Compliance and AML policy

Introduction

Fortress Algo Incorporated, operating under the trade name Wiremi, is a corporation incorporated under the laws of Canada with Registry ID 4363756. We are licensed by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a Money Services Business (MSB) under License Number M23401666. This Compliance and Anti-Money Laundering (AML) Policy outlines our comprehensive approach to preventing financial crimes, including money laundering, terrorist financing, fraud, and other illicit activities.

As a licensed financial services provider operating across multiple jurisdictions, we recognize our critical role in the global effort to combat financial crime. We are committed to maintaining the highest standards of regulatory compliance and ethical business practices. Our compliance program is designed to detect, prevent, and report suspicious activities while ensuring that our services are not misused for illegal purposes.

This policy applies to all employees, officers, directors, contractors, and agents of Wiremi, as well as to all users of our services. We require strict adherence to this policy and related procedures, and we provide regular training to ensure that all personnel understand their compliance obligations. Failure to comply with this policy may result in disciplinary action, termination of employment or services, and referral to relevant authorities.

Our Compliance Programme

Wiremi maintains a written Anti-Money Laundering and Anti-Terrorist Financing Compliance Programme, version 2.0, effective March 2026, approved by the Chief Executive Officer and owned by the Chief Compliance Officer. It replaces the policy we published in October 2024, it is built on the five elements the PCMLTFA requires of every Money Services Business, and it is reviewed on the schedule the law sets rather than when convenient.

The five elements

• A Chief Compliance Officer, appointed by the CEO, with the authority and the resources to run the programme and to file directly with FINTRAC.
• Written policies and procedures, kept current and approved by senior management, covering client identification, record keeping, monitoring, reporting, sanctions and training.
• A documented assessment of the money laundering and terrorist financing risks in our products, clients, geographies and delivery channels, with the controls that answer each risk.
• A training programme for every employee, officer, director and agent who touches an account or a transaction, delivered on joining and at least annually thereafter.
• An independent effectiveness review of the whole programme at least every two years, with findings reported to senior management and remediated on a tracked plan.

Governance

The Chief Compliance Officer is the designated filer for every report submitted to FINTRAC, maintains the credentials for FINTRAC’s electronic reporting system, and provides the CEO with a quarterly summary of reports filed, alerts reviewed and false positives. Support staff are responsible for identifying transactions that may trigger a reporting obligation; engineering maintains the automated detection systems; the CEO provides the resources the programme needs and receives its reports.

The Chief Compliance Officer carries no sales or growth target and is not paid on transaction volume, has direct access to the board, and may stop, delay, hold or reverse any transaction and freeze, restrict or close any account where money laundering, terrorist financing or sanctions risk is identified, without needing anyone's approval first. Tightening a limit or a control is the Chief Compliance Officer's decision alone. Loosening one requires the written approval of the Chief Executive Officer and is recorded.

Scope

The programme covers every service Wiremi offers, including domestic transfers between Wiremi accounts, cross-border remittances delivered through regulated payment partners and mobile money operators, stablecoin on-ramp and off-ramp services delivered through regulated partners, savings circles, Circle Credit, cards and Wiremi Verify. Wiremi is a digital-only platform and does not accept or hand over physical cash.

Regulatory Framework

Our compliance program is built upon a foundation of international standards and national regulations from all jurisdictions in which we operate. We continuously monitor regulatory developments and update our policies and procedures to ensure ongoing compliance. The following regulatory frameworks form the basis of our compliance program:

Financial Action Task Force (FATF) Recommendations

The FATF is the global standard-setter for anti-money laundering and counter-terrorist financing measures. We align our compliance program with the FATF's 40 Recommendations, which provide a comprehensive framework for combating money laundering, terrorist financing, and the financing of proliferation of weapons of mass destruction. We regularly review updates to FATF guidance and incorporate relevant requirements into our policies and procedures.

