KNOW YOUR CUSTOMER (KYC) & KNOW YOUR BUSINESS (KYB) POLICY

1. Purpose and Scope

ExactFlow's KYC/KYB programme serves three complementary purposes:

• AML/CFT compliance: to fulfil ExactFlow's obligations as an Obligated Institution under the Polish AML Act and EU AML Directives — verifying that Sellers and Platform Clients are who they claim to be, and that their activities do not involve ML/TF
• Consumer protection (DSA compliance): to comply with Article 30 of the EU Digital Services Act (Regulation (EU) 2022/2065) — verifying that Marketplace Sellers are genuine traders before they can sell to consumers
• Fraud prevention: to prevent identity fraud, account takeover at onboarding, and fictitious Seller registrations designed to harvest Payouts

This Policy applies to: all Marketplace Sellers (mandatory); all Platform Clients subscribing to SaaS services (mandatory); Marketplace Buyers above transaction thresholds (triggered CDD — see AML Policy Section 4.3); and third-party integration partners (risk-based).

2. KYB — Business Verification (Sellers and Platform Clients)

2.1 Standard KYB Requirements

All Sellers and Platform Clients must complete Standard KYB before Account activation. The following information and documentation must be provided:

2.2 Individual Identity Requirements (Beneficial Owners and Account Administrators)

Each natural person who is a Beneficial Owner (above 25% threshold) or Account Administrator must be individually verified. Verification requires:

3. KYC Tiers — Risk-Based Verification Levels

4. The KYC / KYB Onboarding Process

4.1 Step-by-Step Onboarding Flow

5. Re-Verification and Ongoing KYC

5.1 Scheduled Re-Verification

ExactFlow re-verifies all Seller KYB records on the following schedule:

• Tier 1 Sellers: re-verification triggered when approaching the Payout limit or annual period — whichever comes first
• Tier 2 Sellers: full re-verification annually, including refresh of identity documents and CRBR check
• Tier 3 Sellers: re-verification quarterly; enhanced ongoing monitoring continuously

5.2 Event-Triggered Re-Verification

Immediate re-verification is triggered by any of the following events:

• Change of Beneficial Owner (any ownership change above 5%)
• Change of legal form, company name, or jurisdiction of registration
• Change of Account Administrator
• Change of Payout bank account
• Identification in adverse media reports
• Receipt of a law enforcement enquiry or court order relating to the Account
• Detection of a sanctions or PEP hit in ongoing screening
• Significant unexplained change in transaction volume or pattern
• Regulatory inspection request by GIIF or other competent authority

5.3 Seller Obligations — Ongoing

Sellers must notify kyc@exactflow.com within 5 business days of any change to: company name; registered address; Beneficial Ownership structure; regulatory licences; Account Administrator; bank account details. Failure to notify constitutes a material breach of the Seller Agreement and may result in Account suspension.

6. Buyer KYC (Triggered CDD)

Marketplace Buyers are not subject to mandatory upfront KYC. However, triggered CDD applies to Buyers in the following circumstances, as required by the Polish AML Act and ExactFlow's AML Policy:

7. Refusal and Termination

7.1 Grounds for Refusing Onboarding

ExactFlow will refuse to onboard a Seller or Client where:

• The Seller cannot provide satisfactory identity or business verification documentation
• A Beneficial Owner or Account Administrator is subject to sanctions or is identified as a PEP with no adequate EDD mitigation
• The Seller is registered or substantially operating in a FATF-identified high-risk jurisdiction with no adequate EDD mitigation
• The business activity involves Prohibited Items or regulated activities for which no appropriate licence is held
• The Seller has been previously terminated by ExactFlow or is listed on an industry fraud or negative database
• ExactFlow has reasonable grounds to believe the business is a shell company, front for criminal activity, or designed to facilitate ML/TF

7.2 Grounds for Terminating an Existing Relationship

ExactFlow may terminate an existing Seller or Client relationship where:

• Re-verification fails and the Seller cannot provide updated compliant documentation within 10 business days
• A Beneficial Owner change introduces a sanctioned party or an unmitigable EDD risk
• A SAR has been filed and, following AML Compliance Officer review, continuing the relationship presents unacceptable ML/TF risk
• The Seller provides false or materially misleading information during KYC/KYB (past or present)
• A court order or regulatory direction requires termination

7.3 Data on Termination

Upon termination, ExactFlow retains all KYC/KYB documentation and records for 5 years from the date of termination, as required by Article 49 of the Polish AML Act. Where a SAR has been filed, retention is extended to 5 years from the date of the SAR. Personal data is processed only to the extent required by AML law during the retention period and deleted securely thereafter.

8. Data Protection in KYC/KYB

8.1 Legal Basis for KYC Data Processing

ExactFlow processes personal data collected during KYC/KYB on the following GDPR legal bases:

• GDPR Article 6(1)(c) — Legal obligation: processing required by the Polish AML Act and EU AML Directives
• GDPR Article 6(1)(b) — Contract performance: processing necessary to assess whether to enter into the Seller Agreement
• GDPR Article 9(2)(g) — Substantial public interest: for biometric data used in liveness verification, where applicable under national law

8.2 Special Category Data

Biometric data (facial geometry derived from liveness checks) may constitute special category data under GDPR Article 9. Where used, ExactFlow:

• Relies on GDPR Article 9(2)(g) — substantial public interest — and Article 9(2)(b) — legal obligation in employment/social security — where applicable
• Minimises processing to only what is necessary for identity verification — biometric templates are deleted within 30 days of verification completion
• Does not use biometric data for any purpose other than identity verification at onboarding

8.3 Data Subject Rights and AML Limitations

Data subjects (Sellers, Beneficial Owners, Account Administrators) have GDPR rights in relation to KYC data. However, certain rights are restricted by the Polish AML Act:

• Right of access (GDPR Art. 15): may be restricted where disclosure would prejudice an AML investigation — ExactFlow will inform the data subject of the restriction without revealing its reason
• Right to erasure (GDPR Art. 17): cannot be exercised during the mandatory 5-year AML retention period
• Right to object (GDPR Art. 21): does not apply to processing based on a legal obligation (Art. 6(1)(c))

All other GDPR rights apply in full. Data subjects may contact privacy@exactflow.com to exercise their rights.

9. KYC Quality Standards and Governance

9.1 KYC Team

ExactFlow's KYC team is responsible for:

• Managing the end-to-end KYC/KYB onboarding process
• Reviewing and approving identity verification results that fall below automated confidence thresholds
• Escalating complex or high-risk profiles to the AMLCO
• Maintaining the KYC document management system
• Conducting ongoing training on document fraud and identity verification best practices

9.2 Acceptable Document Standards

The following minimum standards apply to all identity and business documents submitted for KYC/KYB:

• Documents must be current and not expired at the time of submission
• Documents must be government-issued originals — notarised copies accepted for company documents where originals cannot be submitted
• Documents must be in clear, legible condition — blurred, cropped, or altered documents are rejected
• Documents in languages other than Polish or English must be accompanied by a certified translation
• Digital copies submitted via the secure upload portal must be unmodified image files (JPEG, PNG, PDF) — screenshots of screenshots or PDF printouts of scans are not accepted

9.3 Third-Party KYC Providers

ExactFlow uses specialist third-party KYC/KYB verification providers for automated document verification, biometric liveness checks, registry lookups, sanctions screening, and adverse media monitoring. All third-party KYC providers:

• Are listed in ExactFlow's Subprocessor List
• Are bound by GDPR Article 28-compliant DPAs
• Are assessed for AML regulatory compliance on an annual basis

10. Contact