AML/CFT, Sanctions and Fraud Prevention Policy

1. Presentation and objectives of the Policy

This Policy sets out guidelines to prevent and mitigate risks related to money laundering, terrorist financing, financing of proliferation of weapons of mass destruction, sanctions, fraud, simulated transactions, concealment of beneficial ownership and misuse of the TroqPay platform.

TroqPay is a technology and SaaS company. TroqPay provides technology infrastructure for merchant onboarding, checkout, payment links, API, webhooks, dashboard, automation, order routing, reconciliation, operational intelligence and integration with competent partners.

TroqPay is not a bank, financial institution, payment institution, payment transaction initiator, VASP, exchange, foreign exchange broker, currency exchange institution, eFX provider, custodian or direct executor of remittances, foreign exchange, regulated financial settlement, purchase and sale or transfer of virtual assets on its own account.

This Policy should be read together with TroqPay's Terms of Use and Privacy Policy. The Terms of Use concentrate the contractual rules for using the platform, prohibited activities, merchant responsibilities, disputes, blocks and contractual consequences. The Privacy Policy concentrates the rules for processing personal data, legal bases, data subject rights, sharing, security and retention.

The purpose of this Policy is to present, in clear language, the public guidelines on governance, diligence, monitoring, documentation, cooperation with competent partners and response to indications of unlawful activity adopted by TroqPay.

2. Applicable rules and best-practice references

This Policy considers Brazilian legislation applicable to anti-money laundering, counter-terrorist financing, sanctions, data protection, fraud prevention and, where relevant, rules applicable to regulated partners that execute financial, payment, settlement, foreign exchange, eFX, remittance, virtual asset or related service steps.

Reference to regulatory rules in this Policy does not mean that TroqPay presents itself as an institution authorized by the Central Bank of Brazil, financial institution, payment institution, VASP, exchange, eFX provider or currency exchange institution. These rules are considered, as applicable, as best-practice references, as requirements applicable to competent partners or as operational compatibility parameters required in the service chain.

• Law No. 9,613/1998, which addresses money laundering crimes and prevention mechanisms.
• Law No. 13,260/2016, which regulates terrorism and its financing.
• Law No. 13,810/2019, which addresses compliance with sanctions imposed by United Nations Security Council resolutions.
• Law No. 13,709/2018, the Brazilian General Data Protection Law.
• Law No. 14,478/2022 and regulations related to virtual assets, when applicable to competent partners and enabled flows.
• BCB Resolutions No. 519, 520 and 521/2025, and related rules, when applicable to competent partners, virtual asset service providers, transactions with virtual assets, stablecoins, pay-in, payout, cross-border flows or activities included in the foreign exchange market.
• Rules of the Central Bank of Brazil, COAF and competent authorities that apply to regulated partners or serve as a proportional best-practice reference for TroqPay.
• Policies, manuals, operating rules and acceptance criteria of BaaS partners, financial institutions, payment institutions, VASPs, pay-in/payout partners, settlement, foreign exchange, eFX, remittance or other competent providers.

3. Definitions

For purposes of this Policy, the terms below should be interpreted together with the definitions in TroqPay's Terms of Use.

4. Scope of the Policy

This Policy applies to TroqPay, its officers, employees, contractors, suppliers, commercial partners, prospects, merchants, legal representatives, attorneys-in-fact, partners, controllers, beneficial owners and other third parties that participate in or may affect use of the platform.

The scope includes registrations, documents, data, communications, evidence, instructions, withdrawal requests, pay-in, payout, receipt, settlement, order routing, disputes, chargebacks, integrations and other technology flows processed by TroqPay.

Application of this Policy considers the merchant profile, product or service sold, declared activity, countries involved, currencies used, charging method, settlement method, enabled rails, responsible partners and signals identified throughout the relationship.

TroqPay may require merchants, suppliers and partners to observe this Policy, the Terms of Use, the Privacy Policy and the operating rules of competent partners applicable to the functionalities used.

5. Compliance responsibilities and internal governance

TroqPay adopts governance proportional to its business model and technology role, with internal responsibilities focused on preventing AML/CFT, sanctions and fraud risks.

The area responsible for compliance and risk may define internal procedures, guide product, technology, operations, support, sales and customer service teams, assess new flows, track alerts, review registrations, request documents, record evidence and coordinate interactions with competent partners.

TroqPay's compliance governance does not turn the company into a regulated institution and does not replace the obligations of financial, payment, foreign exchange, eFX, remittance, settlement or VASP partners that execute regulated steps.

