Anti-Money Laundering and Sanctions Compliance Policy

Status: Pre-listing governance baseline; intended to take full effect upon adoption by the Board of Directors.

0) Corporate structure and scope

Tanqory PTE. LTD. (Singapore, UEN 202448997H) is the ultimate parent and holding company of the Tanqory group, including its wholly-owned subsidiaries Tanqory Inc. (Delaware, USA) and Tanqory OÜ (Estonia). Tanqory Inc. is the contracting entity and merchant of record for every product and service Tanqory sells to merchants and customers worldwide — Tanqory PTE. LTD. itself does not contract with, bill, or hold a direct customer relationship with any merchant or customer. This document is adopted by Tanqory PTE. LTD. as the group's holding company and applies group-wide, including to Tanqory Inc.'s and Tanqory OÜ's operations, unless a section below states a narrower scope.

1) Purpose

This Policy sets out the framework by which TANQORY PTE. LTD., Tanqory OÜ, Tanqory Inc., and their respective directors, officers, employees, agents, and representatives (collectively, the "Company") identify, manage, and report risks associated with money laundering, terrorist financing, the proliferation of weapons of mass destruction, and breaches of economic and trade sanctions. The Policy is designed to align Company conduct with the legal and regulatory framework summarized in Section 2 and to support the Company's progression toward listing on Nasdaq.

The Company is a software-as-a-service provider for merchants and developers. It is not a bank, money services business, money transmitter, or registered financial institution. Notwithstanding this, the Company's onboarding of merchants, its commercial relationships with payment processors and other financial-services partners, and its global customer and vendor base bring it within the practical reach of anti-money-laundering ("AML") and sanctions controls, both as a matter of contractual obligation to those partners and as a matter of independent legal compliance.

2) Authorities

This Policy reflects the requirements and supervisory expectations of, without limitation:

(a) United States. The Bank Secrecy Act of 1970, as amended (31 U.S.C. §§ 5311–5336), the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act of 2001, the Anti-Money Laundering Act of 2020 and the Corporate Transparency Act, and the regulations of the Financial Crimes Enforcement Network (FinCEN) at 31 C.F.R. Chapter X.

(b) United States sanctions. The International Emergency Economic Powers Act (50 U.S.C. § 1701 et seq.), the Trading With the Enemy Act (50 U.S.C. App. § 1 et seq.), and the sanctions programs administered by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"), including the Specially Designated Nationals and Blocked Persons List ("SDN List"), the Sectoral Sanctions Identifications List, the Foreign Sanctions Evaders List, and country and regional programs.

(c) European Union. Directive (EU) 2015/849 ("AMLD 4"), Directive (EU) 2018/843 ("AMLD 5"), Directive (EU) 2018/1673 ("AMLD 6"), and the EU AML/CFT package adopted in 2024 (Regulation (EU) 2024/1624, Directive (EU) 2024/1640, and Regulation (EU) 2024/1620 establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism), in each case as transposed into Estonian law (including the Money Laundering and Terrorist Financing Prevention Act and the International Sanctions Act of Estonia).

(d) European Union restrictive measures. Council Regulations imposing restrictive measures under Article 215 of the Treaty on the Functioning of the European Union, including the consolidated EU list of persons, entities, and bodies subject to financial sanctions.

(e) United Kingdom. The Sanctions and Anti-Money Laundering Act 2018 and the consolidated list maintained by the Office of Financial Sanctions Implementation ("OFSI").

(f) United Nations. Resolutions of the United Nations Security Council adopted under Chapter VII of the UN Charter, and the consolidated UN Security Council Sanctions List.

(g) Singapore. The Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992 ("CDSA"), the Terrorism (Suppression of Financing) Act 2002, and the regulations issued by the Monetary Authority of Singapore implementing UN sanctions and other targeted financial sanctions. As a general commercial company that is not a financial institution under the Financial Services and Markets Act 2022 or related Acts, the Company is subject to the CDSA's general reporting obligation under section 39 and to targeted financial-sanctions regulations.

3) Scope

This Policy applies to all Tanqory entities; to all directors, officers, employees, contractors, and agents; and to all customer, merchant, partner, vendor, distributor, and reseller relationships. It applies to: (a) the onboarding and ongoing monitoring of merchants and customers; (b) the engagement of vendors, subprocessors, and partners; (c) the receipt and disbursement of funds, whether through payment-processor partners, banking partners, or otherwise; and (d) the use of the Company's products and platforms by end users.

4) Sanctions screening

The Company will not knowingly enter into, maintain, or facilitate any transaction or relationship that is prohibited under any sanctions program identified in Section 2. The Company will screen, on a risk-based basis, the following categories of counterparty against the SDN List, the EU consolidated list, the UK OFSI list, the UN consolidated list, and applicable Singapore targeted-financial-sanctions lists:

(a) merchants and customers at onboarding and on a periodic refresh basis;

(b) ultimate beneficial owners and authorized representatives of merchants and customers, where identified;

(c) vendors, subprocessors, partners, distributors, and resellers at onboarding and on a periodic refresh basis;

(d) recipients of payments, refunds, or other disbursements made by the Company; and

(e) counterparties to material transactions, including any acquisition, joint venture, or significant investment.

