KNOW YOUR CUSTOMER (KYC) POLICY

INTRODUCTION AND REGULATORY COMMITMENT

Overview of the Policy

URIGHTCOMPANY FINANCE LIMITED hereinafter — the "Company", "we", "us", or "our" — maintains this Know Your Customer (KYC) Policy as a core component of its Anti-Money Laundering and Counter-Terrorist Financing (AML/CTF) compliance framework.

This Policy establishes the principles, standards, and procedures used by the Company to identify and verify customers, understand the purpose and intended nature of business relationships, determine beneficial ownership and control, assess customer risk, perform sanctions and PEP screening, and monitor customer information on an ongoing basis.

The Company applies KYC controls to prevent the use of its services for money laundering, terrorist financing, sanctions evasion, fraud, identity misuse, or other financial crimes.

Regulatory Framework

The Company is a registered Money Services Business (MSB) in Canada and conducts its activities in accordance with:

• the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA);
• applicable FINTRAC requirements and guidance;
• the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations;
• applicable Canadian sanctions legislation, including the Special Economic Measures Act (SEMA), the United Nations Act, and the Justice for Victims of Corrupt Foreign Officials Act;
• applicable privacy and data protection requirements, including the Personal Information Protection and Electronic Documents Act (PIPEDA);
• relevant international standards, including the Financial Action Task Force (FATF) Recommendations.

Where applicable, the Company may also take into account sanctions regimes, watchlists, and regulatory expectations issued by the United Nations, the European Union, OFAC, and other competent authorities.

Role of KYC in the Company's Compliance Framework

KYC is not a one-time administrative process. It is an essential part of the Company's broader AML/CTF, sanctions, fraud prevention, transaction monitoring, and risk-management framework.

The Company does not establish or continue a business relationship unless required identification, verification, screening, and risk assessment procedures have been completed to the Company's satisfaction.

Applicability

This Policy applies to:

• all customers of the Company, including individual and corporate customers;
• Ultimate Beneficial Owners (UBOs);
• directors, officers, shareholders, partners, trustees, and controlling persons;
• authorized representatives and persons acting on behalf of customers;
• payers, payees, beneficiaries, counterparties, and other relevant parties where involved in transaction flows;
• all Company employees, officers, contractors, consultants, agents, and service providers involved in onboarding, verification, screening, transaction review, risk assessment, or compliance functions.

KYC PRINCIPLES

Customer Identification Standard

The Company applies KYC measures before establishing a business relationship or providing regulated services. The Company must have sufficient understanding of the customer's identity, business activity, ownership structure, source of funds, expected transaction behavior, and risk profile.

Risk-Based Approach

The Company applies a Risk-Based Approach (RBA) to customer identification and verification. The level of due diligence applied is proportionate to identified risks, including customer risk, geographic risk, product and service risk, transaction risk, delivery channel risk, virtual currency exposure, sanctions exposure, and adverse media risk.

Accuracy and Completeness of Information

Customers are required to provide accurate, complete, current, and truthful information. The Company may request additional documents, explanations, confirmations, or supporting evidence at any stage of the relationship.

Prohibited Relationships

The Company does not knowingly establish or maintain relationships with:

• anonymous customers;
• persons using false, stolen, synthetic, or fictitious identities;
• shell companies without a legitimate business purpose;
• entities with concealed or unverifiable beneficial ownership;
• sanctioned individuals, entities, or jurisdictions;
• persons attempting to evade AML/CTF, sanctions, fraud, geographic, or KYC controls;
• customers who refuse to provide required identification, ownership, or risk-related information.

Zero-Tolerance Approach

The Company maintains a zero-tolerance approach toward any attempt to bypass KYC controls through VPN, proxy, Tor, false documents, nominee arrangements, mule accounts, synthetic identities, identity concealment, or other deceptive practices.

CUSTOMER IDENTIFICATION AND VERIFICATION

Identification of Individual Customers

Where the Company provides services to individual customers, or where individuals are involved as UBOs, directors, authorized representatives, or controlling persons, the Company may collect and verify:

• full legal name;
• date of birth;
• residential address;
• government-issued photo identification;
• proof of address;
• occupation or employment information;
• purpose and intended nature of the relationship;
• source of funds, where required;
• source of wealth, where required by risk level;
• contact details;
• liveness, biometric, or electronic verification checks, where applicable.

