ANTI-MONEY LAUNDERING AND COUNTER-TERRORIST FINANCING (AML/CTF) POLICY

INTRODUCTION AND SCOPE

Regulatory Commitment

URIGHTCOMPANY FINANCE LIMITED (hereinafter — the "Company") is firmly committed to the highest standards of financial integrity, transparency, and the prevention of financial crimes. Our compliance framework is designed to detect, mitigate, and report money laundering (ML) and terrorist financing (TF) activities.

The Company's operations are strictly governed by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) of Canada. Furthermore, in alignment with our international expansion and commitment to global best practices, the Company adheres to:

• The Financial Action Task Force (FATF) Recommendations, including the "Travel Rule" for virtual asset transfers.
• The 5th and 6th Anti-Money Laundering Directives (5AMLD/6AMLD) of the European Union, ensuring high standards of Due Diligence for all users, including those within the European Economic Area (EEA).
• The Sanctions regimes issued by the United Nations (UN), the Office of Foreign Assets Control (OFAC), and the European Union Consolidated List of Sanctions.

Entity Identity and Regulatory Status

The Company is a registered Money Services Business (MSB) in Canada.

• Legal Name: URIGHTCOMPANY FINANCE LIMITED.
• FINTRAC Registration Number: C100000462.
• Authorized Activities: The Company is authorized to provide Foreign Exchange (FX), Money Transferring (Remittance services), Issuing and Redeeming Money Orders, Virtual Currency Services, and Payment Service Provider (PSP) activities.

Prohibited Activities

URIGHTCOMPANY FINANCE LIMITED maintains a zero-tolerance policy regarding illegal financial activities. The Company strictly prohibits and takes active measures against:

• Money Laundering (ML): The process of disguising the origins of illegally obtained money.
• Terrorist Financing (TF): The provision of funds for terrorist activities or organizations.
• Sanctions Evasion: Attempts to bypass economic sanctions imposed by the Government of Canada (e.g., SEMA), the UN Security Council, or other relevant international bodies.
• Fraud and Financial Crime: Any activity involving deception for illegal financial gain.

The Company does not engage with anonymous clients, shell companies, or individuals/entities listed on global sanctions watchlists.

Internal Policies and Technical Compliance

This Policy applies to all employees, contractors, and customers of the Company. We employ advanced technical measures, such as Velocity Checks, Device Fingerprinting, and BIN-code verification, to ensure that our platform is not used for illicit purposes. The Company maintains a zero-tolerance policy toward any attempt to bypass KYC/AML controls via VPN, Proxy, or identity concealment.

RISK-BASED APPROACH (RBA)

Risk Assessment Methodology

The Company employs a comprehensive Risk-Based Approach (RBA) to identify and mitigate potential financial crime threats before they occur. We recognize that not all business relationships present the same level of risk; therefore, we tailor our compliance measures to be proportionate to the identified risk levels.

Core Risk Factors

In accordance with FINTRAC guidelines, the Company evaluates risk across five primary categories:

• Customer Risk: We assess the nature of the customer's business, their occupation, and their profile, including identification as a Politically Exposed Person (PEP) or Head of an International Organization (HIO).
• Geographic Risk: We monitor whether the customer is located in or conducting business with high-risk jurisdictions, countries under international sanctions, or regions with strategic AML/CTF deficiencies.
• Product and Service Risk: We evaluate the inherent risks of our specific offerings, such as virtual currency services, cross-border remittances, and foreign exchange operations.
• Transaction Risk: We analyse transaction patterns, including volume, frequency (velocity), and unusual complexity that may indicate money laundering or terrorist financing.
• Delivery Channel Risk: We account for the risks associated with non-face-to-face onboarding and digital service delivery.

Risk Classification Levels

Based on the assessment, every customer is assigned a risk rating:

• Low Risk: Standard business profiles with transparent and predictable activity.
• Medium Risk: Profiles that require more frequent monitoring due to their business nature or geographical links.
• High Risk: Requires mandatory Enhanced Due Diligence (EDD) and continuous senior management oversight.

