Anti-Money Laundering (AML) Policy

AQNOVA MARKETPLACE

Global Legal Footer Framework

Comprehensive Compliance & Platform Governance Reference

ANTI-MONEY LAUNDERING (AML) POLICY

AML / KYC Obligations — Payment Processing & Regulatory Standing

FATF-Aligned | Global Regulatory Coverage | Risk-Based Approach

Arivon Holding Corporation | AqNova Marketplace

Effective Date: April 7, 2026 | Version 1.0 | CONFIDENTIAL — INTERNAL & REGULATORY USE

This Anti-Money Laundering Policy ("AML Policy," "the Policy") establishes AqNova Marketplace's comprehensive framework for the prevention, detection, investigation, and reporting of money laundering, terrorist financing, proliferation financing, and related financial crimes across all jurisdictions in which AqNova operates.

The Policy is established pursuant to and in compliance with the Financial Action Task Force (FATF) Recommendations — the internationally recognized global standard for AML/CFT (Countering the Financing of Terrorism) — and the applicable national AML legislation of every jurisdiction in which AqNova conducts business. It governs AqNova's obligations as a payment-facilitating e-commerce platform, a data processor, and a commercial intermediary interacting with vendors, buyers, and payment processors across more than 25 countries.

This Policy applies to all employees, contractors, payment operations staff, compliance personnel, and senior management of AqNova and Arivon Holding Corporation. Compliance with this Policy is mandatory and non-negotiable. Violation of AML obligations — including willful blindness to suspected money laundering, failure to file required reports, or tipping off subjects of investigations — constitutes a serious disciplinary offense and may result in criminal liability.

4.1.1 Financial Action Task Force (FATF)

The Financial Action Task Force (FATF) is the global standard-setter for anti-money laundering, counter-terrorist financing, and counter-proliferation financing. Established in 1989 by the G7, FATF has 40 Recommendations covering: legal systems and law enforcement; preventive measures for financial institutions and designated non-financial businesses; transparency of beneficial ownership; and international cooperation.

AqNova's AML framework is designed to meet or exceed FATF Recommendations, in particular: Recommendation 1 (Risk-Based Approach); Recommendation 10 (Customer Due Diligence); Recommendation 12 (Politically Exposed Persons); Recommendation 15 (New Technologies — including digital assets and e-commerce platforms); Recommendation 16 (Wire Transfers); Recommendation 20 (Reporting of Suspicious Transactions); Recommendation 24 (Transparency of Beneficial Ownership); and Recommendation 25 (Legal Arrangements).

FATF periodically assesses member countries through Mutual Evaluation Reviews (MERs). Countries receiving poor ratings are placed on FATF's Enhanced Follow-Up ("Grey List") or High-Risk Jurisdictions subject to a Call for Action ("Black List"). AqNova's geographic risk policy (Section 4.15) is directly calibrated to FATF's current lists, updated upon each FATF plenary publication.

4.1.2 Core International AML Instruments

4.2.1 United States

4.2.2 European Union

4.2.3 United Kingdom

4.2.4 Canada

4.2.5 Africa — Nigeria, Kenya, Ghana & South Africa

4.2.6 Latin America — Brazil, Colombia, Chile & Argentina

4.2.7 Asia-Pacific — Australia, India, Japan, Singapore & South Korea

4.3.1 The Risk-Based Approach Principle

AqNova's AML program is founded on the FATF Risk-Based Approach (RBA), which requires that the allocation of AML resources and the intensity of due diligence measures be proportionate to the assessed level of money laundering and terrorist financing risk associated with a given customer, product, transaction, or geographic relationship. The RBA does not mean accepting higher risk — it means understanding it and applying controls accordingly.

AqNova conducts a formal Enterprise-Wide AML Risk Assessment (EWRA) annually, and on an ad hoc basis whenever material changes occur in: the Platform's product or service offerings; the jurisdictions in which it operates; its customer base composition; payment methods accepted; or the external risk environment (including FATF plenary updates and national regulatory guidance).

