Fraud Prevention and Response Policy

1001148579 ONTARIO CORPORATION, a Canadian Money Services Business registered with FINTRAC under C10001709.

Document control

Policy purpose

This Policy establishes Altivest's framework for preventing, detecting, investigating and responding to fraud. It protects customers, the Company, its financial partners and service integrity, and supports the AML/CTF and due diligence framework.

Control principle: do not proceed where customer identity, payment activity, source of funds, wallet control or instructions are reasonably believed to have been falsified, manipulated or fraudulently obtained. Material unresolved concerns require a pause and review; staff need not prove fraud before escalating.

This revision retains the original 22 sections. Its aligned controls and additions require approval and implementation; it does not certify historical operation, completed testing or approval of the related revised policies.

1. Purpose and Objectives

1001148579 ONTARIO CORPORATION, trading as Altivest (the Company), maintains a risk-based fraud framework for non-face-to-face onboarding, bank-funded cryptocurrency purchases, digital verification and direct external-wallet settlement.

• Prevent fraudulent persons, accounts and transactions from entering the process, and detect identity theft, document fraud, payment fraud, account takeover, third-party activity and wallet fraud.
• Investigate and document suspected fraud consistently and proportionately, considering customer victimization as well as wrongdoing.
• Protect customer funds, Company assets, banking relationships, settlement processes and regulatory standing.
• Coordinate fraud controls with KYC/KYB, sanctions, AML/CTF, transaction monitoring and Enhanced Due Diligence (EDD).

2. Scope and Applicability

This Policy applies throughout the customer lifecycle to onboarding, verification, transaction processing, Compliance, operations, technology, support, finance and management. It covers prospective/existing customers; purchase requests and associated bank transfers; identity, address, source and wallet information; systems, communications and records; and employees, relevant contractors and service providers within their assigned functions.

Provider responsibilities follow their contracts and assigned work; their entire workforce is not automatically Company staff. No person or entity is authorized as an agent, mandatary or broker to offer or deliver Altivest's MSB service. Customers obtain the service directly and exclusively through the Company's website.

3. Fraud Risk Profile

The Company is a Canadian MSB registered with FINTRAC under C10001709. The Risk Assessment identifies online delivery, virtual currency and customer relationships as material inherent risks; this Policy adds fraud-specific controls without changing the approved risk scores.

Required onboarding precedes transaction permission. Customers select cryptocurrency before fiat payment, fund the purchase by bank transfer, and receive the purchased asset at their nominated external wallet after required checks. No cash/card funding, customer crypto deposits, crypto-to-crypto exchange, customer crypto custody or customer sell-back facility is offered.

Canada is the primary commercial focus. No active EU solicitation is authorized. EU customers, including existing relationships and unsolicited approaches, require documented jurisdictional eligibility review. Reverse solicitation requires assessment of exclusive customer initiative; prior relationships, website access or declarations alone are not exemptions. Preserve the existing Quebec exclusion and other approved restrictions. [R4]

4. Definitions

5. Fraud Governance and Responsibilities

• Senior management oversees the framework, approves material amendments and provides appropriate resources. Material incidents and unresolved conflicts are escalated to it.
• Compliance owns this Policy, oversees investigations, coordinates EDD, documents material decisions and assesses external reporting under the Compliance Procedures.
• Operations and Customer Support identify unusual behaviour, suspicious communications and transaction anomalies; preserve facts and raise concerns promptly.
• Technology and Security maintain appropriate authentication, access controls, logging and system monitoring, and assist authorized containment and evidence preservation.
• All relevant staff and contractors follow these controls, protect confidential information and escalate suspected fraud without delay. No commercial pressure may override a mandatory check.

Use the documented approval/delegation record for onboarding, restrictions, release and reporting decisions. Refer concerns on the same day identified and immediately for urgent fraud, sanctions/property or imminent-settlement risk. If the Compliance Officer is unavailable, use the recorded designate or senior-management route; affected activity remains paused without an authorized decision-maker.

