## **KYC AND DUE DILIGENCE POLICY**

**Gleec Pay LTD and its Affiliates**  
(“Gleec”, “Gleec.com”, “The Company”, “we”, “us”, “our”)

### **1\. Purpose, Scope and Regulatory Context**

This Know Your Customer (“KYC”) and Due Diligence Policy (the “Policy”) establishes the principles, standards, governance framework, and operational controls adopted by Gleec Pay LTD and all affiliated entities within the Gleec Group to prevent, detect, and mitigate the risks of money laundering, terrorist financing, sanctions violations, fraud, corruption, and other forms of financial and economic crime.

This Policy applies to all natural persons and legal entities, including users, customers, clients, merchants, counterparties, partners, and beneficial owners who access, register for, or use any of the Company’s products, services, platforms, infrastructure, or applications, including but not limited to Gleec Pay, Gleec Card, Gleec Chat, Gleec BTC Exchange, and Gleec DEX (collectively, the “Services” or the “Platform”).

The Policy is designed to ensure compliance with all applicable anti-money laundering (“AML”), counter-terrorist financing (“CTF”), sanctions, and financial crime prevention laws and regulations in the jurisdictions in which the Company operates or provides Services. It aligns with internationally recognised standards and best practices, including the recommendations of the Financial Action Task Force (“FATF”), relevant EU Directives, and applicable national regulatory frameworks.

### **2\. Governance and Responsibility**

Ultimate responsibility for the implementation, oversight, and effectiveness of this Policy rests with the Board of Directors and Senior Management of the Company. The Board ensures that the Company maintains adequate systems, controls, and resources to manage financial crime risks proportionate to its business model, geographic footprint, and risk exposure.

Day-to-day responsibility for implementing and maintaining this Policy is delegated to the Money Laundering Reporting Officer (“MLRO”), who operates with sufficient authority, independence, and access to information. The MLRO is supported by the Risk and Compliance function and relevant operational teams.

All employees, officers, contractors, and relevant third parties involved in onboarding, customer interaction, transaction processing, or monitoring activities are required to comply with this Policy and supporting procedures.

### **3\. Risk-Based Approach**

#### **3.1 General Principles**

The Company applies a comprehensive risk-based approach (“RBA”) to KYC, customer due diligence, enhanced due diligence, and ongoing monitoring. The level and intensity of controls are proportionate to the level of money laundering, terrorist financing, sanctions, and fraud risk identified.

The RBA recognises that risks vary based on customer type, jurisdiction, product and service usage, transaction behaviour, and delivery channels. Enhanced scrutiny is applied to higher-risk relationships, while baseline controls are maintained across all Services. This approach ensures flexibility in responding to emerging risks, regulatory developments, and evolving typologies.

#### **3.2 Risk Assessment Methodology**

The Company identifies, assesses, and manages risks using a combination of qualitative analysis and quantitative indicators. Factors considered include service complexity, client profiles, geographic exposure, transaction size and frequency, funding methods, asset types, source and destination of funds or virtual assets, and behavioural indicators.

Risk assessments are formally documented, subject to review, and retained in an auditable manner.

### **4\. Client Risk Assessment and Categorisation**

#### **4.1 Initial Risk Assessment**

Before establishing a business relationship or granting access to the Services, the Company conducts an initial client risk assessment. Each relationship is assigned a Low, Medium, or High Risk classification, which determines due diligence requirements, approval thresholds, escalation procedures, and monitoring frequency.

Risk classifications are dynamic and are reviewed throughout the lifecycle of the relationship whenever new or material information becomes available.

#### **4.2 Risk Factors Considered**

The Company assesses multiple risk factors, including sanctions exposure, reputational risk, Politically Exposed Person (“PEP”) status, geographic exposure, industry and business activity, financial transparency, products and services used, and transactional and behavioural patterns.

#### **4.3 High-Risk Indicators**

Certain indicators may result in immediate classification as high-risk, including complex or opaque ownership structures, offshore arrangements, PEP involvement, exposure to high-risk or sanctioned jurisdictions, unexplained or inconsistent transaction behaviour, difficulty verifying source of wealth or funds, or reluctance to provide required KYC information.

Risk scoring is not influenced by commercial considerations. The MLRO may override automated risk outcomes where justified, provided that the rationale is documented and approved.

