Prohibited Jurisdiction Policy

1001148579 ONTARIO CORPORATION, a Canadian Money Services Business registered with FINTRAC under C10001709.

Document control

Core rule. Canada is the primary customer market. EU customer relationships require documented jurisdictional eligibility and, where relied upon, genuine exclusive customer initiative. Existing express prohibitions remain; supplier and personnel geography is assessed separately from the customer-market rule.

1. Purpose and Policy Objective

1001148579 ONTARIO CORPORATION, trading as Altivest (the Company), maintains a documented jurisdictional risk appetite to prevent customer relationships and activity outside its approved scope or involving unacceptable money laundering, terrorist financing, sanctions, fraud, regulatory or reputational risk.

The Company is a Canadian MSB registered with FINTRAC under C10001709. It provides fiat-funded cryptocurrency purchases directly and exclusively through its website. Required onboarding precedes transaction permission; the customer selects cryptocurrency before fiat payment and receives it at a nominated external wallet after the required checks. No service-delivery agent, mandatary or broker is appointed.

This Policy operates with the AML/CTF Policy, Risk Assessment, Staff and Compliance Procedures, Due Diligence, Fraud, Transaction Monitoring and Privacy policies. It distinguishes legal prohibitions, ministerial directives, external country-risk information and stricter Company restrictions. A control may exceed the legal minimum without being described as a statutory ban.

2. Scope

The original scope across onboarding, periodic review, transaction processing, ongoing monitoring and offboarding is retained. Apply the appropriate type of geographic assessment rather than one undifferentiated country gate.

2.1 Separate customer access from support arrangements

The customer-market restriction does not automatically prohibit an overseas Compliance Officer, director, employee or technology supplier. Their location and access require their own approved risk and privacy assessment. Sumsub and Global Ledger support checks; they are not authorized to offer Altivest's service to customers independently.

This clarification does not approve a new financial counterparty or waive an express counterparty prohibition. Existing customer-facing financial-counterparty restrictions remain unless formally amended. Approval must identify the entity, role and geographic exposure; a vendor cannot be relabelled to bypass a restriction.

3. Geographic Risk Appetite

3.1 Canada: primary commercial focus

Canada is the primary target market. Customers must meet the Company's KYC/KYB, risk and transaction requirements and applicable legal eligibility. The existing exclusion of business in Quebec is retained from the Risk Assessment and revised AML documents unless formally amended after regulatory assessment. Canadian location is not, by itself, proof of low risk or authorization for every product.

3.2 EU customers and customer-initiated relationships

The Company does not actively market or solicit its service to EU customers. Previously established EU relationships and customers approaching independently may be considered only following documented jurisdiction-specific review before acceptance and continued service. Prior relationships are not an automatic exemption.

Where relying on MiCA Article 61, Compliance must establish the customer's own exclusive initiative for the relevant requested service and any specifically related relationship. Solicitation by the Company or a person acting on its behalf cannot be cured by a disclaimer or checkbox. Customer initiative does not authorize marketing new types of crypto-assets or services. [R5]

Retain the date/channel of approach, residence or establishment, requested asset/service, relevant communications, prior marketing/contact, legal basis and decision. Assess further requests and later promotions separately; an earlier unsolicited purchase is not permanent permission to solicit the customer. ESMA's guidelines construe the exemption narrowly. Staff must not coach or manufacture evidence. [R6]

3.3 Other customer locations and retained restrictions

• Customers in the United States, the Middle East or jurisdictions outside Canada and Europe remain prohibited under the original geographic restriction. Section 11 retains the separately named country bans.
• "Europe" is not interchangeable with "European Union." UK, Swiss and other non-EU European customer eligibility is not established by this revision. Do not onboard or process such activity without a separately approved jurisdictional and legal decision; a change outside the approved appetite requires formal amendment.
• No customer may proceed where an express prohibition applies, including an EU customer in a country that remains internally prohibited. An external low-risk score, bank account or former relationship does not override it.
• Use the controlled country/territory schedule, including the defined Middle East scope. Geographic labels must not be used to guess borderline eligibility. An unresolved territorial or overlapping classification requires a pause and documented resolution before service.