6. Customer Onboarding Fraud Controls

Fraud prevention begins before transaction permission. The staged Sumsub-supported process includes email verification, questionnaire, screening, documents and review under the Due Diligence Policy v2.0.

• Confirm control of the onboarding email channel; this does not itself establish identity.
• Obtain required identifying, occupation/business, purpose, expected-activity and geographic information. For organizations, verify existence, ownership/control and representative authority.
• Review sanctions, PEP/HIO and relevant adverse or criminal information where available, age and geographic eligibility. A potential match requires investigation, not an automatic finding of fraud.
• Authenticate government-issued photo identification, confirm validity/currentness and match the name and photograph to the customer through the approved selfie/liveness workflow. Retain verification details, not merely a pass/fail result.
• Obtain proof of address for every customer under the aligned Company standard. Obtain bank statements, source-of-funds and source-of-wealth evidence where required by risk or the applicable procedure.
• Resolve material inconsistencies across questionnaire, documents, liveness and screening before approval. The Due Diligence Policy minimum age and above-65 EDD trigger remain; no new age limit is introduced here.

Retain the initial cryptocurrency-risk acknowledgement. Before each purchase proceeds to payment, require both confirmations, with timestamp and the relevant Terms version:

1. "I confirm I am acting on my own behalf and without third-party influence."
2. "I confirm that I have read, understood, and agree to the Terms and Conditions."

These confirmations supplement the checks; they do not prove freedom from coercion or authorize an otherwise prohibited transaction. Verify corporate representative authority separately.

7. Document and Identity Fraud

Treat suspected manipulation or impersonation as a material concern. Pause affected onboarding while identity integrity remains unresolved; request replacement or corroborating evidence through approved channels, review authenticity/liveness discrepancies and record the decision. Do not approve solely because a document appears valid.

Customers must not use another person's identity, credentials or account. Qualifying foreign ID, remote digital submission or legitimate privacy concerns are not by themselves fraud indicators. Do not alter customer evidence to make it pass or substitute an unapproved verification method.

8. Payment and Bank-Funding Fraud

Review incoming fiat payments through approved banking channels against the verified customer, pre-selected cryptocurrency, purchase purpose and expected activity. Bank transfers are the funding method; references to unusual cash entries in a bank statement concern external evidence, not Altivest cash acceptance.

• Match available sender/account details, amount and reference to the customer and order. A payment confirmation or screenshot must not substitute for the approved evidence of actual receipt.
• Review required bank statements for unexplained entries, unusual movements or activity inconsistent with the profile. A balance alone does not explain the origin of funds.
• Escalate material sender-name differences, third-party funding, joint-account ownership questions and corporate funding of a personal purchase. Establish the facts without creating an automatic funding exception.
• Consider repeated similar or split payments, sudden changes in frequency/value, reversals, conflicting references and dormant-to-active patterns under the Transaction Monitoring Policy.
• More than three incoming payments in one calendar day requires review. This is an internal review trigger, not automatic proof of fraud or a statutory reporting threshold; use the documented day/time zone.
• Request targeted statements, explanations or source evidence when needed. Keep affected settlement paused while a material funding concern is unresolved; record the outcome.

A large or repeated purchase, or a normal request for prompt service, is not suspicious in isolation. Assess facts and context. Transaction, refund and reporting decisions remain separate. No new transaction cap or fixed source-document period is introduced.

9. Account Takeover and Unauthorized Access

The Company applies controls to prevent and identify unauthorized access, including the two-factor authentication (2FA), IP/access logging and mismatch review described by management. Technology/Security and Compliance must document their actual scope, configuration, owner, limitations and implementation evidence; this Policy is not a certification of an unverified technical setting.

