Anti-Money Laundering and Counter-Terrorist Financing Policy

Last Updated: 2025-01-05 Effective Date: 2025-01-05 Version: 2.0 (Non-Custodial Remittance Orchestration Platform) Classification: Internal / Compliance

---

1. Introduction and Scope

1.1 Purpose

This Anti-Money Laundering and Counter-Terrorist Financing Policy ("AML/CTF Policy") establishes DONATION POS L.P. (trading as "PayWolt")'s framework for preventing, detecting, and mitigating the risks of money laundering (ML), terrorist financing (TF), and proliferation financing (PF) in connection with our cross-border remittance orchestration platform.

1.2 PayWolt's Business Model and AML/CTF Role

Critical Context:

PayWolt operates as a technology service provider (TSP) that orchestrates cross-border money transfers between licensed payment service providers. PayWolt does NOT:

• Hold, custody, or transmit customer funds
• Operate as a money transmitter or remittance business
• Issue electronic money
• Provide payment services as defined in PSD2 Article 4

PayWolt's AML/CTF Responsibilities:

While PayWolt is not a regulated payment institution, we implement AML/CTF controls appropriate to our role as a technology platform, including:

1. Platform-Level Sanctions Screening: Screening users and transactions against EU, UN, US, and UK sanctions lists
2. Transaction Pattern Monitoring: Detecting suspicious orchestration patterns (e.g., rapid corridor switching, structuring across providers)
3. Provider Compliance Verification: Ensuring our licensed payment service providers maintain adequate AML/CTF programs
4. Cooperation with Authorities: Assisting law enforcement and regulatory authorities as legally required
5. Record Keeping: Maintaining transaction orchestration records for regulatory review

Provider AML/CTF Responsibilities:

Our licensed payment service providers (Wise, Flutterwave, Stripe) are independently responsible for:

• Customer Due Diligence (CDD) / Know Your Customer (KYC)
• Identity verification and document retention
• Source of funds / source of wealth verification
• Politically Exposed Person (PEP) screening
• Transaction monitoring for payment execution
• Suspicious Activity Reporting (SARs) to their respective Financial Intelligence Units (FIUs)
• AML/CTF compliance in accordance with their licenses

1.3 Scope of Application

This Policy applies to:

1.4 Regulatory Framework

This Policy is informed by (but does not constitute full compliance with, given PayWolt's non-regulated status):

Important Note: As a technology platform, PayWolt is not directly subject to licensing requirements under AMLD5/6 or PSD2. However, we implement controls reflecting best practices to:

• Support our providers' AML/CTF compliance
• Protect our business from ML/TF risks
• Demonstrate responsible platform governance to regulators, investors, and partners

---

2. Governance and Organizational Structure

2.1 AML/CTF Governance Framework

Board of Directors
        │
        ├─► Chief Executive Officer (CEO)
        │           │
        │           └─► Chief Compliance Officer (CCO)
        │                       │
        │                       ├─► AML/CTF Compliance Manager
        │                       │           │
        │                       │           ├─► Sanctions Screening Team
        │                       │           ├─► Transaction Monitoring Team
        │                       │           └─► Provider Compliance Team
        │                       │
        │                       └─► Money Laundering Reporting Officer (MLRO)
        │
        └─► Chief Technology Officer (CTO)
                    │
                    └─► Security & Fraud Prevention Team

2.2 Roles and Responsibilities

2.2.1 Board of Directors

Responsibilities:

• Approve this AML/CTF Policy and material amendments
• Set the organization's risk appetite for ML/TF exposure
• Ensure adequate resources (budget, staffing, technology) for compliance
• Receive quarterly AML/CTF reports from the CCO/MLRO
• Oversee management's implementation of the AML/CTF program

Frequency: Quarterly AML/CTF updates; annual policy review.