Canada's Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA)

As a Canadian Money Services Business, we are subject to the PCMLTFA and its associated regulations. This legislation requires us to implement a comprehensive compliance program that includes appointing a compliance officer, developing written policies and procedures, conducting risk assessments, implementing training programs, performing effectiveness reviews, and meeting all record-keeping and reporting obligations to FINTRAC.

Regional and International Regulations

Given our global operations, we comply with applicable regulations in all jurisdictions where we offer services. This includes but is not limited to the European Union's Anti-Money Laundering Directives (AMLDs), which establish comprehensive requirements for customer due diligence, beneficial ownership identification, and suspicious transaction reporting; the United States Bank Secrecy Act (BSA) and related FinCEN regulations for any transactions involving the U.S. financial system; and various national AML laws and regulations in African, Asian, and other markets where we operate.

The corridors we serve

Our clients are resident in Canada, and remittances are delivered in the destination country by licensed partners that hold the local licence and carry the local reporting obligation. We align our controls with the destination regime so that a transfer that is acceptable in Canada is not unacceptable on arrival: Nigeria under the Money Laundering (Prevention and Prohibition) Act 2022 and Central Bank of Nigeria regulation; Ghana under the Anti-Money Laundering Act 2020 and Bank of Ghana guidelines; Cameroon under the CEMAC regulation and ANIF; Kenya under the Proceeds of Crime and Anti-Money Laundering Act and the Financial Reporting Centre. Every corridor is rated in our country risk table, carries its own limits, and is screened on both the sending and the receiving side.

Sanctions Compliance

We maintain strict compliance with economic sanctions programs administered by the United Nations, the United States Office of Foreign Assets Control (OFAC), the European Union, the Government of Canada, and other relevant authorities. We do not provide services to sanctioned countries, entities, or individuals, and we screen all customers and transactions against applicable sanctions lists.

Customer Due Diligence & KYC

Customer Due Diligence (CDD) is the cornerstone of our compliance program. We are committed to knowing our customers and understanding their financial activities to detect and prevent misuse of our services. Our Know Your Customer (KYC) procedures are designed to verify the identity of all users, understand the nature and purpose of business relationships, and assess the risk profile of each customer.

Verify before value moves

The law requires a money services business to verify identity at CAD $1,000 for an electronic funds transfer. We verify every client at onboarding, before any function that moves money is enabled, whatever the amount. Someone who has registered but not verified can look around the app, receive an invitation to a savings circle and read what we publish. They cannot deposit, send, receive, save, join or start a circle, borrow, lend, pay rent, hold a card or touch stablecoins. The platform enforces that gate, and no employee can override it.

Identity Verification

Every client is identified and verified before any function that moves money is enabled. For an individual that means a valid, unexpired, government-issued photo identification document, captured live in the app rather than uploaded as a photocopy or a screenshot, and authenticated by technology that checks security features, fonts, layout, the machine-readable zone and the consistency of the data. We collect full legal name, date of birth, residential address, nationality, occupation, and the purpose and intended nature of the relationship, and we compare what the client tells us with what the document says. Proof of address dated within the last three months is required at Tier 2 and for every client rated high risk.

Biometric Verification

To ensure that the person opening an account is the same person whose identity documents have been submitted, we employ biometric verification technology. This includes selfie verification, where customers take a photograph of themselves that is compared against the photo on their identity document using facial recognition technology; and liveness detection, which ensures that the person is physically present during verification and that static images or videos are not being used fraudulently.

Verification tiers

What a client can do follows what we know about them. Tier 0 is a registered login with no access to money. Tier 1 is the verified account: photo identification authenticated by technology, a liveness-checked selfie matched to the document photograph, the identifying information above, and sanctions and politically exposed person screening. Tier 2 adds proof of address, source of funds with supporting documents, and the approval of the Chief Compliance Officer, and it is required for higher limits, for every client rated high risk, for foreign politically exposed persons, and for stablecoin transfers to external wallets above the base limit. A business profile is opened on the verified identity of its owner and additionally requires confirmation of the entity, its directors, and identification of every person who owns or controls 25 percent or more.

