AML & CTF Compliance Policy

Document control

1. Policy Statement

1.1 Our Commitment

1001148579 ONTARIO CORPORATION, trading as Altivest (the "Company" or "ONTARIO"), is committed to preventing, detecting and deterring money laundering, terrorist activity financing, sanctions evasion and related financial crime. The Company maintains a zero-tolerance approach to knowingly facilitating money laundering or terrorist financing. Every director, senior manager, officer, employee, consultant, contractor, part-time worker and other person acting on behalf of the Company must comply with this Policy, the Company's related procedures and applicable Canadian law.

If the Company identifies a non-compliance event, the Compliance Officer will document the facts, remediation and follow-up, and submit a voluntary self-declaration of non-compliance to FINTRAC in accordance with the Company's existing internal commitment. This is an internal policy commitment, not a statement that every voluntary disclosure is a statutory reporting obligation. Required transaction or property reports must still be filed separately.

This Policy is supported by the AML & CTF Procedures for All Staff, AML & CTF Procedures for Compliance Staff, AML & TF Risk Assessment, Due Diligence Policy, Transaction Monitoring Policy, Fraud Prevention and Response Policy, Prohibited Jurisdiction Policy and relevant verification, sanctions and Travel Rule instructions. The Privacy Policy and Terms of Service address related customer-facing matters.

This Policy governs the Company's Canadian AML/ATF compliance framework for its MSB activities, including services to eligible non-Canadian customers. Other applicable legal obligations must be assessed separately; this Policy does not grant authorization to operate in any jurisdiction.

Staff receive formal AML/CTF, anti-fraud and anti-bribery refresher training once a year. New-hire induction and necessary event-driven instruction are addressed in Section 5.5.

1.2 Anti-Bribery

ONTARIO is committed to conducting business in an ethical and honest manner and to implementing and enforcing systems designed to prevent bribery and corruption. ONTARIO has zero tolerance for bribery and corrupt activity and is committed to acting professionally, fairly and with integrity in all business dealings and relationships.

1.3 Canadian Regulatory Background & Context

The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and associated Regulations establish AML/ATF obligations for reporting entities in Canada. Persons or entities engaged in prescribed money services business activities, including dealing in virtual currency, may be subject to these requirements.

Virtual currency dealing includes exchanging funds for virtual currency, virtual currency for funds, and virtual currency for another virtual currency, as well as prescribed virtual currency transfer services. The Company's current customer-facing model is limited to fiat-funded purchases of pre-selected cryptocurrency; the Company does not accept customer cryptocurrency deposits and does not offer customer crypto-to-crypto exchange.

The Company's obligations include maintaining an effective compliance program, knowing its clients, keeping prescribed records, monitoring business relationships where required, complying with reporting obligations, applying the Travel Rule where applicable, complying with Ministerial Directives, and addressing sanctions-related risks and reporting requirements.

1.4 Compliance Program

Under the PCMLTFA and associated Regulations, a reporting entity's AML/CTF compliance program contains five core elements:

• Written policies and procedures that describe the Company's legal obligations and the processes and controls used to meet them.
• A documented risk assessment that identifies and assesses the risk that the Company's activities could be used for money laundering, terrorist activity financing or sanctions evasion.
• Appointment of a Compliance Officer with sufficient authority and access to senior management to implement and maintain the compliance program.
• An ongoing compliance training program and written training plan.
• A documented plan for an effectiveness review of the compliance program, with the review carried out at least every two years.

1.5 Operational Compliance

In addition to maintaining the documented compliance program, the Company must implement its controls in practice. This includes, as applicable:

• Collecting, verifying and recording customer identification information and conducting KYC/KYB.
• Determining and verifying beneficial ownership and third-party involvement where required.
• PEP, HIO, sanctions and adverse-risk screening.
• Risk ranking, ongoing monitoring of business relationships and enhanced due diligence for higher-risk activity.
• Monitoring incoming fiat funding and transaction patterns for unusual or suspicious activity.
• Screening customer-provided external wallet addresses before settlement using approved blockchain analytics.
• Submitting prescribed reports to FINTRAC when reporting thresholds or conditions are met.
• Applying the Travel Rule to applicable electronic funds transfers and virtual currency transfers.
• Complying with Ministerial Directives and sanctions-related obligations.
• Maintaining FINTRAC registration information and prescribed records.

2. AML & CTF Basics

Money laundering is the process of concealing or disguising the criminal origin of funds or property so that they appear legitimate. Money laundering may involve fiat currency, virtual currency, assets or other property.

Terrorist activity financing involves collecting, providing, moving or using funds or property to facilitate terrorist activity. The source of the funds may be legitimate or illegitimate; the risk arises from their intended use or connection to terrorist activity.

