Anti-Money Laundering (AML), Counter-Terrorist Financing (ATF), Counter-Proliferation Financing (CPF) & Sanctions Compliance Policy

1. Purpose and Commitment

Airpero Financial Technologies Inc. ("Airpero", "we", "our", or the "Entity") is committed to maintaining the highest standards of integrity, compliance, and financial-crime prevention.

Airpero maintains a risk-based compliance framework designed to prevent, detect, investigate, and report money laundering, terrorist financing, proliferation financing, fraud, sanctions violations, bribery, corruption, and other forms of financial crime.

This Policy establishes the principles and procedures through which Airpero identifies, assesses, mitigates, monitors, and manages financial-crime risks associated with its customers, products, services, transactions, business relationships, geographic exposure, and third-party relationships.

Airpero complies with applicable laws and regulatory requirements in the jurisdictions in which it operates. For its Canadian operations, this includes applicable requirements under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and applicable FINTRAC requirements.

Where Airpero's U.S. operations or activities are subject to applicable U.S. requirements, including the Bank Secrecy Act (BSA), FinCEN requirements, and applicable OFAC sanctions requirements, appropriate controls are maintained for the relevant U.S. entity and activities.

2. Scope

This Policy applies to:

• Directors and officers;
• Employees;
• Compliance personnel;
• Contractors and consultants;
• Agents and representatives;
• Relevant third-party service providers; and
• Business activities and customer relationships conducted through or on behalf of Airpero.

The Policy applies to Airpero's financial technology and payment-related services, including, where applicable:

• Digital payment solutions;
• Payment processing and collection services;
• Local and cross-border payment solutions;
• Virtual account services;
• Foreign exchange-related services;
• Digital wallet services;
• Card-related services;
• Bill payment services;
• API-based financial infrastructure; and
• Other financial technology services provided directly or through regulated financial institution and payment partners.

3. Governance and Responsibilities

3.1 Board and Senior Management

The Board and senior management are responsible for providing appropriate oversight of Airpero's AML/CFT/CPF and Sanctions Compliance Program.

Responsibilities include:

• Approving the AML/CFT/CPF and Sanctions Compliance Policy;
• Providing appropriate resources for compliance activities;
• Ensuring appropriate compliance oversight;
• Reviewing material financial-crime risks;
• Receiving relevant management information and compliance reports;
• Reviewing material compliance deficiencies and remediation;
• Supporting a strong culture of compliance throughout the Entity.

3.2 Compliance Officer

Airpero appoints a suitably qualified Compliance Officer with appropriate knowledge and experience to administer the compliance program.

The Compliance Officer is responsible for:

• Maintaining the AML/CFT/CPF and Sanctions Compliance Program;
• Overseeing customer due diligence;
• Monitoring AML and sanctions risks;
• Overseeing transaction monitoring;
• Reviewing suspicious activity;
• Managing sanctions alerts and escalations;
• Coordinating regulatory reporting;
• Maintaining compliance records;
• Coordinating AML training;
• Conducting or coordinating risk assessments;
• Monitoring regulatory developments; and
• Reporting material compliance matters to senior management and the Board.

3.3 First Line of Defence

The first line of defence consists of business and operational personnel responsible for:

• Following approved customer onboarding procedures;
• Applying customer verification controls;
• Identifying unusual activity;
• Following transaction controls;
• Escalating potential financial-crime concerns; and
• Complying with approved policies and procedures.

3.4 Second Line of Defence

The compliance function provides independent oversight of business activities and is responsible for:

• Compliance policies and procedures;
• Risk assessment;
• Customer risk classification;
• Monitoring and testing;
• Sanctions oversight;
• AML/CFT/CPF advisory;
• Compliance reporting; and
• Escalation of material risks.

3.5 Third Line of Defence

Independent internal audit or appropriately qualified external parties may conduct independent testing of the AML/CFT/CPF and Sanctions Compliance Program.

4. Enterprise-Wide Financial Crime Risk Assessment

Airpero maintains a documented, risk-based financial-crime risk assessment.

The assessment considers risks associated with:

• Customers;
• Beneficial owners;
• Products and services;
• Transaction types;
• Delivery channels;
• Geographic exposure;
• Countries and jurisdictions;
• Industries;
• Transaction volumes and values;
• PEP/HIO exposure;
• Sanctions exposure;
• Third-party relationships;
• Fraud risks;
• Technology and operational risks; and
• Emerging financial-crime typologies.

The risk assessment is reviewed at least annually and whenever there is a material change in the Entity's business, products, services, geographic exposure, customer base, transaction profile, regulatory environment, or overall risk profile.

5. Customer Identification and Verification

Airpero verifies the identity of customers before providing services where identification is required.