Identification of Corporate Customers

Before establishing a business relationship with a legal entity, the Company collects and verifies information including, but not limited to:

• full legal name of the entity;
• business registration or incorporation number;
• certificate of incorporation, registration, or equivalent corporate document;
• registered office address;
• principal place of business or operational address, if different;
• jurisdiction of incorporation or registration;
• legal form and ownership structure;
• names of directors, officers, partners, trustees, or equivalent controlling persons;
• nature of business activities;
• business licenses or regulatory registrations, where applicable;
• purpose and intended nature of the business relationship;
• expected transaction types, volumes, currencies, and countries involved;
• source of funds and, where required, source of wealth;
• tax identification number or equivalent, where applicable;
• website, business profile, or other supporting information where relevant.

Verification of Corporate Customers

The Company verifies corporate customers using reliable and independent sources, which may include:

• government or public corporate registries;
• certified corporate documents;
• official company extracts;
• regulatory databases;
• business licenses or permits;
• reliable commercial databases;
• independent electronic verification tools;
• documents issued by a competent authority.

The Company must be satisfied that the customer legally exists and that the information provided is accurate, current, and consistent with the customer's stated business activities.

Verification Methods for Individuals

The Company may verify individuals using one or more reliable methods, including:

• government-issued photo identification;
• certified true copies of documents;
• credit file or dual-process verification methods, where permitted;
• electronic identity verification tools;
• proof of address documents;
• video verification;
• liveness checks;
• biometric checks, where applicable;
• information obtained from regulated financial institutions or trusted third-party providers, where permitted.

Document Authenticity

The Company reviews documents for authenticity, validity, completeness, and consistency. Documents that appear altered, expired, forged, incomplete, or inconsistent may result in escalation, enhanced review, refusal of onboarding, restriction of services, or termination of the relationship.

BENEFICIAL OWNERSHIP AND CONTROL

Ultimate Beneficial Ownership

The Company identifies and verifies the Ultimate Beneficial Owners (UBOs) of corporate customers.

For the purposes of this Policy, a UBO generally includes any individual who directly or indirectly owns, controls, or exercises significant influence over 25% or more of the customer, or otherwise controls the customer through ownership, voting rights, contractual arrangements, or other means.

UBO Information

For each UBO, the Company may collect and verify:

• full legal name;
• date of birth;
• residential address;
• nationality or citizenship, where relevant;
• ownership percentage or nature of control;
• government-issued identification document;
• proof of address, where required;
• source of funds or source of wealth, where required by risk level.

Control Where No UBO Meets the Threshold

Where no individual meets the ownership threshold, the Company identifies and verifies the individual or individuals exercising control over the entity, including senior managing officials, directors, trustees, partners, or equivalent persons.

Complex Ownership Structures

Customers with complex, layered, nominee, offshore, trust-based, or opaque ownership structures may be subject to Enhanced Due Diligence. The Company may refuse or terminate the relationship if ownership or control cannot be reasonably understood or verified.

AUTHORIZED REPRESENTATIVES AND THIRD PARTIES

Authorized Representatives

Where a person acts on behalf of a customer, the Company verifies both the identity of the representative and their authority to act.

The Company may collect:

• full legal name;
• date of birth;
• residential address;
• government-issued identification document;
• position or role within the customer's organization;
• board resolution, power of attorney, mandate, authorization letter, or equivalent authority document;
• contact details and business email address.

The Company does not accept instructions from representatives whose identity or authority has not been verified to the Company's satisfaction.

Third-Party Determination

The Company takes reasonable measures to determine whether a customer is acting on behalf of a third party.

Where a third party is involved, the Company may collect and record:

• name and address of the third party;
• date of birth, if an individual;
• occupation or principal business;
• registration number and place of incorporation, if an entity;
• nature of the relationship between the customer and the third party;
• reason for the third party's involvement.

Prohibition on Concealment

The use of third parties, nominees, intermediaries, or layered structures to obscure ownership, control, source of funds, or transaction purpose is strictly prohibited.

