AML Policy

Draft for review. This document is an internal working template prepared to support commercial onboarding and institutional due diligence. It does not constitute legal advice and must be reviewed and approved by FLOWA PAY INC.'s legal and compliance functions before it is relied upon. FLOWA PAY INC. makes no representation that it holds any licence, authorisation or certification except the FINTRAC Money Services Business registration expressly stated in the Regulatory Disclosures.

This Anti-Money-Laundering ("AML") Policy sets out FLOWA PAY INC.'s commitment and control objectives for preventing money laundering, terrorist financing and other financial crime. It applies to all directors, employees, contractors and to services provided to customers of Flowa Pay.

We apply a risk-based approach: we assess the money-laundering and terrorist-financing risk presented by our customers, products, delivery channels and geographies, and we apply controls proportionate to that risk. Our enterprise-wide risk assessment is reviewed at least annually and when material changes occur.

Before establishing a business relationship we identify and verify each customer and, for businesses, their beneficial owners and controllers. We apply Enhanced Due Diligence to higher-risk relationships, including politically exposed persons and higher-risk jurisdictions, and we refresh due diligence on an ongoing, risk-sensitive basis. See our KYC and KYB policies.

We screen customers and, where relevant, transactions against applicable sanctions lists and for politically exposed persons and adverse media. Positive matches are investigated and, where required, escalated and reported. We do not process transactions that would breach applicable sanctions.

We monitor activity for unusual or suspicious patterns using a combination of rules and risk scoring. Where we identify activity that we know, suspect or have reasonable grounds to suspect is linked to money laundering or terrorist financing, we make the reports required by applicable law and do not "tip off" the customer.

A designated compliance officer owns this policy. All relevant personnel receive AML training on joining and periodically thereafter. We keep records of identification, due diligence and transactions for the period required by applicable law. See our Record Keeping Policy.