Due Diligence Policy

Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) for 1001148579 ONTARIO CORPORATION, a Canadian Money Services Business registered with FINTRAC under C10001709.

Document control

Policy purpose

This Policy establishes Altivest's due diligence process from initial contact through onboarding, transaction review and EDD. It specifies customer information, verification steps, risk triggers, supporting evidence and decisions required before activity can proceed.

No customer may progress through an onboarding or transaction stage until the checks required for that stage are complete and material concerns have been appropriately resolved.

1. Policy Objective

1001148579 ONTARIO CORPORATION, trading as Altivest (the Company), applies structured, risk-based due diligence to establish who a customer is, understand the proposed activity, identify financial-crime and fraud risks, and determine whether a relationship or transaction may be accepted, processed or settled.

The Company combines customer information, identity documents, configured screening, authenticity checks, source evidence and blockchain analytics. EDD is tailored to the event or information that triggered it, rather than applied as one fixed document checklist.

Operating model

The Company is a Canadian MSB registered with FINTRAC under C10001709. Customers obtain services directly and exclusively through its website. Required onboarding precedes transaction permission. Customers select the cryptocurrency before fiat payment, fund purchases by bank transfer, and receive purchased cryptocurrency at their nominated external wallet after the required transaction, wallet and compliance checks.

The Company does not accept cash or card funding or customer crypto deposits; it does not offer customer crypto-to-crypto exchange, customer crypto custody or a facility for customers to sell cryptocurrency back to Altivest. No agent, mandatary or broker is authorized to offer or deliver the Company's MSB service on its behalf.

2. Scope

• All new and prospective customers, individual and organizational onboarding, and required identity-verification activities.
• All customer purchase requests and nominated external wallet addresses; every settlement requires the relevant wallet review.
• Any customer relationship or transaction that triggers EDD, and ongoing review when information changes or new concerns arise.
• Company personnel carrying out assigned onboarding, operational or compliance functions. Provider obligations follow their contracts and assigned functions, not an assumption that every provider employee is Company staff.

3. Roles and Responsibilities

• Compliance owns the framework, assesses escalated cases, specifies EDD, determines higher-risk outcomes and documents reporting assessments under the Compliance Procedures.
• Onboarding and operations personnel obtain and review required information, use the approved Sumsub configuration, match funding and instructions, obtain wallet screening, and prevent premature progression.
• Senior management approves material amendments and provides appropriate resources. Approval of this revision does not certify that all controls have operated historically.
• Delegates act only within documented authority. Urgent matters use the recorded direct escalation route and backup; affected activity remains paused if no authorized reviewer is available.

Sumsub and Global Ledger support specified checks. The Company retains responsibility for acceptance, interpretation of results, EDD, reporting and settlement decisions. Questions and case escalation: compliance@altivest.io.

4. Customer Due Diligence Framework

The original seven-stage framework is retained. Identity, eligibility and any onboarding EDD must be complete before transaction permission. Wallet and transaction-specific checks are completed before settlement; EDD may arise at any stage, not only at Stage 7.

5. Initial Customer Onboarding

5.1 Email Confirmation

Confirm that the customer controls the email address used to begin the relationship. Email verification establishes the communication channel; it does not establish identity or authorize a purchase.

5.2 Digital Onboarding Questionnaire

After email confirmation, obtain full legal name, date of birth for an individual, residential or physical business address, occupation/principal business, country information, purpose and intended nature, expected activity and other fields required by the approved workflow. Obtain relevant organizational and representative details under Section 6.3.

5.3 Screening of Customer-Provided Information

Use configured Sumsub controls and approved supplementary sources to review sanctions, PEP/HIO connections, adverse or criminal information where available, geographic restrictions and age-related risk. A potential match must be investigated; a provider pass/fail result does not override unresolved concerns or establish that all required steps were completed. Do not assume unconfirmed screening coverage is operational.

6. KYC Documentation and Verification

All customers must complete required KYC or KYB before they are permitted to transact. An application record can collect onboarding information but must not enable an unverified customer to transact. The following evidence is used for the relevant customer and purpose.

