AML & CTF Procedures for All Staff

1. Staff

For the purposes of this document, references to staff and employees include any other third-party companies (including subcontractors) that perform relevant functions including customer interactions, customer identification and transaction related functions.

All procedures listed in this document are mandatory. In addition to reading this document, all employees are required to complete training at least annually.

2. Staff Procedure

As a Foreign Money Services Business (FMSB) we are required under Canadian legislation to have an anti-money laundering (AML) and counter terrorist (CTF) compliance program. This procedure should be read in conjunction with 1001148579 ONTARIO CORPORATION. (ONTARIO)'s Canadian AML & CTF Policy and Risk Assessment. Additional procedures applicable to compliance staff only are documented in a separate procedure.

This procedure has been designed to assist staff who deal directly with our customers and our transactions. We are required to verify, collect, and record information about our customers and transactions. Violations of this procedure can have severe negative consequences for ONTARIO. Any questions or concerns about this procedure should be directed to the Compliance Officer.

3. Money Laundering & Terrorist Financing

Money laundering is the process of taking money obtained by committing a crime and disguising the source to make it appear legitimate. Under the Criminal Code of Canada, it is illegal to launder money or to knowingly assist in laundering money. Under the PCMLTFA and Regulations, we must take steps to be sure that our business is not used to launder money and if we suspect that money laundering may be taking place, we must report it.

Terrorist financing is the process of moving funds in order to pay for terrorist activities. Unlike money laundering, the source of the funds is not always criminal, but the intended use of the funds is criminal. Under the Criminal Code of Canada, it is illegal to knowingly assist in the financing of terrorism, including the possession of terrorist funds or property. If we know or suspect that we have terrorist property in our possession, it must be reported immediately.

3.1 How Money Laundering & Terrorist Financing Work

Money laundering is described as having three phases by the Financial Action Task Force ('FATF'). These are Placement, Layering and Integration.

Terrorist financing, as opposed to money laundering can occur with legitimate funds, meaning funds which are not the proceeds of crime. Legitimate funds can be transferred and used by those who would commit terrorist activities. In this, it can be said that terrorist financing most often acts in the 'Layering' and 'Integration' phases described by the FATF.

Placement

The launderer introduces illegal profits into the financial system, often by breaking up large amounts of cash into smaller sums deposited into bank accounts, or purchasing monetary instruments.

Layering

The launderer engages in a series of conversions or movements of the funds to distance them from their source through purchases, sales, or wire transfers through various accounts.

Integration

The funds re-enter the legitimate economy through investments in real estate, luxury assets, or business ventures.

Important: It is not necessary to identify the stage, or even to know that money laundering is taking place, to consider a transaction suspicious. It is enough to have "reasonable grounds to suspect" that money laundering may be occurring. If something seems unusual, trust your instincts and escalate the issue to the Compliance Officer.

4. Customers

Before customers initiate applicable transactions, we must conduct identification measures before those transactions can be completed. We collect identification information and information about the customer (individuals and organizations).

For customers where there is an existing authenticated and up to date customer profile, it is not necessary to re-identify the customer at the time of a transaction.

Periodically (based on risk level), customer information and identification (if applicable) is updated.

5. Customer Authentication & KYC

ONTARIO takes steps to collect Know Your Customer (KYC) and authentication information for all customers. All individuals who apply to become a user of our services undergo an onboarding process comprised of a questionnaire, submission of customer identification and providing us with the nature and purpose of the relationship with ONTARIO.

ONTARIO will not open nor maintain an anonymous profile or profile in a fictitious name nor will a profile be setup without full KYC being completed.

In cases that we cannot identify a customer, we must document the reasons that the customer could not be identified and our efforts to identify them.

