AML/KYC Policy and Procedures

Document Control and Regulatory Basis

This policy establishes PayOak's internal AML/KYC framework. It is intended to operate alongside applicable Nigerian law, regulatory requirements, guidance, and PayOak's supporting compliance procedures. The principal statutory reference is the Money Laundering (Prevention and Prohibition) Act 2022, together with other requirements applicable to PayOak's activities. This policy does not by itself determine PayOak's regulatory classification or replace any requirement imposed by a competent authority.

1. Purpose and Policy Statement

PayOak, operated by StoneBridge Technologies Limited, is committed to maintaining appropriate measures to prevent the misuse of its services for money laundering, terrorism financing, fraud, and other financial crimes.

PayOak maintains an Anti-Money Laundering and Know Your Customer (AML/KYC) framework designed to support the identification and verification of customers, understanding of customer relationships and transactions, monitoring for potentially suspicious activity, maintenance of appropriate records, and escalation or reporting where required by applicable law and regulatory obligations.

PayOak applies a risk-based approach to customer identification and due diligence. The level of verification and additional information required may vary according to the customer's account type, verification tier, transaction activity, and identified risk.

PayOak's AML/KYC framework is maintained in accordance with applicable Nigerian anti-money laundering and counter-terrorist financing requirements, including the Money Laundering (Prevention and Prohibition) Act 2022, together with other applicable laws, regulations, regulatory requirements and guidance relevant to PayOak's activities.

Where applicable, PayOak may also take account of recognised international AML/CFT principles and standards in developing its internal controls.

2. Customer Identification and KYC

PayOak applies customer identification and verification measures before enabling transaction functionality that requires verification and throughout the customer relationship where additional verification is required.

Initial registration may collect information such as email address, authentication credentials, mobile number, residential address, and, for business accounts, business name and relevant business information. Email and mobile verification may be used as applicable.

PayOak verifies the customer's bank account information and BVN where required. Where the relevant information does not match or cannot be validated, the customer may be required to correct the information or provide additional information before proceeding.

PayOak uses a tiered verification approach. Depending on the applicable tier and risk, this may include NIN validation, facial/selfie verification against the image associated with the BVN, a valid government-approved identity document, proof of address, and other appropriate verification measures. Where required for address verification at a higher tier, PayOak may request permission to use precise device location for validation against the customer's proof of address.

For business accounts, PayOak may collect and verify relevant business and representative information and, where necessary, information concerning ownership or control.

Additional identification or verification may be required where PayOak cannot satisfactorily verify information, where transaction activity presents increased risk, where material customer information changes, where suspicious or unusual activity is identified, or where enhanced due diligence is required by law, regulation, or internal controls.

PayOak may restrict, suspend, delay, or decline access to relevant services where required or permitted by applicable law, regulatory requirements, or its risk controls.

3. Customer Due Diligence and Risk-Based Approach

PayOak applies a risk-based customer due diligence approach appropriate to its services and identified risks.

Core due diligence measures include:

• Identifying and verifying the customer using reliable information and documents appropriate to the applicable verification tier and risk.

• Understanding the nature and purpose of the customer relationship and expected use of PayOak services.

• Keeping customer and verification information sufficiently accurate and up to date.

• Understanding and reviewing transaction activity in a manner proportionate to the customer's risk and PayOak's services.

• Applying enhanced due diligence where ordinary due diligence is insufficient or where heightened risk is identified.

• Maintaining appropriate records of due diligence, reviews, decisions, and escalations.

Risk factors may include customer characteristics, account type and verification tier, transaction characteristics and frequency, geographic or counterparty considerations where relevant, and other factors identified through PayOak's risk assessment. Where risk cannot be adequately managed through ordinary due diligence, PayOak may apply enhanced due diligence or other proportionate controls.

4. Transaction Monitoring

PayOak maintains appropriate measures to monitor customer and transaction activity for indicators of money laundering, terrorism financing, fraud, and other financial crime, proportionate to its services, risk profile, and operational capabilities.

Potential indicators may include unusual or unexpected activity; activity inconsistent with known customer information or expected use; multiple transactions that together increase risk; unexplained third-party involvement; activity involving higher-risk jurisdictions or counterparties where relevant; unverifiable customer information; or other circumstances giving rise to reasonable suspicion.