6.1 Primary Individual Verification Method

The primary method is government-issued photo identification supported by Sumsub's approved remote workflow. Authenticate the document, establish that it is valid and current, and match the name and photograph to the customer using the approved selfie/liveness process. A scan, video call or pass/fail label alone is insufficient. Resolve failed authentication, manipulation, mismatches or inconclusive results before approval. [R1]

Retain the customer name, verification date, document type and unique number, issuing country and province/state, and expiry date if available, plus the supporting result. Qualifying equivalent foreign government ID is not automatically unacceptable. Alternative prescribed methods need documented Compliance authorization and their method-specific evidence; the standard photo-ID process is not labelled dual process. [R1]

6.2 Proof of Address and Evidence Quality

The original Due Diligence Policy used conditional address wording, but the Staff Procedures required proof of address for all customers. This revision expressly aligns with the stricter all-customer standard retained in the three revised AML documents. It is a Company standard, not a claim that every statutory ID method requires a separate proof-of-address document.

Check that evidence identifies the customer and relevant address, is legible and sufficiently current under the controlled document rules, and is consistent with the questionnaire and other records. Compliance records acceptance criteria and resolves unsupported or conflicting evidence; this revision does not invent document-age limits or substitute unverifiable information.

6.3 Organizations and Beneficial Ownership

For an organizational customer permitted by the Company's risk appetite, the onboarding review must identify the entity separately from any individual who represents it. Collect and verify the following as applicable; the description does not expand the permitted customer sectors.

Take reasonable measures to confirm ownership information and retain supporting evidence. Where it cannot be obtained, updated or confirmed, record the attempts, take reasonable measures to verify the CEO or equivalent and apply prescribed high-risk measures. Apply stricter Company acceptance criteria separately; the fallback does not automatically authorize a purchase. [R2]

For a high-risk federally incorporated corporate customer, follow the Compliance Procedures' Corporations Canada database/discrepancy process. Report a reportable material discrepancy within 30 days of identification unless resolved within that period, and retain the acknowledgement. This federal database duty does not automatically apply to every Ontario corporation. [R2, R3]

6.4 Verification Failures and Provider Responsibility

If mandatory verification is incomplete or unreliable, do not grant transaction permission. Obtain corrected or additional evidence, use an authorized alternative where appropriate, and record the attempted verification and decision. Legitimate privacy concerns alone are not evidence of crime; unexplained failures or abandoned attempts may still require internal escalation.

Provider-held verification records must remain accessible to authorized Company reviewers. A technical outage or missing evidence is not permission to bypass a required check. Identity-verification agency arrangements, if used, are assessed separately from the prohibition on service-delivery agents.

Core acceptance rule: required identity and eligibility checks must be satisfied. A high-risk label, vendor approval or customer declaration cannot replace them.

7. Identity, Age and Geographic Controls

Check consistency between questionnaire data, identity evidence, selfie/liveness, address and other records. Resolve material discrepancies before the affected stage proceeds. Individuals must meet the Terms of Service minimum age of 18. The original above-65 EDD trigger is retained unchanged; it is not a FINTRAC age threshold.

Age-based EDD: customers above 65 years of age require enhanced review in addition to normal KYC. No additional maximum age is newly imposed or removed by this revision; any unresolved upper-age eligibility instruction must be reconciled before the affected customer is accepted.

Canada is the primary commercial focus. Apply the existing Quebec exclusion unless formally amended after regulatory review. Check residence, incorporation and principal business location against the controlled jurisdiction rules, with payment geography and available IP/geolocation evidence considered where relevant. Nationality alone is not a complete location or risk determination.

The Company does not actively solicit EU customers. Previously established relationships and unsolicited approaches require documented jurisdictional eligibility before acceptance or continued service. Where relying on reverse solicitation, record the customer's exclusive initiative, requested service, relevant communications and legal basis. Prior contact, website access or a declaration alone does not establish the exemption or permit marketing new types of service. Do not fabricate or coach evidence. [R7]

This is not permission to serve every European or other foreign jurisdiction. Existing prohibitions remain until properly amended. A change in residence, ownership, business location or material transaction geography triggers reassessment before further affected activity.

8. Source of Funds and Banking Evidence

Source of Funds (SOF) means the origin of the money used for the transaction. Source of Wealth (SOW) concerns how the customer or relevant owner accumulated wealth. Obtain each where required by the specific risk, legal rule or Compliance instruction; the two are not interchangeable.