6. Enhanced Customer Identification & KYC

In some cases, we need additional information to identify our customers and record specific information about the customer. If we are not able to identify the customer, we must decline the following types of transactions:

• Large virtual currency transactions (valued at CAD 10,000 or more in a single transaction or multiple transactions within 24 hours)
• Virtual currency transactions valued at CAD 1,000 or more

In other cases, we must take reasonable measures to attempt to identify the customer, if it is possible to do so, without letting the customer know that we may have suspicions about the nature of their activities. These include:

• Suspected money laundering or terrorist financing activity
• Terrorist property

6.1 Dual Process Method of Identification for Individuals

ONTARIO confirms the identity of a customer, that is an individual, by referring to information from reliable and independent sources, and the information must be valid and the most recent.

Under the dual process method, we can refer to any two of the following options:

• Documents or information from a reliable source that contain the customer's name and address
• Documents or information from a reliable source that contain the customer's name and date of birth

All customers must provide a government-issued photo identification and proof of address during onboarding which is passed to a third-party service provider called SumSub. ONTARIO is given a pass/fail response from SumSub.

6.2 Business Relationships

We have a business relationship with any individual customer that has completed two or more transactions that require us to identify the customer. In these cases, we must ask about the purpose of the customer's business relationship with us and record that purpose.

We also have to conduct a Politically Exposed Person (PEP) or Head of an International Organization (HIO) determination when we enter into a business relationship with a customer. It is our practice to conduct such checks at onboarding and periodically thereafter.

6.3 Customers That Cannot Be Identified

If we are not able to identify a customer, they cannot complete transactions that require identification.

Some customers may be hesitant to provide identification for legitimate reasons. Remember that if you are obtaining identification because you suspect that the customer's transactions or requests are related to terrorist financing or money laundering, you should not tell the customer about your suspicion. Instead, let the customer know that it is our company's policy to ask for identification.

6.4 Records Related to "Reasonable Efforts"

In any case where ONTARIO is required to take reasonable efforts to obtain or confirm information and/or collect documentation, we must keep a record of those efforts, the date they were taken and whether or not they are successful. These records are maintained electronically.

7. Reporting

ONTARIO must report certain types of transactions. Reporting to any regulatory, law enforcement, or government agency, should always be completed by the Compliance Officer or a designate. All other employees should use the internal forms (i.e., Unusual Transaction Form) to submit reports to the Compliance Officer.

All reports have specific timelines in which they must be submitted. All internal reports should be submitted to the Compliance Officer on the same day that the incident or transaction takes place.

7.1 Suspicious Transactions & Attempted Suspicious Transactions

Suspicious Transaction Reports (STRs), and Attempted Suspicious Transaction Reports (ASTRs), are submitted to FINTRAC where there are reasonable grounds to suspect that an activity is related to money laundering or terrorist financing. These reports must be submitted whether or not the transaction or activity is completed.

Important: It is against the law to deliberately "tip off" a customer about a potential investigation. You are, however, protected under Canadian law from any action when you submit a report in good faith.

7.2 Large Virtual Currency Transactions

Large Virtual Currency Transaction Reports (LVCTR) have to be submitted to FINTRAC when a customer conducts transactions, in virtual currency, valued at CAD 10,000 or more in the same 24-hour period. This may be in a single transaction or several separate transactions. LVCTRs must be submitted to FINTRAC within five working days after the day on which the customer transfers or receives the amount.

7.3 Travel Rule

The travel rule refers to specific information that should be included with the information sent or received for virtual currency and EFT transactions:

• The name, address and, if any, the account number or other reference number of the person or entity who requested the transfer
• The name, address and, if any, the account number or other reference number of the beneficiary

7.4 Third-Party Determinations

A third-party determination must be completed anytime a LVCTR is required. This means that we ask the customer if the transaction is being conducted on behalf of any other individual or organization. If so, we must collect and record information about the individual or organization on behalf of which the transaction is being conducted.