The Company must take reasonable and risk-based measures to prevent its services from being used for money laundering or terrorist activity financing and must escalate and report suspicious activity when the applicable legal threshold is met.

2.1 How Money Laundering & Terrorist Financing Work

Placement

In the initial stage, criminal proceeds are introduced into the financial system or converted into assets or instruments that are easier to move or disguise.

Layering

In this stage, funds or assets may be moved through a series of transactions, conversions, accounts, entities or wallets to make their origin more difficult to trace.

Integration

In the integration stage, funds or assets may re-enter the legitimate economy through apparently lawful investments, purchases, business activity or other transactions.

Staff do not need to identify a money-laundering stage or establish reasonable grounds to suspect before escalating an unusual circumstance internally. They must record available facts and context and refer the concern to Compliance. The Compliance Officer assesses whether the external reporting threshold is met; a hunch alone is not the STR threshold.

3. Canadian Regulatory Background & Requirements

3.1 Money Services Businesses and FINTRAC Registration

1001148579 ONTARIO CORPORATION is an Ontario-incorporated Canadian Money Services Business (MSB), registered with FINTRAC under registration number C10001709. The Company has a place of business in Canada and is not classified as a Foreign Money Services Business. Its incorporation date is 14 February 2025; actual transaction activity began in June 2026. [2]

The Company's current service is dealing in virtual currency through fiat-funded cryptocurrency purchases. The Compliance Officer must keep the registered services, business address, director and ownership information, and other prescribed registration details accurate. FINTRAC registration details are maintained in controlled registration records; this policy is not a substitute for the live registry.

Customers obtain the Company's service exclusively through its website. Required onboarding must be completed before customers are permitted to transact. Customers select the cryptocurrency before initiating fiat payment, pay through approved bank-transfer channels, and receive the purchased cryptocurrency in their nominated external wallet after transaction review and wallet screening. The Company does not accept cash or card funding, customer crypto deposits, or customer crypto-to-crypto exchange; it does not provide customer crypto custody or a facility for customers to sell cryptocurrency back to the Company.

Canada is the primary target market and commercial focus. The Company does not actively solicit EU customers. EU customer relationships, including previously established relationships and unsolicited customer approaches, remain subject to documented jurisdiction-specific eligibility review before acceptance and continued service. Where reverse solicitation is relied upon, Compliance must assess and record the customer's own exclusive initiative and the relevant service requested. An existing relationship, website access or a contractual declaration does not alone establish an exemption or permit further solicitation. This does not create general permission to serve all European or other foreign jurisdictions. [13]

No person or entity is authorized to offer or deliver the Company's MSB service as its agent, mandatary or broker. Customers contract and transact directly through the website. Sumsub, Global Ledger and approved financial counterparties support specified functions; those arrangements do not authorize them to independently offer Altivest's service. Any identity-verification agency arrangement must separately satisfy its applicable written-arrangement requirements.

3.2 FINTRAC

The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) is Canada's financial intelligence unit and the federal body responsible for supervising reporting entities for compliance with obligations under the PCMLTFA and associated Regulations. FINTRAC may examine the Company's compliance program, records, reporting, KYC controls, risk assessment and operational implementation and may take enforcement action for non-compliance.

FINTRAC registration is a legal registration requirement and does not constitute a licence, endorsement or approval of the Company's business practices.

3.3 Revenu Québec

The Company's existing Risk Assessment excludes business in Québec. That restriction remains in place unless formally amended following a documented assessment of applicable provincial requirements. Revenu Québec administers a separate provincial money-services-business regime. This Policy does not represent that the Company holds a Québec licence. Any proposed expansion must be reviewed before commencement.

3.4 Provincial Securities Regulators

Provincial and territorial securities regulators oversee securities and derivatives activities within their jurisdictions. The Company does not provide investment advice. Its described purchase and settlement model must be assessed for applicable securities requirements; fiat-to-crypto dealing or external-wallet delivery alone must not be treated as proof of exemption. Compliance must review relevant regulatory requirements for the actual service, supported assets and material product changes, obtaining legal advice where necessary.

3.5 Regulator Examinations

FINTRAC may request information or records and may conduct desk-based or on-site compliance examinations. All regulatory requests must be escalated to the Compliance Officer and answered within the deadline specified by the regulator. Registration clarification requests must also be addressed within the applicable FINTRAC timeframe. Staff must not alter, conceal or destroy records relevant to a regulatory request.