4.3.2 Risk Dimensions

The EWRA evaluates ML/TF risk across four primary dimensions:

4.3.3 Risk Rating Matrix

Based on the EWRA, each customer and transaction is assigned a risk rating — Low, Medium, or High — which determines the level of due diligence applied:

4.4 Customer Due Diligence (CDD) & Know Your Customer (KYC)

Customer Due Diligence (CDD) is the process of identifying customers, verifying their identity, understanding the nature of the business relationship, and conducting ongoing monitoring. It is the foundation of AqNova's AML program and is required before establishing a business relationship or conducting a transaction above applicable thresholds.

4.4.1 CDD Requirements — Individual Buyers

For individual buyer accounts, AqNova collects and verifies the following information as part of its CDD process:

4.4.2 CDD Requirements — Vendor Business Entities

Vendor onboarding involves more extensive CDD commensurate with the commercial nature of the relationship and the higher inherent risk of business accounts. The following information is required for all vendor business entity registrations:

4.4.3 Electronic Identity Verification (eIDV)

AqNova utilizes approved electronic identity verification (eIDV) providers to automate the verification of customer identity information at scale, consistent with FATF Guidance on Digital Identity (2020) and applicable national standards (including NIST SP 800-63-3 for US, EU eIDAS Regulation for EU, and Canada's DIACC Pan-Canadian Trust Framework for Canada).

AqNova's eIDV providers must meet the following minimum standards: ISO/IEC 27001 information security certification; compliance with applicable data protection law in each jurisdiction; documented fraud detection capabilities; support for biometric verification where required; and compatibility with national digital identity schemes (including GOV.UK Verify, Belgium eID, India Aadhaar, Singapore MyInfo, and equivalents where available).

For jurisdictions where digital identity verification databases have limited coverage, AqNova supplements eIDV with document verification (upload of government-issued ID documents) processed through an approved document verification provider. All verification decisions are logged with timestamp, verification method, outcome, and data source for audit purposes.

4.4.4 Simplified Due Diligence (SDD)

Simplified Due Diligence may be applied — with documented justification — in circumstances where the assessed risk is demonstrably low. SDD is not an absence of CDD; it means reduced intensity of specific measures. AqNova applies SDD only in the following circumstances:

Buyers making very low-value purchases below defined thresholds, with no adverse screening results and no risk flags, from low-risk jurisdictions.

Established buyers with a long, consistent, and unremarkable transaction history on the Platform, where periodic re-KYC triggers no new risk indicators.

SDD is never available where a customer or transaction involves a high-risk jurisdiction, a PEP, adverse screening results, or any unusual or complex ownership structure.

4.5 Enhanced Due Diligence (EDD) — High-Risk Customers & Transactions

Enhanced Due Diligence (EDD) is a higher-intensity set of CDD measures applied to customers and transactions carrying elevated ML/TF risk. EDD is mandatory (not discretionary) in the circumstances described below. Senior management approval is required before establishing or continuing a high-risk customer relationship subject to EDD.

4.5.1 Mandatory EDD Triggers

Customer is located in, registered in, or conducts business primarily with a jurisdiction on the FATF High-Risk Jurisdictions list (Black or Grey List) — see Section 4.15.

Customer is a Politically Exposed Person (PEP), immediate family member of a PEP, or close associate of a PEP — see Section 4.6.

Customer has a complex or opaque ownership structure involving multiple layers of holding companies, trusts, or foundations that obscures beneficial ownership.

Customer's stated business purpose or source of funds is inconsistent with the nature of their listings, transaction patterns, or geographic profile.

Customer has generated one or more SAR (Suspicious Activity Report) filings in AqNova's transaction history.

Customer is subject to adverse media reporting relating to financial crime, corruption, organized crime, terrorism, or sanctions evasion.

A transaction involves an unusual amount, an unusual payment method, an unusual source or destination jurisdiction, or an unusual beneficiary inconsistent with the customer's profile.

The customer is a money services business, exchange house, cryptocurrency service provider, or other intermediary presenting elevated layering risk.

4.5.2 EDD Measures

Where EDD is triggered, AqNova applies the following additional measures, calibrated to the specific risk factors identified:

Source of Funds (SoF) Verification: The customer is required to provide documentary evidence of the legitimate origin of the funds being used in the transaction — for example, bank statements, salary slips, business financial statements, or proof of asset sale.

Source of Wealth (SoW) Verification (for PEPs and high-value relationships): Documentary evidence of the overall wealth of the individual or entity is required — for example, company accounts, audited financial statements, or inheritance documentation.