• Review required bank statements and source evidence against the customer's profile, expected activity and purchase. Consider unexplained movements, unusual entries, irregular patterns and third-party funding.
• Request targeted additional statements, transaction explanations, supporting agreements or other appropriate evidence. Do not treat a balance alone as explaining the source of the money.
• Compare the sender/account information with the verified customer. Escalate mismatches, joint-account questions and corporate funding of personal purchases before release. A corporate representative acting with verified authority is not automatically an undisclosed third party.
• Assess patterns and explanations, including repeated or split transfers. A large amount alone is not proof of wrongdoing; unresolved inconsistencies and material concerns trigger EDD or refusal.

The amount and type of evidence remain proportionate to the trigger. This Policy does not create a new fixed transaction cap, bank-statement period or funding exception. Existing controlled requirements apply, and an explanation does not waive a prohibition.

9. Wallet Address Due Diligence

For each purchase request, obtain the customer's exact nominated external wallet address and network. Screen that address through Global Ledger before each settlement to identify sanctions exposure, scams, fraud, stolen assets, darknet links, mixers/tumblers or other high-risk or illicit blockchain exposure.

• Retain the address/network, screening date, result, identified exposure, reviewer and decision. Re-screen changed settlement instructions and investigate unexpected redirection.
• Resolve preliminary alerts. A high-risk score or other material risk indication triggers Compliance review and EDD before the transaction proceeds, preserving the original wallet-risk trigger.
• Assess the customer's legitimate control/entitlement under the existing wallet rules. A blockchain score does not prove ownership and does not certify that activity is free of crime.
• Do not initiate settlement while material concerns or required approvals remain unresolved. A prohibited transaction cannot be authorized merely because EDD has been performed.

The Company does not continuously surveil the external wallet after settlement. Later relevant adverse information must still inform customer risk, future purchases and any reporting assessment. Screening remains distinct from the Travel Rule process in Section 12.2.

10. Enhanced Due Diligence (EDD)

EDD is tailored to its trigger. Obtain sufficient additional evidence to understand the customer and circumstances, address the concern and determine whether activity is acceptable. All four original trigger categories remain below; other mandatory high-risk requirements also apply.

10.1 EDD Triggers

Examples from the linked AML framework include PEP/HIO connections, opaque ownership, location discrepancies, possible account takeover and coaching. Preliminary screening similarity is investigated; a PEP/HIO determination is not itself a sanctions designation or proof of crime.

10.2 Wallet-Triggered EDD

• The customer may be required to demonstrate that they are the lawful and sole controller/holder of the nominated wallet, preserving the original evidence requirement.
• Request explanations of relevant transactions or counterparties contributing to the alert and corroborating evidence where the explanation cannot be verified.
• Refer hosted, corporate, multisignature or other arrangements that cannot satisfy the existing control rule to Compliance. This revision does not automatically approve new wallet arrangements or allow an exception to a prohibition.
• Never request a private key, seed phrase, wallet password or transfer of wallet control as evidence. Use approved non-secret evidence; this is an added safeguard for implementing the existing wallet-control check.

10.3 Bank Statement / Source-of-Funds EDD

Where EDD is triggered by suspicious or irregular banking activity, obtain further documentary evidence and a clear explanation of the relevant transactions. Additional statements and financial documents may be requested to establish origin and reconcile activity with the stated purpose. Seek SOW separately where required. Unresolved inconsistencies may result in a hold, decline, restriction or escalation.

10.4 EDD for Other Triggers

Compliance determines additional evidence case by case, with requests connected to the identified concern. Apply the Risk Assessment's existing high-risk treatment and the Compliance Procedures' prescribed PEP/HIO measures, management review and relevant timeframes. Do not wait for a later statutory deadline to bypass an earlier Company onboarding or settlement requirement.

For suspected coaching or account takeover, assess who gives instructions, who controls the destination and whether customer explanations are independent and consistent. Consider possible victimization as well as wrongdoing. Record the facts and evidence; declarations alone do not resolve a material concern.

11. EDD Decision-Making and Possible Outcomes

Compliance or an authorized designate records one of the following outcomes, retaining the original range of decisions:

• Proceed, with conditions where appropriate, after the identified concern is satisfactorily resolved and all other checks are complete.
• Require additional evidence or monitoring before further activity.
• Keep the affected transaction on hold pending specified clarification or evidence.
• Decline the purchase, or restrict, suspend or terminate the relationship under the applicable policies.

Record the trigger, evidence, rationale, decision-maker, date/time, conditions and follow-up owner. Review open holds promptly and avoid unnecessary delay after resolution. Refund instructions require appropriate authority and legal review of restrictions; a hold is not automatically a legal asset freeze.