CUSTOMER RISK ASSESSMENT

Risk Classification

Each customer is assigned a risk rating based on information collected during onboarding and ongoing monitoring.

The Company generally classifies customers as:

• Low Risk;
• Medium Risk;
• High Risk.

Risk Factors

The Company assesses customer risk based on factors including:

• jurisdiction of incorporation, residence, or operation;
• countries involved in transaction flows;
• industry and business model;
• ownership and control structure;
• presence of nominees, trusts, intermediaries, or complex structures;
• expected transaction volume, frequency, and value;
• products and services requested;
• virtual currency exposure;
• delivery channel and non-face-to-face onboarding risk;
• sanctions, PEP, HIO, or adverse media exposure;
• history of suspicious activity, fraud, chargebacks, or regulatory concerns;
• inconsistencies between customer information, payment methods, device information, geographic indicators, and transaction behavior.

Review of Risk Rating

Customer risk ratings are reviewed periodically and upon trigger events. The Company may update a customer's risk rating at any time based on new information, changed behavior, transaction activity, sanctions exposure, fraud indicators, or compliance concerns.

CUSTOMER DUE DILIGENCE

Standard Due Diligence

Standard Due Diligence is applied to customers presenting normal or expected levels of risk. It includes identification, verification, screening, business activity assessment, and establishment of an expected customer profile.

Enhanced Due Diligence

Enhanced Due Diligence (EDD) is applied to customers or relationships presenting higher risk. EDD may include:

• additional verification of identity and ownership;
• senior management approval;
• source of funds verification;
• source of wealth assessment;
• detailed review of business model and transaction rationale;
• review of counterparties, countries, and payment flows;
• adverse media checks;
• more frequent KYC refresh and ongoing monitoring;
• additional transaction limits or controls;
• additional restrictions on products or services.

EDD Triggers

The Company may apply EDD in the following cases:

• identification of a Politically Exposed Person (PEP), Head of an International Organization (HIO), or their family members or close associates;
• customers connected to high-risk jurisdictions;
• customers or transactions involving countries identified by FATF as having strategic AML/CTF deficiencies;
• complex or opaque ownership structures;
• unusual, large, complex, or high-volume transaction activity;
• activity involving virtual currency, unhosted wallets, mixers, tumblers, darknet markets, or other high-risk digital asset indicators;
• anonymity-enhancing technologies or attempts to conceal identity, location, or device information;
• use of VPN, Tor, proxy services, or other tools to bypass geographic or identity controls;
• negative media or allegations of financial crime;
• high-risk industries or business models;
• transactions lacking an apparent lawful or economic purpose;
• inconsistencies in documents, ownership, business activities, payment methods, or expected activity.

Simplified Due Diligence

Where permitted by applicable law and the Company's internal risk assessment, simplified due diligence may be applied to lower-risk customers. Simplified due diligence does not remove the Company's obligation to understand the customer, verify identity where required, and conduct sanctions screening.

SANCTIONS, PEP, HIO AND ADVERSE MEDIA SCREENING

Mandatory Screening

The Company screens customers, UBOs, directors, authorized representatives, and relevant counterparties against sanctions, PEP, HIO, and adverse media sources before onboarding and on an ongoing basis.

Sanctions Lists

Screening may include, but is not limited to:

• Canadian sanctions lists, including lists under SEMA and the United Nations Act;
• Global Affairs Canada sanctions lists;
• United Nations Security Council sanctions lists;
• European Union consolidated sanctions lists;
• OFAC sanctions lists, where relevant to risk exposure;
• United Kingdom sanctions lists, where relevant;
• other applicable international sanctions and watchlists.

PEP and HIO Screening

The Company identifies Politically Exposed Persons (PEPs), Heads of International Organizations (HIOs), their family members, and close associates. Where such persons are identified, the Company applies risk-based controls, which may include EDD, senior management approval, and enhanced ongoing monitoring.

Adverse Media

The Company may review publicly available information, including adverse media, litigation records, regulatory actions, law enforcement notices, and credible public sources where relevant to customer risk assessment.

Action on Matches

Potential matches are escalated to the Compliance Officer / MLRO for review. Where a match is confirmed, the Company may reject onboarding, block or reject transactions, restrict access to services, freeze assets where required by law, and report to FINTRAC or other competent authorities where applicable.