Where activity requires further review, PayOak may review customer identification information, account and transaction history, supporting documents, relevant communications, and other available information, and may request additional information or apply enhanced due diligence where appropriate.

PayOak may use automated and manual monitoring and review controls as appropriate to the scale and nature of its operations. Monitoring outcomes are documented and escalated in accordance with applicable procedures.

5. No Cash Transactions

PayOak does not support physical cash deposits, cash withdrawals, or cash settlement through its platform.

Supported payment flows are electronic and are designed to maintain appropriate transaction records and audit trails.

Where payment processing is carried out through authorised third-party providers, PayOak does not directly collect or store card information beyond what is necessary and permitted for the relevant service.

Attempts to circumvent supported payment channels or otherwise introduce unexplained cash-equivalent activity may be reviewed and escalated on a risk-based basis.

6. PEPs and Enhanced Due Diligence

PayOak applies risk-based measures to identify and manage politically exposed persons (PEPs), and, where applicable, relevant family members and close associates, in accordance with applicable law and regulatory requirements.

PEP status alone does not constitute evidence of suspicious activity. Where PEP or other heightened-risk indicators are identified, PayOak may apply enhanced due diligence, which may include obtaining additional information about the customer and the nature and purpose of the relationship, obtaining information or evidence concerning source of funds or source of wealth where appropriate, enhanced monitoring, additional documentation, senior approval where required, and periodic or event-driven review.

Additional enhanced due diligence measures may be applied where the overall customer or transaction risk warrants them.

Suspicious activity identified in connection with a PEP or any other customer is handled under the applicable suspicious activity review and reporting procedures. PEP status alone does not automatically trigger a suspicious activity report.

7. Suspicious Activity Identification and Reporting

PayOak maintains procedures for identifying, reviewing, escalating, and, where required, reporting potentially suspicious activity relating to money laundering, terrorism financing, fraud, or other financial crime.

Indicators may include unusual, inconsistent, unexplained, or apparently evasive activity; attempts to avoid monitoring or reporting controls; unexplained third-party involvement; activity involving higher-risk jurisdictions where relevant; unverifiable customer information; or other circumstances giving rise to reasonable suspicion.

A compliance review may include consideration of customer identification information, transaction history, supporting documents, relevant communications, additional information requested from the customer, and enhanced due diligence where appropriate.

Where activity is reportable under applicable law, PayOak will make the appropriate report to the competent authority through the applicable reporting process.

PayOak will not disclose the existence or details of a suspicious transaction or related report where such disclosure is prohibited by applicable law or regulatory requirements.

Records relating to suspicious activity reviews and reporting are maintained securely and in accordance with applicable legal, regulatory, and internal retention requirements.

8. Confidentiality and Protection of AML/KYC Information

AML/KYC information is treated as confidential and is accessed only by authorised personnel with a legitimate business, compliance, legal, or operational need.

Personnel involved in customer due diligence, transaction monitoring, suspicious activity review, reporting, or related functions must maintain the confidentiality of AML/KYC information and must not make unauthorised disclosures.

PayOak will restrict disclosure of AML/KYC and suspicious activity information to circumstances permitted or required by law, regulation, competent authorities, lawful requests, or legitimate internal governance and control requirements.

Access to AML/KYC records is governed by applicable access controls, role-based permissions, information security requirements, and the principle of least privilege.

9. Refusal, Restriction and Escalation

PayOak may decline, delay, restrict, or suspend relevant services where required information or verification is incomplete or cannot be satisfactorily completed; where an unacceptable or unresolved AML/KYC risk is identified; where information appears inaccurate or misleading; where activity appears prohibited or unlawful; where reasonable suspicion exists; or where required by applicable law, regulation, or lawful authority.

PayOak may request additional information or documentation and may apply proportionate controls while a review is conducted.

Personnel must not circumvent AML/KYC requirements or disclose restricted information in a manner that could amount to tipping off or otherwise breach applicable law.

A restriction, suspension, or refusal under this section does not by itself constitute a finding that a customer has committed a criminal offence or other wrongdoing.

10. Record Keeping and Retention

PayOak maintains records necessary to demonstrate the operation of its AML/KYC framework and to support applicable legal, regulatory, compliance, audit, and investigation requirements.