7.5 PEP & HIO Determinations

FMSBs are required to determine whether or not the customer is a Politically Exposed Person (PEP) or Head of an International Organization (HIO), or the close associate or family member of a PEP or HIO in the following cases:

• When we enter into a business relationship with a customer
• When conducting periodic monitoring of business relationships
• Upon detection of a fact about an existing business relationship that indicates a PEP or HIO connection
• When we receive CAD 100,000 or more
• When we transfer CAD 100,000 or more

Foreign PEPs

People who hold or have ever held positions on behalf of a foreign government:

• Head of state or head of government
• Member of executive council or legislature
• Deputy minister or equivalent rank
• Ambassador, or attaché
• Military officer (general or above)
• President of state-owned company/bank
• Head of government agency
• Judge of supreme/constitutional court

Domestic PEPs

People who hold or held in the last five years positions in Canadian government:

• Governor General, lieutenant governor
• Member of Senate or House of Commons
• Deputy minister or equivalent rank
• Ambassador, or attaché
• Military officer (general or above)
• President of crown corporation
• Head of government agency
• Judge of appellate/federal/supreme court
• Mayor (municipal level)

Prescribed family members include: mother or father, child, spouse or common-law partner, spouse's mother or father, brother, sister, half-brother or half-sister.

7.6 Terrorist Property

Terrorist Property Reports (TPRs) are completed if you believe that ONTARIO may be in possession of funds or property that belong to a terrorist (either an individual or an organization). These reports should be escalated to the Compliance Officer immediately. In some cases, property or funds must be frozen. TPRs must be submitted to FINTRAC, and other agencies, immediately.

8. Responding to Law Enforcement Requests

If staff are aware that a request has been made by law enforcement, they must immediately notify the Compliance Officer who will handle all related correspondence.

9. Unusual Indicators & Red Flags

Trust your instincts – if something doesn't feel right (whether or not any of these indicators are present), file an Unusual Transaction Report with the Compliance Officer. These indicators are a sample provided by FINTRAC and will be augmented regularly.

9.1 General Indicators

• The individual or entity appears on a government sanction list
• Customer admits or makes statements about involvement in criminal activities
• Customer shows uncommon curiosity about internal systems, controls, and policies
• Customer presents confusing details about the transaction or knows few details about its purpose
• Customer over justifies or explains the transaction
• Customer insists that a transaction be done quickly
• Customer provides false information or information that you believe is unreliable
• Customer offers money, gratuities, or unusual favours for services
• Transaction involves a suspected shell entity

9.2 Knowledge of Reporting Requirements

• Customer attempts to convince employee not to complete documentation required for the transaction
• Customer makes inquiries that would indicate a desire to avoid reporting
• Customer has unusual knowledge of the law in relation to suspicious transaction reporting
• Customer is quick to volunteer that funds are "clean" or "not being laundered"
• Customer appears to be structuring amounts to avoid reporting thresholds

9.3 Identity Documents

• Customer provides doubtful or vague information
• Customer produces false identification or identification that appears to be counterfeited, altered or inaccurate
• Customer refuses to produce personal identification documents
• Customer only submits copies of personal identification documents
• All identification presented is foreign or cannot be checked
• Customer presents different identification documents at different times
• Customer alters the transaction after being asked for identity documents

9.4 Economic Purpose

• Transaction appears to be out of the normal course for industry practice
• Activity is inconsistent with what would be expected from declared business
• No business explanation for size of transactions or cash volumes
• Transaction involves non-profit or charitable organization with no logical economic purpose

9.5 Indicators Specific to Human Trafficking

• Frequent purchases of virtual currencies in multiples of small amounts (e.g., $3, $12, $24)
• Cash deposits/withdrawals between 10 p.m. and 6 a.m.
• Frequent transactions across different cities and provinces within short timelines
• Common address provided by different people undertaking transfers
• Customer makes deposits accompanied or watched by a third-party
• Financial activity inconsistent with customer's stated occupation or business activity

9.6 Indicators Specific to Online Child Sexual Exploitation

• Frequent low-value transfers to females in jurisdictions of concern for child sexual exploitation
• Travel-related expenses occurring before or after transfers to jurisdictions of concern
• Transactions conducted from jurisdictions of concern (e.g., ATM withdrawals, account logins)
• Purchases of online encryption tools, VPN services, software to clear online tracking
• Purchases on webcam/livestreaming platforms, including adult entertainment
• Purchases on dating platforms, particularly Asian dating websites