How we rate risk

Every client is rated low, medium or high at onboarding, from residence and nationality, the corridors they use, occupation and source of funds, politically exposed person status, the products they hold, their behaviour and any adverse information. The rating is the highest level any single factor produces, and it is recalculated on every material event. It sets the tier we require, the limits we allow, how closely the account is monitored, and how often we refresh what we know: every three years at low risk, every two at medium, and annually at high. A foreign politically exposed person, a confirmed sanctions match, and the subject of a filed suspicious transaction report are always rated high.

Enhanced Due Diligence (EDD)

For customers identified as higher risk, we apply Enhanced Due Diligence measures that go beyond our standard verification procedures. Factors that may trigger EDD include customers from high-risk jurisdictions as identified by FATF or our own risk assessment; Politically Exposed Persons (PEPs) and their close associates or family members; customers with unusual transaction patterns or unclear sources of wealth; complex business structures or beneficial ownership arrangements; and any other factors that suggest elevated money laundering or terrorist financing risk.

Source of Funds Verification

For higher-value transactions or higher-risk customers, we require verification of the source of funds. This may involve collecting documentation such as bank statements, employment records, business financial statements, sale contracts, inheritance documents, or other evidence that demonstrates the legitimate origin of the funds being transferred through our platform.

Ongoing Monitoring and Reviews

Customer due diligence is not a one-time event but an ongoing process. We continuously monitor customer activity and periodically review customer profiles to ensure that information remains current and accurate. Customers may be required to provide updated identification documents, confirm or update their personal information, and answer questions about changes in their circumstances. Risk assessments are updated based on transaction behavior and any new information that becomes available.

Third parties

We ask at onboarding, and again whenever a transaction suggests it, whether a client is acting on behalf of or at the instruction of anyone else. Where there is a third party we record who they are and what the relationship is. Sometimes the signs point to one nobody has declared: funds arriving from unrelated accounts, a client who cannot explain a transaction, instructions visibly coming from someone else. We record the suspicion and our reasons, treat it as a risk factor and assess it for a suspicious transaction report. An account is operated only by the verified holder, or for a business by a verified authorised user.

Who performs the checks

Identity verification and screening at onboarding are performed by our regulated identity provider under a written agreement that requires the check to be made by a method the regulations permit and requires the verification record to be given to us on request, so that we can produce it to FINTRAC within 30 days. We screen against the Canadian lists ourselves in addition, and we set the risk rating, the monitoring and the refresh ourselves. Reliance covers the check, never the judgement: we remain fully responsible to FINTRAC for every verification performed on our behalf, and the Chief Compliance Officer audits a sample of those records every quarter.

Politically Exposed Persons

Politically Exposed Persons (PEPs) present an elevated risk for potential involvement in corruption, bribery, and money laundering due to their public positions and influence. We have implemented specific procedures to identify and manage relationships with PEPs in accordance with FATF recommendations and applicable regulations.

Definition of PEPs

For the purposes of our compliance program, PEPs include individuals who hold or have held prominent public functions, such as heads of state or government, senior politicians, senior government officials, judicial or military officials, senior executives of state-owned corporations, and important political party officials. We also apply enhanced measures to family members of PEPs, including spouses, children, parents, and siblings, as well as close associates who are known to have close business or personal relationships with PEPs.

PEP Screening and Identification

We screen all customers against comprehensive PEP databases at the time of onboarding and on an ongoing basis. Our screening process uses specialized third-party databases that are regularly updated with information from government sources, news media, and other reliable sources. When a potential PEP match is identified, our compliance team conducts a manual review to confirm whether the customer is indeed a PEP.

Enhanced Measures for PEPs

When a customer is confirmed as a PEP, we apply enhanced due diligence measures including senior management approval for establishing or continuing the business relationship; enhanced scrutiny of the source of wealth and source of funds; collection of additional documentation to verify the legitimate origin of assets; enhanced ongoing monitoring of transactions with lower thresholds for triggering alerts; and more frequent periodic reviews of the customer relationship.

