AML and Counter-Terrorist Financing Policy Statement

1. Who we are

1.1. Fin&Pay Partners OÜ is a private limited company incorporated in Estonia under registry code 16757225, with registered address at Juhkentali tn 8, Kesklinna linnaosa, Tallinn, Harju maakond, 10132, Estonia. "BillBlend" is a trading brand of the Company and is not a separate legal person.

1.2. The Company supplies payment technology. It connects business clients ("Merchants") to payment solutions provided by licensed acquiring banks, payment service providers, electronic money institutions and providers of alternative payment methods ("Partners"). The Company does not acquire transactions, does not issue payment instruments or electronic money and does not open payment accounts.

1.3. The Company does not at any time receive, hold or control funds relating to a Merchant's transactions. Funds paid by a customer are received and held by the licensed Partner processing the transaction and are settled by that Partner. No bank account and no wallet in the Company's name is used to receive, hold or transmit those funds, and the Company maintains no balances for Merchants.

2. Our regulatory position, stated plainly

2.1. The Company does not hold a license as a payment institution, an electronic money institution or a credit institution, and is not supervised by the Estonian Financial Supervision Authority.

2.2. Because the Company at no time enters into possession of the funds to be transferred, its activity falls within the exclusion in Article 3(j) of Directive (EU) 2015/2366 for technical service providers that support the provision of payment services.

2.3. On the basis of the activity described in clause 1.2 and of the fact stated in clause 1.3, the Company is not an obliged entity under the Estonian Money Laundering and Terrorist Financing Prevention Act, which applies to credit institutions, financial institutions, virtual currency service providers, gambling organizers and the other categories listed in that Act. The Company does not provide virtual currency services to third parties: it neither exchanges virtual currency for others nor holds virtual currency wallets on their behalf.

2.4. The Company nevertheless operates a financial crime prevention program. It does so because:

(a) its Partners and the card schemes require the Company to know the businesses it introduces to them, and hold the Company responsible for those businesses;

(b) the Company does not wish to provide technology to criminal activity, and does not accept the legal, financial and reputational consequences of doing so; and

(c) prohibitions on dealing with sanctioned persons apply to every person, licensed or not.

2.5. The program is therefore adopted voluntarily and under contract. The Company describes it as such and does not claim a regulatory status it does not hold.

3. What our program covers

3.1. We apply the program to every Merchant, to every Partner and to every person who controls them. In outline:

(a) Business verification. Before onboarding we verify the identity and standing of the applicant company, its directors, its shareholders and its ultimate beneficial owners, using documents from the applicant and information from official registers.

(b) Understanding the business. We establish what the applicant sells, to whom, in which countries, under which licenses where a license is required, and how it has performed on chargebacks and fraud.

(c) Sanctions screening. We screen the applicant, its group, its directors and its beneficial owners against the sanctions lists applicable to our activity, including those of the European Union, the United Nations, the United States and the United Kingdom, and we repeat that screening for the duration of the relationship.

(d) Politically exposed persons. We identify politically exposed persons, their family members and their close associates. That status is not a ground for refusal in itself; it triggers a higher level of scrutiny and senior approval.

(e) Enhanced measures. Where the risk is higher — because of the country, the sector, the ownership structure, the volumes or the absence of a required license — we apply enhanced measures before onboarding and thereafter.

(f) Ongoing monitoring. We monitor traffic against the parameters agreed with the Merchant and investigate departures from them.

(g) Record keeping. We retain the documents and the records of our checks for five years after the end of the relationship.

(h) Training. Staff whose work touches onboarding, risk or settlement receive training appropriate to their role.

3.2. We do not publish our thresholds, our risk scoring or our monitoring rules. Publishing them would tell those who wish to evade them exactly what to avoid.

4. What we ask of applicants

4.1. An applicant should expect to provide, at a minimum:

(a) certificate of incorporation and constitutional documents;

(b) an extract from the commercial register showing current status, directors and address;

(c) evidence of the ownership structure up to the ultimate beneficial owners, and a declaration of beneficial ownership;

(d) identity documents and proof of address for directors and ultimate beneficial owners;

(e) evidence of authority to sign;

(f) a description of the business, the websites to be used and the goods or services sold;

(g) licenses and permissions where the activity requires them;

(h) processing history, including chargeback and fraud statistics, where the applicant has processed before;

(i) bank or settlement details in the name of the applicant.

4.2. We may ask for further documents. We may ask for documents to be certified, notarized, apostilled or translated. We may ask for updated documents at any time during the relationship.

4.3. We verify what we are given. Where information cannot be verified, or where the answers we receive do not match the documents, we do not proceed.

5. What we will not do

5.1. We do not provide services where:

(a) the applicant, its group, its directors or its beneficial owners are subject to sanctions, or are owned or controlled by a sanctioned person;

(b) the ownership structure cannot be traced to identifiable natural persons;

(c) the applicant refuses to provide requested information, or provides information that is false, incomplete or inconsistent;

(d) the activity is unlawful in a jurisdiction in which the applicant operates or in which its customers are located;

(e) the activity requires a license that the applicant does not hold;

(f) the activity falls within a category we do not serve, as set out in the agreement with the Merchant;

(g) we are unable to satisfy ourselves as to the source of the applicant's funds where that question arises.

5.2. We are entitled to refuse an application without giving reasons, and to suspend or terminate a relationship where any of the circumstances in clause 5.1 arises during it.

6. Cooperation with authorities and partners

6.1. Where we become aware of circumstances suggesting money laundering, terrorist financing or another financial crime, we escalate internally, take the measures available to us — including suspending traffic — and inform the Partner concerned.

6.2. Where a reporting obligation applies to us we report to the Estonian Financial Intelligence Unit (Rahapesu Andmebüroo). Where the obligation rests with a Partner, we provide that Partner with the information it needs to discharge it.

6.3. We respond to lawful requests from competent authorities and courts, and we provide the information and documents required of us.

6.4. Where we are prohibited from disclosing that a report has been made or an enquiry is under way, we do not disclose it.

7. Responsibility and contact

7.1. Responsibility for the program rests with the management board. Day-to-day responsibility is assigned to Director, who may be contacted at office@billblend.com.

7.2. The program is reviewed at least annually and whenever the Company's activity, its Partner requirements or the applicable law change materially.

7.3. General enquiries: office@billblend.com.