TECHNICAL KYC, SECURITY, AND PAYMENT CONTROLS

Device and Access Controls

The Company may use technical controls to support KYC, fraud prevention, and transaction security, including:

• device fingerprinting;
• IP address and geolocation checks;
• VPN, Tor, and proxy detection;
• browser and session integrity checks;
• login anomaly detection;
• automated activity and bot detection.

Payment Method Verification

The Company may verify consistency between the customer's identity, business profile, transaction behavior, payment method, card issuer country, bank account information, IP address, and geographic location.

BIN-Code and Geo-Consistency Checks

Where card payments are involved, the Company may use BIN-code verification and geo-consistency checks to identify discrepancies between the customer profile, payment instrument, issuing country, and access location.

Closed Loop Principle

Where applicable, withdrawals, refunds, or redemptions may be required to return to the same payment method or account used for the original transaction, unless otherwise approved through a risk-based review.

VIRTUAL CURRENCY AND KYT CONTROLS

Virtual Currency Services

Where the Company provides virtual currency-related services, additional KYC and Know Your Transaction (KYT) controls may be applied to address the specific risks of digital assets.

Wallet and Transaction Risk

The Company may assess wallet addresses, transaction flows, blockchain exposure, source of funds, and links to high-risk indicators such as mixers, tumblers, darknet markets, ransomware, fraud, sanctioned entities, stolen assets, or other illicit activity.

Unhosted Wallets

Transactions involving unhosted or self-custodied wallets may be subject to enhanced scrutiny to verify the legitimacy of the source and destination of funds.

Prohibited Virtual Asset Activity

The Company does not knowingly support virtual asset activity involving anonymity-enhanced cryptocurrencies, sanctioned wallets, darknet markets, ransomware proceeds, mixers, tumblers, stolen assets, or other illicit sources.

ONGOING MONITORING AND KYC REFRESH

Continuous Monitoring

KYC is not a one-time process. The Company conducts ongoing monitoring to ensure that customer activity remains consistent with the customer's profile, business model, source of funds, expected transaction behavior, and assigned risk level.

Trigger Events

The Company may refresh KYC information or conduct additional review when trigger events occur, including:

• changes in ownership or control;
• changes in directors or authorized representatives;
• changes in business activity or operating countries;
• unusual transaction behavior;
• high-value, frequent, or complex transactions;
• sanctions, PEP, or HIO status changes;
• negative media or law enforcement concerns;
• expired identification or corporate documents;
• inconsistencies in customer information;
• use of new payment methods, wallets, countries, or counterparties;
• suspected fraud, chargeback abuse, account takeover, or misuse of services.

Periodic Review

The Company periodically reviews customer information based on risk level. High-risk customers are reviewed more frequently and may be subject to enhanced monitoring and additional documentation requirements.

REFUSAL, RESTRICTION, AND TERMINATION OF RELATIONSHIP

Grounds for Refusal or Restriction

The Company may refuse onboarding, restrict services, suspend transactions, freeze funds where required by law, or terminate a relationship where:

• required identification or verification cannot be completed;
• beneficial ownership or control cannot be determined;
• the customer provides false, misleading, incomplete, or inconsistent information;
• the customer refuses to provide required information or documents;
• sanctions, fraud, AML/CTF, or terrorist financing concerns are identified;
• the customer attempts to conceal identity, ownership, location, source of funds, or transaction purpose;
• the relationship exceeds the Company's risk appetite.

No Obligation to Provide Services

The Company is not obligated to provide or continue services where doing so would breach applicable law, regulatory requirements, sanctions obligations, internal risk policies, or the Company's AML/CTF and sanctions compliance standards.

RECORD KEEPING

Retention Period

The Company securely retains KYC-related records for a minimum period of five (5) years after the end of the business relationship or completion of the relevant transaction, unless a longer retention period is required or permitted by law.