3.4 Nationality, residence and payment location

Nationality alone does not decide customer location or risk. Check residence, incorporation, business location and material transaction links separately, including any legally relevant citizenship or ownership criterion. The country of an IBAN, bank or liquidity provider is not proof of customer residence or target market; record the actual flow without concealing its geography.

4. Prohibited High-Risk and Sanctions-Related Jurisdictions

Apply the following distinct controls cumulatively. A relationship that passes one test can still fail another. The snapshot in Section 11 is dated reference information, not a substitute for current legal sources and the controlled jurisdiction register.

4.1 Applicable sanctions and legal restrictions

Screen the customer, relevant beneficial owners, directors, authorized persons and transaction counterparties under the Compliance Procedures. Apply Canadian sanctions and terrorist-property rules, including relevant ownership/control and territorial or activity-based restrictions. A name-only alert is not automatically a true match, and not every sanctions regime bans every transaction involving a whole country. [R3, R7]

Use the operative regulations and designations. The Consolidated Canadian Autonomous Sanctions List is an administrative aid covering specified Canadian regimes, not the complete law or a substitute for other relevant Canadian terrorist/UN measures. Check relevant foreign sanctions where law or contractual arrangements require them; do not assume every foreign-list alert triggers every Canadian disclosure. [R3, R7]

4.2 Ministerial directives

FINTRAC currently lists directives for Russia, Iran and the Democratic People's Republic of Korea (DPRK). The directive determines its nexus, required enhanced measures, records and reporting. Compliance must apply the current instructions to covered transactions, including unexpected or indirect exposure; the normal reporting thresholds may not always be sufficient. A directive is distinct from an internal country ban or a sanctions prohibition. [R4]

Retain the Company's Iran and DPRK prohibitions. Russia is not approved as a customer market under the current Canada/EU model. Any Russia-related connection requires review of both the directive and sanctions; this section does not authorize business in Russia.

4.3 FATF classifications

4.4 Retained bans and dynamic restrictions

All individually named bans in the source policy remain in Section 11. Their former blanket "FATF high-risk" label is removed; a country need not remain on a FATF list for an internal ban to remain effective. New adverse listings trigger prompt assessment and a pause where eligibility is unresolved. Compliance may immediately restrict a jurisdiction pending formal review, as the original policy allowed. Removal of an external listing does not automatically remove an internal prohibition.

5. Canada and Eligible EU Jurisdictions Are Not Automatically Low Risk

Geographic eligibility never overrides sanctions, unacceptable activity, adverse information, unreliable source of funds, opaque ownership, third-party control, fraud or regulatory concerns. A country classified as prohibited/high risk under the Company's approved country methodology remains prohibited even if it lies within the potential customer geography.

A customer with a material connection to a prohibited jurisdiction must be assessed against the actual rule and evidence. Residence, beneficial control, instructions, funding and counterparties can create different links. Neither foreign nationality nor remote blockchain exposure alone establishes that the customer is resident in a prohibited country. Document the connection and its significance; EDD cannot override a prohibition.

6. Examples of Prohibited Geographic Profiles

These examples retain the original profiles while distinguishing customer eligibility from supporting-provider geography. They are illustrative, not a complete legal sanctions list.

7. Customer and Counterparty Onboarding Requirements

7.1 Customer eligibility workflow

• Obtain and verify the relevant residence, incorporation and principal-business locations. Use the Sumsub-supported KYC/KYB process and all-customer proof-of-address standard; obtain source evidence as required by risk.
• Compare identity, address, declared country, actual payment information and available IP/geolocation/device evidence. Record discrepancies and resolve material concerns rather than accepting a self-declaration as conclusive.
• Check the current controlled jurisdiction schedule and relevant legal restrictions. Record the version/date, customer category, decision basis and reviewer before transaction permission.
• For EU cases, retain the Section 3.2 evidence and jurisdiction-specific legal assessment. Prior relationships, website access and risk/Terms declarations do not establish reverse solicitation by themselves.
• Screen relevant persons/entities under the Compliance Procedures. A material alert requires resolution and appropriate EDD; an expressly prohibited relationship must be declined.
• Before each settlement, obtain the Global Ledger result for the exact destination address/network. Assess credible geographic or sanctions links alongside transaction facts; do not infer a wallet holder's country solely from an address or risk score.
• Resolve applicable Travel Rule requester/beneficiary information under the approved workflow. Wallet screening does not replace that information; intended provider functionality must not be assumed operational.