Depending on the nature and risk of the relationship, Airpero may collect and verify:

• Full legal name;
• Date of birth;
• Residential address;
• Business address;
• Email address;
• Telephone number;
• Government-issued identification;
• Passport;
• National identity documentation;
• Driver's licence;
• Business registration documents;
• Beneficial ownership information;
• Selfie or biometric verification;
• Source of funds information;
• Source of wealth information; and
• Other information required to complete appropriate due diligence.

Airpero may use identity verification and KYC technology providers, including Didit, where applicable, to support identity verification and customer onboarding.

Failure to provide required information may result in delayed onboarding, restricted services, declined transactions, or account closure.

6. Customer Due Diligence

Airpero conducts Customer Due Diligence ("CDD") on customers in accordance with applicable legal and regulatory requirements.

CDD may include:

• Identification and verification;
• Understanding the purpose and intended nature of the relationship;
• Understanding the customer's business activities;
• Identifying beneficial owners;
• Understanding ownership and control structures;
• Assessing expected transaction activity;
• Assessing geographic exposure;
• Assessing source of funds where appropriate;
• Assessing source of wealth where appropriate;
• PEP/HIO screening;
• Sanctions screening;
• Adverse media screening; and
• Customer risk classification.

CDD is completed during onboarding where required and is maintained throughout the customer relationship.

7. Beneficial Ownership

Airpero identifies and verifies applicable Ultimate Beneficial Owners ("UBOs") and persons exercising effective control over legal-entity customers.

The Entity applies the beneficial ownership requirements applicable to the relevant jurisdiction and customer relationship.

Where a customer has a complex ownership structure, Airpero may request additional documentation to establish:

• Direct ownership;
• Indirect ownership;
• Control;
• Ownership percentages;
• Corporate shareholders; and
• Ultimate natural-person beneficiaries.

Where required, Airpero will not establish or continue a relationship until satisfactory beneficial ownership information has been obtained.

8. Customer Risk Classification

Airpero applies a risk-based customer classification methodology.

Customers may be classified as low, medium, or high risk based on relevant factors, including:

• Customer type;
• Ownership structure;
• Beneficial ownership;
• Geographic exposure;
• Products and services;
• Transaction activity;
• Transaction volume and value;
• Delivery channels;
• Industry;
• Source of funds;
• Source of wealth;
• PEP/HIO status;
• Sanctions exposure;
• Adverse media;
• Fraud indicators; and
• Other relevant AML/CFT/CPF risk factors.

Higher-risk customers are subject to enhanced controls and more frequent review.

9. Enhanced Due Diligence

Enhanced Due Diligence ("EDD") is applied where a customer or transaction presents elevated financial-crime risk.

EDD may include:

• Additional customer identification;
• Additional beneficial ownership verification;
• Source of funds verification;
• Source of wealth verification;
• Additional information concerning the purpose of the relationship;
• Additional information regarding expected transactions;
• Senior management approval where required;
• Enhanced transaction monitoring;
• Enhanced sanctions and PEP screening; and
• More frequent KYC reviews.

EDD may apply to:

• PEPs/HIOs;
• Family members and close associates of relevant PEPs/HIOs;
• Customers connected to higher-risk jurisdictions;
• Customers with complex ownership structures;
• Customers operating in higher-risk industries;
• Customers with unusual or high-value transactions;
• Customers with significant adverse information;
• Customers presenting elevated sanctions risk; and
• Other customers identified as high risk through the Entity's risk assessment.

10. Periodic KYC Review

Airpero conducts periodic reviews of customer information based on the customer's risk classification.

High-risk customers are reviewed at least annually, or more frequently where required based on the risk profile.

Reviews may include:

• Reverification of identity;
• Updating customer information;
• Verification of beneficial ownership;
• Review of business activities;
• Source of funds / source of wealth review;
• PEP/HIO screening;
• Sanctions screening;
• Adverse media screening;
• Review of transaction activity; and
• Reassessment of the customer's risk classification.

Additional reviews may be triggered by material changes or unusual activity.

11. PEP and HIO Screening

Airpero maintains procedures to identify Politically Exposed Persons ("PEPs"), Heads of International Organizations ("HIOs"), and applicable family members and close associates.

Where a customer is identified as presenting PEP/HIO risk, Airpero may apply:

• Enhanced Due Diligence;
• Source of wealth verification;
• Source of funds verification;
• Senior management approval;
• Enhanced ongoing monitoring; and
• More frequent customer reviews.

12. Sanctions Compliance

Airpero maintains a risk-based Sanctions Compliance Program designed to prevent prohibited transactions and relationships involving sanctioned persons, entities, jurisdictions, or activities.

Sanctions screening may cover:

• Customers;
• Beneficial owners;
• Directors and controlling persons;
• Counterparties;
• Payment recipients;
• Relevant transaction parties; and
• Other parties connected to transactions.