• Apply the documented 2FA and access controls to the relevant customer and staff workflows. Staff must not share credentials or bypass authentication to expedite a transaction.
• Review available login/access information for unusual locations, devices, repeated failures or patterns inconsistent with the customer. Check apparent VPN/proxy concealment or jurisdictional mismatches in context.
• Escalate unusual requests to change email/contact details, credentials, authentication factors, bank information or destination wallets. Changes must be verified against reliable customer information before being relied on.
• Where takeover is suspected, pause affected activity and arrange appropriate account/session restriction through authorized technical personnel; preserve access and change records.
• Confirm legitimate access through a previously verified or independently re-established channel. Do not rely solely on the new contact details involved in the suspicious request.
• Use proportionate re-verification/EDD and review recent purchases and account changes. Any authentication reset or release requires the appropriate recorded authority.

Do not ask a customer to disclose their password, one-time authentication code, private key or seed phrase to staff. Do not instruct customers to grant remote control of a device to bypass checks. These are protective implementation safeguards, not a substitute for the approved verification workflow.

Any material gap or outage affecting mandatory verification or account protection must be escalated and addressed before affected activity proceeds. This Policy does not claim continuous automated surveillance or a separate transaction-monitoring department.

10. Wallet and Blockchain Fraud Controls

For each purchase, obtain the customer's exact nominated external wallet address and network. Screen it through Global Ledger before each settlement to identify sanctions exposure, scams, fraud, stolen assets, darknet links, mixers/tumblers and other high-risk or illicit blockchain exposure.

• Retain the address/network, screening date, result, relevant exposure, reviewer and decision. Re-screen changed destination instructions and investigate unexpected redirection.
• Resolve preliminary alerts. A material high-risk result triggers Compliance review and EDD before settlement; required checks and approvals must be complete before the transfer is initiated.
• Require evidence of lawful and sole control/holding of the wallet where called for by the existing wallet rules, and explanations of relevant high-risk transactions or counterparties. A screening score does not prove ownership or certify absence of crime.
• Refer hosted, corporate, multisignature or other arrangements unable to meet the existing control rule to Compliance. This revision does not authorize new wallet types or relax a prohibition.
• Use approved non-secret evidence for wallet-control checks. Never request private keys, seed phrases, wallet passwords or transfer of wallet control.
• Confirm required funding, customer, jurisdictional and Travel Rule steps. Wallet screening does not replace Travel Rule information; intended Sumsub functionality must not be assumed operational.
• Where material wallet risk remains unresolved, keep settlement paused and record the hold, decline, restriction or other authorized outcome. EDD does not permit legally prohibited activity.

There is no continuous post-settlement surveillance of customer external wallets. Later relevant adverse information still informs customer risk, future purchases and reporting assessments. Record the final settlement identifier and link it to the purchase and approval evidence.

11. Common Fraud Red Flags

Retain and assess the following indicators in context. One serious concern can warrant immediate escalation; several weaker indicators need a combined assessment. A red flag is not, by itself, proof that the customer committed fraud.

• Identity information that does not match across onboarding materials; suspected forged, altered or manipulated documents; failed or inconsistent selfie/liveness results.
• Customer information that conflicts with geographic eligibility or declared circumstances, including attempted circumvention through a proxy or VPN.
• Irregular or unexplained banking activity inconsistent with the stated purpose, unexpected sender information, reversals or unusual repeated deposits.
• Third-party funding or instructions suggesting undisclosed involvement; a customer who appears coached, pressured or unable to explain who controls the destination.
• Unusual changes to settlement instructions, contact details or access information; requests to bypass authentication or send funds to another person.
• A destination wallet associated with scams, fraud, illicit activity or other high-risk exposure.
• Pressure to bypass controls, repeated attempts after a decline or conflicting explanations. Ordinary urgency without other concerns is not enough.
• Promises of guaranteed returns, urgent recovery/unlocking fees, or a supposed adviser/online contact supplying the wallet or controlling the purchase.

Nationality, age, limited crypto experience, lawful privacy tools or a legitimate joint-account query alone do not prove wrongdoing. Keep the underlying eligibility and EDD rules, assess possible victimization and apply the response in Sections 12–15.

