1.1. Policy Statement

Metaflow Technology Platforms Limited ("Taja", "the Company", "we", or "us"), the operator of the "Taja" platform, is fully committed to preventing its services, platforms, and employees from being used to facilitate money laundering (ML), terrorist financing (TF), proliferation financing (PF), or any other financial crime.

This Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) Policy ("Policy") establishes the comprehensive framework, minimum standards, internal controls, and procedures for Taja's compliance with its legal and regulatory obligations. The Company is dedicated to maintaining the highest standards of integrity and vigilance in all its operations. We will maintain a compliance program that is effective, risk-based, and actively enforced.

1.2. Purpose and Objectives

The primary objective of this Policy is to ensure that the Taja platform is not exploited for illicit activities. This Policy is designed to:

• Prevent, detect, deter, and report potential ML, TF, and PF activities on the Taja platform.
• Ensure full and demonstrable compliance with all applicable AML/CFT laws and regulations in the jurisdictions where we operate, primarily.
• Establish and maintain a robust AML/CFT Compliance Program (the "Program") built upon a formal, documented Enterprise-Wide Risk Assessment (EWRA) and a Risk-Based Approach (RBA).
• Protect the Company's reputation, integrity, and operational viability by maintaining the confidence of our users, banking partners, and regulators.
• Provide clear guidance to all employees and agents regarding their obligations and responsibilities under the Program.

1.3. Scope

This Policy manual applies universally to the company and all its global operations, subsidiaries, and affiliates. It is binding on all directors, officers, management, and staff (including permanent, contract, and temporary employees), as well as any agents or partners acting on the Company's behalf.

All business units and operational functions, including but not limited to technology, product development, customer onboarding, payments, marketing, and customer support, must incorporate and adhere to the procedures outlined in this Policy.

1.4. Holder of Canada MSB License

Metaflow Technology Platforms Limited operates the Taja platform as a licensed Money Services Business (MSB) registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). As such, the Company is subject to the full supervisory and reporting authority of FINTRAC and must comply with all obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its associated Regulations.

1.5. Regulatory and Legal Frameworks

Taja ensures adherence to all applicable laws and regulations in its operating and market jurisdictions. This Policy is specifically designed to comply with:

• Canada: Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), associated Regulations, the Criminal Code of Canada, Special Economic Measures Act (SEMA), Justice for Victims of Corrupt Foreign Officials Act (JVCFOA).
• Global Standards: The Financial Action Task Force (FATF) Recommendations, which set the global standard for AML/CFT/CPF.

1.6. "Higher of Home or Host" Principle

Taja's operations span multiple jurisdictions (licensed in Canada, serving users globally). Where the AML/CFT requirements of these jurisdictions differ, Taja shall adopt and implement the more stringent or prescriptive standard across its entire operation. This "higher of home or host" principle ensures the highest and most defensible level of compliance.

Rationale: This is a regulatory best practice. For example, Canada's FINTRAC sets a 25% beneficial ownership threshold, while Nigeria's CBN mandates a 5% threshold. This policy formally adopts the 5% threshold as the Company's global standard.

1.7. Key Regulatory Bodies

Taja is subject to the supervision and reporting requirements of FINTRAC (Canada), the Financial Transactions and Reports Analysis Centre of Canada. As our primary licensor, FINTRAC receives regulatory reports (STRs, LCTRs, etc.) and conducts compliance examinations.

2.1. Money Laundering (ML) Defined

Money laundering is the criminal process of disguising the origin of money or assets derived from illegal activities ("proceeds of crime") to make them appear legitimate. Profit-motivated crimes that generate such proceeds include drug trafficking, fraud, corruption, organized crime, and tax evasion.

The Taja platform, which facilitates the rapid, cross-border movement of funds, could be attractive to criminals seeking to obscure the money trail.

2.2. Terrorist Financing (TF) Defined

Terrorist financing provides funds for terrorist activity. This involves the collection, provision, or movement of funds, from either legitimate or illegitimate sources, with the intention or knowledge that they will be used to support terrorist acts or organizations.

Unlike money laundering, the source of funds can be legal (e.g., personal donations, business profits), but the intended use is criminal. Detecting TF often involves identifying transaction patterns that are small in value, making them difficult to distinguish from legitimate transfers.

2.3. Proliferation Financing (PF) Defined

Proliferation financing is the act of providing funds or financial services for the manufacture, acquisition, possession, development, or transport of nuclear, chemical, or biological weapons (Weapons of Mass Destruction or WMDs) and their delivery systems. This includes funds for dual-use goods intended for non-legitimate purposes. Taja is obligated to screen for and block any transactions related to PF.

2.4. Stages of Money Laundering

The money laundering process is traditionally described in three stages. These stages can be separate, overlap, or occur simultaneously.

2.4.1. Placement

This is the initial stage where illicit funds are first introduced into the legitimate financial system. For the Taja platform, this could be an attempt to receive a fraudulent wire transfer into a newly created virtual account.

2.4.2. Layering

This is the process of separating the criminal proceeds from their source by using complex layers of financial transactions. The goal is to hide the audit trail and provide anonymity.

Taja Platform Risk: This is the highest-risk stage for our platform. A launderer might use a mule account on Taja to receive illicit funds (Placement), and then immediately attempt to make a payout to a third-party bank account or a crypto-exchange (Layering). Our strict prohibition on third-party payouts is designed to directly disrupt this stage.

2.4.3. Integration

This is the final stage where the laundered funds re-enter the legitimate economy, appearing as "clean" money. The criminal can now use the funds to invest in businesses, real estate, or luxury assets.