3.6 Ministerial Directives and Sanctions

The Company must comply with applicable Ministerial Directives issued under Part 1.1 of the PCMLTFA. FINTRAC currently lists directives concerning Russia, Iran and the Democratic People's Republic of Korea (DPRK / North Korea). The current directive, not an outdated country list, determines the required enhanced measures, recordkeeping and reporting. The Company's existing prohibitions on Iran and DPRK are retained. [3]

Compliance must distinguish Canadian legal prohibitions, Ministerial Directive requirements and stricter internal country restrictions. Customer and relevant connected-person sanctions screening is required at onboarding and through the ongoing review process. Potential matches must be resolved promptly and escalated; a preliminary match is not automatically a confirmed designation. Confirmed exposure must be assessed against the applicable law, ownership/control rules and disclosure threshold. An operational transaction hold is not the same as a statutory asset freeze. Additional foreign lists may be relevant to contractual or jurisdictional requirements but do not automatically trigger every Canadian reporting duty.

4. Roles & Responsibilities

Everyone at ONTARIO has a responsibility to support the effective operation of the AML/CTF compliance program.

Senior Management & Board of Directors

• Provide oversight of the AML/CTF compliance program and ensure it is appropriately resourced.
• Approve the appointment of the Compliance Officer and ensure the Compliance Officer has sufficient authority, access and independence to perform the role.
• Receive regular status reporting on the compliance program, at least annually and more frequently where material issues arise.
• Approve the written AML/CTF policy and material amendments through a senior officer, ensure procedures remain consistent, and authorize only documented changes to internal risk appetite or controls.
• Receive the prescribed written effectiveness-review findings, policy-update information and implementation status within 30 days after completion; document senior-management review/sign-off within that period and oversee remediation.

Compliance Officer

• Develop, implement and maintain the AML/CTF compliance program, policies and procedures.
• Maintain and update the Company's AML/TF risk assessment and risk-based controls.
• Oversee customer due diligence, enhanced due diligence, transaction monitoring, sanctions/PEP screening and wallet-risk escalation.
• Maintain the written training program and plan, deliver the annual staff training cycle, and ensure new-hire induction and necessary updates are completed and recorded.
• Maintain the Company's FINTRAC registration information and coordinate regulatory correspondence.
• Assess and submit FINTRAC reports where the applicable reporting threshold or condition is met.
• Oversee compliance with Ministerial Directives, Travel Rule procedures and listed-person or entity property reporting.
• Oversee the Company's two-year effectiveness review plan and remediation of findings.
• Ensure required compliance records are complete, accurate, protected and retained for the applicable period.
• Oversee material decisions involving third-party compliance providers and ensure the Company acts on relevant results.

All Employees and Contractors

• Comply with this Policy and all related compliance procedures.
• Complete required AML/CTF, fraud and role-specific training.
• Obtain and protect customer information in accordance with approved procedures.
• Identify and promptly escalate unusual, suspicious, fraudulent, sanctions-related or otherwise higher-risk activity.
• Maintain accurate records and document material compliance decisions and customer explanations.
• Maintain confidentiality and avoid prohibited tipping-off or inappropriate disclosure of internal investigations or reports.

Third-Party Compliance Providers

The Company may use specialist third-party providers to support compliance functions. Sumsub is used to support digital onboarding, identity/document verification, liveness checks and configured screening. Global Ledger is used for blockchain analytics and pre-settlement screening of customer-provided external wallet addresses. Use of third-party providers does not transfer the Company's legal responsibility for compliance, review, escalation, reporting or final decision-making.

5. Canadian AML Compliance Program Components

The Company's AML/CTF program is designed to address the compliance-program elements required under Canadian AML/ATF legislation and to reflect the Company's actual operating model.

5.1 Policy & Procedures

Policies describe the Company's standards; procedures specify who performs each step, what evidence is collected, when action is required and how decisions are documented. Compliance must reconcile inconsistent versions before issuing instructions. Applicable law prevails; stricter internal controls remain effective unless formally amended. No commercial exception may override a legal prohibition or an expressly non-waivable company restriction. Older FMSB descriptions, obsolete reporting labels or superseded training schedules must not be used after this revision is approved.

At approval, Compliance must record this version in the policy register and issue the necessary interim staff instructions. Related procedures are being revised separately; operational conflicts must be resolved and communicated, not silently ignored. The annual training schedule and confirmed Canadian MSB classification in this Policy replace incompatible earlier wording when this version is approved.

5.2 Risk Assessment

The Company's Risk Assessment is maintained as a separate controlled document. It assesses the inherent and residual ML/TF and sanctions-evasion risks associated with the Company's products and services, delivery channels, clients and business relationships, geographic exposure, technology, third parties and other relevant factors.

Compliance reviews the Risk Assessment and program at least annually, in the fourth quarter, consistent with the existing Compliance Procedures, and sooner for material changes in services, customer profile, geography, providers, technology, law, incidents or review findings. Annual policy maintenance is distinct from the two-year effectiveness review. Changes are logged and communicated before affected activity proceeds.

Geographic risk assessment must take account of the Company's Canada-focused commercial strategy, restrictions on active cross-border solicitation, the manner in which non-Canadian customers access the service, and jurisdiction-specific eligibility and regulatory requirements.