Senior Management Approval: Onboarding or continuing an EDD customer relationship requires written approval from AqNova's AML Officer or the Chief Compliance Officer. The approval is documented and retained.

Enhanced Ongoing Monitoring: Transactions involving EDD customers are subject to more frequent review, tighter automated monitoring thresholds, and periodic manual review by the AML Operations team.

Third-Party Intelligence: For high-risk vendor relationships, AqNova may commission third-party due diligence reports from recognized providers (e.g., Refinitiv World-Check, Dow Jones Risk & Compliance, LexisNexis Risk Solutions, or equivalent).

In-Person / Video KYC: For the highest-risk relationships, AqNova may require identity verification via video call with a trained AML Officer, consistent with applicable regulatory guidance on video-KYC.

Periodic Re-KYC: EDD customers are subject to full KYC refresh at intervals not exceeding 12 months (compared to the standard 24-month cycle for Low-risk customers).

4.6.1 Definition of PEP

A Politically Exposed Person (PEP) is an individual who is, or has been within the preceding 12 months, entrusted with a prominent public function, domestically or internationally. PEP status creates a heightened risk of corruption and bribery, which can be associated with money laundering of corruption proceeds.

AqNova's PEP definition aligns with FATF Recommendation 12 and applicable national law, and encompasses:

4.6.2 PEP Screening & Risk Management

AqNova screens all customers against a real-time PEP database at onboarding and re-screens the entire customer database at regular intervals (not less than monthly). PEP databases used must be updated in real-time or near-real-time by the data provider. Recognized PEP database providers include: Refinitiv World-Check; Dow Jones Risk & Compliance; LexisNexis Risk Solutions; Moody's Analytics (BvD Orbis); ComplyAdvantage; and Trulioo.

All confirmed PEP identifications trigger mandatory EDD (Section 4.5). No PEP customer relationship may be established or continued without: senior management sign-off (AML Officer or CCO level); documented EDD measures including source of wealth verification; and enhanced ongoing monitoring. The decision to onboard or continue a PEP relationship is reviewed annually at minimum.

Domestic PEPs — persons holding prominent public functions in AqNova's home jurisdictions — are assessed on a risk-sensitive basis. While domestic PEPs require EDD at initial onboarding, ongoing EDD intensity may be calibrated where the domestic PEP is clearly using the Platform for low-value personal shopping and the risk context is low.

4.7.1 Beneficial Owner Definition

A Beneficial Owner is the natural person(s) who ultimately owns or controls a legal entity customer — whether through direct or indirect ownership of shares, voting rights, or other means, or who otherwise exercises ultimate effective control over the entity. Beneficial ownership transparency is a cornerstone of FATF Recommendation 24 and a mandatory AML requirement in every jurisdiction in which AqNova operates.

AqNova defines a beneficial owner as any natural person who:

Directly or indirectly owns or controls 25% or more of the voting shares or equity interest in the legal entity — consistent with the US FinCEN CDD Rule (25% threshold), EU AMLD (25% threshold), UK MLR 2017 (25% threshold), and equivalent standards.

Exercises ultimate effective control over the management and decisions of the entity through other means, regardless of ownership percentage (controlling person).

Where no natural person meets the ownership threshold or can be identified through reasonable means, AqNova identifies the senior managing official (CEO, Director, or equivalent) as the beneficial owner for CDD purposes, while documenting the measures taken to identify ownership.

4.7.2 Beneficial Ownership Verification Process

All legal entity vendor customers must submit a Beneficial Ownership Declaration at onboarding, disclosing all natural persons meeting the beneficial owner definition. AqNova verifies beneficial ownership information through the following steps:

Step 1 — Self-Declaration: Vendor completes the Beneficial Ownership Declaration form in the Platform's compliance portal, naming all beneficial owners with ownership percentage, nationality, date of birth, and government-issued ID details.

Step 2 — Registry Cross-Reference: Where available, AqNova cross-references disclosed ownership against national beneficial ownership registers (EU member state registers, UK Companies House, Canadian Corporations Canada registry, ASIC Australia, and equivalents).

Step 3 — Document Verification: Certified copies of government-issued ID for all disclosed beneficial owners holding 25%+ are required. Certification may be by a notary, lawyer, accountant, or other recognized professional.