2.5. Consequences of Non-Compliance

• Regulatory Sanctions: Significant monetary penalties, fines, and sanctions from regulators like FINTRAC and the CBN.
• Criminal Charges: Criminal prosecution of the Company, its directors, officers, and employees, which can result in imprisonment.
• Business Disruption: Suspension or revocation of our MSB license, termination of critical banking partnerships, and asset forfeiture.
• Reputational Damage: Irreparable harm to our brand and loss of user trust, leading to business failure.

3.1. The Five Pillars of Compliance

Taja's AML/CFT Program is built upon the five internationally recognized pillars of an effective compliance program, as required by FINTRAC and global standards:

• Written Policies and Procedures: This Policy and all supporting operational procedures, which are approved by Senior Management and reviewed regularly.
• A Designated Compliance Officer: The appointment of a qualified Chief Compliance Officer (CCO) with the necessary authority, independence, and resources to manage the Program.
• A Documented Risk Assessment: A formal, ongoing Enterprise-Wide Risk Assessment (EWRA) to identify, assess, and mitigate ML/TF risks.
• Ongoing Training Program: A comprehensive training program for all relevant personnel to ensure they understand their roles and responsibilities.
• Effectiveness Review (Independent Audit): A regular, independent review (audit) of the AML/CFT Program to test its adequacy and effectiveness.

3.2. Governance Structure

A clear governance structure is essential for compliance. AML/CFT is the responsibility of every employee, but oversight is managed through a clear hierarchy.

• The Board of Directors provides ultimate oversight.
• Senior Management is responsible for implementing the Board's directives.
• The Chief Compliance Officer (CCO) is responsible for the day-to-day operation and management of the AML/CFT Program.
• The Compliance Department supports the CCO.
• All Staff are the "first line of defense" responsible for identifying and reporting suspicious activity.

3.3. Roles and Responsibilities

3.3.1. Board of Directors

The Board of Directors (or its equivalent governing body) has ultimate responsibility for ensuring Taja complies with its AML/CFT obligations. The Board shall:

• Approve this AML/CFT Policy and Program, and any material changes thereto.
• Appoint a qualified Chief Compliance Officer (CCO).
• Ensure the CCO has sufficient authority, independence, and resources (human, financial, and technological) to effectively execute their duties.
• Receive and review regular (at least annual) reports from the CCO on the status and effectiveness of the AML/CFT Program, the results of the EWRA, and any independent audit findings.

3.3.2. Senior Management

Senior Management is responsible for executing the Board-approved Program. They shall:

• Oversee the day-to-day implementation of this Policy.
• Ensure that AML/CFT compliance is a key consideration in business strategy, product development, and operational decisions.
• Ensure that the CCO is adequately qualified and has the necessary access to information and personnel.
• Sign off on the results of the independent effectiveness review.
• Provide final approval for establishing or continuing business relationships with high-risk customers, such as PEPs.

3.3.3. Chief Compliance Officer (CCO)

The CCO is the designated individual responsible for the implementation and management of the AML/CFT Program. The CCO's duties include:

• Developing, maintaining, and updating this Policy and all related AML/CFT procedures.
• Conducting and updating the Taja-Wide Risk Assessment (EWRA).
• Serving as the primary point of contact for FINTRAC, NFIU, CBN, and other regulators.
• Overseeing the investigation of internal suspicious activity escalations.
• Making the final determination on, and ensuring the timely submission of, all external regulatory reports (STRs, LCTRs, etc.).
• Developing and delivering the AML/CFT training program for all staff.
• Managing the response to and remediation of any findings from the independent audit.
• Advising Senior Management and the Board on compliance matters and emerging risks.

3.3.4. Compliance Department Staff

Compliance staff (e.g., Compliance Analysts, Officers) report to the CCO and support the Program by:

• Conducting onboarding KYC, CDD, and EDD reviews on new users.
• Monitoring and analyzing transaction alerts to detect suspicious activity.
• Assisting in the preparation of regulatory reports (STRs, LCTRs, etc.).
• Conducting initial and ongoing sanctions and PEP screening.
• Maintaining organized compliance records.

3.3.5. All Employees

All employees are the "first line of defense" and have a personal responsibility for compliance:

• Complying with all requirements of this Policy and the AML/CFT Program.
• Being vigilant in identifying potential ML/TF activities, red flags, or policy violations.
• Immediately reporting any suspicious transactions, activities, or concerns to the CCO through the designated internal channels.
• Completing all mandatory AML/CFT training as required.
• Crucially, all employees must NEVER "tip off" a customer or any external party that a suspicious activity is being investigated or has been reported.

3.4. Communication and Escalation

Clear and confidential lines of communication are vital.

• Suspicion: Any employee who detects a "red flag" or suspicious activity must escalate it immediately to the CCO or the Compliance Department via the designated internal reporting tool or email channel.
• Whistleblowing: If an employee suspects wrongdoing involving the CCO, they must report it directly to the CEO or the Chair of the Board of Directors. All such reports will be treated with the utmost confidentiality, and the employee will be protected from victimization.

4.1. The Risk-Based Approach (RBA)

Taja adopts a Risk-Based Approach (RBA) to AML/CFT compliance, as mandated by FINTRAC and FATF. This means we identify, assess, and understand the specific ML/TF risks we face, and then apply mitigation measures that are proportionate to those risks.

Our RBA involves the following steps:

• Step 1: Identify Inherent Risks: Conducting the EWRA to assess risks linked to our products, customers, geography, and channels.
• Step 2: Set Risk Tolerance: As a licensed MSB, our risk tolerance for ML/TF is low. We will not engage with prohibited customers or activities.
• Step 3: Create Risk-Reduction Measures: Designing and documenting key controls (like this Policy, EDD, and monitoring rules) to mitigate high-risk activities.
• Step 4: Evaluate Residual Risks: Comparing our residual risks (after controls) to our risk tolerance.
• Step 5: Implement Controls: Applying risk-reduction strategies, particularly for high-risk situations.
• Step 6: Review RBA: Continually reviewing and testing the RBA for effectiveness, especially through the independent audit.