5.3 Compliance Officer

Senior Management approves the Compliance Officer's appointment. Zineb El Moustaooui is the named Compliance Officer / MLRO in the Company's existing records. The role must have direct access to the director and senior management, relevant customer and transaction records, sufficient resources, and authority to stop or decline transactions, require EDD and make reporting decisions. Delegation must be documented, with a designated escalation route during absence; the Company remains responsible for compliance.

5.4 AML Compliance Effectiveness Review

The Company must maintain a documented effectiveness-review plan and carry out a review at least every two years. The plan must record the first-review timetable and track review start and completion dates. Subsequent reviews must start no later than 24 months after the previous review started, and the previous review must be completed before the next begins. Both documented controls and operational implementation must be tested. [1]

The review covers the policies and procedures, Risk Assessment, ongoing training program and plan, and relevant KYC/KYB, monitoring, reporting, recordkeeping, sanctions and Travel Rule implementation. The plan records scope, rationale, period under review, anticipated methods and sample sizes. Tests include staff interviews, customer and transaction samples, reporting decisions, high-risk measures and record retrieval.

The Company retains its existing internal commitment to an external review at least every two years and the reviewer criteria in the Compliance Procedures: current Canadian AML knowledge, relevant review experience and a maintained CAMS designation. These are company standards, not universal statutory requirements. FINTRAC permits other reviewer arrangements in appropriate circumstances, but the Company's stricter commitments must not be relaxed without formal amendment.

Within 30 days after completion, written reporting to a senior officer must include findings, policy/procedure updates made during the review period other than as a result of the review, and implementation status. Senior Management documents review/sign-off; Compliance assigns remediation owners and deadlines, tracks closure and arranges follow-up testing where needed.

Actual transaction activity began in June 2026. This version does not claim that an independent effectiveness review has already occurred. Compliance must document the first-review schedule within the applicable legal cycle and cannot defer required compliance measures on the basis of a six-month grace period or an insufficient volume of transactions.

5.5 Training & Training Plan

The Company maintains a written training program and delivery plan. The scheduled formal refresher is once a year for all relevant staff, including management, compliance personnel and contractors performing relevant functions. There is no separate twice-yearly management or quarterly compliance training schedule in this Policy. [1]

• The annual session includes AML/TF fundamentals, sanctions-evasion risks, the Company's business model, KYC/KYB, wallet screening, fraud and bribery prevention, unusual-activity escalation, reporting, recordkeeping and confidentiality, tailored to each role.
• The plan identifies recipients, topics, materials, delivery method, trainer and annual due dates. Completion and assessment results are documented; relevant external training can support the plan where its coverage is adequate.
• Material legal or procedural changes and identified knowledge gaps must be communicated promptly through targeted instructions or remediation. These event-driven measures do not establish an additional recurring training cycle.
• New hires receive basic AML/CTF, anti-fraud and anti-bribery induction within their first 30 days and role-specific instruction before independently handling customers or customer funds. Induction is separate from the annual refresher.
• Completion is mandatory. Any training quiz requires a minimum score of 80%; failed or incomplete assessments require remediation and re-assessment. Compliance retains the training plan, materials, attendance, dates and results for at least five years under the Company's recordkeeping standard.

6. Operational Compliance

Operational compliance is the practical implementation of the Company's legal and internal control requirements, including customer verification, risk assessment, transaction review, reporting, record keeping, sanctions controls and escalation.

6.1 FINTRAC Registration

The Company must maintain an active FINTRAC registration while carrying on registrable money services business activities. Its registration number is C10001709.

• Prescribed registration information must be updated within 30 days after a change, including relevant changes to activities, address, directors or key personnel. [2]
• FINTRAC registration clarification requests must be answered within 30 days. Other requests follow their specified statutory or regulator deadline; 30 business days must not be assumed. [2]
• Registration must be renewed before its recorded expiry in accordance with FINTRAC's renewal process. Compliance maintains renewal reminders and supporting evidence. [2]
• If the Company ceases to meet the Canadian MSB definition, Compliance must complete the required cessation notification within 30 days. Ceasing to serve Canadian customers alone is not the applicable FMSB-style cancellation test for this Canadian MSB. [2]
• Current registration status, classification and expiry information must be checked against the FINTRAC registry and internal registration records rather than relying on static dates reproduced in this Policy.

6.2 Reporting

The Compliance Officer or documented designate assesses and submits required reports. The assessment considers the Company's legal role, facts, thresholds, aggregation rules and applicable exceptions. Third-party reporting or fiat-only customer funding does not automatically remove the Company's own obligation. All statutory amounts below are Canadian-dollar thresholds or equivalents; they are not a statement of accepted customer funding currencies. More than one report can be required for the same facts.