7.2 Financial counterparties and other providers

Identify the actual legal contracting entity, licensing/registration where relevant, operational and processing locations, significant ownership/control and the proposed service. Record the financial route, source/destination countries and approved scope. A trading brand or IBAN prefix is not a complete counterparty assessment.

Retain express financial-counterparty bans and approved-role limits. Where a new location falls outside the previously approved counterparty scope, resolve the restriction through the formal governance process before use. Technology vendors and authorized overseas personnel require separate sanctions, security, privacy, access and retention controls; customer-market eligibility must not be used as a substitute for that review.

7.3 Circumvention and unresolved information

Customers must not use false documents, another person's account, proxies or VPNs to conceal a prohibited location. Ordinary privacy-tool use is not sufficient by itself to prove wrongdoing. Investigate material mismatches. If a prohibited jurisdiction is established, stop onboarding or further affected activity and refer the case for decline/restriction/offboarding and any independent reporting assessment.

No incomplete approval. Do not activate the affected service while country eligibility, a material screening concern or a mandatory approval remains unresolved. A provider outage is not permission to bypass the check.

8. Ongoing Monitoring and Transaction Controls

Monitor customer activity for geographic inconsistencies, unexpected intermediaries and routing designed to conceal the origin, destination or controlling party. Consider the actual fiat funding, purchase instructions, relevant bank information and Global Ledger evidence within the Company's available information and control perimeter.

• Reassess a change of residence, principal business, ownership/control, funding route, destination arrangement or other material geographic nexus before further affected activity. Review new designations and country changes promptly.
• Use the aligned customer review intervals: high risk at least every six months, medium risk every nine months and low risk at least every twelve months, with earlier review when warranted. These are Company intervals, not permission to defer urgent country or sanctions action.
• Prohibited jurisdictions must not be used as the origin, destination or material transaction nexus where the relevant Company prohibition applies. Examine the genuine nexus; incidental foreign infrastructure must not be assumed to change customer residence.
• Raise concerns on the day identified and immediately for urgent sanctions/property, fraud or imminent-settlement risk. Use the internal Unusual Transaction Form or approved equivalent and the documented backup route.
• Pause affected activity within authorized powers; Compliance distinguishes a temporary review hold from a legally required freeze. Do not move or return potentially restricted property without a lawful, documented instruction.
• Assess STR, listed-person/entity-property and directive-related duties under the Compliance Procedures independently of refusal or offboarding. A geography flag alone is not automatically reportable; a required property report cannot await routine review. [R7]
• Retain evidence of the alert, current source, nexus analysis, action, decision, release/refund authority and follow-up. No continuous post-settlement wallet surveillance is claimed; later relevant adverse information must still inform the relationship.

9. Exceptions

No commercial, financial or relationship-based exception may permit onboarding from an expressly prohibited customer jurisdiction. Completing EDD, accepting a declaration, obtaining a bank partner's consent or knowing a customer previously does not override a legal or non-waivable Company prohibition.

Compliance may resolve a false positive or document a temporary hold, restriction or offboarding decision. That is not an exemption from a confirmed prohibition. Decisions on supplier or personnel geography under Section 2 are role-specific assessments, not disguised customer-country exceptions.

A prospective change to Company risk appetite requires a documented rationale, relevant legal assessment, senior-officer approval, coordinated amendments and implementation instructions before affected activity proceeds. No approval can waive law. A legal permit or exemption must be verified within its scope and does not automatically amend a stricter internal ban.

10. Governance and Review

Compliance owns this Policy and the controlled jurisdiction register. Senior management approves material amendments and risk-appetite changes. Review the Policy at least annually in the fourth quarter and sooner for legal, sanctions, FATF, provider, business-model or risk changes; do not wait for the annual review to apply a newly effective restriction.

