UpFinance ANTI-MONEY LAUNDERING (AML) AND KNOW-YOUR-CUSTOMER (KYC) POLICY

Last Updated: Oct 8, 2025

1. Legal and Regulatory Framework

UpFinance complies with all applicable U.S. laws and regulations, including the Bank Secrecy Act (BSA), USA PATRIOT Act, and related FinCEN rules (31 CFR §§ 1010-1023), as well as the Financial Action Task Force (FATF) Recommendations. UpGlobal Inc. is registered with the U.S. Financial Crimes Enforcement Network (FinCEN) as a Money Services Business (MSB Reg. No. 31000308751680). Where applicable, we coordinate with licensed custodial partners, including Merits Bank & Trust Limited (Hong Kong — TCSP Licence No. TC008817), which operate under their respective regulatory regimes.

2. Risk-Based Approach (RBA)

We employ a risk-based approach consistent with FATF guidance and FinCEN expectations. Customers are risk-classified based on geographic origin, business nature, transaction patterns, source of funds, and PEP/sanctions status. Enhanced Due Diligence (EDD) is applied to high-risk profiles, including those from higher-risk jurisdictions or with complex structures or unusual behavior.

3. Customer Due Diligence (CDD)

CDD is mandatory before establishing any relationship or enabling transactions. It includes:

Verification of identity via government ID and, where permitted, biometric checks;
Collection of residential address, nationality, date of birth, and contact details;
Verification of source of funds and source of wealth;
Sanctions screening against OFAC, UN, EU, and other lists;
Determination of Ultimate Beneficial Ownership (UBO) for entities.

No services are provided to individuals or entities failing to meet CDD standards. All data is handled in accordance with our Privacy Policy and applicable data-protection laws.

4. Ongoing Monitoring

UpFinance uses automated and manual controls to monitor transactions and behavior continuously, including:

Screening against updated sanctions and PEP lists;
Review of activity against typologies of fraud and money laundering;
Triggering alerts on threshold breaches or anomalies;
Periodic re-verification of customer information.

Suspicious activity is documented, escalated internally, and may be reported to FinCEN or other competent authorities as required by law.

5. Recordkeeping and Reporting

All records related to CDD, transactions, communications, and internal reviews are retained for a minimum of seven (7) years after account closure or final activity, consistent with 31 CFR § 1010.430. UpFinance files Suspicious Activity Reports (SARs) or Currency Transaction Reports (CTRs) when required and cooperates fully with law-enforcement and regulatory requests.

6. Training and Governance

All personnel receive annual AML/KYC training covering red flags, typologies, and reporting obligations. A designated Compliance Officer oversees program implementation, monitors effectiveness, and reports directly to the Board of Directors. This Policy is reviewed at least annually and updated to reflect new regulations and emerging risks.

7. Prohibited Clients and Activities

UpFinance does not onboard clients who:

Reside in or are nationals of jurisdictions under comprehensive U.S. OFAC or UN sanctions;
Appear on OFAC SDN, EU Consolidated, or UN lists;
Refuse to provide required information or submit false documents; or
Are suspected of laundering, fraud, terrorist financing, or sanctions evasion.

We also prohibit use of the Services for:

Mixing or tumbling transactions without legitimate purpose;
Facilitating ransomware payments; or
Anonymous or synthetic-identity usage.

8. Cooperation and Audit

UpFinance cooperates with regulators, auditors, and licensed partners (including Merits Bank & Trust) to ensure audit readiness and transparency. Authorized auditors and regulators may inspect our AML controls under confidentiality obligations.