Screening is supplemented by location-based controls, including geolocation and self-attestation of merchant operating geography, in order to identify and decline activity from sanctioned jurisdictions (Section 6). Screening hits will be reviewed, escalated to the Sanctions Officer, and resolved with documented rationale before any related activity is permitted to continue.

5) Know Your Merchant / Know Your Customer

Although the Company is not itself a regulated financial institution and the Company's PCI DSS scope is limited under SAQ-A (no Company-controlled processing of full primary account numbers), the onboarding of merchants on the platform requires Know Your Merchant / Know Your Customer ("KYC") procedures. The KYC procedures will, on a risk-based basis:

(a) identify the merchant or customer (legal name, registered address, jurisdiction of incorporation or residence, registration number, tax identification number where applicable);

(b) identify the ultimate beneficial owners and controlling persons of merchants that are legal entities, consistent with the beneficial-ownership thresholds in AMLD 4 (as amended) and the Corporate Transparency Act;

(c) screen the merchant, ultimate beneficial owners, and authorized representatives against the sanctions lists referenced in Section 4 and against politically-exposed-person ("PEP") and adverse-media data sources;

(d) classify the merchant by risk (low, medium, high) based on jurisdiction, sector, payment-method profile, and transactional pattern, with enhanced due diligence applied to high-risk merchants;

(e) collect information about the nature and intended purpose of the merchant's use of the platform sufficient to identify red flags (for example, payment-aggregator or shell-company patterns, transaction values inconsistent with stated business, layered ownership structures); and

(f) refresh the KYC file on a risk-based cadence and upon trigger events (change of control, change of registered address, change of beneficial owner, or material change in transactional pattern).

KYC obligations imposed by the Company's payment-processor partners (including Stripe Connect onboarding and equivalent partner-imposed obligations) operate concurrently with this Policy. The Company will not rely solely on a partner's KYC where the Company has independent visibility into red flags.

6) Sanctioned jurisdictions and restricted activity

The Company prohibits the onboarding or servicing of merchants, customers, vendors, or partners that are organized in, ordinarily resident in, located in, or that operate from, the following jurisdictions or regions subject to comprehensive United States sanctions: Cuba, the Islamic Republic of Iran, the Democratic People's Republic of Korea, the Syrian Arab Republic, the Crimea region of Ukraine, the so-called Donetsk People's Republic region of Ukraine, and the so-called Luhansk People's Republic region of Ukraine.

The Company also implements restrictions consistent with applicable sectoral, list-based, and partial sanctions in respect of activity involving the Russian Federation and the Republic of Belarus, the Republic of Venezuela, the Republic of Zimbabwe, and other jurisdictions subject to evolving restrictive measures under U.S., EU, UK, and UN programs. The Sanctions Officer will maintain a current list of restricted and prohibited jurisdictions and activities reflecting the lists referenced in Section 2, and the Company is implementing geolocation, IP-based, and self-attestation controls to enforce these restrictions as part of its pre-listing readiness.

7) Risk-based approach

The Company adopts a risk-based approach to AML and sanctions controls, as recommended by the Financial Action Task Force and as required under EU and Estonian AML legislation. The Sanctions Officer will maintain a written AML/sanctions risk assessment that identifies inherent risks across jurisdictions, products, customer segments, distribution channels, and payment methods; assesses the design and effectiveness of mitigating controls; and produces a residual-risk rating. The risk assessment will be reviewed periodically on a risk-based basis, at a frequency determined by management, and upon material changes to the business.

8) Suspicious activity escalation

Any Company representative who becomes aware of activity that may involve money laundering, terrorist financing, sanctions evasion, fraud, or other financial crime shall immediately escalate the matter to the Money Laundering Reporting Officer / Sanctions Officer ("MLRO/Sanctions Officer"). Indicators include, without limitation: structuring of transactions to avoid thresholds; rapid in-and-out flows inconsistent with the merchant's stated business; refusal to provide ordinary KYC information; mismatches between merchant operating geography and beneficial ownership; use of high-risk payment instruments or routing through high-risk jurisdictions; involvement of nominees or shell entities without commercial rationale; and matches against sanctions or PEP lists.

The MLRO/Sanctions Officer will evaluate escalations, determine whether to suspend or terminate the relationship, and determine whether external reporting is required.

