AML Policy

1. Introduction and Purpose

CODEGENIX LTD. ("Catalyst," "we," "our," or "us") is committed to preventing money laundering, terrorist financing, and other financial crimes. This Anti-Money Laundering (AML) Policy outlines our commitment to compliance with applicable laws and regulations.

This policy applies to all employees, contractors, and third parties acting on behalf of Catalyst. We are committed to:

• Complying with all applicable AML laws and regulations
• Implementing effective controls to detect and prevent financial crime
• Reporting suspicious activities to relevant authorities
• Maintaining appropriate records of customer transactions
• Providing ongoing training to our staff

2. Regulatory Framework

Our AML program is designed to comply with applicable laws and regulations, including but not limited to:

• The Money Laundering, Terrorist Financing and Transfer of Funds Regulations
• EU Anti-Money Laundering Directives (AMLD)
• Financial Action Task Force (FATF) Recommendations
• Local regulatory requirements in jurisdictions where we operate

We regularly review and update our policies to ensure continued compliance with evolving regulatory requirements.

3. Customer Due Diligence (CDD)

3.1 Customer Due Diligence

We apply a risk-based approach to customer verification. Concretely, we refuse new sign-ups from Russia, Belarus, Iran, North Korea, Syria and Cuba (by the visitor's country and the email address's domain) and refuse payments with a billing address in one of them, using that single maintained country list. Existing account holders keep access to their account and balance. This is a baseline automated control, not a substitute for a licensed sanctions/PEP screening vendor; we review and expand it as our compliance needs grow.

• Automated sanctioned-country blocking (visitor country and email domain at sign-up, billing country at checkout)
• Manual review of flagged accounts and payment records
• Enhanced due diligence for high-risk users or large transactions

4. Risk Assessment

4.1 Risk-Based Approach

We adopt a risk-based approach to AML compliance, assessing risks based on:

• Customer Risk: Type of customer, geographic location, occupation, transaction patterns
• Product Risk: Nature of services used, payment methods, transaction volumes
• Geographic Risk: Country of residence, countries involved in transactions
• Channel Risk: Non-face-to-face relationships, online transactions

4.2 High-Risk Indicators

We apply enhanced scrutiny to users or transactions exhibiting high-risk indicators, including:

• Politically Exposed Persons (PEPs) and their associates
• Users from high-risk jurisdictions
• Unusual or complex transaction patterns
• Inconsistencies between stated purpose and actual activity

5. Transaction Monitoring

5.1 Monitoring Systems

Sanctioned-country blocking is automated (see §3.1). Beyond that, transaction monitoring today is manual: our team reviews payment and account records for the red flags listed below. We are evaluating automated, real-time transaction monitoring (pattern recognition, threshold alerts, velocity checks) as a future enhancement to this policy.

5.2 Red Flags

We investigate transactions that may indicate money laundering, including:

• Transactions with no apparent business purpose
• Structuring transactions to avoid reporting thresholds
• Rapid movement of funds through accounts
• Transactions inconsistent with customer profile
• Multiple accounts with similar patterns or linked activity

6. Suspicious Activity Reporting

6.1 Internal Reporting

All employees are required to report suspicious activities. Reports should be made promptly and include all relevant details.

6.2 External Reporting

Where required by law, we file Suspicious Activity Reports (SARs) with the relevant Financial Intelligence Unit (FIU). We maintain strict confidentiality regarding SAR filings and do not inform the subject of any report.

6.3 Tipping Off

It is a criminal offense to "tip off" any person that a SAR has been or may be filed. All employees are prohibited from disclosing any information related to suspicious activity investigations.

7. Sanctions Compliance

We do not accept new sign-ups from Russia, Belarus, Iran, North Korea, Syria and Cuba. This is enforced automatically against a single maintained list: a check of the visitor's country and the email domain at sign-up, and a billing-country check at checkout.

These are country-level checks only. We do not check individual names against sanctions lists.

8. Record Keeping

We keep these records for the periods the law requires:

• Transaction records (credit top-ups and spending, invoices, paid orders): 7 years from the date of the transaction, the same period as our Privacy Policy §7 (this covers the 5-year minimum under anti-money laundering rules)
• Identity details and documents of specialists who have done paid work on the platform (legal name, date of birth, country, ID type and number, passport or ID, proof of address): 5 years after the relationship ends. We do not collect identity documents from customers.
• Internal suspicious activity reports: minimum 5 years
• Training records: minimum 5 years

Records are stored securely and made available to regulatory authorities upon request.

8.1 When you delete your account

Self-service account deletion (Privacy Policy §7) does not remove the records above. What happens depends on whether the account has any financial history:

• No purchases, paid projects or paid specialist work: there are no transactions to keep records of, so the account and everything linked to it are erased immediately. This includes a specialist application and any identity documents uploaded with it.
• With financial history: your name, email, photo, password, sign-in methods and messaging-app link are erased and every session is signed out immediately. The transaction records, invoices, paid orders and identity-verification status stay under an anonymous account. For a specialist, the public profile is taken off the list, and the identity details and documents from the application are kept for the period above.

Kept records are used only to meet these legal obligations and to answer lawful requests from authorities. They are not deleted automatically when the period ends: once it has passed, write to support@catalystai.expert and we will delete them.

9. Training and Awareness

We provide comprehensive AML training to all relevant staff:

• Initial training upon hiring
• Annual refresher training
• Updates on regulatory changes and new typologies
• Role-specific training for high-risk functions

10. Governance and Oversight

10.1 Independent Review

Our AML program is subject to regular independent review to ensure effectiveness and compliance. Findings are reported to senior management with recommendations for improvement.

11. User Obligations

By using our platform, users agree to:

• Provide accurate and complete identification information
• Update information promptly if it changes
• Not use the platform for any illegal purpose
• Cooperate with our verification and monitoring procedures
• Not structure transactions to evade reporting requirements

12. Consequences of Non-Compliance

Failure to comply with this policy or applicable AML laws may result in:

• Account suspension or termination
• Freezing of funds
• Reporting to law enforcement authorities
• Civil or criminal penalties

13. Policy Updates

This policy is reviewed annually and updated as necessary to reflect changes in regulations, business operations, or risk assessment. Material changes will be communicated to users through our platform.