6.2.1 Electronic Funds Transfers (EFTs)

The Company must report a qualifying international EFT of CAD 10,000 or more where it is the reporting initiator or final recipient, including applicable 24-hour aggregation. Receiving a bank transfer as payment for a purchase does not alone establish that role. Compliance must document the role and exceptions for each banking arrangement and reassess material changes. Required EFTRs are due within five working days after the day the transfer is initiated or finally received. [4]

The Compliance Procedures must identify the applicable aggregation method, connected parties, relevant time window, valuation and required report fields. Internal deposit-count review triggers are not substitutes for the statutory 24-hour rule.

6.2.2 Large Cash Transactions

Cash is not an accepted funding method. Any unexpected receipt is escalated without treating it as an approved purchase. Where the reporting conditions are met, receipt of CAD 10,000 or more in cash, individually or under the applicable 24-hour rule, requires an LCTR within 15 calendar days after the day of receipt. Compliance assesses reporting and lawful handling or return separately. [5]

6.2.3 Large Virtual Currency Transactions

LVCTR reporting generally concerns receipt of virtual currency with a value of CAD 10,000 or more, including applicable 24-hour aggregation, rather than every outgoing settlement. Where required, the report is due within five working days after the day of receipt. Prescribed identity, third-party and recordkeeping requirements must also be considered. [6]

The Company accepts no customer crypto deposits, but Compliance must still assess actual receipts from liquidity providers or other counterparties. FINTRAC provides exceptions, including virtual currency received for the business's own operational purposes, such as business holdings. Whether an exception applies depends on the purpose and arrangement; it must be documented rather than assumed for every OTC receipt. An exception from LVCTR reporting does not remove an independent STR obligation. [6]

6.2.4 Suspicious Transactions

The Company must submit an STR when a transaction or attempted transaction occurs in the course of its activities and there are reasonable grounds to suspect that it is related to the commission or attempted commission of a money laundering, terrorist activity financing or sanctions-evasion offence.

Completed and attempted suspicious transactions use the STR process; ASTR is not treated as a separate FINTRAC report type. There is no monetary minimum. File as soon as practicable after completing the measures necessary to establish reasonable grounds to suspect. Record the facts, context, indicators, decision and submission evidence. Staff escalate concerns internally on the same day, and immediately where urgent, rather than waiting to complete their own reporting-threshold analysis. [7]

The law prohibits disclosure of an STR or its contents with intent to prejudice a criminal investigation. The Company additionally restricts report and investigation information to authorized persons and requires Compliance approval of sensitive customer communications. The statutory protection for good-faith reporting applies within its legal scope; it is not blanket immunity for unrelated misconduct. [7]

6.2.5 Listed Person or Entity Property

The Listed Person or Entity Property Report (LPEPR) replaces the former Terrorist Property Report. It applies where the Company is required to disclose under the relevant Canadian terrorist or sanctions-property provisions, including the Criminal Code, United Nations Act, Special Economic Measures Act or Justice for Victims of Corrupt Foreign Officials Act. No completed or attempted transaction is necessary. [8]

Potential matches or property concerns are escalated immediately. Compliance determines the applicable legal threshold, restriction and disclosure recipient; reports to the RCMP or CSIS are made as required by the relevant law, rather than automatically sending every case to all agencies. Required LPEPRs are sent to FINTRAC immediately using its prescribed channel, currently fax (or mail where fax capability is unavailable). Record the basis and evidence of disclosure; assess an STR separately where a transaction was attempted or completed. [8]

6.2.6 Travel Rule

Travel Rule obligations apply to specified EFTs and virtual-currency transfers, including relevant VC transfers for which a transfer or receipt record is required. Compliance documents the Company's role, the transfer type and applicability; the LVCTR threshold is not a universal Travel Rule threshold. The present no-customer-crypto-deposit model does not remove applicable duties for outward settlement. [9]

For applicable transfers, obtain, retain and include the prescribed originator/requester and beneficiary names, addresses and account numbers or other reference numbers, if any, together with any other information required for the relevant transfer type. Identify whether the beneficiary uses a hosted or self-hosted arrangement and apply the appropriate documented process. Blockchain wallet screening is not a substitute for Travel Rule information. [9]

For an applicable incoming transfer lacking required information, take and document reasonable measures to obtain it, such as contacting the sender or relevant provider. If unsuccessful, apply written risk-based allow, suspend or reject criteria and follow-up measures. For outward transfers, resolve required information before release. Do not transmit personal information publicly on-chain; use an appropriate secure channel. [9]

Approved technology may support this process. Sumsub is the intended Travel Rule provider, but its module must not be represented as active until implementation and the relevant workflow are confirmed. Compliance remains responsible for a working process for every applicable transfer; no transfer may proceed on an assumption that a provider has fulfilled the obligation.

