This Anti-Money Laundering and Anti-Terrorist Financing Policy (“AML/ATF Policy”) sets out the key processes and controls used by FinchPay to prevent, detect, manage and mitigate the risks of money laundering, terrorist financing, sanctions evasion, fraud and other illegal activity.

FinchPay is operated by ZENVIA TECH LIMITED, a company registered in Canada as a Money Services Business (“MSB”) with the Financial Transactions and Reports Analysis Centre of Canada (“FINTRAC”). As a Canadian MSB, we are committed to maintaining a compliance program designed to meet our obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (“PCMLTFA”) and its associated regulations.

Money laundering is the process of concealing or disguising the source of illegally obtained funds in order to make them appear legitimate. Terrorist financing involves collecting, providing or using funds or assets for terrorist purposes. Companies providing financial services and virtual asset-related services may be targeted by criminals and therefore must maintain appropriate safeguards.

Our AML/ATF Policy covers the following areas:

• Compliance Program — we maintain a risk-based compliance program designed to meet applicable Canadian AML/ATF requirements, including written policies and procedures, ongoing risk assessment, compliance training and periodic review of the effectiveness of the program.

• Compliance Officer — we have appointed a Compliance Officer responsible for overseeing the implementation and maintenance of our AML/ATF compliance program.

• Customer Identification and Verification — we apply Know Your Customer (“KYC”) procedures to identify and verify customers where required. This may include collecting and verifying identity information, understanding the purpose and intended nature of the business relationship, and obtaining additional information where required.

• Enhanced Due Diligence — we apply enhanced due diligence measures for higher-risk customers, transactions or situations, including where a customer is identified as a politically exposed person (“PEP”), head of an international organization (“HIO”), family member or close associate, or where other risk factors are present.

• Card Verification — for customers using payment cards, we apply card verification and fraud prevention controls, which may include 3D Secure authentication, BIN checks, IP checks, velocity rules and other anti-fraud measures.

• Transaction Monitoring and Ongoing Monitoring — we monitor transactions and customer activity on a risk-sensitive basis to detect unusual or suspicious patterns, including activity that may be linked to money laundering, terrorist financing, sanctions evasion, fraud, scams, darknet markets, mixers, high-risk wallets or other prohibited activity.

• Virtual Currency Controls — where virtual currency transactions are involved, we may use blockchain analytics, wallet screening and transaction risk scoring to identify exposure to sanctioned addresses, illicit services, high-risk counterparties or suspicious transaction patterns.

• Travel Rule Compliance — where applicable, we take measures to collect, transmit and retain required information related to virtual currency transfers in accordance with applicable travel rule requirements.

• Reporting Obligations — where required by applicable law, we submit prescribed reports to FINTRAC, including suspicious transaction reports and other reportable transaction reports. This may include large virtual currency transaction reports where the applicable reporting threshold is met.

• Sanctions Screening — we screen customers, counterparties and transactions against applicable sanctions lists, including Canadian sanctions and United Nations sanctions lists. We may also screen against other international sanctions lists as part of our broader risk management framework.

• Record Keeping — we maintain appropriate records relating to customer identification, verification, transactions, risk assessments, reports and compliance controls for legally required retention periods.

• Employee Due Diligence and Training — we conduct appropriate checks on relevant employees and provide AML/ATF training to employees involved in customer onboarding, transaction processing, compliance, risk management and operational controls.

• Risk Assessment and Risk Management — we apply a risk-based approach to identify, assess and mitigate money laundering, terrorist financing, sanctions evasion and fraud risks. Our risk assessment considers customers, products and services, delivery channels, geography, transaction activity and other relevant risk factors.

FinchPay reserves the right to refuse, suspend, cancel or delay any transaction, account or business relationship where we identify legal, regulatory, sanctions, AML/ATF, fraud or other compliance concerns.

FinchPay does not tolerate the use of its services for money laundering, terrorist financing, sanctions evasion, fraud, scams or any other illegal activity.