9) External reporting

The Company is not registered as a money services business in any jurisdiction and is not a designated financial institution under the Singapore Financial Services and Markets Act or the Bank Secrecy Act. The Company therefore does not file Suspicious Activity Reports ("SARs") with FinCEN under the financial-institution SAR framework. However:

(a) the Company will cooperate with, and provide information to, its payment-processor and banking partners in support of their SAR or Suspicious Transaction Report ("STR") obligations;

(b) the Company will file reports under the general reporting obligation of section 39 of the Singapore CDSA where applicable;

(c) the Company will file reports with the Estonian Financial Intelligence Unit (Rahapesu Andmebüroo) and other Estonian competent authorities to the extent required of Tanqory OÜ under Estonian AML and sanctions legislation; and

(d) the Company will file reports with OFAC and other competent authorities where required, including OFAC reports of blocked or rejected transactions under 31 C.F.R. § 501.603 and § 501.604.

10) Recordkeeping

The Company will retain KYC records, sanctions-screening records, escalation files, and reports submitted to authorities for not less than the longest of: (a) five years from the end of the customer or counterparty relationship, consistent with the Bank Secrecy Act recordkeeping framework (31 C.F.R. § 1010.430); (b) five years from the date of the relevant transaction or report under the Singapore CDSA framework; (c) five years from the end of the business relationship or occasional transaction under EU AML legislation and the Estonian Money Laundering and Terrorist Financing Prevention Act, subject to extension by the competent authority where permitted; and (d) seven years from closure where the matter is the subject of any ongoing investigation, audit, or litigation. Records will be retained in a manner that supports retrieval upon lawful request.

11) MLRO / Sanctions Officer

The Board shall designate a Money Laundering Reporting Officer and Sanctions Officer (which may be the same person) responsible for the administration of this Policy; pending such designation, the function is performed by the senior officer designated by the Company's management (typically the General Counsel, Chief Compliance Officer, or Head of Trust and Safety). The MLRO/Sanctions Officer reports to the Audit Committee (or, pending its formation, the board of directors) and has authority to suspend or terminate any relationship that, in the MLRO/Sanctions Officer's reasonable judgment, presents an unacceptable AML or sanctions risk. The MLRO/Sanctions Officer reports to the Audit Committee (or, pending its formation, the board of directors) periodically on AML and sanctions matters.

12) Training

The MLRO/Sanctions Officer will design and deliver AML and sanctions training appropriate to role and risk. Training will be required of (a) new joiners within 30 days of joining; (b) all employees, on a recurring basis at a frequency determined by management, with additional role-based training for personnel in trust and safety, merchant onboarding, finance, partnerships, and legal; (c) directors and officers, on a recurring basis; and (d) high-risk third parties on engagement and periodically. Completion of training is tracked, and certifications of completion are retained for not less than five years.

13) Independent testing

The Company commits to periodic independent testing of the AML and sanctions program on a risk-based basis, at a frequency determined by management. Testing may be performed by Internal Audit, by an external firm, or by both; pending the engagement of a dedicated Internal Audit function or external provider, the Company will conduct interim self-assessment. The Audit Committee (or, pending its formation, the board of directors) will receive the testing reports and will track remediation of any findings to closure.

14) Cooperation with payment-processor and banking partners

The Company recognizes that its payment-processor partners (including Stripe and its Connect program, and any equivalent partner) and its banking partners are themselves subject to AML and sanctions obligations and impose contractual obligations on the Company in support of those programs. The Company will: (a) cooperate fully with information requests, due-diligence requests, and audits by payment-processor and banking partners; (b) implement the merchant-onboarding controls, prohibited-business controls, and transaction-monitoring measures required by those partners; and (c) reflect any partner-imposed prohibition list in the Company's own onboarding controls.

15) Reporting violations

Any Company representative who becomes aware of a violation, or a suspected violation, of this Policy or of applicable AML or sanctions law shall promptly report the matter to the MLRO/Sanctions Officer or through any channel described in the Whistleblower and Anonymous Reporting Policy. Reports may be made anonymously where the channel permits. Retaliation against any person who reports in good faith is prohibited.

16) Penalties

Violations of AML and sanctions law carry significant civil and criminal consequences, including, under U.S. law, civil penalties up to the greater of USD 250,000 or twice the amount of the transaction (and substantially higher for certain willful violations) under 50 U.S.C. § 1705 (IEEPA), criminal fines up to USD 1,000,000 and imprisonment up to 20 years for willful IEEPA violations, and the penalty framework of the Bank Secrecy Act; under EU law, administrative and criminal penalties as transposed in Member State legislation, including under the Estonian Money Laundering and Terrorist Financing Prevention Act and the International Sanctions Act; and under Singapore law, fines and imprisonment of up to 10 years under section 47 of the CDSA. Violations of this Policy may, independently of any legal proceeding, result in discipline up to and including termination of employment, removal from office, or termination of a contractual relationship.

17) Adoption, amendment, and review

This Policy is adopted as a pre-listing governance baseline. The Audit Committee will review this Policy not less than annually and may recommend amendments to the Board. Operational details — including the appointment of the MLRO/Sanctions Officer, the cadence of training and independent testing, and the formal AML and sanctions risk assessment — will be specified in operational appendices or in subsequent versions of this Policy.