KYC Policy

1. Purpose

This policy sets out how Royal Payment Solutions, LLC (the "Company") identifies and verifies its customers, understands who they are and what they intend to do, and keeps that knowledge up to date for as long as the relationship lasts. It turns the customer identification and due diligence parts of the Company's AML, BSA and KYC Compliance Program into concrete rules that staff, systems and partners can apply in the same way every time.

The policy has three aims:

1. to make sure the RoyalPay product is not used for money laundering, terrorist financing, sanctions evasion, fraud or other financial crime;
2. to give every licensed partner institution a customer file it can rely on and review; and
3. to treat honest customers fairly, quickly and with respect for their privacy.

2. Scope and our role

The Company designs and operates RoyalPay, a multi-currency account and card product. Accounts, IBANs and cards are issued, and customer funds are held, only by a licensed bank or e-money institution (the "Partner"). The Company does not hold, receive or transmit customer funds.

Under the programme agreement with the Partner:

• the Company runs the onboarding flow, collects and checks customer information, performs the controls in this policy and keeps the records;
• the Partner makes the final decision to accept, restrict or exit a customer, and its own AML programme applies in full; and
• where the Partner's requirements are stricter than this policy, the Partner's requirements apply.

This policy applies to every applicant and customer of RoyalPay, to every person who acts for them, and to every employee, contractor and service provider of the Company who takes part in onboarding or monitoring. Until a Partner agreement is signed, RoyalPay operates only as a sandbox with simulated data, and this policy is applied there as a working rehearsal of the live process.

3. Legal and regulatory framework

The Company is a limited liability company organised in New Mexico, USA, and builds RoyalPay for customers in the European Economic Area, Switzerland, the United Kingdom and the United States. This policy is written to meet, for each market, the requirements that will apply to the Partner and, through the programme agreement, to the Company:

When a law changes, the compliance officer updates this policy. Until the update is approved, the stricter of the old policy and the new legal requirement applies.

4. Principles

• No anonymous accounts. We never open or keep an account for an anonymous person, under a fictitious name or for a person we cannot identify.
• Risk-based approach. The depth of our checks follows the risk of the customer, the product, the countries involved and the channel, as required by FATF Recommendation 1.
• Verify before use. An account cannot receive or send money until identification and verification are complete and the Partner has approved the customer.
• One customer, one file. Every customer has a single, complete file that the Partner, auditors and supervisors can review on request.
• Fair treatment. Decisions are based on risk, never on nationality alone, ethnicity, religion, gender or any other protected characteristic. A refusal is never a judgement about a person's character.
• Privacy by design. We collect only what the law and this policy require and protect it as described in section 15.

5. Customer acceptance

5.1 Who can become a customer

An individual can apply for RoyalPay if they:

• are at least 18 years old and have full legal capacity;
• are resident in a country where the Partner is permitted to serve them (currently planned: the EEA, Switzerland, the United Kingdom and the United States);
• hold a valid identity document listed in section 6.3;
• act on their own behalf and use the account for their own personal purposes; and
• are not a prohibited customer under section 5.2.

Business customers will be accepted only after a separate business onboarding process has been approved by the Partner. Section 8 sets out the rules that will apply to them.

5.2 Prohibited customers

We do not accept, and we exit without delay:

• persons, entities or vessels listed on, or owned 50% or more, individually or in aggregate, by persons listed on, the OFAC Specially Designated Nationals list, the EU consolidated list, the UK sanctions list or the UN Security Council consolidated list, unless a licence from the competent authority expressly permits the relationship;
• persons ordinarily resident in, or acting on behalf of the government of, a country or territory subject to comprehensive sanctions by the United States, the European Union or the United Kingdom;
• persons resident in a jurisdiction on the FATF "call for action" list;
• shell banks, and any institution that allows its accounts to be used by shell banks;
• anyone who refuses to provide the information this policy requires, or who provides information we have good reason to believe is false;
• anyone who wants to open an account for, or on the instructions of, an undisclosed third party; and
• anyone we have previously exited for financial crime reasons, unless the compliance officer and the Partner have both approved in writing.

5.3 Restricted customers

The following can be accepted only after enhanced due diligence under section 9 and written approval by the compliance officer and the Partner:

• politically exposed persons, their family members and close associates (section 10);
• residents of, or customers with significant links to, a high-risk third country identified by the European Commission or a jurisdiction under increased monitoring by the FATF; and
• customers whose expected activity, source of funds or profile does not fit a personal multi-currency account.

