Anti-Money Laundering, Counter-Terrorism and Proliferation Financing, and Anti-Bribery and Corruption Policy

Grymey Technologies Ltd ("the Company") maintains an absolute zero-tolerance mandate regarding Anti-Money Laundering (AML), Countering the Financing of Terrorism (CFT), and Countering Proliferation Financing (CPF). This document defines the institutional rules and automated control mechanisms built natively into our product architecture to prevent our platform from being used for illicit finance.

This program is designed and calibrated to comply strictly with:

Nigeria

• Money Laundering (Prevention and Prohibition) Act 2022
• Terrorism (Prevention and Prohibition) Act 2022
• Central Bank of Nigeria (CBN) AML/CFT/CPF Regulations and CBN Baseline Standards for Automated AML Solutions
• Banks and Other Financial Institutions Act (BOFIA)
• Nigeria Data Protection Commission (NDPC) Act

International

• Financial Action Task Force (FATF) Recommendations
• Applicable United Nations Security Council Resolutions (UNSCRs)
• OFAC Specially Designated Nationals (SDN) and Consolidated Sanctions Lists
• Applicable EU and UK sanctions regimes

Regional and International Expansion

Where Grymey operates or intends to operate within the West African Economic and Monetary Union (WAEMU) region, the Company will comply with applicable BCEAO payment service and AML/CFT directives and obtain the required regulatory authorizations prior to commencement of operations in each jurisdiction. This policy applies globally to all Grymey entities and subsidiaries. Local implementation may include additional jurisdictional-specific watchlists, reporting contacts, and regulatory filings, consistent with this global framework.

Ultimate responsibility rests with the Board of Directors. Daily operations, compliance engineering audits, automated rules calibration, and regulatory escalations are managed exclusively by our designated Compliance Officer. This individual possesses the executive authority to execute real-time administrative freezes on any wallet balance or API pathway deemed anomalous. This policy shall be reviewed and formally re-approved by the Board of Directors on an annual basis, or more frequently as regulatory changes or business developments necessitate.

The Company enforces an immutable identity verification process prior to ledger activation. For individual retail wallets, the platform programmatically collects full legal name, residential address, verified email address, phone number, and date of birth. This data is validated instantly against national databases through secure API infrastructure integrations checking Bank Verification Numbers (BVN) or National Identification Numbers (NIN), coupled with required biometric liveness detection.

For commercial entities utilizing our cross-border global checkout and invoicing rails, Grymey implements a mandatory business authentication gate. Merchants must submit:

• Validated Corporate Affairs Commission (CAC) registration profiles (RC/BN numbers)
• Official Corporate Tax Identification Numbers (TIN) cross-verified against relevant local authorities
• Full identity screening, documentation, and biometric validation of all directors and Ultimate Beneficial Owners (UBOs) holding a stake greater than or equal to 5% equity

Following the completion of onboarding verification, all customers and merchants are assigned a risk classification:

High-risk relationships are subject to more frequent transaction monitoring reviews and mandatory six-monthly periodic recertification of KYC/KYB documentation.

Prior to the commencement of any onboarding data collection, all prospective customers and merchants shall be screened against the sanction lists referenced in Section 1.3.1. Any confirmed match shall result in immediate rejection without further processing. Grymey explicitly prohibits establishing business relationships, issuing ledgers, or processing transactions for shell banks, unverified corporate vehicles, anonymous accounts, or individuals operating under fictitious names. Politically Exposed Persons (PEPs) and merchants operating inside High-Risk Jurisdictions are restricted from regular access and are routed into manual Enhanced Due Diligence (EDD) pipelines.

Before the initialization of any local virtual account rail, incoming digital dollar balance, or cross-border settlement, the automated processing engine screens all platform originators and beneficiaries against mandatory domestic and international sanction datasets, including:

• CBN Domestic Watchlist and the Nigerian Financial Intelligence Unit (NFIU) Internally Designated Persons List
• Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) Index
• United Nations Security Council Consolidated List

To ensure compliance with modern baseline standards, screening is conducted utilizing advanced phonetic matching, alias handling, and transliteration algorithms. This eliminates the vulnerability of exact-match evasions by flagging spelling modifications or structural script alterations. Confirmed matches instantly lock the account and place a hard programmatic hold on all linked settlement webhooks.