10.1 Controlled register and implementation

Maintain one authoritative schedule used by the Risk Assessment, onboarding instructions and transaction controls. The register records each country or territory, customer/counterparty/provider scope, reason and source, external-list status, internal decision, effective date, reviewer/approver and review trigger. An external list is evidence; the internal decision is recorded separately.

• Check current FATF publications, FINTRAC directives/advisories, applicable Canadian regulations/designations and relevant local-market requirements. Retain dated source evidence and resolve inconsistent publication dates.
• After a material change, identify affected applicants, customers, counterparties and pending transactions; document restrictions, required communications, lawful handling and follow-up.
• Translate decisions into approved country/territory settings and operational instructions. Test relevant onboarding, payment and screening controls; record limitations and manual checks where automation is not implemented.
• Record and communicate changes across the policy set. Formal staff refresher training remains once a year; necessary event-driven instructions and new-hire induction remain separate.
• Use source/version history and recorded governance decisions. A country's delisting does not silently reopen it, and a new internal restriction must not be presented as an external legal designation.

10.2 Recordkeeping

Retain jurisdiction assessments, approvals, source snapshots, screening and case decisions under the Compliance Procedures' record-specific schedule, generally at least five years with the correct start event and any longer legal hold. Keep policy/register versions and change records for at least five years under the Company standard. Necessary relationship-supporting evidence follows the aligned later-of-creation-or-last-transaction rule.

Use approved access-controlled storage and preserve provider-held evidence. The Privacy Policy governs purpose limitation, lawful disclosure and disposal of other personal information. This provision does not impose five-year storage on every website log or change the retention start dates in the other policies.

10.3 Matters to resolve before adoption

Record approval and the effective date; finalize the country/territory register and regional boundaries; document any non-EU-European decision, current FATF-monitored EU country decision and financial-counterparty approval; confirm the urgent delegate and implemented screening/access settings. An unfilled setting or an unresolved regional overlap is a reason to pause affected activity, not implied permission.

11. Internal Prohibited Jurisdiction List — Current Policy

The rules apply cumulatively. Distinguish the operative Company restrictions below from the dated external-list snapshot. This revision does not lift an existing named ban merely to match a changed FATF list.

11.1 Retained Company prohibitions

11.2 FATF reference snapshot: 19 June 2026

Checked against FATF's published lists on 27 September 2026. Use the current statements at the time of a decision. The two categories must not be merged. [R1, R2]

A grey-list entry requires current risk analysis, not an invented legal ban. Existing named bans remain binding. For a newly monitored jurisdiction otherwise within potential customer scope, do not approve affected activity until Compliance records the country-risk decision and any required measures; prohibit it if the Company determines it falls outside appetite. This policy neither grants blanket grey-list acceptance nor silently introduces a universal grey-list ban.

The source's Turkey and Malta examples remain prohibited as Company choices. Correcting their external-list description does not authorize customers or financial counterparties there. No risk scores or transaction limits are revised by this Policy.

12. Relationship to the AML/CTF Program

When adopted, this version replaces the source jurisdiction policy's unqualified Canada/Europe permission, inaccurate blanket FATF label and undifferentiated provider/personnel geography. Existing named bans and other expressly stricter controls remain unless formally amended. Compliance must update conflicting Risk Assessment tables, website summaries and operational instructions before affected activity proceeds. Unrelated source documents are not rewritten by this file.

Final control principle. Where customer jurisdiction, material transaction nexus, sanctions exposure or country eligibility remains uncertain, obtain a documented Compliance decision before onboarding or processing continues. A legal prohibition cannot be cured by a commercial exception.

Official references checked 27 September 2026

1. FATF — High-Risk Jurisdictions subject to a Call for Action, 19 June 2026
2. FATF — Jurisdictions under Increased Monitoring, 19 June 2026
3. Global Affairs Canada — Consolidated Canadian Autonomous Sanctions List
4. FINTRAC — Ministerial directives and transaction restrictions
5. ESMA — MiCA Article 61, exclusive initiative of the client
6. ESMA — Guidelines on reverse solicitation under MiCA (2025)
7. FINTRAC — Reporting listed person or entity property

Contact: compliance@altivest.io | Compliance Officer / MLRO: Zineb El Moustaooui