9.7 Indicators for Fentanyl Trafficking

• Customer makes transactions inconsistent with employment or profile
• Customer conducts untypical cash transactions given profile
• Customer lives beyond apparent means (large expenses for real estate or luxury goods)
• Customer incurs significant travel expenses inconsistent with profile
• Customer uses multiple financial institutions with significant cash flow-through

9.8 Indicators for Romance & Mass Marketing Fraud

• Customer met the individual they are transacting with on a social media platform or dating website
• Customer has never met the individual they are in the relationship with
• Customer relays a confusing, conflicting or non-believable story about why funds are needed
• Customer appears to be pooling all financial resources to fund transfers
• Amount or frequency of funds sent increases over time
• Customer conducts large volume of transactions involving foreign jurisdictions

9.9 Indicators of Virtual Currency Abuse

• User provides falsified, altered, forged or inaccurate identification documents
• User provides contact information similar to another user
• Frequent changes in identification information (home address, IP address, linked bank accounts)
• User operates more than one account without approval
• User's portfolio only consists of privacy coins (e.g., Monero, Dash, Zcash)
• Long period of dormancy followed by large volume of transactions
• User receives frequent/large transactions from Bitcoin ATMs
• User is a trust, shell company or private investment company reluctant to provide information

9.10 Exchange/Trading Platform Indicators

• Funds deposited soon after account registration and withdrawn shortly thereafter
• Funds primarily sent to or received from P2P exchanges without using platform features
• Funds with direct/indirect links to darknet marketplaces, mixing services, or illegal activities
• High frequency of deposits or withdrawals with unknown third parties
• User requests withdrawal to be processed unreasonably quickly
• Transactions with jurisdictions known to circumvent sanctions
• Bitcoin ATM withdrawals from high-risk geographies

9.11 Politically Exposed Persons (PEPs) Indicators

• User utilizes third-parties to shield identity as a PEP or beneficial owner
• Information volunteered by PEP is inconsistent with publicly available information
• PEP user repeatedly moves funds to/from countries with no apparent ties
• PEP user has substantial authority over state assets and funds
• Information obtained that a PEP user is denied entry to a country
• PEP user downplays importance of their public function

Additional Virtual Currency Indicators

• Transactions with virtual currency addresses linked to darknet marketplaces or illicit activity
• Transactions initiated from non-trusted IP addresses or sanctioned jurisdictions
• Use of VPN services or Tor to access virtual currency exchange accounts
• Multiple rapid trades between virtual currencies with no related purpose
• Customer provides identification or credentials shared by another account
• Customer significantly older than average platform users engaging in large transactions
• Customer shows limited knowledge of virtual currency despite engagement
• Deposits significantly higher than ordinary with unknown source of funds
• Multiple changes to email address and contact information (may indicate account takeover)

10. Appendix: Unusual Transaction Form (Internal)

This form should be completed if you have reasonable grounds to suspect that a customer's activities are related to money laundering or terrorist financing activities. This form should be submitted to the Compliance Officer on the same day that it is completed. Do not let the customer know that you are filling out this form or discuss its contents with anyone other than the Compliance Officer or a designate.

Your Name & Location (ONTARIO Office Location):

Customer's Name:

Were you able to identify the customer? If yes, include identification information. If not, explain why:

Describe the customer's request or transaction, including whether the transaction was completed:

Describe what happened, what made you suspicious, the customer's behavior, specific words or phrases used:

Date:

Time:

Your Signature:

Compliance Use Only

Date reviewed:

Reviewed By:

This transaction has been deemed suspicious: ☐ Yes ☐ No

Rationale for the decision (whether or not the transaction is deemed suspicious):

Follow up actions (e.g., adjustments to risk rating, enhanced due diligence):