Sanctions and watchlist screening is conducted not only at onboarding but continuously on an ongoing basis for all customers, merchants, and beneficiaries. The Company maintains a daily synchronization schedule with all referenced watchlists. Any new designation or updated list entry is immediately cross-referenced against our entire customer database, and any confirmed match triggers the account lock and hard hold procedures defined in Section 1.3.2.

The internal ledger monitors transaction patterns continuously. Programmatic limits are hardcoded to detect structuring attempts -- the intentional splitting of high-value invoices into smaller, rapid batches designed to circumvent standard processing flags or our maximum credit card limit caps.

Every verified corporate merchant is assigned an operational threshold baseline during onboarding based on their declared industry vertical and expected monthly volumes. The system automatically triggers an automated alert and suspends outward settlements when:

• Transaction volume exceeds 150% of the calibrated merchant baseline within any 30-day rolling period
• A merchant executes three or more transactions that individually exceed 90% of the applicable daily or per-transaction limit within a 2-hour window
• Cumulative daily transaction volume increases by more than 200% compared to the previous 7-day average without a pre-approved justification

Any such alert is immediately escalated to the Compliance Officer for review.

Upon the triggering of any automated alert under Sections 1.4.1 or 1.4.2, the following process is immediately initiated:

1. System Alert: Automated rule triggers and a programmatic hold is placed on the affected wallet or settlement webhook.
2. Compliance Review: The Compliance Officer accesses all relevant transactional, customer, and beneficiary data within 2 hours of the alert.
3. Disposition: The Compliance Officer determines the alert is either dismissed (classified as a false positive with documented rationale) or escalated (classified as a true positive requiring further investigation).
4. STR Filing: If escalated and confirmed as suspicious, the Compliance Officer proceeds to the STR filing process defined in Section 1.5.1.
5. Documentation: All steps, decisions, and rationale are recorded within the compliance management system and preserved under Section 1.4.4.

In strict compliance with regulatory rules, all customer onboarding records, verified identity tokens, physical documentation logs, and chronological transaction ledger histories are securely preserved in an encrypted state for a minimum period of five (5) years from the date of profile termination or account closure.

When transaction alerts are evaluated by the compliance desk and deemed a true positive for financial crime or illicit structuring, the Company automatically converts the log data into a formal Suspicious Transaction Report (STR) schema. This is prepared for transmission to the Nigerian Financial Intelligence Unit (NFIU) within 24 hours of formal determination. The Compliance Officer is responsible for ensuring that each STR contains all relevant transactional, customer, and contextual information necessary for the NFIU to conduct its analysis, including customer identification data, transaction amounts and dates, beneficiary details, and a narrative description of the suspicious activity observed.

All employees, directors, and contractors are strictly prohibited from disclosing to any person, including the subject of an investigation, that a Suspicious Transaction Report (STR) has been or will be filed, or that an investigation is ongoing. This prohibition applies both during and after employment with the Company. Any breach of this confidentiality obligation shall constitute gross misconduct and shall result in severe disciplinary action, up to and including termination of employment and referral for legal prosecution. The Company encourages all personnel to report any actual or suspected breaches of this policy through confidential internal whistleblowing channels.

Any employee or third party who suspects, witnesses, or has reasonable grounds to believe that a bribe or act of corruption has occurred must report it immediately to:

Grymey strictly prohibits retaliation against any individual who raises a concern in good faith under this policy. Employees who report concerns will be protected from dismissal, demotion, or any other form of discrimination.

All reports will be investigated promptly and thoroughly by the Compliance Officer. Investigations will be conducted with discretion and confidentiality to the extent reasonably possible.