• Implement and review proportional KYC, KYB, KYP and KYE controls.
• Guide internal teams on identifying warning signs and escalating suspicious cases.
• Assess risks of new products, countries, currencies, rails, partners or functionalities.
• Document analyses, evidence, decisions and relevant operational communications.
• Cooperate with competent partners, critical providers and authorities within the limits of law and applicable contracts.
• Maintain internal analysis, escalation and response procedures compatible with the risk of the operation.

6. Know your customer, partner, supplier and employee

TroqPay may adopt KYC, KYB, KYP and KYE procedures to know merchants, representatives, beneficial owners, partners, suppliers, providers and employees, in a manner proportional to the risk and nature of the relationship.

Information may be confirmed through documents, declarations, public and private databases, bureaus, restrictive lists, sanctions lists, PEP databases, adverse media, anti-fraud tools, document validation, biometrics, technical data, transactional records and information required by competent partners.

TroqPay may refuse, suspend, limit or terminate a relationship when there is incompatibility with the risk policy, documentary inconsistency, refusal to provide information, attempted concealment of beneficial ownership, use of nominees or straw persons, fraud signals or impediment indicated by a competent partner.

• Verification of CPF, CNPJ, registration status, corporate documents, representation powers and beneficial owners.
• Assessment of declared activity, CNAE, website, sales channels, product or service, average ticket, expected volume, countries involved, currencies used and transactional behavior.
• Validation of ownership or legitimate link with accounts, Pix keys, wallets, domains, integrations and destinations provided.
• Request for additional documents on source of funds, nature of the sale, delivery of the product or service, purpose of the transaction and commercial relationship.
• Enhanced diligence for higher-risk sectors, countries, currencies, products, rails or behaviors.

7. Politically exposed persons, restrictive lists, sanctions and adverse media

TroqPay may perform checks to identify politically exposed persons, links to PEPs, presence on restrictive or sanctions lists, adverse media and other relevant reputational elements.

Identification of a PEP, link to a PEP, sanction, adverse news or reputational risk does not imply automatic approval or automatic rejection, except when law, rules of competent partners or internal risk criteria require refusal, blocking or restriction. The analysis will be proportional to the risk, context and requested functionality.

TroqPay will not accept use of the platform by persons, entities, wallets, accounts, countries, activities or beneficial owners subject to legal restrictions, applicable sanctions or impediments determined by competent partners.

8. Procedure for recording operations and evidence

TroqPay may keep technical, registration, operational, documentary, transactional and communication records necessary for platform security, fraud prevention, AML/CFT, sanctions, support to competent partners, legal or contractual compliance and defense of rights.

TroqPay records are technology, routing, request, tracking, reconciliation, log and evidence records. They do not mean that TroqPay is the institution executing the regulated operation or that it maintains a payment account, bank account, wallet, custody or proprietary financial settlement for the merchant.

When regulated execution falls to a competent partner, TroqPay may collect, organize, supplement and forward information and evidence necessary for that partner to perform its analyses, records, blocks, reports or other legal and regulatory obligations.

• Registration data, documents, corporate structure, representatives and beneficial owners.
• Access logs, IP, device, API use, checkout events, webhooks, dashboard and integrations.
• Information on charge, order, end customer, product or service, value, currency, country, account, wallet, rail, status and commercial evidence.
• Records of analyses, alerts, justifications, document requests, responses, decisions, blocks, suspensions, disputes, MED, refunds or communications with partners.
• Information required by competent partners for pay-in, payout, BRL settlement, supported stablecoins, foreign fiat currencies, virtual assets or cross-border flows.

9. Monitoring and analysis of operations and suspicious situations

TroqPay may monitor, manually or automatically, registrations, documents, transactional behavior, platform use, technical patterns, disputes, reports, chargebacks and other available information to identify atypical, suspicious or profile-incompatible situations.

Monitoring may occur before activation, during the relationship with the merchant, when enabling new functionalities, in pay-in/payout flows, settlement in a currency different from the sale currency, receipt or settlement in BRL, supported stablecoins, foreign fiat currencies, virtual assets or cross-border operations.

TroqPay may apply enhanced analysis when there is elevated risk, documentary inconsistency, abrupt profile change, use of sensitive country or currency, attempted accelerated withdrawal, triangulation, pass-through account, circular transaction, structuring, concealment of beneficial ownership, use of straw persons, document fraud, social engineering, high volume of disputes or inconsistency among merchant, end customer, product, country, currency and settlement method.

Without reproducing the contractual list in the Terms of Use in full, TroqPay does not accept use of the platform for illegal, fraudulent, simulated or sanctioned activities, activities incompatible with rules of competent partners or activities that seek to bypass foreign exchange, tax, regulatory, AML/CFT, sanctions or fraud-prevention controls.