Step 4 — Adverse Screening: All disclosed beneficial owners are screened against sanctions, PEP, and adverse media databases.

Step 5 — Inconsistency Investigation: Where disclosed ownership information is inconsistent with public registry data, third-party business intelligence sources, or transaction patterns, AqNova requests additional documentation and, if unresolved, escalates to the AML Officer.

Beneficial ownership information is re-verified in full every 24 months for standard-risk vendors and every 12 months for high-risk vendors, or immediately upon any material change in ownership structure notified by the vendor or detected through monitoring.

4.8.1 Sanctions Screening Obligations

Sanctions compliance is legally distinct from but operationally integrated with AML compliance. AqNova maintains a zero-tolerance policy for dealings with sanctioned persons, entities, and jurisdictions. Unlike AML obligations — where a risk-based approach permits calibration of intensity — sanctions screening admits of no de minimis exception or risk tolerance. Any match against a sanctions list is treated as a potential violation requiring immediate escalation.

4.8.2 Sanctions Lists Screened

4.8.3 Screening Frequency & Methodology

At Onboarding: All new customers (buyers and vendors) are screened against all applicable sanctions lists before their account is approved and before any transaction is processed.

Periodic Re-Screening: AqNova performs automated re-screening of its entire active customer base against all sanctions lists on a daily basis using its real-time screening platform. This ensures that customers not sanctioned at onboarding are identified promptly if they are subsequently added to a sanctions list.

Transaction-Level Screening: All payment transactions are screened in real-time for sanctions exposure — including payer identity, payee identity, transaction destination, and payment intermediary details.

Fuzzy Matching: AqNova's screening system uses fuzzy matching algorithms to identify potential sanctions matches that involve name variations, transliterations, aliases, or partial name entries, reducing the risk of evasion through minor name alterations.

Match Review Process: All potential sanctions matches are reviewed by AqNova's compliance team within 1 Business Day of identification. Confirmed matches result in immediate account freeze, transaction block, and escalation to the AML Officer and General Counsel. OFAC and applicable national authority are notified as required by law.

False Positive Management: A documented false positive review process ensures that customer accounts are not incorrectly frozen. All false positive determinations are documented with full analysis and reviewer identification.

4.9.1 Transaction Monitoring Program

AqNova operates a risk-based transaction monitoring program designed to detect suspicious patterns, unusual transaction behavior, and potential money laundering or terrorist financing activity in real time and through retrospective analysis. The program uses a combination of automated rule-based systems, behavioral analytics, and machine learning models, supplemented by manual review by trained AML analysts.

4.9.2 Transaction Monitoring Rules — Indicative Scenarios

The following scenarios — drawn from FATF guidance on e-commerce ML risk, FinCEN advisories, and AqNova's own risk assessment — are examples of patterns that trigger transaction monitoring alerts. The specific thresholds and parameters are maintained in AqNova's restricted AML Operations Manual.

4.9.3 Alert Management Process

All transaction monitoring system alerts are reviewed by AqNova's AML Operations team through a structured alert management workflow:

Level 1 Review (AML Analyst): Initial triage within 24 hours. Analyst determines whether the alert is a false positive (closed with documented rationale) or requires further investigation (escalated to Level 2).

Level 2 Review (Senior AML Analyst): Detailed investigation within 3 Business Days. Reviews transaction history, customer profile, CDD documentation, and external intelligence. Determines whether a SAR is warranted or the alert is closed with enhanced monitoring.

Level 3 Escalation (AML Officer): For complex or high-value cases. AML Officer reviews the full investigation file and makes the final SAR filing decision. SAR filed within applicable statutory deadline.

Audit Trail: Every alert, review action, decision, and rationale is documented in AqNova's case management system. No alert may be closed without a documented disposition and approving officer signature.

4.10.1 TBML in E-Commerce Contexts

Trade-Based Money Laundering (TBML) involves the use of commercial trade transactions — including e-commerce transactions — to disguise and transfer the proceeds of crime. The FATF and Egmont Group have identified TBML as one of the three primary methods of money laundering globally, alongside cash smuggling and financial system abuse.

E-commerce platforms are particularly vulnerable to TBML due to: the ability to create fictitious or inflated transactions; the difficulty of verifying the physical delivery and fair market value of goods; the involvement of multiple jurisdictions in a single transaction; and the use of digital payment methods that can obscure the true originator or beneficiary of funds.