The Entity's sanctions screening framework may include applicable lists maintained by:

• United Nations Security Council;
• U.S. Department of the Treasury – OFAC;
• Canada's applicable sanctions authorities;
• UK Office of Financial Sanctions Implementation (OFSI);
• European Union;
• Other relevant G7 authorities; and
• Other applicable regulatory or sanctions authorities.

Sanctions lists and screening rules are monitored for regulatory updates. Material updates are implemented promptly and, where practicable, within 24 hours of an official update.

Potential matches are investigated and escalated before a decision is made.

Where a confirmed sanctions concern exists, Airpero may:

• Reject or decline a transaction;
• Delay processing;
• Restrict account activity;
• Suspend or terminate services;
• Block funds where legally required;
• Report the matter to the appropriate authority; and
• Take other action required by applicable law.

13. Transaction Screening and Monitoring

Airpero maintains risk-based transaction monitoring controls designed to identify unusual, suspicious, or potentially prohibited activity.

Monitoring may consider:

• Transaction size;
• Transaction frequency;
• Transaction velocity;
• Geographic exposure;
• Counterparty risk;
• Payment recipients;
• Account activity;
• Card usage;
• Foreign exchange activity;
• Wallet funding;
• Bill payment activity;
• Rapid movement of funds;
• Unusual transaction patterns; and
• Other relevant risk indicators.

Airpero may use automated transaction monitoring supported by manual review and investigation.

There is no single monetary amount that automatically determines whether a transaction is suspicious. Suspicion is assessed based on the overall customer and transaction context and applicable regulatory requirements.

14. Fraud Monitoring

Airpero maintains fraud prevention and detection controls designed to identify unauthorized, unusual, or potentially fraudulent activity.

Controls may include:

• Identity verification;
• Device and behavioural signals;
• Transaction velocity controls;
• Transaction screening;
• Account activity monitoring;
• Real-time or near-real-time alerts;
• Manual investigation;
• Transaction restrictions; and
• Escalation procedures.

Where suspicious fraud indicators are identified, Airpero may delay, decline, restrict, or investigate the relevant transaction or account.

15. Suspicious Activity

Airpero maintains procedures for identifying, investigating, documenting, escalating, and reporting suspicious transactions and activities.

Potential indicators may include:

• Unusual transaction volumes;
• Rapid movement of funds;
• Transactions inconsistent with the customer's profile;
• Unusual geographic activity;
• Attempts to circumvent controls;
• False or misleading information;
• Suspicious use of third parties;
• Potential fraud or identity theft;
• Sanctions concerns;
• Transactions involving higher-risk jurisdictions;
• Structuring or other attempts to avoid applicable reporting or monitoring requirements; and
• Other activity that may indicate financial crime.

Where required by applicable law, Airpero reports suspicious activity to the appropriate regulatory or law-enforcement authority.

16. Source of Funds and Source of Wealth

Airpero may request Source of Funds ("SOF") and Source of Wealth ("SOW") information where required by law, customer risk, transaction activity, or internal policy.

Supporting documentation may include:

• Bank statements;
• Salary documentation;
• Employment letters;
• Business records;
• Investment statements;
• Sale agreements;
• Inheritance documentation;
• Tax or financial records; and
• Other reliable evidence establishing the lawful origin of funds or wealth.

Failure to provide satisfactory information may result in transaction delays, restrictions, or termination of the relationship.

17. Record Retention

Airpero maintains appropriate records relating to:

• Customer identification;
• Customer due diligence;
• Beneficial ownership;
• Transactions;
• Risk assessments;
• Sanctions screening;
• PEP screening;
• Suspicious activity investigations;
• Regulatory reports;
• Training;
• Compliance testing; and
• Other compliance activities.

Records are retained for the period required by applicable law and regulatory requirements.

Where Canadian AML obligations apply, records are generally maintained for the applicable statutory retention period, including at least five years where required.

18. Data Quality Management

Airpero maintains controls designed to ensure that complete, accurate, and reliable transaction and customer information is available for:

• Transaction monitoring;
• Sanctions screening;
• Customer due diligence;
• Risk assessment;
• Investigations;
• Regulatory reporting; and
• Compliance testing.

Data quality exceptions are investigated and remediated as appropriate.

19. AML/CFT/CPF Training

Airpero provides periodic AML/CFT/CPF and sanctions training to relevant personnel.

Training may cover:

• AML requirements;
• Counter-terrorist financing;
• Counter-proliferation financing;
• Sanctions compliance;
• Customer due diligence;
• Beneficial ownership;
• PEP/HIO identification;
• Transaction monitoring;
• Suspicious activity indicators;
• Fraud prevention;
• Escalation procedures;
• Recordkeeping; and
• Changes to applicable regulatory requirements.