6.3 Responding to Law Enforcement Requests

Refer law-enforcement requests immediately to the Compliance Officer. Verify the requesting authority, legal basis and scope, obtain the request or authority in writing where appropriate, and disclose only as lawfully required or permitted. Preserve relevant records, respond within the applicable deadline and maintain confidentiality. Keep copies of requests, verification, decisions and disclosures for at least five years under the Company's internal standard. Staff must not respond independently.

6.4 Record Keeping

Keep prescribed records for the applicable legal retention period, generally at least five years, using the correct trigger for each record type. For example, exchange/transfer records generally run from creation, report copies from submission, and entity service-agreement records from the last transaction. Compliance maintains the detailed schedule and any longer legal hold. Records must be reproducible and provided to FINTRAC within 30 days of a request, or any shorter legally binding deadline. [10]

Records maintained by the Company include, as applicable:

• Customer identification and verification information, including the method used and verification results.
• KYC/KYB questionnaires, corporate existence records, director and authorized-person information and beneficial-ownership records.
• PEP, HIO, sanctions and related screening results and determinations.
• Source-of-funds and source-of-wealth documents where obtained.
• A virtual-currency exchange transaction ticket or register entry for every exchange, regardless of amount, together with required bank-transfer, receipt and settlement records. Record the actual currency/asset, amount, rate and transaction identifiers; do not omit required denomination information.
• Travel Rule information and related missing-information follow-up.
• Wallet addresses, blockchain-screening results and material wallet-risk review records.
• Copies of reports submitted to FINTRAC and supporting decision records.
• Internal unusual/suspicious activity review records and STR decision rationales.
• Risk rankings, ongoing-monitoring records and enhanced due diligence records.
• Training records and training materials.
• Effectiveness review plans, testing records, reports and remediation tracking.
• FINTRAC correspondence, registration records and compliance-program documents.

Access to identity, screening, investigation and reporting records is role-restricted. Compliance must ensure records held by providers remain available and retrievable, protect confidential information, preserve legal holds, and coordinate secure disposal and lawful disclosure with the Privacy Policy. Attempts to obtain information must record the action, date, source and result.

6.5 Customer Authentication, KYC & KYB

The Company applies a stricter internal onboarding standard than the minimum transaction thresholds that may apply under law: all customers must complete the Company's required KYC or KYB process before they are permitted to transact.

The onboarding workflow includes email verification, questionnaire, government-issued ID authentication, selfie/liveness, sanctions and PEP checks, country eligibility and reliable customer information. Obtain proof of address and source evidence required by the applicable controlled procedure and risk assessment. Pending reconciliation of inconsistent supporting procedures, the existing stricter all-customer proof-of-address requirement is not silently waived. Wallet screening and transaction-specific EDD are completed before settlement.

As part of geographic eligibility, the Company verifies the customer's country of residence or incorporation and, where relevant, considers the basis on which the customer accessed the service. Non-Canadian customers are subject to jurisdiction-specific eligibility review before onboarding or transaction processing is permitted.

Sumsub supports the Company's remote government-issued photo-ID process. An authentic, valid and current document must be authenticated by appropriate technology and matched to the customer's name and photograph, supported by selfie/liveness checks. A vendor pass/fail result alone is insufficient evidence of the prescribed method; retain required verification details and resolve failures or discrepancies before approval. Alternative prescribed methods require documented Compliance approval and the method-specific records. [11]

6.5.1 Identification Methods for Individuals

6.5.2 Organizations

When the customer is an organization, the Company collects and verifies information appropriate to the entity and its risk profile. This includes, as applicable:

• Full legal name and any registered or trading name.
• Legal form and organizational structure.
• Registration or incorporation details and evidence of legal existence.
• Principal place of business and physical address.
• Nature of principal business and expected use of the Company's services.
• Directors, senior officers and authorized representatives.
• The prescribed beneficial-owner information: for corporations, directors and individuals owning or controlling 25% or more of shares, directly or indirectly; for other entities, relevant 25% ownership/control information; for trusts, the applicable trustees, settlors and known beneficiaries or other prescribed ownership information. Take reasonable measures to confirm accuracy and understand the ownership/control structure. [12]
• Ownership and control structure, including additional evidence where ownership is complex or opaque.
• Sanctions, PEP/HIO and adverse-risk screening of relevant persons.
• Source of funds and source of wealth information where required by the risk-based approach.