Records Maintained

KYC records may include:

• customer identification documents;
• corporate documents and registry extracts;
• UBO and ownership records;
• authorized representative documents;
• third-party determination records;
• verification results;
• sanctions, PEP, HIO, and adverse media screening results;
• customer risk assessments;
• EDD documentation;
• source of funds and source of wealth information;
• transaction profile and monitoring records;
• technical security and fraud-prevention indicators;
• internal compliance notes and escalation records;
• correspondence with customers;
• updated KYC forms and review records.

Security of Records

Records are stored securely and protected against unauthorized access, alteration, disclosure, loss, or destruction. Access is limited to authorized personnel with a legitimate business, legal, compliance, or regulatory need.

REPORTING, ESCALATION, AND ANTI-TIPPING-OFF

Internal Escalation

Any KYC concern, suspicious information, sanctions alert, PEP or HIO match, adverse media issue, document inconsistency, fraud indicator, or refusal to provide required information must be escalated to the Compliance Officer / MLRO.

Suspicious Activity

Where the Company has reasonable grounds to suspect that a transaction, attempted transaction, customer, or business relationship may be connected to money laundering, terrorist financing, sanctions evasion, fraud, or other financial crime, the matter will be reviewed by the Compliance Officer / MLRO.

Regulatory Reporting

Where required, the Company will file reports with FINTRAC or other competent authorities in accordance with applicable legal obligations, including Suspicious Transaction Reports (STRs), Terrorist Property Reports (TPRs), or other required reports.

Anti-Tipping-Off

The Company and its employees will not disclose to any customer or third party that a report has been filed, that a report is being considered, or that an AML/CTF, sanctions, fraud, or compliance investigation is underway, where such disclosure is prohibited by law.

DATA PROTECTION AND CONFIDENTIALITY

Data Protection

The Company processes KYC information in accordance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable data protection requirements where relevant.

Confidentiality

KYC information is treated as confidential and used only for lawful business, compliance, security, legal, regulatory, or risk-management purposes.

Sharing of Information

The Company may share KYC information with service providers, financial institutions, regulatory authorities, law enforcement agencies, or other competent authorities where required or permitted by law, contractual obligations, or compliance requirements.

TRAINING, GOVERNANCE, AND INDEPENDENT REVIEW

Compliance Oversight

The Company has designated a Compliance Officer / Money Laundering Reporting Officer (MLRO) responsible for overseeing the implementation of this Policy, maintaining appropriate KYC procedures, reviewing escalations, and ensuring alignment with applicable regulatory requirements.

Three Lines of Defence

The Company applies a "Three Lines of Defence" model:

1. First Line: operational and onboarding teams responsible for collecting customer information, identifying red flags, and following KYC procedures.
2. Second Line: compliance function responsible for oversight, risk assessment, screening, escalation review, and reporting to FINTRAC where required.
3. Third Line: periodic independent review or audit to test the effectiveness of the Company's KYC, AML/CTF, sanctions, and related controls.

Employee Training

All employees involved in onboarding, customer verification, transaction review, risk assessment, payment operations, or compliance functions are required to undergo KYC, AML/CTF, sanctions, and fraud-prevention training.

Training may cover:

• customer identification requirements;
• beneficial ownership verification;
• document authenticity checks;
• sanctions, PEP, and HIO screening;
• red flags of money laundering and terrorist financing;
• fraud and account misuse indicators;
• virtual currency and KYT risks;
• escalation procedures;
• record-keeping obligations;
• anti-tipping-off requirements.

Ongoing Training

Employees receive periodic refresher training and updates when there are material changes in law, regulation, Company procedures, risk profile, products, services, or financial crime typologies.

Independent Review

The Company's KYC framework is subject to periodic independent review as part of the Company's broader AML/CTF compliance program. Such review is conducted at least every two years or more frequently where required by law, regulatory expectations, or changes in the Company's risk profile.

POLICY REVIEW AND CONTACT INFORMATION

Periodic Review

This Policy is reviewed at least annually or upon material changes in laws, regulations, business operations, risk exposure, products, services, or internal procedures.

Contact Our Compliance Department

For any questions regarding this KYC Policy, customer verification requirements, or related compliance procedures, please contact:

• Email: [email protected]
• Address: 1 - 4903 54 STREET, LLOYDMINSTER, SASKATCHEWAN, CANADA, S9V 0N6
• Regulatory Reference: FINTRAC MSB Registration #C100000462