4.10.2 AqNova's TBML Red Flags

The following indicators specifically relevant to e-commerce TBML are integrated into AqNova's transaction monitoring and vendor review processes:

Systematic over-invoicing: Products listed at prices significantly above market value or comparable listings, particularly for transactions with buyers in different jurisdictions.

Systematic under-invoicing: Products listed at prices significantly below market value, suggesting an unreported value transfer between vendor and buyer.

Multiple payments for a single low-value item: Breaking a single transaction into multiple smaller payments across different payment methods or accounts.

Phantom shipments: Order confirmations and tracking data that do not correspond to actual goods movement; high rates of orders marked as "delivered" with no buyer confirmation and subsequent refund requests from unrelated parties.

Round-trip transactions: Buyer and vendor located in the same jurisdiction but routing payment through a third jurisdiction with no commercial purpose for the routing.

Unusual commodity focus: Vendors whose listings are dominated by commodities frequently associated with TBML — gold, gemstones, luxury watches, electronic goods, gift cards — particularly combined with high-volume transaction profiles.

Third-party payment: Payments made by a third party unrelated to the buyer, with no apparent commercial explanation.

Mismatched counterparties: The identity, location, or profile of the buyer or vendor is inconsistent with the nature of the goods being traded.

4.10.3 TBML Mitigation Measures

AqNova implements the following TBML-specific controls:

Pricing reasonableness review: AqNova's product curation system flags listings priced at more than 3x the median market price for the category or less than 30% of the median market price, for compliance team review.

Shipping verification integration: For high-risk transactions, AqNova cross-references carrier tracking data to verify that goods were physically shipped and received, reducing phantom shipment risk.

Cross-jurisdictional transaction analysis: AqNova's transaction monitoring system analyzes patterns in cross-border transactions to identify routing structures inconsistent with legitimate commercial trade.

High-risk commodity enhanced monitoring: Vendors in high-risk commodity categories are subject to enhanced transaction monitoring and may be required to provide customs documentation or export permits.

4.11.1 Reporting Obligation

AqNova is required to file reports with applicable national Financial Intelligence Units (FIUs) whenever it knows, suspects, or has reasonable grounds to suspect that a transaction or attempted transaction involves the proceeds of crime, money laundering, terrorist financing, or proliferation financing. This obligation applies regardless of the amount involved, and regardless of whether the transaction was completed or merely attempted. The obligation to file a SAR (Suspicious Activity Report) or STR (Suspicious Transaction Report) — terminology varies by jurisdiction — is not discretionary once the suspicion threshold is met.

4.11.2 SAR/STR Filing Requirements by Jurisdiction

4.11.3 No Tipping Off

AqNova's AML Policy strictly prohibits 'tipping off' — the disclosure to a customer or any third party that a SAR or STR has been filed or is being considered in connection with their account or transactions. This prohibition applies to all AqNova employees, contractors, and management. Violation of the tipping-off prohibition is a criminal offense in all jurisdictions where AqNova operates and will result in immediate disciplinary action and law enforcement referral.

The existence, content, and outcome of any SAR or STR filed by AqNova, and the identity of any person or transaction the subject of such a report, are strictly confidential and may not be disclosed to any person other than: the relevant FIU; AqNova's AML Officer and legal counsel; and AqNova's external auditors under appropriate confidentiality constraints. Even within AqNova, SAR information is provided on a strict need-to-know basis.

4.11.4 Legal Protection for SAR Filers

Under applicable law in all major jurisdictions (including 31 U.S.C. § 5318(g)(3) in the US, Section 337A of POCA 2002 in the UK, and equivalent provisions globally), AqNova and its employees who file SARs in good faith are protected from civil liability for the disclosure. AqNova indemnifies all employees who file SARs in good faith in accordance with this Policy against any legal action arising from that filing.

4.12.1 AML Record Retention Standards

AqNova maintains comprehensive AML records to support the detection and investigation of money laundering and terrorist financing, to enable regulatory review and audit, and to facilitate law enforcement information requests. Record retention periods are set at the maximum of: the applicable statutory minimum in each jurisdiction; or 5 years from the end of the business relationship or the date of a transaction, consistent with FATF Recommendation 11 and the majority of global AML frameworks.