4.2. EWRA Methodology

The CCO is responsible for conducting and documenting a comprehensive Enterprise-Wide Risk Assessment (EWRA).

Frequency: The EWRA will be reviewed and updated at least annually, or more frequently if a "material trigger event" occurs.

Material Triggers: Such events include, but are not limited to, the introduction of new products (e.g., new virtual account currencies), expansion into new target markets, changes in banking partnerships, or significant changes in the regulatory landscape.

Process: The EWRA involves assessing the likelihood and impact of risks across four key categories, identifying the controls in place, and determining the residual risk rating.

4.3. Inherent Risk Factors

4.3.1. Product and Service Risk

Inherent Risk: High.

Rationale: The Taja platform offers services that are inherently attractive for ML/TF:

• Cross-Border Payments: Enabling rapid, cross-jurisdictional fund movement.
• Multi-Currency Virtual Accounts: Allowing funds to be held and managed in USD, GBP, EUR, and NGN, which can be used for layering.
• Anonymity: Our services inherently provide a degree of anonymity compared to face-to-face banking.

Higher Risk Indicators:

• Services that enable irreversible transfers.
• New technologies like virtual accounts where regulations may be evolving.

Mitigation: Strict CDD/EDD, prohibition of third-party payouts, automated transaction monitoring, and the Travel Rule.

4.3.2. Customer Risk

Inherent Risk: High.

Rationale: Our target market may include individuals or entities whose activities are high-risk.

Higher Risk Indicators:

• Politically Exposed Persons (PEPs) and their associates.
• Complex corporate structures (e.g., shell companies, trusts) where beneficial ownership is obscured.
• Customers in high-risk industries (see Appendix 3).
• Customers requesting undue secrecy or providing incomplete/false information.
• Customers exhibiting unusual behavior, such as attempting to open multiple accounts.

Mitigation: A risk-based CDD process, mandatory EDD for high-risk customers, and enhanced monitoring. We explicitly prohibit certain customer types (see Appendix 2).

4.3.3. Geographical Risk

Inherent Risk: High.

Rationale: We are licensed in Canada (low-risk) but our user base may be customers from countries on the grey list like Nigeria, a jurisdiction identified by FATF as having strategic AML/CFT deficiencies ("grey list"). We also process payments from global jurisdictions (USD, GBP, EUR).

Higher Risk Indicators:

• Users resident in, or receiving funds from, jurisdictions on the FATF "grey list".
• Jurisdictions subject to sanctions (e.g., Canada's SEMA, OFAC).
• Jurisdictions known for high levels of corruption, organized crime, or terrorist activity.

Mitigation: All users from "grey list" jurisdictions (e.g., Nigeria) are automatically rated as high-risk and subject to EDD. We maintain a Prohibited Countries List (Appendix 1) from which we will not accept users or transactions.

4.3.4. Delivery Channel Risk

Inherent Risk: High.

Rationale: The Taja platform is a non-face-to-face (NFTF) service, delivered exclusively through a mobile application. This channel prevents traditional in-person verification and increases identity fraud risk.

Higher Risk Indicators:

• Online account opening.
• Use of new technologies (mobile apps) that can be exploited.

Mitigation: Robust digital identity verification methods, multi-factor authentication, IP address monitoring, and velocity checks.

4.4. Risk Mitigation and Controls

This Policy and its procedures are the primary risk-mitigation framework. Key controls include:

• A stringent, multi-layered KYC process.
• The absolute prohibition of third-party payouts.
• Mandatory application of EDD for all high-risk users.
• Automated transaction monitoring tailored to our specific risks (e.g., mule account red flags).
• Mandatory sanctions and PEP screening for all users.

4.5. Customer Risk Assessment (CRA)

4.5.1. Customer Risk Scoring System

Every user is assigned a risk score at onboarding, which is dynamically updated throughout the business relationship. This score is calculated based on objective criteria, including:

• Customer Type: Individual vs. Corporate.
• Geography: Country of residence, nationality, and source of incoming funds.
• Industry/Occupation: e.g., a user in a high-risk industry (see Appendix 3) will be scored higher.
• Products Used: Use of multiple virtual accounts.
• Onboarding Data: Any flags during verification (e.g., non-resident, watchlist "hit").

4.5.2. Risk Categories

Users are categorized based on their score:

• Low Risk: (Not applicable at this stage; all users are moderate or high).
• Moderate Risk: Default for users from low-risk countries with clear, verifiable profiles and low-volume activity. Subject to Standard CDD.
• Above Average Risk: Users meeting certain criteria (e.g., moderate-volume businesses). Subject to EDD.
• High Risk: This is the default category for:
  • All users resident in Nigeria or other FATF "grey list" jurisdictions.
  • All Politically Exposed Persons (PEPs) and their associates.
  • Users in high-risk industries (e.g., crypto, cash-intensive businesses).
  • Any user exhibiting suspicious activity.

Action: All "Above Average Risk" and "High Risk" customers are subject to mandatory Enhanced Due Diligence (EDD).

5.1. KYC Policy Objective

The "Know Your Customer" (KYC) procedure is Taja's most critical defense against financial crime. The objective is to establish and verify the true identity of every user, understand the nature of their activities, and assess the ML/TF risks they may pose.