2.2.2 Chief Compliance Officer (CCO)

Responsibilities:

• Overall accountability for AML/CTF compliance program
• Report directly to the Board on AML/CTF matters
• Approve provider partnerships from AML/CTF perspective
• Oversee annual enterprise ML/TF risk assessment
• Coordinate with providers on AML/CTF matters
• Liaise with regulators and law enforcement (where applicable)
• Approve high-risk corridors or service expansions

Authority:

• Block high-risk transfers or corridor activations
• Suspend user accounts pending investigation
• Terminate provider relationships for compliance failures
• Access all Platform data for compliance purposes

2.2.3 Money Laundering Reporting Officer (MLRO)

Responsibilities:

• Receive and evaluate internal suspicious activity reports
• Determine whether to file Suspicious Transaction Reports (STRs) / Suspicious Activity Reports (SARs) with relevant FIUs
• Maintain confidential STR/SAR records
• Liaise with Hellenic Authority for Combating Money Laundering and FIUs in other jurisdictions (as appropriate)
• Provide quarterly statistical reports to Board (number of STRs filed, outcomes)

Independence:

• Reports directly to CCO (functionally) and CEO (administratively)
• Protected from retaliation for good-faith reporting
• No conflicting business development responsibilities

Note: Given PayWolt's non-custodial model, STR/SAR filings by PayWolt are rare. Most suspicious activity is reported by providers. PayWolt files STRs only for platform-level suspicions (e.g., coordinated fraud rings using multiple providers).

2.2.4 AML/CTF Compliance Manager

Responsibilities:

• Implement and maintain AML/CTF procedures
• Manage sanctions screening system and watchlist updates
• Oversee transaction pattern monitoring
• Conduct provider AML/CTF due diligence reviews
• Coordinate AML/CTF training programs
• Maintain AML/CTF documentation and audit trail
• Prepare quarterly compliance reports for CCO/MLRO

2.2.5 All Employees

Responsibilities:

• Complete mandatory annual AML/CTF training
• Report suspicious activity to MLRO via internal reporting channel
• Comply with sanctions screening requirements
• Do not "tip off" users about investigations or STR filings
• Escalate compliance concerns without fear of retaliation

---

3. Risk Assessment

3.1 Enterprise-Wide ML/TF Risk Assessment

PayWolt conducts an annual enterprise-wide ML/TF risk assessment covering:

3.1.1 Inherent Risk Factors

3.1.2 ML/TF Risk Matrix

Overall Risk Calculation:

Overall ML/TF Risk = (Inherent Risk) × (1 - Effectiveness of Controls)

Risk Levels:

3.2 Corridor-Specific Risk Assessment

Each transfer corridor (e.g., "Nigeria → Germany", "Ghana → United Kingdom") is assigned a risk rating:

Corridor Risk Ratings:

3.3 Annual Risk Assessment Process

Timing: Conducted annually (Q1 of each calendar year) and updated upon:

• Launch of new corridors or services
• Significant regulatory changes (e.g., new FATF greylist additions)
• Provider incidents (e.g., AML enforcement actions against a provider)
• Internal incidents (e.g., detection of organized fraud)

Output: Written risk assessment report presented to Board, including:

• Summary of inherent risks
• Assessment of control effectiveness
• Residual risk rating
• Recommended control enhancements
• Resource requirements

---

4. Sanctions Screening

4.1 Sanctions Programs

PayWolt screens against the following sanctions lists:

4.2 Screening Points

Sanctions screening is performed at the following checkpoints:

4.3 Screening Methodology

Name Screening:

• Fuzzy matching algorithm (minimum 85% similarity threshold)
• Phonetic matching (Soundex, Metaphone algorithms)
• Alias and alternate spelling matching
• Transliteration variants (e.g., Arabic, Cyrillic to Latin)

Date of Birth Matching:

• Exact match or within ±2 years (to account for data entry errors)

Nationality/Citizenship Matching:

• Exact match to sanctioned nationalities (where applicable)

4.4 Match Disposition

4.4.1 Confirmed Match (True Positive)

Immediate Actions:

1. Block Transaction/Account Immediately: System automatically blocks the transaction and freezes the account.
2. Escalate to MLRO: Automated alert sent within minutes; MLRO reviews within 1 hour.
3. Do NOT Notify User: Per "tipping off" prohibitions, user is not informed of the sanctions match.
4. Report to Authorities:
   • EU sanctions: Report to Hellenic Ministry of Foreign Affairs (within 24 hours)
   • OFAC sanctions: Consider voluntary self-disclosure to OFAC (if US nexus exists)
   • Document all actions in compliance management system

4.4.2 Potential Match (Requires Investigation)

Procedure:

1. Hold Transaction: Transaction placed in pending status (not executed).
2. Gather Additional Information: Request additional identifying information from user (e.g., full legal name, passport number).
3. Manual Review: AML Compliance Manager reviews match against additional data points.
4. Disposition Decision: Within 24 hours, determine:
   • True Positive: Follow 4.4.1 above.
   • False Positive: Document rationale; add to whitelist; release transaction.