Duration of PEP Status

A person does not cease to be a PEP immediately upon leaving a prominent public function. We continue to treat former PEPs as presenting elevated risk for a period of at least two years after they leave their position, or longer if the nature of the position, the jurisdiction, or other factors suggest that elevated risk may persist. Even after this period, we may continue enhanced monitoring if other risk factors are present.

Sanctions Screening

Economic sanctions are powerful tools used by governments and international organizations to combat terrorism, weapons proliferation, human rights abuses, and other threats to international peace and security. Compliance with applicable sanctions is a legal requirement and a cornerstone of our commitment to preventing financial crime.

Sanctions Lists We Screen Against

We screen every client at onboarding and every transaction in flight against the sanctions lists that apply to us, and we rescreen all client accounts whenever a list is updated. In Canada that means the lists of terrorist entities under the Criminal Code, the Regulations Implementing the United Nations Resolutions on the Suppression of Terrorism, the Special Economic Measures Act and the Justice for Victims of Corrupt Foreign Officials Act, together with the consolidated lists published by the Office of the Superintendent of Financial Institutions and Global Affairs Canada. Internationally we screen against the United Nations Security Council consolidated list, the United States OFAC Specially Designated Nationals list and the European Union consolidated list. The Chief Compliance Officer monitors list updates, and where the Minister of Finance issues a directive concerning a jurisdiction or entity, the programme applies it immediately.

Screening Process

We employ automated screening systems that check all customers and transactions in real-time against applicable sanctions lists. Screening occurs at multiple points, including customer onboarding, before processing any transaction, and on an ongoing batch basis to catch any changes to sanctions lists. Our screening systems use sophisticated matching algorithms that account for name variations, transliterations, and common aliases to minimize both false positives and false negatives.

Handling of Matches

When a potential sanctions match is identified, the transaction or account is immediately frozen pending review by our compliance team. Our analysts conduct a thorough investigation to determine whether the match is a true positive or a false positive due to common names or other factors. If a match is confirmed as a true positive, we immediately block the transaction, freeze the account, and report the matter to relevant authorities as required by law.

Prohibited Jurisdictions

We do not provide services to customers located in countries subject to comprehensive sanctions, nor do we process transactions to or from such jurisdictions. The list of prohibited jurisdictions is reviewed and updated regularly based on changes to applicable sanctions programs. We also maintain heightened scrutiny for transactions involving jurisdictions identified by FATF as having strategic deficiencies in their AML/CTF frameworks.

Clients we will not take

We do not open or keep an account for, and we do not process a transaction for: a person or entity listed under Canadian sanctions or terrorist-listing law, or owned or controlled by one; a person resident in, or an entity incorporated in, a country under comprehensive Canadian sanctions or a FATF call for action; a shell bank, an unregistered money services business, or anyone acting as an undisclosed agent for others; anyone under the age of 18, or anyone who cannot complete identity verification; a business engaged in illegal activity, unlicensed gambling, weapons trafficking or the unlicensed sale of controlled substances; or anyone we have already exited for money laundering, terrorist financing or fraud, including under a new identity or a new business.

Transaction Monitoring

Effective transaction monitoring is essential for detecting suspicious activity that may indicate money laundering, terrorist financing, or other financial crimes. We employ a combination of automated systems and human analysis to monitor all transactions processed through our platform.

Automated Monitoring Systems

Our transaction monitoring infrastructure uses artificial intelligence and machine learning algorithms to analyze transaction patterns in real-time. These systems are designed to detect anomalies that may indicate suspicious activity, including transactions that are inconsistent with a customer's known profile or stated purpose; unusual patterns such as rapid movement of funds, round-dollar amounts, or just-below-threshold transactions; transactions involving high-risk jurisdictions or counterparties; and patterns consistent with known money laundering typologies.