### **5\. Business-Wide Risk Assessment**

The MLRO conducts a Business-Wide Risk Assessment (“BWRA”) covering all Gleec entities, Services, customer segments, products, and delivery channels. The BWRA identifies inherent and residual risks, evaluates the effectiveness of controls, and informs policy updates, system enhancements, and monitoring priorities.

The BWRA is reviewed at least annually and whenever material changes occur and is reported to Senior Management and the Board of Directors.

### **6\. Client Acceptance Policy**

#### **6.1 General Acceptance Principles**

The Company only establishes relationships with clients who can be properly identified and verified through KYC procedures, demonstrate a legitimate purpose for using the Services, pass sanctions, PEP, and adverse media screening, and meet the acceptance criteria defined in this Policy.

Account activation and continued access to the Services are conditional upon the successful completion of applicable KYC and due diligence measures.

#### **6.2 Prohibited Clients**

The Company does not onboard or maintain relationships with sanctioned persons or entities, clients linked to prohibited jurisdictions or industries, individuals involved in serious criminal activity, clients with unverifiable identity or ownership, clients providing false or misleading information, or entities with anonymous or unidentifiable beneficial owners.

### **7\. Politically Exposed Persons (PEPs)**

All relationships involving PEPs, their family members, or close associates are subject to Enhanced Due Diligence (“EDD”). This includes identification and verification of PEP status, MLRO and senior management approval, verification of source of wealth and source of funds, enhanced transaction monitoring, and more frequent reviews.

Former PEPs remain subject to enhanced measures for a minimum of 12 months, extendable based on risk.

### **8\. Customer Due Diligence (CDD)**

#### **8.1 CDD Measures**

Customer Due Diligence measures include the identification and verification of clients, beneficial owners, and controlling persons; understanding the purpose and intended nature of the business relationship; and ongoing monitoring of transactions and customer behaviour.

CDD is performed prior to onboarding, when trigger events occur, or when doubts arise regarding previously obtained KYC information.

#### **8.2 Use of Third-Party KYC Platform Provider**

To support the effective execution of its Know Your Customer (“KYC”) obligations, the Company utilises reputable third-party service providers for KYC and identity verification activities. **Gleec uses Sumsub (Sum & Substance) as its primary KYC platform provider** to perform and support customer identification and verification, document authentication, biometric and liveness checks, sanctions screening, Politically Exposed Person (“PEP”) screening, and adverse media monitoring.

Sumsub is fully integrated into the Company’s onboarding, risk assessment, and ongoing KYC monitoring processes and is used across the Services to ensure consistent, scalable, and risk-based KYC controls in line with regulatory requirements and industry best practices.

The use of Sumsub does not transfer regulatory responsibility. **Ultimate responsibility for KYC compliance, due diligence decisions, risk classifications, and regulatory adherence remains with the Company at all times**. The Company maintains appropriate oversight, governance, and validation of all KYC activities performed through Sumsub and ensures that the KYC platform provider meets required standards of security, data protection, reliability, and regulatory compliance.

### **9\. Enhanced Due Diligence (EDD)**

Enhanced Due Diligence is applied where higher risk is identified and may include additional identity and ownership verification, detailed analysis of source of wealth and source of funds, enhanced transaction scrutiny, justification of activity, and senior management approval prior to onboarding or continuation of the relationship.

### **10\. Source of Wealth and Source of Funds**

The Company verifies the legitimacy of source of wealth and source of funds using a risk-based approach and may request documentary evidence appropriate to the client’s risk profile, jurisdiction, and activity. All documentation is reviewed for authenticity, consistency, and plausibility.

### **11\. Ongoing Monitoring and Periodic Reviews**

All client relationships are subject to continuous transaction monitoring and periodic review based on risk classification. Reviews occur at least every 36 months for low-risk clients, 24 months for medium-risk clients, and 12 months for high-risk clients, or earlier where triggered by material changes, sanctions updates, PEP status changes, or suspicious activity.

### **12\. Record Keeping and Audit Trail**

The Company maintains complete, accurate, and retrievable records of KYC data, client risk assessments, monitoring activities, decisions, approvals, and escalations. Records are retained in accordance with applicable legal and regulatory requirements and are made available for internal audit and regulatory inspection.

### **13\. Policy Review and Updates**

This Policy is reviewed at least annually and updated as necessary to reflect regulatory developments, emerging risks, changes in business activities, and industry best practices.
