.1. Prohibited Relationships

The Company shall not knowingly provide services to persons or entities where doing so would:

1. a) Violate applicable sanctions;
2. b) Facilitate money laundering or terrorist financing;
3. c) Involve fraudulent or unlawfully obtained identity information;
4. d) Violate applicable financial services laws;
5. e) Breach mandatory restrictions imposed by the issuing institution.

13.2. Restricted Business Categories

The Company may prohibit or restrict certain business categories based on its risk assessment and issuing partner requirements.

Such categories may include:

• Unlicensed financial services;
• Unlicensed gambling activities;
• Fraudulent investment schemes;
• Illicit goods and services;
• Unlawful virtual asset activities;
• Businesses associated with prohibited sanctions exposure;
• Other activities identified as unacceptable under the Company's risk appetite.

Lawful higher-risk activities may be subject to enhanced review rather than automatic prohibition, unless a specific restriction applies.

13.3. Circumvention

Customers shall not use the Company's services to circumvent verification requirements, transaction restrictions, sanctions or card network rules.

14.1. Risk Mitigation Measures

Subject to applicable law, customer agreements and the Company's contractual authority, the Company may:

1. a) Suspend onboarding;
2. b) Delay activation of card functionality;
3. c) Request additional documentation;
4. d) Restrict access to platform functionality;
5. e) Refer transactions for review;
6. f) Request the issuing institution to impose relevant card restrictions;
7. g) Terminate a customer relationship.

14.2. Card Blocking

Where the Company has contractual and technical authority to manage card status, it may initiate appropriate restrictions in accordance with applicable procedures.

Where card blocking or transaction execution is controlled by the issuing institution, the Company shall refer the matter to that institution.

The Company shall not represent that it can freeze customer funds or exercise statutory powers unless legally authorised.

14.3. Termination

Customer relationships may be terminated where:

• Required verification cannot be completed;
• The customer provides materially false information;
• The relationship presents unacceptable residual risk;
• Continued service would violate applicable law;
• The customer breaches material contractual restrictions.

Any remaining customer funds shall be handled by the legally responsible institution in accordance with applicable law and customer agreements.

15.1. General Principles

The Company may engage third-party providers for:

1. a) Identity verification;
2. b) Corporate verification;
3. c) Beneficial ownership screening;
4. d) Sanctions and PEP screening;
5. e) Fraud detection;
6. f) Transaction monitoring;
7. g) Payment card issuance;
8. h) Payment processing;
9. i) Compliance technology.

15.2. Provider Due Diligence

Before engaging a material provider, the Company shall assess, as appropriate:

• Legal identity and regulatory status;
• Reputation and relevant experience;
• Information security standards;
• Data protection arrangements;
• Operational resilience;
• Compliance capabilities;
• Contractual responsibilities;
• Subcontracting arrangements.

15.3. Contractual Controls

Relevant agreements shall address:

1. a) Scope of services;
2. b) Allocation of compliance responsibilities;
3. c) Information-sharing requirements;
4. d) Incident notification;
5. e) Confidentiality;
6. f) Data protection;
7. g) Record availability;
8. h) Audit or assurance rights, where appropriate;
9. i) Termination and transition arrangements.

15.4. Reliance on Third-Party KYC

Where the Company relies on KYC procedures performed by an external party, it shall ensure that such reliance is legally permissible and consistent with applicable contractual requirements.

The Company shall establish procedures for obtaining necessary verification information and evidence within the required timeframe.

Use of a technical KYC provider shall not, by itself, constitute legally recognised reliance on another obliged entity.

15.5. Ongoing Oversight

The Company may conduct risk-based reviews of material service providers where appropriate, taking into account the nature of the services, contractual arrangements and applicable legal requirements.

Material deficiencies identified through such reviews shall be addressed as appropriate.

16.1. Personal Data

Personal data processed for AML/KYC purposes shall be handled in accordance with applicable data protection and privacy legislation.

16.2. Lawful Processing

The Company shall identify and document the applicable legal basis for each category of personal data processing.

Processing necessary for compliance with statutory AML obligations shall be distinguished from processing conducted for contractual risk management or other purposes.

16.3. Data Minimisation

Only information necessary and proportionate to the relevant purpose shall be collected and processed.

16.4. Security Measures

The Company shall implement appropriate technical and organisational safeguards, including:

1. a) Access controls;
2. b) Encryption where appropriate;
3. c) Secure transmission;
4. d) Logging and monitoring;
5. e) Role-based permissions;
6. f) Secure retention and deletion procedures.

16.5. Data Sharing

Customer information may be shared with issuing institutions, payment service providers, verification providers, competent authorities and other authorised recipients where there is an appropriate legal basis.

Cross-border transfers shall comply with applicable data protection requirements.

16.6. Biometric Data

Where biometric information is processed, the Company shall ensure that any additional legal requirements applicable to sensitive or specially protected personal data are satisfied.

17.1. Records

The Company shall maintain appropriate records relating to:

1. a) Customer identification and verification;
2. b) Corporate ownership and control;
3. c) Risk assessments;
4. d) Screening results;
5. e) Compliance investigations;
6. f) Relevant transaction information available to the Company;
7. g) Internal compliance decisions;
8. h) Training activities;
9. i) Material compliance incidents.

17.2. Retention Period

The Company shall retain relevant records for the periods required by applicable laws, regulatory requirements and contractual obligations.