12. Fraud Investigation and Escalation

Escalate material concerns to Compliance or the documented designate. Use the internal Unusual Transaction Form in the Staff Procedures, or its approved system equivalent. Record concerns on the same day identified and immediately raise urgent cases; do not delay notification until a form is complete or an offence is proved.

• Log the case reference, alert source, available facts, date/time and time zone, reporter, urgency and affected customer, order, bank transfer, wallet and current status.
• Protect against further loss within documented authority: pause the affected release, request authorized account restrictions and preserve records. Do not move or return potentially restricted assets independently.
• Review KYC/KYB, profile, funding, available transaction/access history, Global Ledger results and communications. Distinguish established facts, customer explanations and unresolved questions.
• Request targeted evidence through approved channels and apply EDD where required. Do not coach responses, disclose confidential screening logic or manufacture jurisdictional evidence.
• Document the final decision and rationale, restrictions/release authority, customer communications and reporting assessment. Approval, rejection or refund does not decide whether a report is required.
• Assign follow-up, review date and closure criteria. Record unresolved actions and material findings for management and control remediation.

12.1 Reporting and incident coordination

Compliance separately assesses whether completed or attempted activity meets the reasonable-grounds-to-suspect threshold for an STR concerning money laundering, terrorist activity financing or sanctions evasion. There is no monetary minimum. Submit a required report as soon as practicable after the threshold is established; staff do not wait for that threshold to raise an internal concern. A fraud allegation does not automatically require an STR. [R1, R2]

For possible terrorist or listed-person/entity property, apply the Compliance Procedures immediately. Determine the legal restriction, ownership/control and disclosure duty before deciding recipients or release. A preliminary match is not automatically confirmed, and an operational hold is not necessarily a legal freeze. [R3]

Where fraud involves a security or personal-information incident, notify the responsible technical/privacy function and Compliance. Assess privacy notification, partner notification and law-enforcement contact separately from FINTRAC reporting; the response must not suppress a legally required notice. [R5]

13. Fraud-Triggered EDD

EDD is tailored to the trigger, not one fixed expanded checklist. The original evidence categories below remain; social-engineering review clarifies the response to coaching and third-party control.

14. Transaction Holds and Outcomes

Compliance or the documented authorized decision-maker records the relevant outcome and supporting evidence. Preserve the original range of decisions:

Review open holds promptly and avoid unnecessary delay after adequate clarification. Do not invent fixed holding periods or treat silence as approval. A temporary review hold is not a custody product or a general right to retain funds indefinitely.

A refund or recall is a separate, authorized instruction. Verify the original funding/source details and the applicable legal and contractual basis. Do not redirect funds to an unexplained third party or return property contrary to a legal restriction. No refund fee, guaranteed recovery or new deadline is created here.

For suspected fraud found after settlement, preserve the identifiers, restrict future affected activity where appropriate and assess lawful contact with the banking/settlement provider or authorities. Do not promise that a completed blockchain transfer can be reversed or that funds will be recovered. Document actions and outcomes.

15. Third-Party and Mule-Account Risk

The Company does not support undisclosed third-party transactions. Customers are expected to transact on their own behalf, use their own verified information and comply with the approved funding and destination-wallet rules. A no-agents service model does not remove the need to identify customer-side third-party involvement.

• Treat evidence of an undisclosed controller, intermediary or beneficiary as material. Escalate requests to send purchased assets to a wallet not controlled by the customer; retain the existing wallet restrictions.
• Assess possible money-mule activity, pooled funding or use of the customer as a conduit. Determine who gives instructions, supplies the destination and benefits.
• For an organizational customer, verify representative identity and authority. The entity remains the customer; an authorized representative is not automatically an undisclosed third party.
• Refer joint-account questions and personal purchases funded by corporate or other third-party accounts to Compliance. An explanation alone does not waive a prohibition or establish a new exception.