4.4.3 False Positive

Procedure:

1. Document Rationale: Record why the match is deemed false (e.g., different date of birth, different nationality, common name).
2. Clear Alert: Mark alert as "False Positive - Cleared."
3. Whitelist (if appropriate): Add user to internal whitelist to prevent future alerts (reviewed quarterly).

4.5 Sanctions Compliance Governance

List Update Protocol:

• Automated daily downloads from official sources
• System alerts compliance team upon list changes
• Immediate batch re-screening of all active users upon list update

Audit Trail:

• All screening results logged with timestamps
• Disposition decisions recorded with rationale and approver name
• Quarterly audit of sanctions screening effectiveness

---

5. Transaction Monitoring and Pattern Detection

5.1 Purpose and Scope

PayWolt monitors transaction orchestration patterns (not payment execution, which is monitored by providers) to detect:

• Structuring / Smurfing: Users splitting large transfers across multiple corridors or time periods to evade detection
• Rapid Movement / Layering: Users sending funds through multiple corridors in quick succession (e.g., Nigeria → Germany → UK → Nigeria)
• Unusual Corridor Usage: Transfers through corridors with no logical economic purpose
• Velocity Abuse: Excessive transfer frequency inconsistent with stated purpose
• Provider Hopping: Users systematically avoiding provider-specific limits by switching providers

Important Distinction: PayWolt does NOT monitor individual payment transactions (e.g., card payments, bank transfers) - this is the responsibility of Collection and Payout Providers. PayWolt monitors the orchestration layer (which corridors, which providers, what patterns).

5.2 Monitoring Rules and Thresholds

5.2.1 Threshold-Based Rules

Rationale: These thresholds align with EU Wire Transfer Regulation (EUR 1,000 for full information; EUR 10,000 for heightened scrutiny) and industry best practices.

5.2.2 Behavioral Pattern Rules

5.2.3 Geographic and Corridor Rules

5.3 Alert Management Workflow

Transaction Orchestrated → Monitoring Rules Engine → Alert Generated?
                                                              │
                                                              ├─► No Alert: Transaction proceeds
                                                              │
                                                              └─► Alert Generated
                                                                        │
                                                                        ▼
                                                              L1 Analyst Review (24 hours)
                                                                        │
                                          ┌─────────────────────────────┼─────────────────────────────┐
                                          ▼                             ▼                             ▼
                                    Clear Alert                  Escalate to L2            Request Info from User
                                 (Document Rationale)         (Complex Pattern)          (Via Provider or Direct)
                                                                        │
                                                                        ▼
                                                              L2 Senior Analyst Review (48 hours)
                                                                        │
                                          ┌─────────────────────────────┼─────────────────────────────┐
                                          ▼                             ▼                             ▼
                                    Clear Alert              Escalate to MLRO            Enhanced Monitoring
                                                           (Potential STR)                (Watchlist User)
                                                                        │
                                                                        ▼
                                                              MLRO Review & Decision (72 hours)
                                                                        │
                                          ┌─────────────────────────────┼─────────────────────────────┐
                                          ▼                             ▼                             ▼
                                    Close Case                  File STR/SAR              Account Closure / Exit
                               (No Suspicion)           (Report to Hellenic FIU)      (Terminate Relationship)

5.4 Investigation Procedures

For escalated alerts, the assigned investigator must:

1. Gather Transaction Data:

   • Pull all transfers by the user in the past 90 days
   • Identify all corridors used, amounts, recipients
   • Check for patterns (timing, amounts, frequency)

2. Review User Profile:

   • KYC status from provider (verification level, documents submitted)
   • Stated purpose of account usage
   • Self-declared occupation and income source
   • Historical transaction patterns

3. Analyze Corridor Logic:

   • Is there a logical economic reason for the corridor? (e.g., Nigerian national sending funds to family in Nigeria)
   • Does the pattern suggest trade, employment, or personal remittances?
   • Are amounts consistent with declared income?