If beneficial-owner information cannot be obtained or confirmed, document the reasonable measures taken, apply the prescribed fallback measures (including identifying the most senior managing officer and high-risk measures where required), and assess the Company's stricter acceptance criteria. Do not treat a statutory fallback as automatic permission to proceed. For high-risk federally incorporated corporate customers, follow the applicable Corporations Canada discrepancy process and 30-day reporting rule, including the exception for a discrepancy resolved within that period. [12]

6.5.3 Sanctions, PEP/HIO and Enhanced Due Diligence

Screen customers and relevant connected persons for sanctions and PEP/HIO exposure at onboarding and during required monitoring or event-driven review. Apply prescribed determinations for business relationships and relevant transaction types; do not use an unqualified receipt/transfer threshold for all products. Where legally required, apply source-of-wealth/source-of-funds measures, senior-management approval and enhanced monitoring. The Risk Assessment's existing stricter PEP risk treatment remains subject to formal risk-appetite decisions.

EDD is targeted to the trigger and can include corroborating identity/address evidence, additional bank statements, source of funds (the origin of the transaction money), source of wealth (how wealth was accumulated), explanations, wallet-control evidence and enhanced monitoring. Required checks cannot be bypassed because an activity is commercially attractive. If the risk cannot be resolved or is prohibited, do not proceed; consider reporting separately.

Where third-party determinations are prescribed, take and record reasonable measures to establish who instructs or benefits from the activity and the required identifying information. Corporate representatives acting with documented authority are distinguished from undisclosed third parties. Unresolved funding or authority concerns must be escalated under the linked policies; this revision does not introduce a new exception to an existing prohibition.

6.5.4 Wallet Screening and Customer Transaction Confirmation

Before each settlement, screen the customer's nominated external wallet through Global Ledger to identify sanctions exposure, fraud, scams, stolen assets, darknet links, mixers/tumblers and other high-risk or illicit blockchain activity. Retain the relevant address/network, screening result, review and approval. Re-screen changed settlement instructions. Screening indicates exposure; it does not by itself prove wallet ownership or certify the absence of crime.

A material high-risk result triggers Compliance review and EDD before settlement, consistent with the existing Due Diligence and Fraud policies. No settlement is initiated until required checks are satisfactorily completed. A legally prohibited transaction cannot be approved merely because EDD is complete. The Company does not continuously surveil the customer's external wallet after settlement; subsequent relevant adverse information must still inform customer risk and future transactions.

The initial questionnaire requires acknowledgement of cryptocurrency risks. Before each purchase proceeds to payment, the customer must affirm: (1) "I confirm I am acting on my own behalf and without third-party influence." (2) "I confirm that I have read, understood, and agree to the Terms and Conditions." Retain the acknowledgement, timestamp and relevant terms version. These declarations supplement, and do not replace, checks for scams, coaching or third-party control.

6.6 Business Relationships

For this Canadian MSB, a business relationship generally begins the second time identity verification is required within a five-year period, or when a prescribed ongoing service agreement is entered into with an entity. The Company records the purpose and intended nature at onboarding and applies the relevant legal business-relationship tests. [14]

When a business relationship exists, the Company must keep a record of the purpose and intended nature of the relationship, conduct ongoing monitoring at a frequency appropriate to risk, keep client information up to date as required, assess whether activity is consistent with known information and re-assess the client's risk level.

Customer monitoring and scheduled review follow the controlled Risk Assessment. The existing review intervals are retained pending formal amendment: high risk at least every six months, with enhanced or daily attention where appropriate; medium risk every nine months; low risk at least every twelve months. Material changes or adverse information require earlier review. Reverification is not automatically required for every repeat purchase where existing information remains reliable, but transaction-level controls still apply.

6.7 Risk Ranking & Transaction Monitoring

Customers and business relationships are risk-ranked using the Company's documented Risk Assessment and due diligence framework. Risk factors include customer characteristics, geography, products and services, delivery channel, expected transaction activity, source of funds, ownership/control, third-party involvement, sanctions/PEP exposure, fraud indicators and wallet risk.

Transaction monitoring is embedded in operational review, with Compliance escalation; no separate monitoring department is represented. Review individual concerns as well as patterns in incoming fiat, value, frequency, timing, profile consistency, source of funds, geographic information and reversals. More than three incoming customer deposits in one calendar day requires review under the Transaction Monitoring Policy; it is not automatic proof of wrongdoing or a statutory reporting threshold.

A purchase must be traceable from the verified customer and pre-selected cryptocurrency through fiat receipt, screening/approval, conversion and settlement to the nominated wallet. Material sender-name mismatches, unexplained third-party funding, conflicting instructions or possible account takeover must be resolved before release. Requests to change a wallet or key account information require appropriate verification.

High-risk customers or transactions are subject to enhanced due diligence, additional monitoring and Compliance approval or escalation as appropriate. A transaction may be paused, declined or restricted where material concerns cannot be satisfactorily resolved.

7. Penalties for Non-Compliance

Failure to comply with Parts 1 and 1.1 of the PCMLTFA and associated Regulations may result in administrative monetary penalties or criminal charges. The Company and its staff must treat compliance obligations as mandatory.