Enhanced Due Diligence (EDD) Triggers

The Company automatically applies Enhanced Due Diligence in the following scenarios:

• Identification of a Politically Exposed Person (PEP) or their family members and close associates.
• Operations involving high-risk jurisdictions or countries identified by the FATF as having strategic deficiencies.
• Transactions that are unusually large, complex, or lack an apparent economic or visible lawful purpose.
• Activity involving high-risk virtual asset patterns or anonymity-enhancing technologies.

CUSTOMER DUE DILIGENCE (CDD) AND KYC PROCEDURES

General Principles

The Company adheres to the "Know Your Customer" (KYC) principle, which is the cornerstone of our AML/CTF framework. We do not establish business relationships or carry out transactions until the identity of the customer has been satisfactorily verified in accordance with the PCMLTFA.

Identification of Individual Customers

For individual clients, the Company collects and verifies the following information:

• Full Legal Name: Verified via government-issued photo identification.
• Date of Birth: To ensure the customer meets age requirements and to screen against watchlists.
• Residential Address: Verified through recent utility bills, bank statements, or other reliable government documents (Proof of Address).
• Liveness and Biometric Verification: We utilize advanced technology to ensure that the person presenting the ID is its legitimate owner (where applicable).
• Occupation and Purpose: Information regarding the customer's profession and the intended nature of the business relationship.

Identification of Business Customers

For corporate and legal entities, the Company performs a deep dive into the business structure:

• Corporate Documentation: Collection of Certificate of Incorporation, Articles of Association, and extracts from the relevant corporate registry.
• Identification of Directors: Verification of the individuals authorized to manage the entity.
• Ultimate Beneficial Ownership (UBO): Mandatory identification and verification of any individual who ultimately owns or controls, directly or indirectly, 25% or more of the entity.
• Nature of Business: Assessment of the entity's core activities and expected transaction patterns.

Enhanced Due Diligence (EDD)

In cases where a customer is classified as High Risk, or where specific triggers occur (such as PEP identification or transactions with high-risk jurisdictions), the Company performs Enhanced Due Diligence:

• Source of Funds (SoF): Investigating the origin of the specific funds used in a transaction.
• Source of Wealth (SoW): Understanding the origins of the customer's entire accumulated fortune to ensure it stems from legitimate activities.
• Ongoing Monitoring: High-risk accounts are subject to more frequent reviews and more rigorous transaction scrutiny.

Ongoing Monitoring

KYC is not a one-time event. The Company conducts continuous monitoring of the business relationship to ensure that transactions are consistent with our knowledge of the customer, their business, and their risk profile. We periodically refresh customer documentation based on their assigned risk level or upon the occurrence of specific "trigger events"

Reliance on Third Parties and Data Protection

All collected identity data is processed in strict accordance with the GDPR (for EU residents) and PIPEDA (Canada). Data is encrypted using AES-256 standards. The Company does not store full credit card details (PCI DSS compliance) and uses tokens for payment processing

SANCTIONS AND SCREENING

Zero Tolerance Policy

The Company maintains a strict zero-tolerance approach regarding transactions involving individuals, entities, or regimes subject to international sanctions. Our screening framework is designed to ensure that we do not facilitate the movement of funds for those designated as threats to international peace and security.

Mandatory Global Screening Framework

To ensure full compliance with global regulatory expectations, the Company confirms that all customers and all transactions are rigorously screened against the following watchlists:

• Canadian Sanctions: Comprehensive screening against lists maintained under the Special Economic Measures Act (SEMA) and the Justice for Victims of Corrupt Foreign Officials Act.
• European Union (EU) Sanctions: Mandatory screening against the EU Consolidated List of Sanctions to ensure compliance with European Council regulations.
• United Nations Security Council (UNSC): Global consolidated sanctions list for terrorist groups and prohibited regimes.
• OFAC (U.S. Treasury): Screening against the Specially Designated Nationals (SDN) and all other relevant U.S. sanctions lists to mitigate cross-border risk.
• Politically Exposed Persons (PEP): Identification of individuals in prominent public positions, their family members, and close associates.