5.2. When CDD is Required

Taja must perform CDD measures at the following times:

• Onboarding: Before establishing a business relationship or opening an account for any user.
• Occasional Transactions: (Not applicable as all users must have an account).
• Suspicion of ML/TF: Immediately, when the Company suspects ML/TF, regardless of any threshold.
• Doubts about Veracity: When we doubt the veracity or adequacy of previously obtained identification data.
• Trigger Events: During the relationship, if a "trigger event" occurs (e.g., a significant, unexpected transaction; a change in user profile; or the user is flagged in new screening).

5.3. Standard Customer Due Diligence (CDD)

At a minimum, Standard CDD must be performed for all users and includes the following steps:

5.3.1. Identifying Individuals

We must collect the following for all individual users:

• Full Legal Name
• Date of Birth
• Full Residential Address (P.O. Boxes are not permitted)
• Phone Number and Email Address
• Occupation or Nature of Business
• Bank Verification Number (BVN) (for Nigerian users)

5.3.2. Identifying Legal Entities (Corporate Accounts)

We must collect the following for all corporate users:

• Full Legal Name of the Entity
• Business Operating Name (if different)
• Certificate of Incorporation / Registration Number
• Registered Head Office Address
• Principal Place of Business Address (if different)
• Nature of the Company's Business
• Tax Identification Number (TIN)
• Names of all Directors
• (For Nigerian entities) SCUML Registration, if applicable

5.3.3. Identifying Beneficial Ownership

For all corporate accounts, we must identify and take reasonable measures to verify the identity of the Ultimate Beneficial Owners (UBOs).

Rationale & Threshold: FINTRAC requires identifying UBOs at 25% ownership. In line with our "higher of home or host" principle, Taja will identify and verify all natural persons who, directly or indirectly, own or control 5% or more of the legal entity.

Control: Where no individual meets the 5% threshold, we must identify the natural person(s) who exercise control through other means (e.g., control of the Board).

Senior Management: If no UBO can be identified, we must identify and verify the identity of the senior managing official(s) of the entity (e.g., CEO, CFO).

Information: For each UBO identified, we must collect their Full Legal Name, Date of Birth, and Address, and verify their identity as if they were an individual user.

5.3.4. Understanding the Purpose and Intended Nature of the Business Relationship

We must understand why the user is opening an account. This includes:

• The purpose of the account (e.g., "to receive payments for freelance work").
• The expected origin of incoming funds (countries and payors).
• The expected volume and frequency of transactions.

This information forms the "baseline" for ongoing transaction monitoring.

5.3.5. Verifying Identity (Documentary and Non-Documentary)

We must verify the identity of all users and UBOs using reliable, independent source documents, data, or information.

For Individuals:

• Documentary: A current, valid government-issued photo identification document (e.g., International Passport, Driver's License, National ID Card).
• Non-Documentary: Verifying address against a utility bill, bank statement, or via digital verification methods.
• Nigeria: We will verify the user's BVN and/or National Identification Number (NIN) against the national databases.

For Legal Entities:

• Verifying legal existence via corporate registry searches (e.g., CAC in Nigeria, provincial registries in Canada).
• Obtaining official corporate documents (e.g., Certificate of Incorporation, Articles of Association).

5.4. Prohibited Practices

5.4.1. Anonymous or Fictitious Accounts

It is strictly prohibited for Taja to open or maintain any anonymous accounts, accounts in fictitious names, or "numbered" accounts.

5.4.2. Third-Party and Mule Accounts

It is strictly prohibited for any user to open an account on behalf of another person, or to sell or "rent" their account to a third party. This practice, known as mule activity, is a key indicator of money laundering and is grounds for immediate and permanent account termination.

5.4.3. Shell Banks

Taja is prohibited from establishing or continuing any correspondent relationship with a shell bank (a bank with no physical presence or affiliation with a regulated group). We must take measures to ensure our banking partners do not permit their accounts to be used by shell banks.

5.5. Enhanced Due Diligence (EDD)

EDD consists of additional, more stringent measures to be taken for all users and relationships classified as "Above Average" or "High" risk. This is not an optional step.

5.5.1. EDD Triggers

EDD is automatically triggered for, but not limited to:

• All Politically Exposed Persons (PEPs), their family members, and close associates.
• All users (individuals or entities) resident in or primarily transacting with jurisdictions on the FATF "grey list" (e.g., Nigeria) or other high-risk countries.
• Users operating in high-risk industries (see Appendix 3).
• Corporate structures that are complex, use nominees, or are otherwise designed to obscure beneficial ownership.
• Any user whose transaction monitoring flags high-risk or suspicious activity.

5.5.2. Required EDD Measures

Where EDD is triggered, the following measures must be taken in addition to Standard CDD:

• Senior Management Approval: Obtain approval from Senior Management (or the CCO, as delegated) before establishing or continuing the business relationship.
• Source of Wealth (SoW) and Source of Funds (SoF): Take reasonable and documented measures to establish the user's Source of Wealth (SoW) and the Source of Funds (SoF) for transactions.
• Enhanced Monitoring: Apply enhanced and more frequent ongoing monitoring to the account and its transactions.

5.5.3. Source of Wealth (SoW) and Source of Funds (SoF) Verification

Source of Wealth (SoW): This refers to the origin of the user's total net worth or economic profile (e.g., "Employment income," "Business ownership," "Inheritance"). We must obtain documentary evidence for this, such as:

• Pay slips or employment contracts.
• Audited financial statements for a business.
• A will or grant of probate for an inheritance.

Source of Funds (SoF): This refers to the origin of the specific funds being used for a transaction (e.g., "Company profits," "Sale of property"). We must obtain evidence for this, such as:

• Bank statements showing business revenue.
• A deed of sale for a property.
• A letter from a lawyer or accountant.

