AML & CFT Policy

PAYMENT SOLUTIONS AND SERVICES INTERNATIONAL (PSI)

ANTI-MONEY LAUNDERING AND COUNTER-TERRORIST FINANCING POLICY

Version 1.0

Effective Date: September 1^st 2026

1. PURPOSE AND POLICY STATEMENT

PSI Liquidity Network Ltd. ("PSI", "Company", "we", "our", or "us") maintains a risk-based Anti-Money Laundering and Counter-Terrorist Financing ("AML/CFT") programme designed to prevent the Company and its Services from being used to facilitate money laundering, terrorist financing, proliferation financing, fraud, sanctions evasion or other financial crime.

This Policy establishes the minimum standards governing PSI’s customer due diligence, beneficial ownership identification, risk assessment, transaction monitoring, sanctions controls, suspicious activity escalation, record keeping, training, governance and compliance oversight.

PSI shall apply this Policy in a manner proportionate to the nature, scale, complexity and risk profile of its activities and shall comply with applicable laws, regulations, regulatory requirements and binding obligations in each jurisdiction in which PSI operates or provides Services. Where local law imposes a higher standard, the higher applicable standard shall prevail.

2. SCOPE

This Policy applies to PSI, its directors, officers, employees, contractors and relevant service providers, and to all PSI Services and business relationships to which AML/CFT requirements apply.

PSI’s Services may include, depending on availability, jurisdiction and applicable regulatory permissions: digital asset purchase and conversion services, fiat currency conversion, digital wallets, payment processing, remittance services, merchant payment solutions, business payment infrastructure, treasury and liquidity services, and related technology-enabled financial services. The PSI Terms of Service identify these activities and state that service availability is jurisdiction-specific and subject to applicable regulatory and partner requirements.

PSI may use regulated banking, payment, identity verification, blockchain, custody, liquidity and compliance providers. The use of a third-party provider does not remove PSI’s responsibility to maintain appropriate oversight of its own AML/CFT risks.

3. GOVERNANCE AND RESPONSIBILITY

PSI management is responsible for establishing and maintaining an effective AML/CFT framework and ensuring that adequate resources, systems and controls are available.

The Company shall designate an appropriately qualified person or function with responsibility for AML/CFT oversight, including escalation of material compliance matters to senior management and, where applicable, the Board.

Senior management shall approve material changes to this Policy, the Company’s AML/CFT risk appetite and material remediation measures.

All personnel are responsible for complying with this Policy, completing required training and escalating suspected financial crime or compliance concerns promptly.

4. RISK-BASED APPROACH

PSI shall identify, assess, document and periodically review the money laundering, terrorist financing and proliferation financing risks arising from its customers, beneficial owners, products and services, transaction types, delivery channels, jurisdictions, counterparties, payment methods, digital assets and third-party providers.

Risk assessments shall consider, as appropriate, customer risk, geographic risk, product and service risk, transaction risk, delivery-channel risk, sanctions exposure, digital-asset and blockchain exposure, and other relevant factors.

PSI shall apply enhanced controls where risks are higher and may apply simplified controls only where legally permissible and supported by a documented risk assessment. PSI shall not knowingly establish or maintain relationships where the risks cannot be adequately mitigated.

5. CUSTOMER IDENTIFICATION AND KYC

Before establishing a customer relationship or permitting a transaction where identification is required, PSI shall obtain and verify information reasonably necessary to establish the customer’s identity and understand the purpose and expected nature of the relationship.

For individuals, information may include legal name, date of birth, residential address, jurisdiction, identification documents and other information reasonably required for verification. PSI’s Terms of Service already contemplate identity, address and document verification as part of its compliance procedures.

For businesses and other legal persons, PSI shall obtain and verify appropriate legal entity information, registration documents, directors, beneficial owners, authorized representatives, business purpose and other information reasonably required to understand the customer and its ownership and control structure. PSI’s existing Terms expressly require these categories of KYB information.

PSI may use reliable independent or third-party verification providers and may require additional information where the customer, transaction or jurisdiction presents elevated risk.

6. BENEFICIAL OWNERSHIP AND CONTROL

PSI shall identify the natural persons who ultimately own or control a legal entity or arrangement and shall take reasonable measures to verify their identities.

PSI shall seek to understand ownership and control structures and shall identify persons authorized to act on behalf of a customer.