4. Check External Sources:

   • Adverse media search (Google, Lexis Nexis, World-Check if available)
   • PEP status verification
   • Social media review (LinkedIn, public profiles) for business verification

5. Provider Inquiry (if applicable):

   • Request additional KYC from provider (source of funds, employment verification)
   • Ask provider if they have flagged the user for suspicious activity

6. Document Findings:

   • Prepare investigation report with timeline, findings, conclusion
   • Recommend disposition: Clear, Monitor, Escalate to MLRO, or File STR

7. MLRO Decision:

   • MLRO reviews investigation report
   • Decides whether to file STR with Hellenic FIU
   • Documents decision rationale

5.5 Alert Disposition Codes

5.6 Performance Metrics and Tuning

Quarterly Metrics:

• Total alerts generated
• Alert-to-investigation ratio (target: <20% escalated to L2)
• Investigation-to-STR ratio
• False positive rate (target: <50%)
• Average time to disposition (target: L1 within 24 hours, L2 within 48 hours, MLRO within 72 hours)

Annual Rule Tuning:

• Review rules with high false positive rates
• Adjust thresholds based on user population growth
• Incorporate new ML/TF typologies from FATF, FIU guidance

---

6. Provider Due Diligence and Oversight

6.1 Provider AML/CTF Due Diligence

Before partnering with a payment service provider, PayWolt conducts comprehensive AML/CTF due diligence:

6.1.1 Initial Due Diligence Checklist

6.1.2 Provider Risk Rating

Based on due diligence findings, each provider is assigned a risk rating:

Current Provider Ratings (as of 2025-01-05):

• Wise (Belgium): Low Risk (EU-regulated EMI; strong AML program; transparent)
• Flutterwave (Nigeria, Kenya, Ghana, SA): Medium Risk (African regulation; adequate AML program; cooperative)
• Stripe (US/EU): Low Risk (US/EU-regulated; robust AML controls; publicly documented program)

6.1.3 Ongoing Provider Monitoring

Annual Re-Certification:

• Request updated AML/CTF policy (if amended)
• Verify license remains valid
• Search for new enforcement actions or adverse media
• Review operational performance (incident reports, STR cooperation)

Event-Driven Reviews:

• Provider receives AML/CTF enforcement action → Immediate review; consider relationship suspension
• Provider changes ownership or regulatory status → Re-conduct initial due diligence
• Provider expands to new high-risk jurisdiction → Assess impact on PayWolt's risk profile

6.2 Provider AML/CTF Contractual Requirements

All provider agreements include the following AML/CTF provisions:

---

7. Suspicious Activity Reporting

7.1 Internal Reporting Obligation

All PayWolt employees have a duty to report suspicious activity to the MLRO. Suspicious activity includes:

Internal Reporting Channel:

• Email: mlro@paywolt.com (encrypted)
• Confidential Hotline: [Confidential number for employees]
• Compliance Portal: Internal case management system

Protections for Reporters:

• Confidentiality maintained (reporter identity protected)
• No retaliation for good-faith reporting
• Whistleblower protection under Greek law and EU Whistleblower Directive (EU 2019/1937)

7.2 MLRO Evaluation and STR/SAR Filing

Upon receiving an internal report or escalated alert, the MLRO:

1. Reviews Report/Alert: Gathers all relevant information, transaction data, investigation findings.
2. Applies Legal Test: Determines whether there are "reasonable grounds to suspect" ML/TF (not "proof" or "knowledge" - suspicion is sufficient).
3. Makes Filing Decision: Decides whether to file a Suspicious Transaction Report (STR) / Suspicious Activity Report (SAR).
4. Files STR (if applicable): Submits STR to appropriate Financial Intelligence Unit:
   • Greece: Hellenic Authority for Combating Money Laundering (via dedicated reporting portal)
   • Other EU: If transaction primarily relates to another EU member state, may file with that country's FIU (coordination with Hellenic FIU)
   • UK (if applicable): National Crime Agency (NCA) via Suspicious Activity Reports (SARs) Online
   • US (if applicable): FinCEN via BSA E-Filing System (if PayWolt has US nexus requiring SAR filing)

STR/SAR Content:

• User identifying information (name, date of birth, address, account number)
• Description of suspicious activity
• Amounts, dates, corridors, recipients involved
• Reason for suspicion (which ML/TF indicators triggered the report)
• Supporting documentation (transaction records, screenshots, investigation notes)

Timing:

• Greece: "Promptly" upon forming suspicion (interpreted as within 24-48 hours)
• UK: As soon as practicable after forming suspicion
• US: Within 30 calendar days of initial detection (if US SAR applies)

Record Keeping:

• Maintain copy of STR and all supporting documentation for 10 years (per Hellenic Law 4557/2018, Article 61)
• STRs stored in secure, access-controlled system (separate from general transaction records)
• Access limited to MLRO, CCO, and designated compliance staff

7.3 Prohibition on "Tipping Off"

Legal Prohibition:

Under Greek AML law (Law 4557/2018, Article 52) and AMLD5 (Article 39), it is a criminal offense to disclose to the user or any third party that:

• A STR has been filed or is being considered
• An AML/CTF investigation is underway
• Authorities have been notified or are investigating

Prohibited Actions:

• Informing the user that their account is under review for AML reasons
• Explaining that a transaction was blocked due to a STR filing
• Discussing STRs with colleagues not involved in the investigation
• Disclosing STR information to external parties (except authorities)

Permitted Actions:

• Informing user of general compliance requirements (e.g., "We need to verify source of funds for compliance purposes")
• Blocking a transaction for "compliance review" without specifying STR
• Discussing suspicions internally with MLRO/compliance team on a need-to-know basis

Penalties for Tipping Off:

• Criminal prosecution (imprisonment and/or fines)
• Regulatory sanctions
• Termination of employment

---

8. Record Keeping and Data Retention

8.1 Retention Periods

Pursuant to AMLD5 (Article 40) and Hellenic Law 4557/2018 (Article 61), PayWolt retains:

Note on KYC Documents: PayWolt does NOT retain identity documents (passports, driver's licenses, selfies, proof of address). These are stored exclusively by the payment service providers performing KYC, in accordance with their own retention obligations.

8.2 Data Security and Access Controls

Security Measures:

• Encryption: AES-256 encryption at rest; TLS 1.3 in transit
• Access Controls: Role-based access control (RBAC); only authorized compliance personnel access AML/CTF records
• Audit Logging: All access to AML/CTF records logged with timestamp and user ID
• Physical Security: Data hosted in SOC 2-compliant data centers (AWS)
• Segregation: STR/SAR records stored separately from general transaction data

Access Authorization:

• Transaction Records: Compliance team, finance (for reconciliation), senior management (read-only)
• STR/SAR Records: MLRO, CCO, designated compliance staff only
• Provider Due Diligence: CCO, AML Compliance Manager, senior management

8.3 Data Subject Requests and AML Exemptions

GDPR Right to Erasure ("Right to be Forgotten"):

Users may request deletion of their personal data under GDPR Article 17. However, PayWolt may refuse erasure if retention is necessary for:

• Legal Obligation: Compliance with AML/CTF retention requirements (GDPR Article 17(3)(b))
• Legal Claims: Establishment, exercise, or defense of legal claims (GDPR Article 17(3)(e))

GDPR Right of Access:

Users may request access to their personal data under GDPR Article 15. However, PayWolt may refuse or limit access if disclosure would adversely affect:

• Prevention, detection, or investigation of crime (GDPR Article 23(1)(d)) - e.g., if providing STR information would constitute "tipping off"
• Important objectives of general public interest (GDPR Article 23(1)(e))

Procedure:

• User requests forwarded to privacy@paywolt.com
• Privacy team consults with CCO/MLRO before responding
• If request relates to data subject of STR/ongoing investigation: Refuse request; cite GDPR Article 23 exemption; do NOT disclose existence of STR

---

9. Training and Awareness

9.1 Training Program Structure

9.2 Training Content

Core Topics:

• What is money laundering and terrorist financing?
• Greece's AML/CTF legal framework (Law 4557/2018, AMLD5/6)
• PayWolt's AML/CTF Policy and procedures
• Red flags and suspicious activity indicators
• Internal reporting procedures and whistleblower protections
• Tipping off prohibition
• Sanctions screening and OFAC/EU sanctions
• Record keeping requirements
• Consequences of non-compliance (legal, regulatory, reputational)

Role-Specific Topics:

• Compliance: STR/SAR writing, investigation techniques, provider oversight
• Customer Support: How to handle unusual user requests; when to escalate
• Engineering: Secure data handling; implementing sanctions screening; monitoring system maintenance