Escalate unusual activity on the same day identified and immediately where urgent. Use the internal Unusual Transaction Form; staff need not establish the STR threshold before referral. Compliance makes reporting decisions separately from approval, rejection or refund. Apply the reporting and confidentiality procedures; do not reveal internal reports or confidential investigation details to the customer.

12. Transaction Approval and Settlement

Standard KYC approval does not remove transaction-level controls. Every purchase remains subject to current customer eligibility, funding review, wallet screening and any EDD triggered by available information. No settlement transfer may be initiated before the checks and required approvals are complete.

12.1 Purchase and Release Controls

• Confirm approved customer status and reliable information. The customer selects cryptocurrency before payment and completes the required purchase confirmations.
• Match the fiat receipt and sender details to the customer, order and pre-selected cryptocurrency. Resolve funding/authority, reversal or conflicting-instruction concerns.
• Review the exact Global Ledger-screened destination/network, applicable EDD, jurisdiction and Travel Rule evidence. Record an authorized release decision.
• Link the conversion and completed settlement identifier to the purchase, customer and evidence record. Only authorized personnel may release a Compliance hold.

The initial questionnaire includes the cryptocurrency-risk acknowledgement. Before every purchase proceeds to payment, require both confirmations:

1. "I confirm I am acting on my own behalf and without third-party influence."
2. "I confirm that I have read, understood, and agree to the Terms and Conditions."

Retain the acknowledgement, timestamp and terms version. For an organizational customer, verify representative authority separately; the representative must not be misrecorded as the personal purchaser. Do not waive declarations or allow them to replace substantive fraud checks.

12.2 Travel Rule Linkage

Compliance assesses the applicable transfer type, record requirement and Company role. For covered transfers, obtain and retain prescribed requester/originator and beneficiary names, addresses and account/reference numbers, if any. Apply the approved hosted or self-hosted workflow; a wallet address or blockchain-risk report is not a substitute for this information. [R5]

Resolve required outbound information before release. Do not publish customer personal information on-chain. Missing information on an applicable incoming transfer is handled through documented reasonable measures and the Compliance Procedures' risk-based allow, suspend or reject process. Sumsub is the intended Travel Rule provider, not confirmed active functionality. A missing or unavailable mandatory process requires a pause, not an assumed provider clearance.

12.3 Continuing Due Diligence

Apply the existing review schedule: high risk at least every six months, with more frequent or daily attention where warranted; medium risk every nine months; low risk at least every twelve months. Update relevant information before resuming after a year of inactivity. These are Company intervals; statutory ongoing monitoring is risk-based. [R4]

Material changes, new adverse facts and overdue reviews prompt earlier action. Reliable prior identity verification need not be repeated for every purchase, but transaction checks continue. Confirm the profile, risk rating and next review date; use available history rather than inventing a longer operating record.

13. Recordkeeping and Case Documentation

Maintain complete, retrievable evidence of onboarding, verification, screening, EDD and decisions in approved access-controlled systems. Retain the original record categories and the aligned additions below:

• Customer questionnaire and onboarding data; identity and supporting documents; primary or alternative verification method and result.
• Organizational existence, authority, ownership/control, reasonable measures and relevant discrepancy-report acknowledgements.
• Sanctions, PEP/HIO and adverse-information screening; geographic eligibility and customer-initiated service evidence where relevant.
• Risk rating, EDD triggers, additional documents/explanations, bank and source evidence, review dates and follow-up.
• Exact wallet/network, Global Ledger reports, ownership/control evidence where obtained, Travel Rule completion and changed-instruction checks.
• Customer risk acknowledgement, pre-purchase confirmations, terms version, approvals, declines, holds, releases and escalation notes.
• Traceable purchase, actual fiat/crypto denomination and amount, conversion and settlement references; internal reporting and decision records.

Every virtual-currency exchange requires its transaction ticket or register entry regardless of amount. Generic fiat wording in the service description does not permit omission of actual denominations in transaction records. [R6]

Apply the detailed retention schedule in Compliance Procedures Section 16. Prescribed records generally require at least five years with category-specific start dates; the Company's relationship-supporting evidence standard runs at least five years after the later of creation or the last relationship transaction. Preserve longer legal holds and restrict reporting/investigation records to authorized persons. Secure disposal follows the approved schedule and Privacy Policy.