4.3. High-Risk Jurisdictions and FATF Compliance In accordance with international standards, the Company applies a strict geographic risk assessment:

• FATF Black and Grey Lists: The Company strictly prohibits and blocks access to services for users located in or conducting business with jurisdictions identified by the Financial Action Task Force (FATF) as having strategic AML/CTF deficiencies (High-Risk Jurisdictions subject to a Call for Action and Jurisdictions under Increased Monitoring).
• Prohibited Jurisdictions: No business relationships shall be established with persons residing in regions under comprehensive embargoes or internal risk-based prohibited lists.

Real-Time and Ongoing Monitoring

Screening is an automated, continuous process integrated into our core systems:

• At Onboarding: No customer is permitted to use our services until an initial screening returns a clear result.
• Transaction Screening: Every individual transaction is screened in real-time before execution, including a check of the sender, the recipient, and any intermediary.
• Trigger Events: Re-screening is automatically conducted whenever there is a change in global watchlists or a change in the customer's profile.

Action on Positive Matches

If a confirmed match with a sanctioned or prohibited party is identified:

• Transaction Rejection: The transaction will be immediately blocked or rejected.
• Asset Freezing: Where required by law, the Company will freeze the assets and property of the sanctioned party.
• Regulatory Notification: A mandatory Terrorist Property Report (TPR) or Suspicious Transaction Report (STR) will be filed with FINTRAC and relevant law enforcement agencies as required.

TRANSACTION MONITORING AND FRAUD PREVENTION

Real-Time Detection and Automated Oversight

The Company employs sophisticated, automated monitoring systems designed to scrutinize all financial activity in real-time. These systems identify suspicious patterns through the following advanced mechanisms:

• Velocity Checks (Speed Limits): The Company monitors the frequency and volume of transactions. Alerts are triggered if a user exceeds predefined thresholds (e.g., more than X transactions per hour or exceeding a total daily/monthly volume) to prevent "smurfing" or rapid money movement.
• BIN-Code and Geo-Consistency Verification: The system automatically checks the consistency between the country of the card issuer (BIN-check) and the user's registered location and IP address. Discrepancies lead to immediate transaction flagging or rejection.
• Anti-Proxy and VPN Detection: To prevent the circumvention of geographic restrictions and identity concealment, the Company technically restricts access to the payment page for users utilizing VPN, Tor, or Proxy services.

5.2. Virtual Currency and Asset Monitoring Given the risks associated with digital assets and "coins," the Company applies specialized Know Your Transaction (KYT) protocols:

• Blockchain Forensics: We utilize advanced blockchain analysis tools to verify the "taint" of digital assets. This includes checking wallet addresses against databases of known illicit actors, darknet markets, and mixers.
• Internal Transfer Prohibition: To prevent the platform from being used as an unregulated exchange, the direct transfer of "coins" or virtual assets between internal user accounts is strictly prohibited and technically blocked.
• In-Game Asset Verification: The Company monitors the legitimacy of all game-related assets (skins) used for exchange or sale to ensure they are not proceeds of theft or fraud.

Fraud-Monitoring and Device Fingerprinting

• Device ID Analysis: The Company collects and analyzes Device IDs and digital fingerprints to detect bot networks and multiple account usage (multi-accounting) intended for price manipulation or fraud.
• Consistency of Payment Methods: In accordance with the "Closed Loop" principle, withdrawals of funds or assets are only permitted to the same payment method used for the initial deposit.

5.4. Suspicious Transaction Reporting (STR) Where the Company has reasonable grounds to suspect that a transaction or an attempted transaction is related to the commission of a money laundering or terrorist financing offense:

• Internal Escalation: The activity is immediately escalated to the Compliance Officer (MLRO) for a detailed investigation.
• Regulatory Filing: A Suspicious Transaction Report (STR) or Terrorist Property Report (TPR) is filed with FINTRAC and, where applicable, other relevant financial intelligence units within statutory timelines.
• Anti-Tipping Off: In strict compliance with the PCMLTFA and global standards, the Company and its employees will not disclose to any customer that a report has been filed or that an investigation is underway.