9.3 Training Records and Compliance Tracking

Records Maintained:

• Employee name and role
• Training module(s) completed
• Completion date
• Assessment score (if applicable)
• Acknowledgment of Policy (signed annually)

Compliance Metrics:

• Training completion rate (target: 100% within 60 days of due date)
• Average assessment score
• Overdue training follow-up (automated reminders; escalation to manager after 30 days overdue)

Annual Report to Board:

• Training completion rates by department
• Assessment performance
• Training program updates and enhancements

---

10. Independent Testing and Audit

10.1 Internal Audit (Annual)

Scope:

• Policy and Procedure Compliance: Are procedures being followed?
• Sanctions Screening Effectiveness: Sample testing of screening results; false positive/false negative analysis
• Transaction Monitoring: Review alert generation, investigation quality, disposition accuracy
• Provider Oversight: Review provider due diligence files; verify annual re-certifications
• Record Keeping: Verify retention compliance; test access controls
• Training Compliance: Verify all employees completed training; review training materials for accuracy

Conducted By: Internal Audit function (independent of compliance team) OR external auditor

Deliverable: Written audit report with findings, recommendations, management responses, remediation timeline

Distribution: CCO, CEO, Audit Committee of the Board

10.2 External AML/CTF Review (Every 2-3 Years)

Scope:

• Independent assessment of AML/CTF program against regulatory requirements and industry best practices
• Gap analysis: Identify areas where program falls short of FATF Recommendations, AMLD5 requirements
• Benchmarking: Compare PayWolt's program to peer companies
• Scenario testing: Simulate ML/TF scenarios to test detection capabilities

Conducted By: Qualified external consultant (Big Four accounting firm, boutique AML consultancy)

Deliverable: Comprehensive report with findings, risk assessment, recommendations for enhancement

Action Plan: Management prepares action plan to address findings; progress reported to Board quarterly

10.3 Regulatory Examinations

Preparedness:

• Maintain examination readiness: organized records, accessible documentation
• Designated point of contact for regulators: CCO
• Cooperation protocol: Provide requested information promptly; make personnel available for interviews

Expected Regulators (given PayWolt's non-licensed status, examinations are less likely but possible):

• Hellenic Capital Market Commission (if deemed to provide payment-related services)
• Hellenic Authority for Combating Money Laundering (thematic reviews, investigations)
• Providers' regulators may inquire about PayWolt's controls as part of provider examination

Post-Examination:

• Document all findings and recommendations
• Develop remediation plan with timelines
• Report to Board
• Track remediation completion

---

11. ML/TF Typologies and Red Flags

11.1 Money Laundering Typologies Relevant to Cross-Border Remittances

11.2 User-Level Red Flags

11.3 Transaction-Level Red Flags

11.4 Provider-Level Red Flags

---

12. High-Risk Jurisdictions and Geographic Risk

12.1 Jurisdiction Risk Classification Methodology

PayWolt classifies countries based on the following risk factors:

12.2 Jurisdiction Risk Categories

12.3 FATF Greylist Monitoring

Procedure:

• Monitor FATF website quarterly for Grey List updates
• Upon addition of country to Grey List:
  • Update risk classification to "High Risk"
  • Reduce monitoring thresholds for affected corridors
  • Communicate to all users from that jurisdiction (via email): "We are implementing enhanced verification for transfers involving [Country]. Please ensure your provider has up-to-date KYC on file."
• Upon removal from Grey List:
  • Re-assess risk classification (may remain Elevated if CPI <40)
  • Adjust thresholds accordingly

Current FATF Grey List (as of December 2024; verify at fatf-gafi.org):

• [To be updated based on latest FATF publication]

12.4 Sanctions List Monitoring

Comprehensive Sanctions (No Business):

• OFAC (US): Crimea region of Ukraine, Cuba, Iran, North Korea, Syria, and regions of Donetsk and Luhansk
• EU: Syria, North Korea, Russia (partial; targeted sanctions)
• UN: North Korea, Central African Republic (partial), Democratic Republic of Congo (partial), etc.