Keep provider-held evidence retrievable, including after termination. Record unsuccessful information requests with the action, date/time, source contacted, outcome and next step. Escalate missing/corrupted files, unauthorized access and accidental disclosure promptly. Required record production follows the AML Policy and Compliance Procedures. [R6]

14. Data Quality and Inconsistencies

Where information is incomplete, contradictory, unverifiable or materially inconsistent across records and screening results, request clarification or corroboration. Do not advance the customer to the next stage until the relevant information is sufficiently reliable. Do not fill unknown facts with guesses or overwrite historical evidence to hide a mismatch.

Document corrections and their source with an audit trail. A change to name, address, ownership, access or wallet instructions must be reconciled to the verified customer and assessed for fraud, eligibility and risk implications.

15. No Circumvention

Customers must not bypass due diligence or geographic controls using another person's identity, credentials, account or wallet, misleading information, false documents, or VPN/proxy use intended to conceal a prohibited location. Escalate suspected circumvention and pause the affected activity where required.

Do not treat lawful privacy tools, a legitimate joint-account question or a verified corporate representative as automatic proof of wrongdoing. Investigate the actual facts without creating an exception to existing funding, wallet or jurisdictional prohibitions. Staff must not coach customers to evade checks or manufacture reverse-solicitation evidence.

16. Policy Governance and Review

Compliance owns this Policy. Review it at least annually in the fourth quarter and sooner after material changes to the model, providers, onboarding, risk profile, law, control failures or findings. Record material amendments, senior-officer approval, effective dates and staff communication before the affected process is used.

Formal staff refresher training remains once a year under the AML Policy, with new-hire induction and necessary event-driven instructions separately. This document adds no quarterly or twice-yearly training cycle.

Any exception requires documented Compliance authority, and a material change to risk appetite requires formal approval. No exception may override applicable law or an expressly non-waivable Company prohibition. Required identification, material-risk review and pre-settlement approval cannot be commercially bypassed.

17. Relationship to Other Policies

Read this Policy with the AML & CTF Compliance Policy v2.0, Procedures for All Staff v2.0, Procedures for Compliance v2.0, Risk Assessment, Prohibited Jurisdiction Policy, Fraud Policy, Transaction Monitoring Policy, verification/sanctions instructions, Privacy Policy and Terms. References to revised v2.0 documents do not certify their approval; adoption must be recorded consistently.

Applicable law prevails. Apply the formally adopted stricter control unless properly amended. Compliance must resolve and communicate conflicting versions before affected activity proceeds; document revisions must not silently relax a prohibition.

Final control principle: due diligence is not simply collecting documents. Understand the customer, location, transaction circumstances, required source evidence and destination wallet before deciding whether activity can proceed.

Revision and adoption record

v2.0 retains all 17 original sections, the seven-stage journey, targeted EDD approach, above-65 trigger, wallet-control evidence, decision outcomes, record categories and anti-circumvention rules. It aligns POA to the retained all-customer standard, names Global Ledger, and adds the already aligned KYC/KYB, customer declarations, Travel Rule, review and settlement instructions. It clarifies that settlement must wait for checks and adds a no-secret-wallet-credentials safeguard.

Before adoption: record approval and reconcile any disputed upper-age rule, hosted/corporate wallet eligibility and third-party/joint-account treatment; confirm provider configuration, working Travel Rule workflow and the urgent delegate. Existing prohibitions remain. No new maximum age, transaction cap, SOF period, completed audit or historical implementation is asserted.

Source basis and regulatory references

Source basis: Due Diligence Policy v1.0 (September 2026, 7 pages); the three revised AML documents listed above; supplied Fraud, Monitoring, Jurisdiction and Risk Assessment policies; Terms of Service; management instructions. Numbered references identify legal support for the specified updates, not proof of Company implementation. Checked 27 September 2026.

1. FINTRAC — Methods to verify identity
2. FINTRAC — Beneficial ownership and discrepancy requirements
3. Corporations Canada — Beneficial ownership discrepancy reporting
4. FINTRAC — Ongoing monitoring requirements
5. FINTRAC — Travel Rule for electronic funds and virtual currency transfers
6. FINTRAC — MSB recordkeeping requirements
7. ESMA — MiCA Article 61: exclusive initiative of the client

Contact: compliance@altivest.io | Compliance Officer / MLRO: Zineb El Moustaooui