Where ownership or control cannot be satisfactorily established, PSI may decline onboarding, suspend activity or require additional evidence before proceeding.

7. CUSTOMER RISK CLASSIFICATION AND ENHANCED DUE DILIGENCE

PSI shall assign and periodically review customer risk classifications using documented risk factors.

Higher-risk indicators may include, without limitation, complex or opaque ownership, politically exposed person ("PEP") status, high-risk jurisdictions, unusual transaction patterns, unexplained source of funds or wealth, adverse media, sanctions concerns, high-risk industries, exposure to high-risk virtual asset activity, use of privacy-enhancing technologies, unhosted-wallet exposure where relevant, or other indicators of elevated financial crime risk.

Where enhanced due diligence ("EDD") is required, PSI may obtain additional identification, source-of-funds and source-of-wealth evidence, transaction rationale, beneficial ownership information, expected activity, supporting commercial documentation, wallet information and other information reasonably necessary to mitigate the identified risk. PSI’s Terms already reserve the right to require these forms of enhanced verification.

PSI may decline or terminate a relationship where EDD does not satisfactorily resolve the identified risk.

8. POLITICALLY EXPOSED PERSONS

PSI shall identify customers and relevant beneficial owners or controllers who are PEPs, family members or known close associates, as required by applicable law.

Where required, PSI shall apply enhanced measures, including appropriate senior management approval, establishment of source of wealth and source of funds, enhanced ongoing monitoring and other measures required by applicable law.

9. SANCTIONS AND RESTRICTED PARTIES

PSI shall maintain controls designed to identify and prevent prohibited dealings with persons, entities, jurisdictions, wallets or transactions subject to applicable sanctions or restrictions.

Screening may occur at onboarding, periodically thereafter and in connection with transactions or other events where appropriate.

PSI may delay, refuse, suspend, freeze, cancel or report an account or transaction where required by law, applicable sanctions requirements, partner rules or internal risk controls. The existing Terms expressly reserve these rights.

10. TRANSACTION MONITORING

PSI shall maintain risk-based transaction monitoring appropriate to its products, customers and transaction volumes.

Monitoring may consider transaction size, frequency, velocity, patterns, counterparties, jurisdictions, payment methods, source and destination of funds, customer profile, stated purpose, blockchain activity and other relevant indicators.

PSI may use automated monitoring, blockchain analytics, sanctions screening, fraud systems, manual review and third-party compliance technology.

Potentially unusual or suspicious activity shall be escalated for investigation and disposition. Monitoring controls shall be periodically reviewed and adjusted to reflect changes in products, risks, typologies and regulatory expectations.

11. SOURCE OF FUNDS AND SOURCE OF WEALTH

PSI may require evidence establishing the source of funds for individual transactions or customer relationships and, where appropriate, the source of wealth of the customer or beneficial owner.

Examples of supporting evidence may include bank statements, audited financial statements, invoices, contracts, tax or corporate records, sale agreements, payroll records, investment statements or other reliable evidence appropriate to the circumstances.

PSI shall assess whether the source of funds and source of wealth information is reasonably consistent with the customer profile and transaction activity.

12. DIGITAL ASSET AND BLOCKCHAIN CONTROLS

Where PSI supports digital assets, PSI shall apply AML/CFT controls appropriate to the risks of virtual asset activity. FATF standards apply relevant preventive measures to virtual assets and virtual asset service providers, including customer due diligence, record keeping, suspicious transaction reporting and originator/beneficiary information requirements.

PSI may screen blockchain addresses and transactions using blockchain analytics or other appropriate technology and may consider exposure to sanctioned addresses, illicit services, ransomware, darknet activity, fraud, mixers or other high-risk typologies.

PSI shall apply applicable Travel Rule or equivalent information requirements where legally applicable to relevant transfers and shall not knowingly facilitate transactions that cannot satisfy applicable legal or compliance requirements.

PSI shall conduct appropriate risk assessments before launching new digital asset products, delivery mechanisms or material technology changes. FATF identifies risk assessment and mitigation for new technologies and virtual asset activities as core AML/CFT expectations.

13. CORRESPONDENT, BANKING AND THIRD-PARTY RELATIONSHIPS

PSI shall conduct appropriate due diligence on material banking, payment, liquidity, custody, blockchain, identity verification and other financial or compliance service providers.

Where appropriate, PSI shall assess the provider’s ownership, management, regulatory status, AML/CFT controls, reputation, jurisdiction, services and ability to manage relevant risks.