6. Customer identification and verification

6.1 Information we collect from every individual

6.2 How we verify identity

We verify every individual before the account is opened, using a combination of documentary and non-documentary methods that gives us reasonable certainty, and in the EEA a level of assurance consistent with EBA/GL/2022/15:

1. Document check. The customer photographs an original, valid identity document from section 6.3. The document is checked for authenticity (security features, machine-readable zone, chip data where available, signs of tampering) and for expiry.
2. Biometric match and liveness. The customer takes a live selfie or short video. It is matched against the document photo, and a liveness check confirms that a real person is present and not a photo, mask, replay or deepfake.
3. Data check. Name, date of birth and address are compared with the document and, where available, with reliable independent sources such as credit reference or electoral data, or an electronic identification scheme notified under eIDAS (Regulation (EU) No 910/2014).
4. Address check. Where the address cannot be confirmed electronically, the customer provides a bank statement, utility bill or government letter dated within the last three months.
5. Device and fraud signals. We check for indicators such as multiple applications from one device, mismatches between declared and observed location, and disposable email addresses.

A customer cannot complete onboarding until every check has passed or a compliance analyst has resolved the exception and recorded the reason.

6.3 Accepted identity documents

• Passport.
• National identity card issued by an EEA country or Switzerland.
• UK or US photo driving licence, only together with a second check that confirms the address and identity independently.
• US state-issued photo identity card.
• Residence permit issued by an EEA country or the UK, only together with the holder's passport.

Documents must be original, unexpired and fully legible. We do not accept photocopies, scans of scans, screenshots or documents that have been altered in any way.

6.4 When verification fails

If we cannot verify a customer's identity within 30 days of the application, the application is closed and the data is handled as described in section 14. We never open an account "pending" verification. Where the reason for failure raises suspicion, the case is escalated under section 12.

7. Customer risk assessment

7.1 Risk factors

Every customer receives a risk rating at onboarding. The rating combines at least the following factors, weighted according to the EBA risk factor guidelines and the Company's annual business-wide risk assessment:

7.2 Risk levels and what they mean

A customer's rating is updated whenever new information changes it, not only at the scheduled review.

8. Business customers and beneficial ownership

When business accounts are introduced, the Company will, in addition to section 6:

• obtain and verify the legal name, registration number, legal form, date of formation, registered and principal business addresses, and the nature and purpose of the business, using official registers and constitutional documents;
• identify and verify every individual who owns, directly or indirectly, 25% or more of the equity interests, and one individual with significant responsibility to control, manage or direct the business, as required by 31 CFR 1010.230, AMLD Article 13 and UK MLR regulation 28. Where the Partner or the applicable law sets a lower threshold, we apply the lower threshold;
• where no individual meets the ownership threshold, identify the senior managing official and record the steps taken to look for an owner;
• understand the ownership and control structure and record why it makes sense for the business;
• verify that any person acting for the business is authorised to do so; and
• not accept businesses with bearer shares, nominee shareholders that cannot be looked through, or structures whose only apparent purpose is to obscure ownership.

9. Enhanced due diligence

Enhanced due diligence applies to every high-risk customer and in every case where the law requires it. It includes, in proportion to the risk:

• additional information about the customer and the intended nature of the relationship;
• documented source of funds for the account and, for PEPs and other higher-risk customers, the source of wealth, supported by evidence such as payslips, tax returns, sale contracts or audited accounts;
• reasons for intended or performed transactions that are unusual for the customer;
• adverse media and open-source searches, recorded with their results;
• written approval of the compliance officer and the Partner before the relationship starts or continues;
• lower transaction limits and closer transaction monitoring; and
• a review at least every 12 months.

10. Politically exposed persons

We screen every customer, every beneficial owner and every person acting for a customer against PEP databases at onboarding and continuously afterwards.

A politically exposed person is an individual who holds, or has held, a prominent public function, such as a head of state or government, minister, member of parliament, member of a supreme or constitutional court, member of the board of a central bank, ambassador, high-ranking officer in the armed forces, member of the management of a state-owned enterprise, or director of an international organisation, in any country. Family members and known close associates are treated in the same way.

For every PEP, family member or close associate we apply enhanced due diligence under section 9, obtain senior management approval, establish source of funds and source of wealth, and conduct enhanced ongoing monitoring. A person who has left a prominent public function remains a PEP for at least 12 months, and for longer while they continue to pose a higher risk, in line with AMLD Article 22.