5.6. Politically Exposed Persons (PEPs)

Relationships with PEPs present a higher risk of corruption and money laundering.

5.6.1. Definitions

Foreign PEP (FPEP): An individual who holds or has held a prominent public office in a foreign country (e.g., head of state, senior politician, senior judicial or military official, senior executive of a state-owned corporation).

Domestic PEP (DPEP): An individual who holds or has held a similar prominent public office within Canada (e.g., Governor General, MP, deputy minister, head of a Crown corporation).

Head of an International Organization (HIO): The head (e.g., CEO, President) of an international organization (e.g., UN, NATO).

Family Member: Includes spouse, common-law partner, children, parents, siblings, and in-laws.

Close Associate: An individual closely connected to a PEP for personal or business reasons.

5.6.2. Identification of PEPs

Taja must take reasonable measures to determine if a user or UBO is a PEP, HIO, family member, or close associate. This is done by:

• Asking the user during onboarding.
• Screening the user and UBOs against a comprehensive third-party PEP database.

5.6.3. Procedures for PEPs

If a user is identified as a PEP (or a family member/close associate), they are automatically rated High Risk and the following EDD measures are mandatory:

• Senior Management Approval: The CCO or Senior Management must approve the establishment (or continuation) of the business relationship.
• Establish SoW/SoF: We must take reasonable measures to establish their Source of Wealth (SoW) and the Source of Funds (SoF) for their transactions.
• Enhanced Monitoring: We must conduct enhanced, ongoing monitoring of all transactions associated with the PEP's account.

5.7. Sanctions Screening

5.7.1. Screening Requirement: Taja is prohibited from transacting with any individual, entity, or country designated under applicable sanctions regimes. All users, UBOs, and relevant transaction counterparties (where possible) must be screened.

5.7.2. Screening Lists: Screening is conducted at onboarding and on an ongoing (e.g., daily) basis against, at minimum:

• Canadian Sanctions List (SEMA)
• United Nations Security Council (UNSC) Consolidated List
• US OFAC Specially Designated Nationals (SDN) List
• EU Financial Sanctions List
• UK (HM Treasury) Sanctions List
• Nigerian Consolidated Sanctions List

5.7.3. Procedure on "True Match"

Upon identifying a "true match" to a sanctions list:

• The account and any associated funds must be immediately frozen.
• All transactions must be blocked.
• The CCO must be notified immediately.
• The CCO will report the match to FINTRAC (as a TPR) and/or other relevant authorities (e.g., RCMP, CSIS, CBN) without delay.

5.8. Ongoing Monitoring

CDD is not a one-time event. We must conduct ongoing monitoring of all business relationships to detect unusual activity and keep user information current.

5.8.1. Frequency of Review: User profiles must be formally reviewed and refreshed at a frequency based on their risk rating:

• High Risk: At least semi-annually (every 6 months) or annually. (Policy adopts the stricter semi-annual review).
• Above Average Risk: At least annually.
• Moderate Risk: At least every 2 years.
• Low Risk: At least every 2-3 years.

5.8.2. Trigger Events for Review: An ad-hoc review of a user's CDD information must be conducted upon a "trigger event", such as:

• A significant, unexpected transaction.
• A material change in the user's account operation or profile.
• A new alert (e.g., PEP, sanctions, or adverse media hit).
• A request from law enforcement.

5.8.3. Enhanced Ongoing Monitoring: All high-risk accounts (including all PEPs and Nigerian-based users) are subject to enhanced ongoing monitoring, which includes:

• More frequent and intensive review of their transactions.
• Lower thresholds for transaction monitoring alerts.
• Increased scrutiny of SoF for large transactions.

5.9. Documentation Deferral

As a rule, all KYC documentation must be collected and verified before a business relationship is established or transactions are permitted. In exceptional, low-risk cases, a non-individual (corporate) user may be granted a deferral for non-critical documents.

Approval: Deferrals may only be approved by the CCO or CEO.

Restrictions:

• Critical documents (e.g., Certificate of Incorporation, UBO identification) cannot be deferred.
• The deferral period is a maximum of two (2) weeks.
• A strict transaction limit (e.g., $1,000 USD) will be applied during the deferral period.
• If the documents are not provided, the account will be restricted or terminated.

5.10. Reliance on Third Parties

Taja may, in limited circumstances, rely on a third party (e.g., a regulated financial institution) to perform elements of the CDD process, provided:

• The third party is regulated and supervised for AML/CFT compliance.
• The third party agrees in writing to provide all relevant CDD documents and information upon request, without delay.
• Ultimate Responsibility: Notwithstanding any reliance, Taja remains ultimately responsible for the adequacy of the CDD and for all AML/CFT compliance obligations.

6.1. Transaction Monitoring

6.1.1. Key Internal Processes: Taja shall implement and maintain a robust transaction monitoring system (automated and manual) to detect unusual and potentially suspicious activities. This system is designed to identify transactions that are inconsistent with a user's known, legitimate business or personal activities.

6.1.2. Automated Monitoring and Alerts: Our automated system monitors transactions in real-time and post-transaction, generating alerts for review by the Compliance Department. Alerts are triggered by rules based on:

• Transaction thresholds.
• Velocity and frequency.
• Geographic risk (high-risk counterparties).
• Deviation from the user's established profile.
• Specific "red flag" indicators.

6.1.3. AML/TF Red Flag Indicators: All employees must be vigilant for "red flags" that may indicate ML/TF. While not exhaustive, the following are critical indicators for the Taja platform:

Customer-Related:

• User provides false, incomplete, or suspicious ID documents.
• User is unusually secretive, avoids contact, or is unwilling to provide SoW/SoF.
• Multiple accounts are linked to the same individual, device, or IP address.
• Account is opened in one name, but the IP address, device, or contact info belongs to another known person (potential mule account).