Relevant records may include customer identification and verification information, account and business information, transaction records, customer due diligence and enhanced due diligence records, PEP assessments, monitoring and review records, relevant correspondence and communications, suspicious activity reviews, and reports made to competent authorities where applicable.

Records are retained for the period required by applicable law and regulatory requirements. Where an applicable AML requirement establishes a minimum retention period, PayOak will retain the relevant records for at least that period, subject to any longer period required for a particular record category.

AML/KYC retention is managed consistently with PayOak's Data Retention and Deletion Policy and Retention Register. Different categories of records may have different retention periods, and legal, regulatory, investigation, dispute, or other valid holds may extend retention where required.

AML/KYC records are stored securely and are accessible only to authorised personnel in accordance with applicable information security and access-control requirements.

11. Roles and Responsibilities

Management: provides oversight, appropriate resources, and direction for the AML/KYC framework and significant compliance risks.

Compliance / Designated AML-KYC Responsible Function: oversees customer due diligence and KYC controls, enhanced due diligence, suspicious activity review, transaction monitoring, PEP-related escalation, AML/KYC records, applicable reporting, material escalations, and periodic review of the framework.

Data Protection Officer (DPO): oversees privacy implications, lawful and proportionate processing, access and retention considerations, data subject requests, and privacy-related incidents. The DPO does not replace the responsibilities of the Compliance function.

Technology / Information Security: supports access controls, authentication, protection of AML/KYC information, logging, backups and recovery, and technical investigation of security incidents.

Support and other personnel: follow AML/KYC requirements relevant to their roles, protect confidential information, avoid unauthorised disclosures, and escalate suspicious or unusual activity through approved channels.

12. Training and Awareness

PayOak provides appropriate AML/KYC awareness and training to personnel whose roles involve customer onboarding, customer due diligence, transaction processing, compliance, customer support, monitoring, suspicious activity review, or access to AML/KYC information.

Training may cover this policy and related procedures, CDD and EDD, PEP controls, suspicious activity indicators, escalation requirements, confidentiality and tipping-off restrictions, recordkeeping, and material changes to applicable requirements or internal controls.

Training is provided periodically and when material changes to roles, products, processes, risks, or regulatory requirements make additional training appropriate.

13. Regulatory Cooperation and Information Requests

PayOak cooperates with competent regulatory, law-enforcement, judicial, and other authorised authorities as applicable to its activities and legal obligations.

Where required or lawfully authorised, PayOak may provide relevant records, information, or assistance through appropriate internal channels and authorised personnel.

Requests are handled in a controlled manner to ensure that information provided is relevant, appropriately protected, and legally permitted or required to be disclosed.

14. AML/KYC Compliance Review and Policy Maintenance

PayOak reviews this policy and its supporting AML/KYC controls periodically and when material changes occur, including changes to products or transaction flows, customer verification processes, applicable laws or regulatory requirements, material risk assessments, significant control weaknesses, or relevant incidents.

Material amendments to this policy are subject to appropriate review and approval before becoming effective.

Supporting procedures, registers, training materials, operational controls, and implementation documents may be updated without rewriting the entire policy where the changes remain consistent with this policy and applicable requirements.

15. Policy Exceptions and Escalation

Material exceptions to this policy or its supporting AML/KYC controls must be documented and escalated to the appropriate responsible function and management level.

No exception may be used to circumvent applicable law, regulatory requirements, or lawful directions.

Where personnel are uncertain about the appropriate AML/KYC treatment of a customer, transaction, activity, or request, the matter must be escalated to the Compliance / Designated AML-KYC Responsible Function.

Material unresolved AML/KYC risks must be escalated to management for appropriate decision-making and remediation.

16. Policy Approval and Effective Date

This policy is maintained by StoneBridge Technologies Limited for the PayOak service and becomes effective upon formal approval by the authorised management representatives.

The approved version is maintained as the current controlled version of the PayOak AML/KYC Policy.

17. Approval and Sign-Off

By approving this document, the authorised management representatives confirm that this version is adopted as the controlled AML/KYC Policy for PayOak, operated by StoneBridge Technologies Limited.

Version: 1.0

Effective Date: 25 September 2026

Next Review: Periodic review and upon material change