• Volume, frequency, timing, average ticket, geography, currency or destination incompatible with the informed profile.
• Inconsistency among declared activity, CNAE, website, product, sales channel and observed behavior.
• Use of accounts, Pix keys, wallets or destinations without a clear link to the merchant or its beneficial owner.
• Abrupt change of country, currency, rail, destination account, wallet, product or customer pattern.
• Indications of using stablecoins, fiat currencies, pay-in, payout or settlement in a currency different from the sale currency to conceal source or destination of funds, simulate commercial operations or bypass partner controls.
• MED, disputes, returns, complaints, refund requests or fraud reports in volume incompatible with the operation profile.

10. Communication and cooperation with competent partners

TroqPay may collect, analyze, record and forward information, documents and evidence to competent partners responsible for executing regulated or critical steps of the operation, including BaaS partners, financial institutions, payment institutions, VASPs, pay-in/payout partners, settlement, foreign exchange, eFX, remittance, anti-fraud, identity verification and financial infrastructure providers.

When there are relevant indications of unlawful activity or when legislation, an authority order or an applicable contract requires direct cooperation by TroqPay, the company may provide information to competent authorities, including the Public Prosecutor's Office, police or administrative authorities, within the limits of law, applicable confidentiality, data protection and defense of rights.

Regulatory reports that are proper to financial institutions, payment institutions, VASPs, foreign exchange, eFX, remittance providers or other regulated participants will be the responsibility of competent partners when the obligation is theirs. TroqPay may provide supporting information and evidence so those partners can fulfill their obligations.

TroqPay may limit disclosure of information about analyses, blocks, communications or investigations when necessary to preserve platform security, fact-finding, guidance from a competent partner, legal confidentiality or compliance with applicable law.

11. Blocking, suspension, restriction and containment measures

TroqPay may refuse registration, deny enablement of functionalities, suspend, limit, block or terminate use of the platform, in whole or in part, when it identifies relevant risk, indication of fraud, suspicion of money laundering, terrorist financing, sanctions violation, concealment of beneficial ownership, documentary inconsistency, order from a competent partner, determination by an authority or breach of the Terms of Use.

When blocks, holds, returns, restrictions or equivalent measures are determined or executed by competent partners, TroqPay may reflect those measures in the platform and cooperate with the collection, organization and forwarding of evidence.

In cases involving sanctions, restrictive lists, risk of dissipation of funds, fraud, authority order or guidance from a competent partner, containment measures may be adopted immediately, without prior notice, preserving applicable rights and documentation of the analysis.

• Suspension of access to dashboard, API, webhooks, checkout, links or specific functionalities.
• Limitation or refusal of withdrawal, payout, settlement, conversion, receipt or destination-change request.
• Request for documents, invoices, contracts, delivery confirmations, logs, evidence of commercial relationship, ownership of account or wallet, source of funds and purpose of the transaction.
• Forwarding of information to competent partners for analysis, execution, blocking, return, reporting or regulatory decision.
• Termination of the relationship when the risk is incompatible with TroqPay standards, competent partner standards or applicable law.

12. Communication, training and prevention culture

TroqPay may disclose this Policy to employees, contractors, partners, suppliers and merchants, as applicable, to strengthen a culture of integrity, fraud prevention, AML/CFT, sanctions and operational security.

TroqPay may promote internal guidance, training, communications, checklists, escalation flows and support materials so that product, technology, operations, sales, support and customer service teams can identify warning signs and escalate suspicious situations to internal responsible parties.

Suppliers, partners and critical providers may be subject to contractual clauses, security requirements, confidentiality, data protection, fraud prevention, sanctions and cooperation with TroqPay and competent partners.

13. General provisions

This Policy is public, informational and complementary. Operational procedures, analysis flows and response measures may vary according to risk, functionality used, guidance from competent partners and applicable law.

TroqPay may review this Policy periodically to reflect changes in its business model, operational structure, partners, rails, supported currencies, countries, products, identified risks, legislation or rules of competent partners.

The processing of personal and business data in the context of this Policy will observe applicable law, including the LGPD. Legal bases, data subject rights, categories of data, sharing, security, retention and other privacy rules are detailed in TroqPay's Privacy Policy.

Nothing in this Policy should be interpreted as an offer, promise or guarantee that TroqPay directly executes regulated financial services, foreign exchange transactions, international remittances, eFX, purchase and sale of virtual assets, custody, financial settlement or transfer of virtual assets on its own account.

The merchant remains responsible for the legality of its activity, the truthfulness of information provided, the regularity of products and services it sells, compliance with tax, regulatory and contractual obligations applicable to its business and observance of rules required by competent partners for the functionalities it requests to use.

This Policy enters into force on the date of its publication and remains in force for an indefinite period until replaced by a later version.