11. Sanctions screening

• Every applicant, customer, beneficial owner and authorised person is screened against the OFAC, EU, UK and UN sanctions lists before onboarding.
• The Company keeps its own copy of these lists, downloaded directly from the official publishers (US Treasury, European Commission, UK Foreign, Commonwealth and Development Office and UN Security Council) and refreshed every day. A refresh that looks incomplete is rejected and the previous copy stays in use.
• The full customer base is rescreened automatically after every refresh.
• Our own screening adds to the Partner's screening and never replaces it.
• Outgoing and incoming payments are screened for sanctioned parties and jurisdictions before they are released.
• Potential matches are reviewed by a compliance analyst within one business day. Any account involved is restricted while the review is open.
• A true match is never "tipped off" to the customer. Assets are frozen and reported to the competent authority within the legal deadline, which for OFAC blocked property is 10 business days under 31 CFR 501.603.

12. Ongoing monitoring and periodic review

12.1 Transaction monitoring

We monitor every account for activity that does not fit what we know about the customer, including:

• volumes or values well above the expected activity declared at onboarding;
• structuring, meaning amounts split to stay under reporting or review thresholds;
• rapid movement of funds in and out with no clear purpose;
• payments to or from high-risk jurisdictions or counterparties;
• many accounts linked to the same device, address or payment details; and
• incoming transfers from accounts that are not in the customer's own name, or that are unusual in frequency or amount.

Transfers carry complete payer and payee information as required by Regulation (EU) 2023/1113 and the US recordkeeping and travel rule in 31 CFR 1010.410.

12.2 Periodic review and event-driven review

Each customer file is reviewed at the frequency set in section 7.2. A review is also triggered by a monitoring alert, a change of name, address or nationality, new adverse media, a sanctions or PEP list change affecting the customer, an expired identity document, or a request from the Partner. At each review we confirm that the information is still accurate and the risk rating is still right, and we ask the customer for updated information or documents where needed.

12.3 Suspicious activity

Any employee who suspects money laundering, terrorist financing, sanctions evasion or fraud reports it to the compliance officer at once, through the internal reporting channel. The compliance officer investigates, documents the decision, and where required files a report with the competent authority (in the United States, a Suspicious Activity Report with FinCEN, generally within 30 days of initial detection) and informs the Partner under the programme agreement. Nobody may tell the customer or any third party that a report has been considered or made.

13. Exiting a customer

We restrict or close an account when the customer becomes prohibited under section 5.2, does not provide information we require within the time we set, provides false information, or presents a risk we cannot manage. The decision is made by the compliance officer together with the Partner. Funds belonging to the customer are returned through the Partner to an account in the customer's own name, unless the law requires them to be frozen.

14. Record keeping

We keep, for at least five years after the end of the customer relationship or after the date of an occasional transaction, and longer where the law or the Partner requires it:

• all identification and verification data, including copies of documents and the results of each check;
• the risk assessment and every change to it, with reasons;
• all transaction records;
• EDD evidence, approvals, alerts, investigations and their outcomes; and
• internal and external suspicious activity reports and related correspondence.

Records are kept so that they can be produced promptly to the Partner, auditors and competent authorities. After the retention period, personal data is deleted unless a legal hold applies.

15. Data protection

Personal data collected under this policy is processed to comply with legal obligations (GDPR Article 6(1)(c)) and, where applicable, for the performance of the customer contract (Article 6(1)(b)). Biometric data used for the liveness and face match is processed only for identity verification, with the customer's explicit consent where required by GDPR Article 9(2)(a), or under another legal basis the applicable law provides, and the biometric template is not kept longer than needed for that purpose. Data is accessible only to people who need it, encrypted in transit and at rest, and shared only with the Partner, verification providers under data processing agreements, and authorities where the law requires. The Privacy Policy gives customers the full details.

16. Reliance and outsourcing

We may use specialist providers for document verification, biometric checks, screening and monitoring. The Company remains responsible for the result. Before a provider is used, the compliance officer documents its suitability, data protection terms and testing; its performance is reviewed at least once a year. Where the Company relies on checks performed by the Partner, or the Partner relies on the Company, the conditions are set in writing in the programme agreement, including access to the underlying data on request.

17. Roles and responsibilities

As the team grows, compliance decisions will be separated from product and commercial roles, so that nobody approves their own work.

18. Training

Everyone who takes part in onboarding, monitoring or customer support completes KYC and AML training before they start and at least once a year afterwards. Training covers this policy, red flags, sanctions, data protection and how to escalate a concern. Completion and test results are recorded.

19. Testing and review

This policy and its application are tested at least once a year by a person independent of the work being tested, in line with the Company's AML Program. Findings and their remediation are reported to the managing member and shared with the Partner. The policy itself is reviewed at least once a year and whenever the law, the product, the risk assessment or a Partner agreement changes.

20. Approval

This policy was approved by the managing member of Royal Payment Solutions, LLC and takes effect on 13 October 2026.

Questions about this policy: info@royalpaymentsolutions.com