PSI shall maintain appropriate contractual and operational controls governing information sharing, compliance cooperation, transaction restrictions, audit or oversight rights and termination where relevant.

14. SUSPICIOUS ACTIVITY ESCALATION AND REPORTING

PSI personnel shall promptly escalate activity that may involve money laundering, terrorist financing, proliferation financing, sanctions evasion, fraud or other financial crime to the designated AML/CFT compliance function.

The responsible compliance function shall investigate alerts and escalations, document the rationale and determine whether further action is required, including account restriction, transaction delay or refusal, relationship termination, enhanced due diligence or reporting to a competent authority.

Where PSI is legally required to submit a suspicious transaction or suspicious activity report, it shall do so within the applicable legal timeframe and through the prescribed channel.

PSI shall not disclose to a customer or other unauthorized person that a suspicious transaction or activity report has been or may be filed, except where disclosure is legally permitted.

15. RECORD KEEPING

PSI shall maintain records sufficient to demonstrate compliance with this Policy and applicable AML/CFT requirements, including customer identification and verification records, beneficial ownership information, transaction records, risk assessments, monitoring results, investigations, escalations, reports, training records and relevant correspondence.

Records shall be retained for the period required by applicable law and shall be securely maintained so that they can be produced promptly to authorized regulators, law enforcement or other competent authorities where legally required.

16. DATA PROTECTION AND CONFIDENTIALITY

AML/CFT information shall be accessed only by authorized personnel and shall be protected using appropriate confidentiality and information-security controls.

PSI may disclose information to regulated partners, service providers, regulators, law enforcement or other competent authorities where required or permitted by law, contract or applicable compliance obligations.

17. EMPLOYEE SCREENING AND TRAINING

PSI shall provide AML/CFT training appropriate to employees’ responsibilities and exposure to financial crime risk.

Training shall address applicable legal and regulatory obligations, customer due diligence, beneficial ownership, sanctions, transaction monitoring, suspicious activity escalation, record keeping, confidentiality and relevant financial crime typologies.

Where appropriate, PSI shall conduct personnel screening consistent with applicable law and the sensitivity of the employee’s role.

18. INTERNAL CONTROLS, TESTING AND INDEPENDENT REVIEW

PSI shall maintain internal controls reasonably designed to implement this Policy effectively.

The AML/CFT framework shall be periodically reviewed to assess whether controls remain appropriate to PSI’s products, customer base, jurisdictions, transaction volumes and risk profile.

Where appropriate to the size, complexity and risk of the business, PSI shall obtain independent testing or review of its AML/CFT programme and shall document and remediate material findings.

19. PROHIBITED OR HIGH-RISK ACTIVITY

PSI shall not knowingly facilitate transactions involving illegal activity, fraud, money laundering, terrorist financing, sanctions evasion or other prohibited financial crime.

PSI may prohibit or restrict customers, transactions or business activities presenting unacceptable risk, including undisclosed third-party activity, money mule activity, prohibited businesses, unlicensed regulated activity, fraudulent chargeback schemes, nominee arrangements or activity that misrepresents the true sender, beneficiary, source of funds or purpose of a transaction. These restrictions are consistent with PSI’s existing Terms of Service.

20. ONGOING REVIEW AND POLICY UPDATES

PSI shall review this Policy periodically and when material changes occur in its business, products, jurisdictions, regulatory obligations, financial crime risks or technology.

The Policy may be supplemented by procedures, risk assessments, product-specific controls, territory addenda and operational guidance.

FATF’s standards and guidance continue to evolve, including in relation to virtual assets and new financial crime risks. PSI shall monitor relevant regulatory developments and update its programme where appropriate.

21. GOVERNING PRINCIPLES

This Policy is intended to establish a globally appropriate minimum AML/CFT standard for PSI. It does not limit any obligation imposed by applicable local law, regulation, regulatory direction, licensing condition, banking partner requirement or contractual obligation.

Where PSI operates through a licensed or regulated partner, PSI shall coordinate its controls with the partner’s applicable requirements while maintaining appropriate oversight of the risks arising from PSI’s own activities.

Nothing in this Policy authorizes PSI to conduct an activity in a jurisdiction where the activity is prohibited or requires a license or authorization that PSI does not hold or does not lawfully conduct through an appropriately authorized partner.