Controls built for what Wiremi actually does

Generic bank rules do not describe this platform, so the monitoring is written for the products we run. A savings circle is a closed loop: a contribution can only be funded from a member's own verified wallet and a payout can only reach that same wallet, and the platform blocks anything outside it. In Circle Credit the borrower and the peer benefactor are both verified clients, capital comes only from the benefactor's own wallet, loan proceeds reach only the borrower's wallet, and repayment is taken only from it. Any link between the two is reviewed before a loan is disbursed: a shared device, a shared address, a shared funding source, a shared family name. Rent is paid only to a landlord who has been identified and screened. A Wiremi Verify subscriber attests to a permitted purpose, and abnormal volume or a purpose that does not fit the subscriber's business suspends access. Every stablecoin address is screened before a transfer is released, and an address linked to a mixer, a darknet market, a sanctioned service or a known theft is blocked outright.

Structuring Detection

Structuring (also known as "smurfing") is the practice of breaking up transactions into smaller amounts to avoid reporting thresholds. Our monitoring systems are specifically designed to detect structuring patterns, including multiple transactions just below reporting thresholds conducted in quick succession; transactions split across multiple accounts or recipients; and the use of multiple payment methods or channels to avoid detection.

How an alert is handled

Alerts are prioritised. A sanctions match, confirmed terrorist property, or an account takeover with funds in flight holds the transaction automatically and reaches the Chief Compliance Officer within two hours, at any hour. Structuring, rapid movement on a new account, an illicit stablecoin address, or a politically exposed person hit on a high-value transfer holds the transaction and is reviewed within one business day. Velocity, corridor and profile anomalies are reviewed within five business days. Every alert is closed with a written reason and one of four outcomes: explained, enhanced due diligence applied, account restricted or exited, or escalated for a reporting decision. Nothing is closed silently, and anything still open after ten business days is reported to the Chief Compliance Officer weekly.

What the machines do not decide

Our monitoring models, and Ori, the assistant in the app, surface, rank, summarise and draft. They do not move money, do not close an alert, do not decide whether a report is filed, and do not speak to clients about a compliance hold. Every reporting decision is made by a named person, and the model output that informed a decision is kept with the case so that the reasoning can be reconstructed afterwards. The Chief Compliance Officer reviews model performance at least quarterly, including for disparate impact on the newcomer and diaspora communities we serve.

Suspicious Transaction Reports (STRs)

When our monitoring systems or staff identify potentially suspicious activity, the matter is escalated to our compliance team for investigation. If, after investigation, there are reasonable grounds to suspect that the transaction or activity is related to money laundering, terrorist financing, or other illegal activity, we file a Suspicious Transaction Report (STR) with FINTRAC. We are prohibited from informing the customer that an STR has been filed (known as the "tipping off" prohibition).

Large Cash Transaction Reports (LCTRs)

Wiremi is a digital-only platform and does not receive physical cash from clients. Deposits arrive by bank transfer, mobile money or other electronic means, none of which constitute cash under the PCMLTFA. Large Cash Transaction Reports therefore have low applicability to our current operations. Should the business ever introduce cash handling, for example through an agent network, the risk assessment will be updated, cash monitoring implemented, staff trained and LCTRs filed for cash receipts of CAD $10,000 or more, including 24-hour aggregates, within 15 calendar days.

Electronic Funds Transfer Reports (EFTRs)

Cross-border remittances are the core of what Wiremi does, and Electronic Funds Transfer Reports are the report type most relevant to our operations. We report to FINTRAC every international electronic funds transfer of CAD $10,000 or more that we initiate from Canada or receive into Canada, and any two or more international transfers within a 24-hour window that are conducted by or on behalf of the same person and aggregate to CAD $10,000 or more. Our monitoring system flags qualifying transfers and potential aggregation hits in real time; support gathers the required fields within one business day; the Chief Compliance Officer verifies amounts, parties and aggregation within two business days and files within five business days of the transfer. A transfer between two Wiremi accounts that are both in Canada is domestic and is not reportable.