Training is appropriate to the employee's responsibilities and is refreshed periodically and when material regulatory or operational changes occur.

20. Anti-Bribery and Corruption

Airpero maintains an Anti-Bribery and Corruption ("ABC") framework designed to prevent and detect bribery and corruption.

The framework may include:

• Anti-bribery policies;
• Gifts and hospitality controls;
• Conflicts of interest procedures;
• Third-party due diligence;
• Employee training;
• Whistleblowing procedures;
• Risk assessments;
• Management oversight; and
• Investigation and escalation procedures.

Airpero does not permit bribery, facilitation payments, corruption, or improper benefits in connection with its business activities.

21. Whistleblowing

Airpero maintains mechanisms through which employees and relevant stakeholders may report suspected:

• Money laundering;
• Terrorist financing;
• Sanctions violations;
• Fraud;
• Bribery;
• Corruption;
• Misconduct; or
• Other compliance concerns.

Reports are handled confidentially to the extent permitted by law.

Airpero prohibits retaliation against individuals who make good-faith compliance reports.

22. Third-Party and Partner Risk

Airpero may use regulated financial institutions, payment processors, identity verification providers, sanctions screening providers, technology providers, and other third parties.

Before establishing material third-party relationships, Airpero may conduct appropriate due diligence based on the nature and risk of the relationship.

Third-party relationships may be subject to:

• Contractual requirements;
• Compliance obligations;
• Ongoing monitoring;
• Performance reviews;
• Security requirements;
• Regulatory requirements; and
• Termination procedures.

The use of a third party does not eliminate Airpero's responsibility for maintaining appropriate oversight of its own obligations.

23. Management Information and Reporting

The Compliance function maintains appropriate management information relating to the effectiveness of the compliance program.

Management information may include:

• Customer risk classifications;
• KYC exceptions;
• Sanctions alerts;
• PEP alerts;
• Transaction-monitoring alerts;
• Suspicious activity investigations;
• Regulatory reports;
• Training completion;
• Compliance testing results;
• Audit findings;
• Remediation activities; and
• Material compliance incidents.

Material issues are escalated to senior management and, where appropriate, the Board.

24. Independent Testing and Audit

Airpero conducts periodic testing of its AML/CFT/CPF and Sanctions Compliance Program using appropriately independent resources.

The scope and frequency of testing are determined based on:

• The Entity's risk profile;
• Applicable regulatory requirements;
• Changes to products or services;
• Geographic expansion;
• Material incidents;
• Previous findings; and
• Other relevant factors.

Material deficiencies identified through testing are documented, assigned to responsible parties, tracked to remediation, and reported to appropriate management.

25. Compliance Monitoring and Review

Airpero monitors its compliance framework on an ongoing basis.

The Compliance function may conduct:

• Policy reviews;
• Control testing;
• Customer file reviews;
• Transaction-monitoring reviews;
• Sanctions-screening reviews;
• Risk assessments;
• Training reviews;
• Regulatory-change assessments; and
• Remediation reviews.

The AML/CFT/CPF and Sanctions Compliance Program is reviewed at least annually and whenever significant changes occur.

26. Customer Safeguards and Service Restrictions

Where financial-crime or regulatory risks are identified, Airpero may take appropriate measures, including:

• Requesting additional information;
• Delaying a transaction;
• Declining a transaction;
• Restricting services;
• Suspending an account;
• Freezing or restricting funds where legally permitted or required;
• Terminating a customer relationship; and
• Reporting matters to relevant authorities.

Actions may be taken without prior notice where required by law or necessary to protect the integrity of Airpero's services.

27. Regulatory Status

Airpero Financial Technologies Inc. is a financial technology company and is not a bank.

Airpero provides technology-enabled financial and payment solutions and may provide certain services through licensed financial institutions and regulated payment partners.

The Canadian entity is registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a Money Services Business (MSB), registration number N300000362, where applicable to its regulated activities.

Airpero also maintains a separately incorporated U.S. entity. The U.S. entity is responsible for its own applicable U.S. regulatory requirements, including any applicable BSA, FinCEN, OFAC, and other regulatory obligations.

Airpero does not represent that a licence held by a banking, payment, card, or other regulated partner is an Airpero licence. Applicable registrations, licences, and authorisations are attributed to the legal entity to which they belong.

28. Policy Review and Approval

This Policy is reviewed at least annually and whenever there are material changes to:

• Applicable laws;
• Regulatory requirements;
• Products and services;
• Customer types;
• Geographic markets;
• Transaction activity;
• Risk exposure;
• Business operations; or
• The Entity's compliance framework.

29. Contact Information

Airpero Financial Technologies Inc.

Email: support@airpero.com

Website: https://www.airpero.com

FINTRAC MSB Registration: N300000362

Registered Office:

554 South Street

London, Ontario

N6B 1C6

Canada