4.12.2 Record Storage & Security

All AML records are stored in encrypted format, with access strictly controlled on a need-to-know basis consistent with AqNova's information security framework and applicable data protection law. AML records are stored on systems with appropriate backup and disaster recovery capabilities to ensure they remain retrievable for the full statutory retention period.

AML records may be stored electronically provided: records are searchable and retrievable in a timely manner to satisfy regulatory requests; records are stored in a format that cannot be altered retroactively without detection; access to records is logged; and records can be produced in a legible format acceptable to the relevant regulatory authority.

4.13 AML Training & Awareness

FATF Recommendation 18 and applicable national law require that all covered businesses maintain comprehensive AML training programs to ensure that employees know and understand their AML obligations, can recognize suspicious activity, and know how to respond appropriately.

4.13.1 Training Requirements by Role

4.13.2 Training Assessment & Records

All AML training programs include a post-training assessment with a minimum passing score of 80%. Employees who fail the assessment are required to repeat the training and re-test within 10 Business Days. Employees who fail the assessment on a second attempt are flagged for performance management review and additional targeted training. Training completion records are maintained in accordance with Section 4.12.1.

4.14 Correspondent & Payment Processor Relationships

AqNova processes payments through third-party Payment Processors. These relationships create potential AML risk — AqNova's Platform is only as strong as the AML controls of the payment infrastructure through which its transactions flow. AqNova applies a rigorous due diligence and ongoing oversight framework to all Payment Processor relationships.

4.14.1 Payment Processor AML Due Diligence

Before onboarding any Payment Processor, AqNova conducts due diligence covering:

Regulatory licensing: Confirmation that the Payment Processor holds all required licenses and registrations in the jurisdictions in which it processes payments, including money transmission licenses (US), PSD2 authorization (EU), FCA authorization (UK), FINTRAC registration (Canada), and equivalent.

AML program review: Review of the Payment Processor's AML/KYC Policy, including their customer identification standards, transaction monitoring capabilities, SAR filing procedures, and sanctions screening program.

FATF jurisdiction assessment: Confirmation that the Payment Processor does not operate in FATF Black-Listed jurisdictions without equivalent AML safeguards.

Financial stability and reputation: Review of audited financial statements, ownership structure, regulatory history, and adverse media.

Contractual AML obligations: All Payment Processor agreements include contractual AML provisions requiring: adherence to applicable AML law; real-time sanctions screening; SAR filing in all applicable jurisdictions; information sharing with AqNova on AML-relevant matters; and notification of material AML incidents.

4.14.2 Ongoing Payment Processor Oversight

Ongoing oversight of Payment Processor relationships includes:

Annual AML program review: AqNova requests and reviews Payment Processor AML certifications, audit reports, and regulatory examination findings annually.

Incident notification requirement: Payment Processors must notify AqNova within 24 hours of any material AML incident, regulatory action, or significant sanctions violation.

Transaction-level monitoring: AqNova maintains its own transaction monitoring layer independently of Payment Processor monitoring, to ensure that AML detection does not depend solely on a third-party's systems.

Correspondent banking standards: Where AqNova's payment arrangements involve correspondent banking relationships, AqNova applies the Wolfsberg Group's Correspondent Banking Principles in its assessment and oversight of such relationships.

4.15.1 FATF Jurisdiction Risk Classifications

AqNova calibrates its geographic risk controls directly to FATF's published jurisdiction assessments, updated at each FATF plenary (typically three times per year — February, June, and October). Current FATF lists are available at fatf-gafi.org. AqNova's AML Operations team monitors FATF plenary outcomes and updates geographic risk controls within 5 Business Days of each FATF publication.

4.15.2 Additional Geographic Risk Factors

Beyond FATF lists, AqNova considers the following additional geographic risk indicators in its country risk ratings:

Transparency International Corruption Perceptions Index (CPI): Countries scoring below 40/100 on the CPI are classified as elevated geographic risk, requiring enhanced monitoring of customer relationships.

US State Department INCSR: Countries identified in the Bureau of International Narcotics and Law Enforcement Affairs' annual International Narcotics Control Strategy Report as major money laundering jurisdictions.

Basel AML Index: Countries scoring high on the Basel Institute on Governance's annual AML/CFT risk index.