The travel rule

Every international electronic funds transfer we initiate carries the sender’s name, account number and address (or date of birth or client number) together with the beneficiary’s name and account number, and that information is passed to the next entity in the payment chain. Transfers received without it are treated as a risk indicator and reviewed.

Terrorist Property Reports (TPRs)

If we determine that we are in possession or control of property, including funds in a wallet, owned or controlled by a listed terrorist entity under the Criminal Code, a listed person under the Regulations Implementing the United Nations Resolutions on the Suppression of Terrorism, or a listed person under the Special Economic Measures Act or the Justice for Victims of Corrupt Foreign Officials Act, we report it to FINTRAC immediately. There is no monetary threshold. A confirmed match is frozen at once, reported to the RCMP or CSIS as required, held until a lawful authority releases it, and documented in the compliance log.

Large Virtual Currency Transaction Reports (LVCTRs)

Where Wiremi receives virtual currency of CAD $10,000 or more from a client, in a single receipt or in aggregate within a 24-hour window, we file a Large Virtual Currency Transaction Report with FINTRAC within five business days. The report carries the virtual currency type and amount, the exchange rate, the transaction hash, the sending and receiving addresses, and the identifying information we hold for the client. The travel rule applies to virtual currency transfers of CAD $1,000 or more on the same terms as it applies to funds, and that information travels with the transfer to the next party in the chain.

Anti-Fraud Policy

Fraud prevention is a critical component of our compliance program. We are committed to protecting our customers, our business, and the integrity of the financial system from fraudulent activities. Our anti-fraud measures are designed to prevent, detect, and respond to a wide range of fraud types.

Types of Fraud We Protect Against

Our anti-fraud program addresses multiple categories of fraud, including account fraud involving the creation of accounts using stolen or synthetic identities, or the takeover of legitimate customer accounts; payment fraud including unauthorized transactions, stolen payment credentials, and chargeback fraud; identity theft where criminals use stolen personal information to access financial services; document fraud involving the submission of forged, altered, or counterfeit identity documents; and AML-related fraud such as the use of shell companies, nominees, or false documentation to disguise the origins or ownership of funds.

Prevention Mechanisms

We employ multiple layers of fraud prevention controls, starting with robust KYC verification using advanced document authentication and biometric verification technology. Our transaction monitoring systems analyze patterns in real-time to identify potentially fraudulent activity. We use device fingerprinting and behavioral analytics to detect anomalies that may indicate account compromise or synthetic identity fraud. Strong authentication measures, including multi-factor authentication and biometric login options, protect account access. All sensitive data is encrypted using industry-standard encryption protocols.

Fraud Detection and Response

When potential fraud is detected, our systems can automatically block suspicious transactions or accounts pending investigation. Our fraud investigation team conducts thorough reviews of flagged activity and takes appropriate action, which may include requiring additional verification, blocking transactions, suspending or terminating accounts, recovering funds where possible, and reporting confirmed fraud to law enforcement.

Customer Protection

We are committed to protecting our customers from becoming victims of fraud. This includes educating customers about common fraud schemes and how to protect themselves, providing tools such as transaction alerts and account security settings, promptly investigating customer reports of unauthorized activity, and working to recover funds in cases where customers have been defrauded.

Stablecoin and Virtual Currency Compliance

Wiremi offers stablecoin on-ramp and off-ramp services through regulated partners, so that a dollar can move on a stablecoin network where that is faster and cheaper than a bank rail. We do not hold or trade tokens that move in price. The compliance measures in this section apply to every stablecoin transfer on the platform, in both directions.

Network analytics and address screening

We use network analytics tools to trace the origin and destination of funds moving on stablecoin networks, to identify addresses linked to known illicit activity including sanctions violations, ransomware, darknet markets and terrorist financing, and to assess the risk of a counterparty address from its history before a transfer is released. This is also how we meet the travel rule for virtual asset transfers.