15.1 Social engineering, investment and relationship scams

Where an adviser, online contact, purported support agent or other person appears to direct the purchase, assess whether the customer understands the purpose and independently controls the instructions. Use neutral questions through an approved channel, examine relevant communications lawfully provided and consider escalating requests for funds, secrecy, remote access or guaranteed returns.

A valid identity or willing payment does not rule out victimization. Pause material unresolved concerns even after customer declarations. Staff must not coach answers, encourage concealment from a bank or supply wording to manufacture reverse solicitation. Relevant customer warnings should be factual, respectful and approved by Compliance, without disclosing confidential reports.

16. Employee and Insider Fraud

Employees, contractors and other personnel with access to customer information or transaction systems must protect Company assets and records. Escalate suspected internal fraud, unauthorized access, record manipulation, diversion of assets or misuse of confidential information promptly to management and Compliance.

• Limit access to role and business need. Keep attributable records of material approvals, changes and transaction releases.
• Where a concern involves the normal recipient or a conflict of interest, refer it to another authorized, unconflicted senior decision-maker rather than that person alone.
• Use proportionate investigation, access restriction and disciplinary or legal action through authorized personnel. Protect evidence and do not allow the person under investigation to control its disposal.
• Keep internal investigations confidential and share only with authorized persons who need the information.

17. Third-Party Service Providers

Sumsub supports the approved identity/document, selfie/liveness and configured screening functions. Global Ledger supports blockchain analytics and pre-settlement wallet review. Approved financial counterparties support banking, conversion and settlement. These functions do not authorize providers to independently offer or deliver Altivest's MSB service.

The Company remains responsible for reviewing results, resolving alerts, risk acceptance, reporting and final decisions. Compliance maintains the function scope, signed agreements, responsible contacts, access/retention arrangements and evidence of configuration/testing under the Compliance Procedures.

• Confirm relevant screening coverage and limitations; do not assume every provider feature is enabled or every alert is a confirmed finding.
• Keep provider-held evidence retrievable, including after termination. Record outages, incomplete results and material incidents; pause affected activity if a mandatory check cannot be completed.
• Protect cross-border access through approved systems, contractual controls and the Privacy Policy. The customer geographic rule is not silently applied as a blanket prohibition on all overseas support personnel.
• Do not present intended Sumsub Travel Rule functionality or unverified monitoring automation as active. Material provider or asset/network changes require controlled review and instructions.

18. Recordkeeping and Evidence Preservation

Record fraud alerts and investigation notes promptly in approved access-controlled systems. Preserve the original material and a reliable history of corrections; do not overwrite evidence to conceal a mismatch.

• Case ID; reporter/reviewer; dates, time zones, urgency and source of concern; customer, order, bank-transfer and wallet/network identifiers.
• Customer documents, lawful screenshots/messages, verification/liveness outputs, available access logs, Global Ledger results, required wallet-control and Travel Rule evidence.
• Customer explanations, source evidence, reasonable efforts and unsuccessful requests; declarations, timestamps and Terms version.
• Holds, restrictions, approvals, declines, refund/recall instructions, communications and the rationale and authority for each decision.
• Reporting assessments and submissions where applicable, supporting references, management escalation, follow-up and closure evidence.

Apply Section 16 of the Compliance Procedures: prescribed records generally require at least five years with the correct category-specific start event; Company relationship-supporting evidence is kept at least five years after the later of creation or the last relationship transaction. Preserve longer legal holds and the separate incident-record requirements. Disposal must follow the approved schedule and Privacy Policy.

Keep provider evidence accessible and escalate loss, corruption, unauthorized disclosure or retrieval failures. Actual transaction records retain the actual currency/asset, amount and identifiers; generic fiat wording in the service description is not permission to omit transaction data.