Audit Trail and Record Retention

• Transaction Logging: The system maintains a complete, immutable log of all critical actions, including registrations, password changes, new payment method linking, and every transaction with "coins".
• Data Retention: All monitoring logs and transaction data are securely stored for a minimum period of five (5) years, ensuring they are readily retrievable for regulatory audits.

REPORTING OBLIGATIONS

Mandatory FINTRAC Reporting

URIGHTCOMPANY FINANCE LIMITED strictly complies with its legal obligation to report certain financial transactions and information to the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). This includes, but is not limited to:

• Suspicious Transaction Reports (STRs): The Company files an STR whenever there are reasonable grounds to suspect that a transaction or an attempted transaction is related to the commission of a money laundering or a terrorist activity financing offence.
• Terrorist Property Reports (TPRs): The Company is required to file a TPR immediately if it has in its possession or control property that it knows is owned or controlled by or on behalf of a terrorist or a terrorist group.
• Large Virtual Currency Transaction Reports (LVCTR): Following Canadian regulations, reports are filed when the Company receives an amount equivalent to $10,000 CAD or more in a single transaction in virtual currency.

Non-Disclosure and "Anti-Tipping Off" Rule

In accordance with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), the Company adheres to a strict non-disclosure policy:

• Tipping-Off Prohibition: The Company, including its directors, officers, and employees, is strictly prohibited by law from disclosing to any customer or third party that a Suspicious Transaction Report (STR) has been filed, or that an AML/CTF investigation is being conducted.
• Confidentiality of Communications: All internal compliance communications and reports submitted to FINTRAC are protected and handled with the highest level of confidentiality to preserve the integrity of the financial system and ongoing investigations.

Internal Escalation Process

The Company maintains an internal reporting mechanism where any employee who identifies suspicious activity must immediately report it to the MLRO. The Compliance Officer is responsible for evaluating the internal report and determining whether the statutory threshold for filing an STR with FINTRAC has been met.

VIRTUAL CURRENCY SERVICES AND TRAVEL RULE

Virtual Currency MSB Status

URIGHTCOMPANY FINANCE LIMITED is registered with FINTRAC as a Money Services Business (MSB) authorized to provide Virtual Currency Services. We recognize the inherent risks associated with digital assets, including their potential for rapid cross-border movement and perceived anonymity. Accordingly, we apply stringent specialized controls to all operations involving virtual currencies to ensure they are not used for illicit purposes.

Information Transfer: The Travel Rule

In strict accordance with the PCMLTFA Regulations and FINTRAC requirements, the Company implements the "Travel Rule" for all virtual currency transfers to mitigate money laundering and terrorist financing risks:

• Threshold for Compliance: For any transfer of virtual assets equivalent to $1,000 CAD or more, the Company ensures that required identifying information accompanies the transaction.
• Information Requirements: The Company collects, verifies, and securely transmits the following data to the recipient financial institution:
• Originator Information: Full legal name and the account number (or unique transaction identifier).
• Beneficiary Information: Full legal name and the recipient's wallet address or account number.
• Transmission Security: This data is transmitted through secure, encrypted channels to ensure the protection of customer information in compliance with privacy laws.

Virtual Currency Monitoring and KYT

To maintain the security of our platform, we perform "Know Your Transaction" (KYT) analysis:

• Blockchain Forensics: We use advanced blockchain analysis tools to screen wallet addresses. Any inbound or outbound transfer linked to darknet markets, mixers, tumblers, or other high-risk sources is subject to immediate rejection and reporting.
• Unhosted Wallets: Transactions involving "unhosted" or "self-custodied" wallets are subject to enhanced scrutiny to verify the legitimacy of the source of funds.