What is held, and by whom

The stablecoins in a Wiremi wallet are dollar stablecoins pegged one to one, held and moved through regulated partners in accordance with the rules of each jurisdiction we operate in. Our model is conversion and transfer rather than the custody of volatile assets: value is brought on to a stablecoin network for the purpose of a transfer and brought back off it into fiat, and the platform never holds tokens that move in price on a client’s behalf.

Know Your Transaction (KYT)

Beyond Know Your Customer procedures, we apply Know Your Transaction analysis to every stablecoin transfer. Each transfer is risk-scored on network data, the counterparty address is screened against databases of known high-risk addresses, patterns consistent with laundering typologies are monitored for, and transfers touching privacy coins, mixers or other techniques designed to obscure the flow of funds are refused or escalated.

Record Keeping

Comprehensive record keeping is a legal requirement and an essential component of our compliance program. We maintain detailed records of all customer information, transactions, and compliance activities in accordance with the PCMLTFA and other applicable regulations.

Types of Records Maintained

We maintain comprehensive records including customer identification documents and verification results; transaction records including date, amount, currency, sender and recipient information, and purpose of transaction; copies of all reports filed with FINTRAC and other regulatory bodies; documentation of compliance reviews, risk assessments, and investigations; training records for all employees who handle compliance responsibilities; and correspondence related to customer accounts and compliance matters.

Retention Periods

We retain client identification and verification records for five years from the end of the business relationship or the last transaction, whichever is later, and transaction records, copies of every report filed with FINTRAC, aggregation worksheets, screening dispositions and investigation notes for five years from the date of the transaction, the filing or the decision. Records are stored in a form that allows retrieval and conversion to paper, are protected against alteration and deletion within the retention period, are producible to FINTRAC within 30 days of a request, and are indexed so that any record can be found from a client, a transaction or a report number.

Secure Storage and Access

All records are stored securely using encryption and access controls that limit access to authorized personnel only. We maintain both electronic and, where required, physical copies of essential records. All records must be readily accessible and producible to FINTRAC or other regulatory authorities upon request. We have procedures in place to ensure that records can be retrieved and provided within the timeframes required by law.

Training & Awareness

A well-trained workforce is essential for effective compliance. We invest significantly in training and awareness programs to ensure that all employees understand their compliance obligations and can effectively identify and respond to potential risks.

Training Program Structure

Our training program includes initial training for all new employees before they assume their duties, covering the fundamentals of AML/CTF compliance, our policies and procedures, and their individual responsibilities. We provide ongoing annual refresher training that updates employees on regulatory changes, new typologies, and lessons learned from internal and external cases. Role-specific training is provided for employees with specialized compliance responsibilities, such as customer onboarding, transaction monitoring, and investigation staff. Ad hoc training is delivered when new regulations are introduced, significant risks are identified, or specific knowledge gaps are observed.

Training Content

Our training programs cover a comprehensive range of topics including the legal and regulatory framework governing our business; our AML/CTF policies, procedures, and controls; customer due diligence requirements and procedures; red flags and indicators of suspicious activity; reporting obligations and how to escalate concerns; sanctions compliance and screening procedures; fraud prevention and detection; current money laundering and terrorist financing typologies; and the consequences of non-compliance for both individuals and the organization.

Training Documentation and Assessment

We maintain records of all training provided, including attendance records and assessment results. Employees are required to pass assessments demonstrating their understanding of training content. Training effectiveness is evaluated through testing, monitoring of employee performance, and regular review of the training program.

Reporting Suspicious Activity

Prompt reporting of suspicious activity is critical for effective compliance and for supporting law enforcement efforts to combat financial crime. We have established clear procedures for internal and external reporting of suspicious activity.

Internal Reporting by Employees

All employees are required to report any suspicious activity or concerns to the compliance team immediately. Reports can be made through our internal reporting system, by email to our compliance department, or through our anonymous whistleblower hotline for those who prefer to report concerns confidentially. Employees are protected from retaliation for good-faith reporting of compliance concerns.