Transaction-Related:

• CRITICAL: Receiving funds and attempting to make a payout to a third-party bank account (a violation of our terms).
• CRITICAL: Receiving funds and immediately attempting to transfer the full amount out (rapid velocity / "layering").
• Transactions that have no apparent economic or lawful purpose.
• Receiving funds from, or sending to, a high-risk jurisdiction without a clear explanation.
• Structuring transactions just below a reporting threshold.

Employee-Related:

• Employee exhibits a lavish lifestyle inconsistent with their salary.
• Employee frequently overrides compliance controls or approves high-risk users without justification.
• Employee avoids taking mandatory holidays.

6.2 Internal Suspicious Activity Reporting

6.2.1. Employee Obligation to Report: Any employee who detects a "red flag" or, in the course of their duties, knows or suspects that a transaction may be related to ML/TF has a mandatory, non-negotiable obligation to report it internally.

6.2.2. Internal Escalation Flow

1. The employee (First Line of Defense) identifies an unusual transaction or activity.
2. The employee immediately escalates this to the CCO/Compliance Department via the designated, confidential channel, providing all supporting documents. This must be done within 24 hours of the discovery.
3. The Compliance team investigates the alert/escalation, gathers additional information, and analyzes the user's entire profile and history.
4. The Compliance team documents its findings and makes a recommendation to the CCO (e.g., "no suspicion," "file STR," "terminate account").
5. The CCO makes the final determination.

6.2.3. CCO Investigation and Determination: The CCO will document all internal reports and the outcome of the investigation, including the rationale for either filing an STR or determining that no suspicion was found. This documentation is critical for audits.

6.3 External Regulatory Reporting

6.3.1. Suspicious Transaction Reports (STRs): An STR (or SAR) must be filed with the relevant FIU if the CCO forms "Reasonable Grounds to Suspect" (RGS) that a transaction (or attempted transaction) is related to the commission or attempted commission of an ML/TF offense.

6.3.2. Defining "Reasonable Grounds to Suspect" (RGS)

Simple Suspicion: A hunch or intuition; cannot articulate the reason. This is not enough for an STR but requires further investigation.

Reasonable Grounds to Suspect (RGS): The standard for filing. It is a step above simple suspicion. It means there is a possibility of ML/TF based on an assessment of facts, context, and indicators. The suspicion does not need to be proven or verified as a crime.

Reasonable Grounds to Believe: A higher standard (probability) where facts are verified and support the belief a crime is occurring. We do not wait for this standard to file an STR.

6.3.3. Reporting to FINTRAC (Canada): The CCO must submit an STR to FINTRAC "as soon as practicable" (typically within 3 days, and no later than 30 days) after RGS is formed.

6.3.4. Terrorist Property Reports (TPRs): We must immediately submit a TPR to FINTRAC (and relevant law enforcement) if we know or believe we are in possession or control of property owned or controlled by or on behalf of a terrorist or terrorist group. This is a "knowledge" or "belief" standard, not suspicion.

6.3.5. Large Cash Transaction Reports (LCTRs): We must report to FINTRAC when we receive $10,000 CAD or more in cash (or its foreign equivalent) in a single transaction, or in multiple transactions within a 24-hour period (the "24-hour rule"). This report must be filed within 15 calendar days.

6.3.7. Large Virtual Currency Transaction Reports (LVCTRs): We must report to FINTRAC when we receive virtual currency (VC) equivalent to $10,000 CAD or more in a single transaction (or 24-hour period). This report must be filed within 5 working days.

6.3.8. Electronic Funds Transfer Reports (EFTRs): We must report to FINTRAC all international Electronic Funds Transfers (EFTs) of $10,000 CAD or more (or its equivalent) that we initiate or finally receive. This report must be filed within 5 business days. This also includes the "24-hour rule" for multiple smaller transfers from the same person.

6.4. Enforcement Actions and Cooperation

6.4.1. Right to Freeze, Terminate, or Reverse: As stated in our user terms, Taja reserves the right, upon forming RGS of ML/TF or identifying a direct violation of this Policy (such as attempted third-party payouts), to take immediate enforcement actions. These actions include, but are not limited to:

• Freezing or holding funds associated with the user or transaction, temporarily or permanently.
• Refusing, canceling, or reversing any transaction.
• Immediately suspending or permanently terminating the user's account.

6.4.2. Cooperation with Law Enforcement: Taja will cooperate fully with all competent authorities (e.g., FINTRAC, RCMP, EFCC). This includes:

• Responding to formal requests for information (e.g., subpoenas, court orders) promptly and accurately.
• Proactively sharing information where required by law.
• Appointing the CCO as the official liaison for all such requests.

6.5. Prohibition of "Tipping-Off"

This is a critical legal obligation. No director, officer, employee, or agent of Taja shall disclose to any person, especially the customer involved, that:

• An internal suspicious activity report has been made.
• An STR or TPR has been, or is being, prepared or filed.
• An investigation is underway or a law enforcement request has been received.

"Tipping-off" is a serious criminal offense and is grounds for immediate termination and potential criminal prosecution.

Voluntary Self-Declaration of Non-Compliance

If Taja identifies a failure in its compliance program (e.g., a batch of reports was missed), it is our policy to proactively manage the issue. The CCO will assess the issue and, where appropriate, make a voluntary self-declaration of non-compliance to FINTRAC. This declaration will include the nature of the issue, the period, the reason, and a detailed remediation plan.