Prohibited Virtual Asset Activity

The Company does not support or facilitate:

• Anonymity-Enhanced Cryptocurrencies (AECs): Transactions involving privacy-focused coins (e.g., Monero, Zcash) that prevent the transparent tracking of funds.
• Illicit Services: Any assets identified as proceeds of crime, ransomware payments, or linked to sanctioned entities.

RECORD KEEPING

Statutory Retention Period

In accordance with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and FINTRAC regulations, URIGHTCOMPANY FINANCE LIMITED maintains a strict record-keeping policy. All relevant records are securely stored for a minimum period of five (5) years.

Scope of Records

The Company ensures that the following documentation is preserved to allow for the reconstruction of individual transactions and to provide evidence of compliance activities:

• Customer Identification Records: Copies of government-issued IDs, proof of address, beneficial ownership information, and records of the methods used to verify identity.
• Transaction Records: Detailed logs of all financial activity, including dates, amounts, currencies (fiat and virtual), sender/receiver information, and associated wallet addresses.
• Reporting Data: Copies of all reports submitted to FINTRAC (STR, TPR, LVCTR) along with the supporting documentation and internal analysis.
• Compliance Documentation: Records of risk assessments (individual and institutional), compliance training logs for employees, and results of independent effectiveness reviews.
• Correspondence: All substantial communications with customers regarding account opening, due diligence inquiries, and transaction justifications.

Format and Security of Records

• Digital Archiving: Records are primarily maintained in a secure, encrypted electronic format that ensures their integrity and prevents unauthorized alteration.
• Retrieval and Accessibility: Our systems are designed to ensure that all records are readily retrievable and can be provided to FINTRAC or law enforcement authorities within the statutory timelines upon a valid request.
• Confidentiality: Access to compliance records is strictly limited to authorized personnel to protect customer privacy and comply with the Personal Information Protection and Electronic Documents Act (PIPEDA).

Disposal of Data

Upon the expiration of the mandatory 5-year retention period (starting from the closing of an account or the completion of a specific transaction), the Company securely disposes of or deletes the data in a manner that ensures it cannot be recovered, unless otherwise required by ongoing legal proceedings or regulatory inquiries.

COMPLIANCE GOVERNANCE AND TRAINING

Compliance Structure

The Company maintains a robust internal governance framework to oversee the AML/CTF program:

• Appointed Compliance Officer (MLRO): The Company has designated a qualified Compliance Officer (Money Laundering Reporting Officer) who has the necessary authority and resources to manage the program and reports directly to Senior Management.
• Three Lines of Defence: We implement a "Three Lines of Defence" model:

1. First Line: Operational teams (front-line staff) responsible for initial KYC and identifying red flags.
2. Second Line: The Compliance Function, responsible for oversight, policy updates, and reporting to FINTRAC.
3. Third Line: Periodic independent reviews/audits to test the effectiveness of our controls.

Employee Training Program

All employees, including senior management and board members, are required to undergo mandatory AML/CTF training:

• Onboarding Training: New hires must complete training before handling any customer transactions.
• Ongoing Education: Regular updates and refresher courses to inform staff about emerging trends in financial crime, new regulatory requirements, and internal procedure changes.
• Focus Areas: Training specifically covers the identification of suspicious activity, reporting obligations under Canadian law, and the proper handling of high-risk scenarios.

Independent Effectiveness Review

In accordance with FINTRAC requirements, the Company's AML/CTF program undergoes an independent review at least every two years. This review ensures that our policies, risk assessments, and training programs remain adequate and effective in the face of evolving threats.

POLICY REVIEW AND CONTACT INFORMATION

Periodic Review

This Policy is a "living document" and is reviewed at least annually to ensure alignment with legislative changes in Canada and shifts in the Company's risk profile.

Contact Our Compliance Department

For any questions regarding our AML/CTF procedures, identity verification requirements, or to report suspicious activity, please contact our Compliance Office:

• Email: [email protected]
• Address: 1 - 4903 54 STREET, LLOYDMINSTER, SASKATCHEWAN, CANADA, S9V 0N6
• Regulatory Reference: FINTRAC MSB Registration #C100000462