Criminal Penalties

Criminal non-compliance can result in substantial fines and imprisonment. Relevant offences include failure to report, failure to maintain required records, registration breaches, failure to assist a lawful examination, directive breaches and prohibited disclosures. Directors, officers or other persons may also face liability where the statutory participation conditions are met. Applicable offences and maximum penalties must be checked against current legislation; outdated fixed figures are not reproduced here.

Administrative Monetary Penalties (AMPs)

FINTRAC distinguishes violations before and after the amendments effective 26 March 2026. The older per-violation penalty ranges must not be presented as the current universal limits. The amended framework includes increased maximum penalties and additional compliance-agreement/order tools. Compliance must apply the legislation and FINTRAC policy relevant to the conduct and examination period. Extensive non-compliance may also be disclosed to law enforcement. [15]

8. Appendix: Definitions & Acronyms

AML (Anti-Money Laundering) — Measures designed to detect, deter and prevent money laundering.

CDD (Customer Due Diligence) — The process of identifying and understanding a customer, verifying required information and assessing financial-crime risk.

CTF / ATF (Counter / Anti-Terrorist Financing) — Measures designed to detect, deter and prevent terrorist activity financing.

EDD (Enhanced Due Diligence) — Additional risk-based measures applied when a customer, transaction or relationship presents elevated risk.

EFTR (Electronic Funds Transfer Report) — A report submitted to FINTRAC when a qualifying international electronic funds transfer meets the applicable reporting conditions.

FINTRAC — The Financial Transactions and Reports Analysis Centre of Canada: Canada's financial intelligence unit and the federal supervisor for compliance with the PCMLTFA.

HIO (Head of an International Organization) — A person who is or was the primary person who leads an international organization, as defined under applicable FINTRAC requirements.

LCTR (Large Cash Transaction Report) — A report generally required when a reporting entity receives CAD 10,000 or more in cash in a single transaction or through applicable 24-hour aggregation.

LPEPR (Listed Person or Entity Property Report) — A FINTRAC report concerning terrorist or sanctioned property where the applicable disclosure/reporting condition is met. It replaces the former Terrorist Property Report.

LVCTR (Large Virtual Currency Transaction Report) — A report concerning qualifying receipt of virtual currency equivalent to CAD 10,000 or more, including applicable aggregation and exceptions. When required, submit within five working days after the day of receipt.

Money laundering — The process of concealing or disguising the criminal origin of funds or property.

MSB (Money Services Business) — A person or entity with a place of business in Canada that carries on one or more prescribed money services, including dealing in virtual currency.

PEP (Politically Exposed Person) — A person who holds or has held a prescribed prominent public function, together with related family-member and close-associate considerations under applicable requirements.

STR (Suspicious Transaction Report) — A report submitted to FINTRAC when there are reasonable grounds to suspect that a completed or attempted transaction is related to money laundering, terrorist activity financing or sanctions evasion.

Terrorist activity financing — Collecting, providing, moving or using funds or property to facilitate terrorist activity.

Travel Rule — The requirement to include or obtain prescribed originator and beneficiary information with applicable electronic funds transfers and virtual currency transfers.

UTR / Internal Unusual Transaction Record — An internal record used to document unusual or potentially suspicious activity and its review. It is not a substitute for an STR where the legal reporting threshold is met.

Virtual Currency (VC) — Digital representation of value meeting the applicable definition under the PCMLTFA and associated Regulations.

Contact

Policy owner: Compliance. Named Compliance Officer / MLRO: Zineb El Moustaooui. Questions and internal escalations: compliance@altivest.io. Urgent concerns must follow the documented immediate escalation route, not wait for the annual review.

This document forms part of the compliance programme of 1001148579 ONTARIO CORPORATION, trading as Altivest, FINTRAC registration C10001709.

Regulatory references

Official references checked on 27 September 2026. These support the regulatory updates; Company-specific facts and internal standards derive from the supplied policy set and management instructions. Applicable legislation prevails over a policy summary.

1. FINTRAC — Compliance program requirements
2. FINTRAC — MSB status and registration maintenance
3. FINTRAC — Ministerial directives and transaction restrictions
4. FINTRAC — Reporting electronic funds transfers
5. FINTRAC — Reporting large cash transactions
6. FINTRAC — Reporting large virtual currency transactions
7. FINTRAC — Reporting suspicious transactions
8. FINTRAC — Reporting listed person or entity property
9. FINTRAC — Travel Rule for electronic funds and virtual currency transfers
10. FINTRAC — MSB recordkeeping requirements
11. FINTRAC — Methods to verify identity
12. FINTRAC — Beneficial ownership requirements
13. MiCA Article 61 — Exclusive initiative of the client (ESMA)
14. FINTRAC — Business relationship requirements
15. FINTRAC — AMP changes following legislative amendments