Anti-Money Laundering Policy

Paytone treats financial-crime prevention as a core operating discipline. We design our platform, partner network, and onboarding processes to identify and disrupt money laundering, terrorist financing, sanctions evasion, and related illicit activity.

1. Purpose & scope

This Anti-Money Laundering Policy ("AML Policy") describes the controls NEW WAGE TECHNOLOGIES LTD (HE 449912), trading as Paytone, applies on a voluntary basis to detect, prevent, and respond to money laundering, the financing of terrorism, sanctions evasion, and other financial-crime risks across the services we provide. It applies to all Paytone personnel, contractors, directors, and authorized representatives, and informs how we work with customers and Providers.

Paytone is a technology provider offering payment orchestration and routing services. NEW WAGE TECHNOLOGIES LTD is not currently an "obliged entity" under the Cyprus Prevention and Suppression of Money Laundering and Terrorist Financing Activities Law of 2007 (Law 188(I)/2007, as amended), as it does not provide services that fall within Section 2A of that Law, and is not a credit or financial institution authorized by the Central Bank of Cyprus or the Cyprus Securities and Exchange Commission. We nevertheless maintain this programme voluntarily, both because financial-crime risk is inherent to the payments ecosystem in which we operate and because our licensed Provider partners and card-scheme counterparties expect equivalent controls of the technology providers connected to their rails.

This policy is supplemented by internal procedures that translate the principles below into operational steps for our compliance and customer-onboarding teams.

2. Regulatory framework & reference standards

Paytone aligns its programme with internationally recognized standards and the legal framework applicable in our country of establishment, including:

• the Financial Action Task Force (FATF) Recommendations;
• Directive (EU) 2015/849 (4AMLD), Directive (EU) 2018/843 (5AMLD), and Directive (EU) 2018/1673 (6AMLD), and Regulation (EU) 2024/1624 (AMLR) once applicable;
• the Cyprus Prevention and Suppression of Money Laundering and Terrorist Financing Activities Law of 2007 (Law 188(I)/2007), as amended, and the implementing directives issued thereunder;
• guidance issued by MOKAS (the Cyprus Unit for Combating Money Laundering), the Central Bank of Cyprus, and the Cyprus Securities and Exchange Commission, where relevant to our partner relationships;
• applicable Union sanctions regimes, including measures adopted under Article 215 TFEU and implemented under Council Regulations.

Should Paytone in future provide services that bring NEW WAGE TECHNOLOGIES LTD within the scope of Law 188(I)/2007 or another regulatory regime, we will adopt the additional obligations set by the competent supervisory authority and update this policy accordingly.

3. Customer due diligence (CDD & EDD)

Before establishing a business relationship and on an ongoing basis, Paytone performs customer due diligence proportionate to the assessed risk. Standard due diligence includes:

• Identification and verification of the legal entity and its principal place of business.
• Identification and verification of ultimate beneficial owners holding qualifying interests.
• Identification of directors, senior managers, and authorized representatives.
• Assessment of the customer's business activity, geography, and expected payment flows.

Where higher risk is identified — for example, complex ownership structures, exposure to high-risk jurisdictions, or sensitive industries — Paytone applies enhanced due diligence (EDD). EDD may include additional documentation, source-of-funds review, senior-management approval, and elevated monitoring frequency.

4. Risk-based approach

Paytone follows a risk-based approach, allocating resources and controls in proportion to the financial-crime risk presented by a given customer, product, channel, or geography. Each customer is assigned a risk rating that drives the depth of due diligence, the intensity of monitoring, and the review cadence.

5. Sanctions screening

Paytone screens customers, beneficial owners, and counterparties against applicable sanctions lists, including those maintained by the United Nations, the European Union, the United Kingdom, the United States Office of Foreign Assets Control (OFAC), and other competent authorities. Screening is performed at onboarding, on an ongoing basis as lists are updated, and at the Transaction level where appropriate.

Where a confirmed match is identified, Paytone takes the steps required under applicable law, which may include freezing funds, blocking Transactions, and reporting to the relevant authority.

6. Politically exposed persons (PEP)

Paytone screens for politically exposed persons, their family members, and close associates as part of customer onboarding and ongoing monitoring. Confirmed PEP relationships are subject to enhanced due diligence and senior-management approval before the relationship is established or continued.

7. Transaction monitoring

Paytone monitors Transactions processed through the Platform for indicators of money laundering, terrorist financing, fraud, and other financial-crime typologies. Monitoring combines rule-based detection, behavioural analysis, and human review. Indicators include, among others:

• Activity that is inconsistent with the customer's known profile or stated business model.
• Structured Transactions designed to avoid reporting thresholds.
• Unusual cross-border patterns or high-risk-jurisdiction exposure.
• Rapid movement of funds through multiple accounts or methods.

Cases that meet defined criteria are escalated to the compliance team for investigation and, where warranted, formal reporting.

8. Suspicious activity reporting

Where Paytone has knowledge or a reasonable suspicion of money laundering, terrorist financing, or other reportable activity, we report internally to our compliance function and, where there are reasonable grounds, make a disclosure to MOKAS (the Cyprus Unit for Combating Money Laundering, established under Law 188(I)/2007) and, where appropriate, to the Financial Intelligence Unit of another competent jurisdiction. We also notify the licensed Provider or acquirer through which the relevant flows are routed, so that they may discharge their own statutory reporting obligations. Information about specific reports is confidential and may not be disclosed to the subject of the report or to unauthorized third parties ("tipping-off" prohibition).

9. Record keeping

Paytone retains records of customer due diligence, Transaction activity, monitoring alerts, investigations, and suspicious-activity reports for at least five (5) years from the end of the customer relationship or the date of the relevant Transaction, whichever is later, in line with the retention period prescribed by Article 68 of Cyprus Law 188(I)/2007 and Article 40 of Directive (EU) 2015/849. Records are stored securely and made available to competent authorities on lawful request.

10. Training & awareness

All Paytone employees and relevant contractors receive financial-crime training upon joining and at regular intervals thereafter. Training is tailored by role and covers AML/CTF obligations, sanctions, fraud typologies, internal escalation paths, and the consequences of non-compliance. Targeted refresher training is delivered when regulatory expectations or internal procedures change materially.

11. Governance & roles

Paytone's board of directors and senior management are ultimately responsible for the AML programme. A designated Compliance Lead, performing the functions of a Money Laundering Reporting Officer on a voluntary basis, oversees day-to-day implementation, advises the business, and acts as the primary point of contact with our Provider partners and, where appropriate, with authorities. The compliance function operates independently of revenue-generating teams and has the authority to escalate concerns directly to the board. Should Paytone become a regulated entity in the future, the appointed officer will be submitted for approval to, and registered with, the competent supervisory authority in accordance with applicable Cyprus law.

12. Independent audit

The AML programme is subject to periodic independent audit and assurance, performed by internal audit or qualified third parties. Findings are reported to senior management, and remediation actions are tracked to completion. The programme is reviewed at least annually and updated to reflect regulatory changes, business developments, and lessons learned from monitoring and audits.

13. Contact

The Paytone platform is operated by NEW WAGE TECHNOLOGIES LTD, registration number HE 449912, with its registered office at Pavlou Valdaseridi 2A, Floor 1, 6018 Larnaca, Cyprus.

Compliance enquiries and lawful information requests can be directed to compliance@paytone.io, or by post to NEW WAGE TECHNOLOGIES LTD at the address above, attention: Compliance Team. Where required, requests should be accompanied by appropriate legal authority and reference details so we can route them correctly and respond within the time frames provided for by applicable law.