A report may be made anonymously, through the compliance mailbox or the internal channel. Where a concern involves the Chief Compliance Officer it goes to the Chief Executive Officer, and where it involves the Chief Executive Officer it goes to the board. We do not retaliate against anyone who reports in good faith, and we treat retaliation as gross misconduct.

Customer Reporting

Customers who observe or experience suspicious activity, including potential fraud or scams, should report it to us immediately. Reports can be made through our in-app "Report Fraud" feature, which provides a direct channel to our compliance and fraud teams, by contacting our customer support team via phone, email, or chat, or by emailing our compliance department directly.

External Reporting to Authorities

When required by law or when we believe it is appropriate, we file reports with FINTRAC and other relevant authorities. These reports include Suspicious Transaction Reports (STRs), Large Cash Transaction Reports (LCTRs), Electronic Funds Transfer Reports (EFTRs), and Terrorist Property Reports. We cooperate fully with law enforcement investigations and respond promptly to lawful requests for information.

Confidentiality and Non-Disclosure

In accordance with the tipping off provisions of the PCMLTFA and similar laws in other jurisdictions, we are prohibited from disclosing to customers or any other unauthorized person that a suspicious transaction report has been or will be filed, or that related information has been provided to law enforcement. Violation of this prohibition is a criminal offense.

Independent Audits

Regular independent review of our compliance program is essential to ensure its effectiveness and identify areas for improvement. We engage external auditors to conduct comprehensive assessments of our AML/CTF controls.

Scope of Audits

Our independent audits cover all aspects of our compliance program, including our policies, procedures, and internal controls; customer due diligence and KYC processes; transaction monitoring systems and their effectiveness; sanctions screening procedures; record-keeping practices; training program adequacy; compliance with all reporting obligations; and overall program governance and accountability.

Frequency of Audits

The policy itself is reviewed by the Chief Compliance Officer at least annually, and sooner when legislation or FINTRAC guidance changes, when we add a product, corridor, partner or channel, or when a review or an incident shows that a control did not hold. The next scheduled policy review is March 2027. Separately, and as the law requires, the effectiveness of the whole programme is reviewed at least every two years by a reviewer independent of the compliance function. The first such review covers March 2026 to February 2028, is carried out by an external consultant, and is delivered to the Chief Executive Officer within 30 days of completion, with every finding tracked to closure. FINTRAC may also examine the programme at any time, and we cooperate fully with any examination.

Remediation of Findings

Audit findings are reported to senior management and the board of directors. We develop action plans to address any deficiencies identified, with clear ownership and timelines for remediation. Progress on remediation is tracked and reported to management, and follow-up assessments are conducted to verify that issues have been effectively resolved. We view audits as an opportunity for continuous improvement of our compliance program.

Non-Compliance Penalties

We take compliance seriously and have zero tolerance for money laundering, terrorist financing, fraud, and other financial crimes. Violations of our policies or applicable laws will result in swift and decisive action.

Consequences for Customers

Customers who violate our terms of service, engage in prohibited activities, or are found to have provided false information will face immediate account suspension and investigation, permanent account termination and ban from our services, forfeiture of funds related to illegal activity, reporting to FINTRAC and other relevant authorities, and potential referral to law enforcement for criminal prosecution.

Consequences for Employees

Employees who fail to comply with our policies and procedures, or who facilitate or ignore compliance violations, may face disciplinary action up to and including termination of employment, personal liability for regulatory penalties, professional sanctions affecting their ability to work in the financial services industry, and criminal prosecution in cases of willful misconduct.

Regulatory and Criminal Penalties

Failure to meet our obligations under the PCMLTFA exposes the company to administrative monetary penalties of up to CAD $250,000 for each unreported large cash or electronic funds transfer and up to CAD $500,000 for each unreported terrorist property matter, to penalties for late, incomplete or inaccurate reports, and, for wilful failure to report or destruction of records to impede FINTRAC, to criminal prosecution. We treat these obligations as the floor of the programme, not its ceiling.

Contact Compliance

For AML inquiries, to report suspicious activity, or for any compliance-related questions