Countries subject to comprehensive US, EU, or UN trade sanctions programs.

Jurisdictions with known high levels of trade-based money laundering activity in product categories relevant to AqNova.

4.15.3 Prohibited Jurisdictions

AqNova maintains a Prohibited Jurisdictions List — distinct from the FATF list — of jurisdictions where AqNova will not onboard customers or process transactions under any circumstances. This list includes: jurisdictions subject to comprehensive US OFAC sanctions; jurisdictions subject to comprehensive EU or UN sanctions; and other jurisdictions designated by AqNova's AML Officer based on unacceptable residual risk following due diligence. The Prohibited Jurisdictions List is maintained in the restricted AML Operations Manual and is reviewed quarterly.

4.16.1 AML Governance Structure

AML Officer (AMLO): AqNova designates a qualified AML Officer (AMLO) responsible for: oversight and implementation of this Policy; management of the AML Operations team; SAR/STR filing decisions; liaison with regulatory authorities and FIUs; and annual AML risk assessment. The AMLO must hold or be actively pursuing a recognized AML professional qualification (CAMS — Certified Anti-Money Laundering Specialist, ICA International Diploma in AML, or equivalent). The AMLO has direct reporting access to the CEO and Board.

Chief Compliance Officer (CCO): The CCO has overall accountability for AqNova's compliance program, including AML. The CCO approves the AML Policy annually, receives quarterly AML performance reports, and escalates material AML issues to the Board.

Board / Executive Oversight: The Board of Directors (or equivalent governance body) receives an annual AML report covering: risk assessment findings; SAR/STR filing statistics (no identifying details); regulatory developments; training completion rates; and material incidents. The Board approves the AML Policy. AML risk is included in AqNova's enterprise risk register.

AML Committee: An AML Oversight Committee comprising the AMLO, CCO, General Counsel, CFO, and Head of Payments meets monthly to review: transaction monitoring metrics; alert disposition statistics; SAR filing activity; EDD case reviews; regulatory and FATF developments; and training completion status.

Independence of AML Function: The AML function operates independently of commercial and business development functions. AML Officers may not be overruled on SAR filing decisions or CDD requirements by commercial management. Material AML decisions require AMLO sign-off regardless of commercial impact.

4.16.2 Independent AML Audit

AqNova's AML program is subject to independent annual audit by a qualified external AML auditor with no commercial relationship to AqNova other than the audit engagement. The audit covers: policy and procedure review; sample testing of KYC records; transaction monitoring effectiveness review; SAR/STR filing accuracy; training records; and sanctions screening system testing. Audit findings are reported to the Board and, where required by applicable law, to the relevant regulatory authority. All material audit findings are remediated within the timeframe specified in the audit remediation plan, under the oversight of the CCO.

4.16.3 Regulatory Cooperation

AqNova is committed to full, prompt, and transparent cooperation with AML regulatory authorities, FIUs, law enforcement agencies, and other competent authorities across all jurisdictions. This includes:

Responding to regulatory information requests within applicable statutory timeframes.

Granting regulatory authorities access to AML records and systems during examinations and investigations.

Proactively notifying regulators of material AML program weaknesses or significant incidents, consistent with applicable mandatory notification requirements.

Participating in public-private sector information-sharing initiatives (e.g., FinCEN Exchange in the US, JMLIT in the UK, ACIP in Australia) where appropriate and legally permitted.

4.16.4 AML Policy Review Cycle

This AML Policy is reviewed and updated annually — or more frequently in response to: significant regulatory changes; FATF standard updates; new product launches creating material AML risk; regulatory examination findings; or material AML incidents. All updates are approved by the CCO and Board before taking effect, and are communicated to all relevant employees within 5 Business Days of approval. The effective date and version history of all Policy updates are maintained in a Policy Change Register accessible to all compliance personnel.

4.17 AML Contact Directory & Reporting Channels

AqNova Marketplace | Global Legal Footer Framework | Section 4: Anti-Money Laundering Policy

© 2026 Arivon Holding Corporation. All rights reserved. Effective April 7, 2026. Version 1.0.

CONFIDENTIAL — This document contains sensitive compliance information. Distribution restricted to authorized personnel, regulators, and external auditors. Does not constitute legal advice.