7.1. General Record-Keeping Requirement

Taja shall keep complete and accurate records of all transactions, KYC/CDD information, and AML/CFT compliance activities. These records are essential to assist law enforcement, satisfy regulators, and reconstruct transactions.

7.2. Retention Period

All records required by this Policy must be kept for a minimum of five (5) years from the date the record was created (e.g., date of transaction) or five (5) years after the business relationship has ended (e.g., date of account closure), whichever is later.

7.3. Preserved Documentation

The following records must be kept for the 5-year retention period:

• KYC/CDD Records: All identifying information and verification documents obtained for individuals and entities (e.g., ID copies, corporate documents, UBO information).
• Transaction Records: Detailed records of all transactions processed, sufficient to reconstruct the transaction.
• Regulatory Reports: A copy of every report submitted to an FIU (STR, LCTR, LVCTR, EFTR, TPR).
• Internal Reports: All internal suspicious activity escalations and the CCO's documented analysis and determination.
• High-Risk Records: All EDD documentation, including SoW/SoF evidence, senior management approvals, and PEP determinations.
• Business Correspondence: Relevant correspondence with users, especially concerning account activity or KYC.
• Policy & Program Records: This Policy, all versions of the EWRA, training logs, and all independent audit reports.

7.4. Additional Record-Keeping Requirements

Government-Issued ID: When verifying an ID, we must record the person's name, document type, document number, issuing jurisdiction, and expiry date.

Third-Party Reliance: If we rely on a third party for CDD, we must keep the written agreement with that third party.

Entity Verification: We must keep the paper or electronic record used to verify a corporation's existence (e.g., the corporate registry search result).

7.5. The "Travel Rule"

Taja must comply with the "Travel Rule" for EFTs and VC transfers. This means we must ensure that all qualifying transfers include specific originator and beneficiary information:

• Originator's name, address, and account number.
• Beneficiary's name, address, and account number.

We must take reasonable measures to ensure this information is included when sending a transfer and is received when acting as an intermediary or beneficiary.

7.6. Record Accessibility

All records must be maintained in a secure, organized manner (electronically) and must be retrievable for FINTRAC, CBN, or other competent authorities. As per FINTRAC requirements, records must be provided within 30 days of a request. As per Nigerian regulations, records must be available "on a timely basis, not later than 48 hours".

Policy: In line with our "higher of home or host" principle, Taja will endeavor to meet the 48-hour access standard where feasible, and in all cases will meet the 30-day standard.

8.1. Know Your Employee (KYE)

The integrity of our employees is as important as the identity of our customers. A robust KYE program is essential to prevent insider abuse, fraud, and willful blindness.

8.1.1. Staff Screening and Integrity

Hiring Process: Taja must exercise due diligence during the hiring process for all employees, especially those with access to financial systems or customer data.

Checks: This process includes verifying identity, work history, and conducting:

• Criminal conviction searches (where permissible by law).
• Credit checks (for sensitive roles, where permissible).
• Adverse media and sanctions screening.

Integrity: All employees are expected to maintain the highest standards of moral judgment, honesty, and professional conduct.

8.1.2. Counterchecking of Work

Senior management and team leads will perform occasional, risk-based spot checks and reviews of work done by staff to ensure policies and procedures are being followed correctly.

8.1.3. Employee Actions

To get to know employees, the company may conduct:

• Criminal conviction searches.
• Credit checks.
• Private investigations, if necessary.
• Internet checks before hiring.

8.2. Staff Training and Awareness

8.2.1. Training Program Requirement: Taja shall provide a comprehensive, ongoing AML/CFT training program for all directors, officers, senior management, and employees.

8.2.2. Frequency and Audience

• Onboarding: All new hires must receive AML/CFT training within their first 60 days, and before they deal with customer funds independently.
• Ongoing: All relevant staff must receive training at least annually.
• Job-Specific: Role-based training will be provided to high-risk departments (Compliance, Onboarding, Payments).
• Board/Senior Mgt: Directors and Senior Management will receive specialized, high-level training on their oversight responsibilities.

8.2.3. Essential Training Content: The training program, managed by the CCO, will cover:

• AML/CFT laws of Canada (PCMLTFA) and Nigeria (ML/PPA).
• This Policy and internal procedures.
• ML/TF typologies and "red flags" specific to Taja.
• KYC/CDD/EDD requirements.
• The internal and external reporting process (STRs).
• Record-keeping requirements.
• The strict prohibition on "tipping-off".
• Sanctions and PEP screening.

8.2.4. Training Records: The CCO shall maintain a register of all training sessions, including dates, content, and attendee lists, to be made available for audits.

8.2.5. Non-Compliance: Completion of training is mandatory. Failure to complete training may result in disciplinary action, up to and including suspension or termination.

8.3. Anti-Bribery and Corruption (ABC)

Taja has zero tolerance for bribery and corruption.

Policy: No employee or agent may offer, solicit, or accept any bribe, kickback, or other corrupt payment to or from any person (including government officials or commercial partners).

Gifts: Employees must not ask for or receive gifts or hospitality of significant value (e.g., above NGN 50,000 or $50 CAD) from a customer or vendor. All gifts must be reported to a supervisor. Any gift that could be seen as an inducement must be rejected, regardless of value.

9.1. Review Requirement: To ensure Taja's AML/CFT Program is effective and compliant, the Program shall be subject to a regular, independent review (audit).

9.2. Frequency: As a Canadian MSB, this independent review must be conducted at a minimum once every two (2) years. The CCO may commission a review more frequently if there are material changes to the business or its risk profile.