Where no specific retention period is prescribed, records shall be retained only for as long as reasonably necessary for legitimate compliance and operational purposes, subject to applicable data protection requirements.

17.3. Accessibility

Records shall be stored securely and be retrievable within a reasonable timeframe for lawful compliance, audit and regulatory purposes.

17.4. Deletion

Upon expiration of the applicable retention period, records shall be securely deleted or anonymised unless further retention is legally required.

The Company shall ensure that employees involved in customer onboarding, compliance and card-related operations have an appropriate understanding of relevant AML/CFT requirements and internal procedures.

Training and awareness activities shall be conducted as necessary, taking into account employees' responsibilities, the Company's business model, applicable legal requirements and contractual obligations.

The Company shall maintain internal controls appropriate to its business model, operational responsibilities and applicable legal requirements.

Compliance reviews and assessments may be conducted where necessary, taking into account identified risks, regulatory requirements and contractual obligations.

20.1. General Principle

The Company recognises that its card-related services depend on cooperation with regulated financial institutions and other service providers.

The Company shall maintain clear operational arrangements to support effective compliance.

20.2. Information Exchange

Subject to applicable law and data protection requirements, the Company may exchange relevant compliance information with financial partners for:

1. a) Customer verification;
2. b) Risk assessment;
3. c) Fraud prevention;
4. d) Sanctions compliance;
5. e) Transaction monitoring;
6. f) Investigation of suspicious activity;
7. g) Regulatory compliance.

20.3. Compliance Requests

The Company shall respond to legitimate compliance information requests from its financial partners within agreed contractual timeframes.

20.4. Partner Restrictions

The Company shall implement lawful restrictions communicated by issuing institutions where required by contractual arrangements and applicable legislation.

20.5. Responsibility Allocation

The Company and its financial partners shall maintain a documented allocation of operational and compliance responsibilities.

Such allocation shall not override mandatory statutory obligations.

21.1. Compliance Incidents

The Company shall maintain procedures for identifying, documenting and escalating material compliance incidents.

Examples include:

• Suspected sanctions violations;
• Material verification failures;
• Significant suspicious activity;
• Fraud involving multiple customer accounts;
• Unauthorised disclosure of customer information;
• Material failures of screening or monitoring systems.

21.2. Incident Response

The Company shall assess incidents based on severity, legal implications and potential customer impact.

Response measures may include containment, investigation, notification, remediation and review of relevant controls.

21.3. Notifications

The Company shall notify competent authorities, financial partners or affected persons where legally or contractually required.

22.1. Policy Review

This Policy shall be reviewed and updated as necessary to reflect material changes in applicable legal requirements, the Company's business activities, operational risks or contractual obligations.

22.2. Approval

Material amendments shall be approved by the Company's designated governing body or authorised senior management.

22.3. Implementation

The designated person responsible for compliance shall coordinate implementation of approved amendments and communicate relevant changes to affected personnel.

23.1. Binding Nature

This Policy is binding upon the Company's directors, officers, employees and relevant contractors within the scope of their duties.

23.2. Supporting Procedures

The Company may adopt additional internal procedures, manuals, risk matrices and operational instructions to implement this Policy.

Such documents shall be consistent with applicable law and the principles established herein.

23.3. Effective Date

This Policy shall become effective upon approval by the Company's authorised governing body.

The Company shall evaluate customer risk using a combination of relevant factors.

Customer risk classifications shall be documented and reviewed as appropriate, taking into account applicable requirements and relevant changes in customer risk profiles.

High-risk classification shall trigger enhanced controls in accordance with applicable law and internal procedures.

The following circumstances may warrant additional review:

• Rapid creation of multiple cards followed by immediate intensive usage.
• Repeated payments to the same merchant without an apparent commercial explanation.
• Transaction volumes materially exceeding the customer's declared expectations.
• Frequent transactions involving jurisdictions inconsistent with the customer's profile.
• Repeated declined transactions or attempts to circumvent established limits.
• Unusual refund or chargeback patterns.
• Multiple unrelated customers using overlapping identifying or technical information.
• Corporate cards used for transactions inconsistent with the customer's business activities.
• Unexplained changes in transaction frequency or merchant categories.
• Indications that payment cards are being controlled or used by unauthorised third parties.
• Unusual patterns of card funding or movement of value between payment instruments, where supported.
• Transactions potentially associated with prohibited or unlawful activities.

Red flags shall be assessed collectively and in context.

The following matrix establishes an indicative allocation of responsibilities for the Company's partner-based card model. Final responsibilities shall be documented in the relevant agreements and operating procedures.

This matrix does not constitute a transfer or waiver of statutory obligations.

Customer information and risk classifications may be reviewed, where appropriate and within the Company's operational responsibilities, in response to relevant risk indicators, applicable legal requirements or requests from financial partners.

Potential review triggers include:

1. a) Material changes in identity or registration information;
2. b) Changes in beneficial ownership or control;
3. c) Material changes in business activities;
4. d) Significant deviation from expected transaction behaviour;
5. e) New sanctions or PEP exposure;
6. f) Relevant adverse media or credible risk information;
7. g) Identification of suspected fraud or financial crime;
8. h) Requests from the issuing institution or competent authorities;
9. i) Material changes in product usage or geographical exposure;
10. j) Other events indicating that existing due diligence information may be insufficient or outdated.