Targeted Sanctions (Individual/Entity Level):

• Screened via sanctions lists in Section 4.1
• May permit transfers to country if counterparty is not sanctioned individual/entity

Sanction Updates:

• Real-time monitoring of sanctions announcements (OFAC, EU, UN, UK)
• Immediate corridor/user review upon new sanctions designation

---

13. Incident Response and Breach Notification

13.1 AML/CTF Incident Definition

An "AML/CTF Incident" includes:

• Failure of sanctions screening system (e.g., system outage; list update failure)
• Processing of transaction involving sanctioned individual/entity due to system/human error
• Delayed filing of STR/SAR beyond regulatory deadline
• Tipping-off violation (disclosure of STR to user or unauthorized party)
• Data breach involving AML/CTF records (STRs, investigation files, user KYC data)
• Discovery of employee involvement in ML/TF facilitation

13.2 Incident Response Procedures

Immediate Actions (Within 24 Hours):

1. Containment: Stop processing affected transactions; suspend affected accounts if necessary
2. Notification to MLRO/CCO: Employee discovering incident immediately notifies MLRO and CCO
3. Preliminary Assessment: Determine scope, impact, root cause (preliminary)
4. Preserve Evidence: Secure logs, records, communications related to incident

Investigation (Within 72 Hours):

1. Root Cause Analysis: Investigate how incident occurred; identify control failures
2. Impact Assessment: Determine number of affected transactions/users; financial impact; regulatory impact
3. Regulatory Notification (if required):
   • Sanctions violations: Report to relevant authority (OFAC, EU, Hellenic Ministry of Foreign Affairs)
   • Data breach: Report to Hellenic Data Protection Authority (if GDPR breach criteria met)
   • STR delayed filing: File STR with explanation of delay; notify FIU
4. Documentation: Incident report with timeline, findings, affected parties, corrective actions

Remediation (Within 30 Days):

1. Corrective Actions: Implement fixes to prevent recurrence (system patches, procedure updates, retraining)
2. User Notification (if applicable): If user data compromised, notify affected users (GDPR Article 34)
3. Regulatory Follow-Up: Provide regulators with incident report and corrective action plan
4. Board Notification: Report significant incidents to Board

13.3 Breach Notification Requirements

---

14. Consequences of Non-Compliance

14.1 Legal and Regulatory Consequences

14.2 Reputational and Business Consequences

• Loss of Provider Partnerships: Providers may terminate relationship if PayWolt demonstrates AML/CTF deficiencies
• Investor Confidence: AML incidents may deter investors or trigger contractual breaches (representations & warranties)
• User Trust: Public disclosure of AML failures damages brand and user confidence
• Regulatory Scrutiny: Increased regulatory examinations; potential license requirements imposed

14.3 Employee Consequences

---

15. Policy Review and Amendment

15.1 Review Schedule

15.2 Triggers for Interim Review

• Regulatory Changes: New AML/CTF legislation or guidance issued by Greek authorities, EU, FATF
• Service Expansion: Launch of new corridors, especially high-risk jurisdictions
• Provider Changes: Addition or termination of payment service provider partnerships
• Incident or Breach: AML/CTF incident requiring control enhancements
• Audit Findings: Internal or external audit identifies gaps or recommendations
• Industry Developments: Emerging ML/TF typologies; peer incidents providing lessons learned

15.3 Amendment Process

1. Draft Amendment: CCO or MLRO drafts proposed changes with rationale
2. Internal Review: Legal, Compliance, Risk, and relevant business teams review
3. Board Approval: Material changes (e.g., risk appetite, governance structure, prohibited activities) require Board approval
4. Communication: Updated policy communicated to all employees via email; mandatory acknowledgment
5. Training Update: Training materials updated to reflect changes; supplemental training provided if material
6. Version Control: New version number assigned; revision history maintained

---

16. Definitions

---

Document Control

---

Acknowledgment

I acknowledge that I have read, understood, and agree to comply with this Anti-Money Laundering and Counter-Terrorist Financing Policy.

Failure to comply with this Policy may result in disciplinary action up to and including termination of employment, as well as potential criminal prosecution.

---

This Policy is confidential and proprietary to DONATION POS L.P. (trading as PayWolt). Unauthorized distribution or disclosure is prohibited.

---

This AML/CTF Policy reflects PayWolt's commitment to preventing money laundering and terrorist financing. While PayWolt is not a regulated payment institution, we implement robust controls appropriate to our role as a technology orchestration platform. For legal or regulatory guidance specific to AML/CTF compliance, consult qualified legal counsel or compliance advisors.