STAND-IN DRAFT · VERSION STANDIN-1

Anti-Money-Laundering (AML) Policy

Anti-Money-Laundering Policy

Effective date: [EFFECTIVE DATE]. Meritwave Digital Inc is committed to preventing the use of its services for money laundering, terrorist financing, sanctions evasion and fraud. This policy describes our approach. It is a public summary, not the full internal program.

1. Who we check. Merchants: we verify the business (KYB), its owners of 25% or more, and its authorized representative. We check the business registration, its industry code against a list of prohibited industries, and screen the business and each owner against sanctions (OFAC) and politically-exposed-person lists. The bank account must be in the same name as the verified business. Clients: we verify identity, with photos of the ID and a selfie, and screen against sanctions lists. Autonomous Node users run their own node and are not identity-checked by us; they cannot use services that need a verified identity.

2. Review levels. Applications are reviewed in two steps. A customer-service representative runs the checks and records a recommendation. A customer-service manager makes the binding decision, and may override an automatic result, but must give a written reason. Larger or more complex reviews are passed to an accountant and an Accounting Manager. Client applications that pass all automatic checks may be approved automatically. Every decision records who made it, when and in what role. Staff actions are logged, and staff see only what their role needs.

3. Ongoing checks. We repeat identity, ownership and business checks every year and when an ID expires, with no grace period; access, Boosts and payouts may be paused until done. New merchants start on a probationary period with lower limits on volume and speed. We watch for sudden spikes and unusual patterns. Merchant and client limits for Boost are set in the settings and enforced by the system. Unclear transactions are reviewed by a person.

4. Payouts. Payouts to merchants go out only after a person with the right permission reviews and authorizes each stage of our end-of-day process with a one-time code. We may stop or hold any payout. [Payout controls depend on banking partners not yet in place.]

5. Restricting accounts. We may suspend or end an account, hold funds and refuse a transaction where we suspect fraud, money laundering or a sanctions problem, or where the law requires. We do not delete suspended clients' records. Where the law requires it we report to the authorities and we may be forbidden to tell you.

6. Program elements. Established, as described by the CEO and the Operations documents (not checked against the running system): transaction limits for merchants and Boost limits, set in the settings and enforced by the system; identity (KYC) and business (KYB) checks for all authorized users at sign-up and every year, run in our entity verification module; monitoring of transaction activity by our Accounting Manager, who watches for suspicious transactions [REVIEW SCHEDULE: being set in Operations; see the pull request]. To be confirmed by the CEO before this page is published, because none of it appears in the repositories: a designated U.S.-based compliance officer [NAME AND TITLE]; a written risk assessment [DOCUMENT AND DATE]; written monitoring thresholds and alert procedure [DOCUMENT]; the procedure for suspicious-activity reports and who files them [COUNSEL]; recordkeeping schedule [COUNSEL: see the five-year federal note and the three-year ID-photo period]; employee training [SCHEDULE]; independent review [WHO AND WHEN]; sanctions-screening vendor and list-update schedule [VENDOR - JAH]. [Do not publish a statement that these elements are fully established and documented until each is confirmed to exist.]

7. Your part. Give us true information, keep it current, and tell us at [email protected] if you see something suspicious.

8. Law. This policy is governed by the laws of the State of Wyoming, and the state and federal courts located in Wyoming. Nothing in this section limits rights that the law of your state says cannot be waived by contract, including rights under the Illinois Biometric Information Privacy Act. Contact: [email protected]; [MAILING ADDRESS].