9.3. Auditor Independence: The review must be conducted by an auditor (either internal or external) who is independent of the AML/CFT Program and the CCO. The auditor must have sufficient knowledge of Canadian and Nigerian AML/CFT requirements to conduct the review.

9.4. Scope of Review: The review will be comprehensive and must test, at a minimum:

• Policies: The adequacy and currentness of this Policy and the EWRA.
• CDD/KYC: A sample of user files (low, moderate, and high-risk) to test if CDD/EDD was performed correctly.
• Monitoring: A sample of transaction alerts to test if they were investigated and resolved correctly.
• Reporting: A sample of LCTRs, EFTRs, and STRs (if any) to test for timeliness and accuracy.
• Record-Keeping: A test of the record-keeping system's completeness and accessibility.
• Training: A review of training logs and interviews with staff to test their knowledge.

9.5. Reporting and Remediation: The auditor will produce a formal written report detailing their findings, any identified deficiencies, and recommendations for improvement.

This report will be provided directly to Senior Management and the Board of Directors.

The CCO is responsible for creating and executing a formal remediation plan to address all findings. This plan and its progress will be tracked and reported to the Board.

Appendix 1: List of Prohibited and High-Risk Countries

Taja maintains a dynamic list of Prohibited and High-Risk countries based on guidance from FATF, FINTRAC, and other credible sources.

A. Prohibited Jurisdictions: Taja will not establish any business relationship with, or process transactions to/from, individuals or entities in the following jurisdictions:

• Jurisdictions subject to a FATF "Call for Action" (Black List) (e.g., Democratic People's Republic of Korea (DPRK), Iran, Myanmar).
• Jurisdictions subject to comprehensive Canadian, UN, OFAC, or other major international sanctions (e.g., Cuba, Syria, Russia, Belarus, regions of Ukraine).
• Any jurisdiction deemed to pose an unacceptable risk by Senior Management.

B. High-Risk Jurisdictions (Requires EDD)

All users from or transacting with the following jurisdictions are automatically rated High-Risk and are subject to mandatory Enhanced Due Diligence (EDD):

This includes, but is not limited to: NIGERIA, South Africa, Turkey, UAE, Burkina Faso, Cameroon, Croatia, DRC, Haiti, Jamaica, Kenya, Mali, Mozambique, Philippines, Senegal, South Sudan, Syria, Tanzania, Vietnam, Yemen.

Other jurisdictions identified by credible sources (e.g., Transparency International) as having high levels of corruption, organized crime, or weak AML/CFT regimes.

(This list is illustrative and will be maintained and updated by the CCO based on real-time regulatory guidance.)

Appendix 2: List of Prohibited Industries

Taja will not open accounts for any individual or entity whose primary business or stated purpose involves any of the following activities, as they fall outside our risk appetite:

• Unlawful internet gambling.
• Adult entertainment, pornography, prostitution, or sexual exploitation.
• Dealers in arms, weapons, and defense equipment.
• Illicit traffic in drugs, narcotics, or psychotropic substances.
• Shell banks or unlicensed financial institutions.
• Ponzi/Pyramid schemes.
• Unregistered charities or unregistered Non-Profit/Non-Governmental Organizations (NPOs/NGOs).
• Virtual currency businesses that are not regulated or licensed in their operating jurisdiction (e.g., P2P exchanges, crypto ATMs).
• Dealers in conflicted diamonds or precious metals (outside the regulated system).
• Any activity that is illegal in Canada or Nigeria.

Appendix 3: List of High-Risk Industries

Individuals or entities operating in the following industries are considered High-Risk and will be subject to mandatory Enhanced Due Diligence (EDD):

• Registered Charities, NPOs, and NGOs (due to TF risk).
• Regulated Virtual Currency / Crypto-Asset Businesses (e.g., Exchanges, Wallet Providers).
• Casinos and other betting/gaming businesses.
• Money Services Businesses (MSBs), Electronic Money Institutions (EMIs), and Payment Service Providers.
• Dealers in high-value goods (e.g., art, antiques, luxury cars).
• Cash-Intensive Businesses (e.g., restaurants, retail).
• Trust and Company Service Providers (TCSPs).
• Construction, Real Estate, and Property Development.
• Extractive Industries (oil, gas, minerals).

Appendix 4: AML/TF Red Flag Indicators

This is a non-exhaustive list of "red flags" that all employees must be aware of. The presence of one flag does not automatically mean ML/TF, but it requires further scrutiny.

A. User Profile & Onboarding Red Flags:

• User provides inconsistent or suspicious ID documents.
• User is on a sanctions, PEP, or adverse media list.
• User is from a high-risk jurisdiction but has no logical reason to be.
• User is evasive about their occupation, SoW, or nature of business.
• Multiple accounts are opened with minor variations in name, address, or phone number.
• Applicant's IP address, phone number, or device ID is linked to a previously terminated or fraudulent account.
• The UBO of a corporate account is overly complex, involves shell companies, or is domiciled in a secrecy haven.

B. Transactional Red Flags:

• Rapid Movement: Receiving one or more payments followed by an immediate attempt to transfer the full balance out of the platform.
• Third-Party Payout Attempt: Any attempt to add or pay out to a bank account that is not in the same verified legal name as the Taja user.
• Unusual Patterns: Transaction patterns that do not match the user's profile (e.g., a "student" suddenly receiving multiple large payments from various countries).
• No Clear Purpose: Transactions that lack any apparent economic or lawful justification.
• Geographic Risk: Receiving funds from or attempting to send funds to a high-risk or prohibited jurisdiction.
• Structuring: Multiple small transactions designed to fall just below a monitoring or reporting threshold.
• Funneling: An account receives multiple small deposits from various sources that are then consolidated and transferred out as a single, large amount.