19. Confidentiality and Tipping-Off Risk

Fraud cases can overlap with AML/CTF, sanctions and privacy investigations. Staff must not disclose internal reports, confidential screening methods, restricted findings or investigation details to a customer or unauthorized person. Questions about sensitive communications go to Compliance.

The statutory restriction prohibits disclosure of an STR, its contents or the fact of filing/intended filing with intent to prejudice a criminal investigation. Company confidentiality controls also restrict wider investigative information. Lawful customer communication and mandatory notifications must be assessed separately; confidentiality is not a reason to omit a required notice. [R1]

Verify authority and scope before disclosure to law enforcement or other outside parties, and retain approval and delivery evidence under the Compliance Procedures. Provide only information lawfully required or permitted through an approved secure channel.

19.1 Personal-information incidents

If a fraud event involves a breach of security safeguards, involve the responsible privacy function and Compliance. Where PIPEDA applies, assess sensitivity, likelihood of misuse and real risk of significant harm; report to the Privacy Commissioner and notify affected individuals where required, as soon as feasible. Keep a record of every covered breach, including non-reportable cases. [R5]

The privacy breach-record minimum is 24 months from determining that the breach occurred, separate from longer applicable AML/Company evidence periods and legal holds. Document the assessment, protective actions, notification decision and timing. Do not treat every fraud case as automatically a reportable privacy breach or every privacy breach as an STR. [R5]

20. Training and Awareness

Formal refresher training is once a year for all relevant staff, including management, Compliance personnel and relevant contractors, under the AML Policy and Staff Procedures. No additional quarterly or twice-yearly recurring fraud course is imposed.

• Cover identity/document fraud, payment fraud, account takeover, social engineering, wallet fraud, third-party/mule risks, red flags, confidentiality and escalation, tailored to the role.
• Preserve new-hire induction within 30 days and role-specific instruction before independently handling customers or customer funds.
• Completion is mandatory; any training quiz requires at least 80%, with remediation and re-assessment where needed. Retain plan, materials, attendance, dates and results.
• Communicate material changes and knowledge gaps promptly through targeted instructions. These event-driven measures do not create another scheduled training cycle.

21. Policy Governance and Review

Compliance owns and oversees this Policy. Review it at least annually in the fourth quarter and sooner after material fraud events, control failures, review findings or changes to the business, products, systems, providers, law or risk profile. Record causes, corrective actions and follow-up testing for material deficiencies.

Material changes require documented senior-officer approval, effective dates and staff communication. Resolve conflicting instructions before affected activity proceeds; applicable law and formally adopted stricter controls prevail. No commercial exception may override a legal or expressly non-waivable company prohibition.

Read this Policy with the AML & CTF Compliance Policy v2.0, Procedures for All Staff v2.0, Procedures for Compliance v2.0, Due Diligence Policy v2.0, Risk Assessment, Prohibited Jurisdiction Policy, Transaction Monitoring Policy, Privacy Policy and Terms of Service. Referenced policies require their own recorded adoption; no automatic approval is implied.

22. Final Control Principle

PROTECT — VERIFY — INVESTIGATE — DOCUMENT

Verify the person and documents, understand the funding, screen the destination wallet, investigate anomalies and document the decision. Where fraud risk cannot be satisfactorily resolved, hold, decline, restrict or terminate the affected activity under the applicable rules. Assess reporting separately and preserve the evidence.

Regulatory support for specified clarifications

Official sources checked on 27 September 2026. References support the legal distinctions; they do not verify Company facts or system implementation. Other operational provisions are source-derived Company controls or the clarifications identified above.

1. FINTRAC — Reporting suspicious transactions (threshold, timing and confidentiality)
2. FINTRAC — Report suspected sanctions evasion
3. FINTRAC — Reporting listed person or entity property
4. ESMA — MiCA Article 61: exclusive initiative of the client
5. OPC — Reporting a privacy breach and keeping records; all breach records: 24-month minimum

Contact: compliance@altivest.io | Compliance Officer / MLRO: Zineb El Moustaooui