AML & Compliance Policy

2. Scope

This Policy applies to:

• individual Users
• business customers
• merchants
• API clients
• institutional customers
• beneficial owners
• authorized representatives
• counterparties interacting with Meridian where applicable

The Policy applies across every Meridian interface, including:

• Website
• Telegram Bot
• mobile applications
• web applications
• APIs
• merchant dashboard
• customer support channels
• future Meridian products

3. Compliance Principles

Meridian maintains a compliance framework based upon internationally recognized risk management principles.

The objectives of the framework include:

• protecting Users
• protecting the integrity of the Platform
• preventing financial crime
• supporting lawful use of Digital Assets
• managing operational risk
• complying with applicable legal obligations
• maintaining appropriate internal controls

Meridian continuously reviews and improves its compliance framework as the Platform evolves.

4. Risk-Based Approach

Meridian applies a risk-based approach when providing Services.

Compliance measures may vary depending upon factors including:

• jurisdiction
• customer profile
• transaction volume
• transaction frequency
• transaction value
• supported Digital Assets
• blockchain risk indicators
• source of funds
• source of wealth
• products used
• delivery channels
• behavioral indicators
• sanctions exposure
• internal risk assessment

Higher-risk relationships may be subject to enhanced compliance procedures.

Meridian reserves the right to determine the level of due diligence appropriate for each User.

5. Customer Acceptance

Meridian reserves the right to determine whether to establish or maintain a business relationship with any prospective or existing User.

Meridian may decline, suspend, restrict, or terminate Services where it reasonably determines that the associated legal, regulatory, operational, or financial crime risk is unacceptable.

When evaluating customer relationships, Meridian may consider factors including:

• identity verification results
• sanctions screening
• adverse media
• geographic risk
• blockchain risk
• source of funds information
• intended use of the Platform
• transaction profile
• beneficial ownership
• previous compliance history

Meridian is not obligated to disclose internal customer acceptance criteria.

6. Customer Identification (KYC)

Meridian applies Know Your Customer ("KYC") procedures designed to establish and verify the identity of Users before providing certain Services or where otherwise required by law or internal risk controls.

Depending on the circumstances, Users may be required to provide:

• full legal name
• date of birth
• nationality
• residential address
• government-issued identification
• proof of address
• contact information
• tax residency information
• corporate documentation
• other information reasonably requested for compliance purposes

Meridian may verify information using reliable independent sources and authorized verification providers.

Identity verification may be required:

• during onboarding
• before certain Transactions
• periodically during the customer relationship
• following material account changes
• where unusual activity is detected

7. Enhanced Due Diligence (EDD)

Meridian may apply Enhanced Due Diligence ("EDD") where increased risk is identified.

EDD measures may include:

• additional identity verification
• documentary verification
• video verification
• source of funds verification
• source of wealth verification
• verification of business activities
• verification of beneficial ownership
• senior compliance review
• additional transaction monitoring

Completion of EDD does not guarantee continued access to the Platform.

Meridian may request updated information at any time throughout the customer relationship.

8. Beneficial Ownership

Where Services are provided to legal entities, trusts, foundations, partnerships, or similar organizations, Meridian may require identification of the natural persons who ultimately own or control the customer.

Meridian may request:

• incorporation documents
• shareholder registers
• ownership charts
• constitutional documents
• information regarding directors and officers
• beneficial ownership declarations
• supporting corporate documentation

Meridian may require additional information where ownership structures are complex or insufficiently transparent.

9. Ongoing Customer Monitoring

Compliance obligations continue throughout the entire customer relationship.

Meridian may conduct ongoing monitoring of:

• customer information
• transaction activity
• blockchain activity
• changes in risk profile
• sanctions exposure
• unusual behavior
• account activity
• beneficial ownership information

Users are responsible for ensuring that information provided to Meridian remains accurate and up to date.

Meridian may periodically request updated documentation or information.

Failure to cooperate with ongoing compliance reviews may result in restrictions, suspension, or termination of Services.

10. Transaction Monitoring

Meridian maintains a risk-based transaction monitoring program designed to identify unusual, suspicious, or potentially unlawful activity throughout the customer relationship.

Transaction monitoring is performed on an ongoing basis using a combination of automated systems, internal controls, blockchain analytics, and manual compliance reviews where appropriate.

Monitoring may consider:

• transaction value
• transaction frequency
• transaction velocity
• geographic exposure
• customer risk profile
• blockchain risk indicators
• historical account activity
• wallet behavior
• transaction patterns
• supported Digital Assets
• unusual account activity
• deviations from expected customer behavior

Monitoring thresholds are determined internally and may be modified without prior notice.

Meridian is not obligated to disclose its monitoring methodologies, scoring models, or internal compliance criteria.

11. Blockchain Analytics

Meridian may utilize blockchain analytics technologies to enhance financial crime prevention and support compliance with applicable legal obligations.

Blockchain analytics may be used to:

• identify high-risk wallet addresses
• detect exposure to illicit activity
• assess transaction risk
• identify sanctioned wallets
• monitor blockchain transaction flows
• investigate suspicious activity
• identify links between blockchain addresses
• support internal investigations
• assist law enforcement cooperation where required

Meridian may engage independent blockchain intelligence providers to assist with blockchain risk analysis.

The use of blockchain analytics does not guarantee detection of every unlawful transaction.

12. Wallet Risk Assessment

Meridian evaluates blockchain wallet risk using internal and external risk indicators.

Risk factors may include exposure to:

• sanctioned entities
• terrorist financing
• ransomware
• darknet marketplaces
• fraud
• phishing
• stolen assets
• mixers or tumblers
• sanctioned virtual asset services
• scams
• malware operations
• illicit marketplaces
• high-risk jurisdictions

Wallets presenting elevated risk may be subject to:

• enhanced due diligence
• delayed transactions
• additional verification
• transaction restrictions
• temporary suspension
• permanent refusal of service

13. Sanctions Compliance

Meridian maintains a sanctions compliance program designed to prevent the provision of Services where prohibited by applicable sanctions laws or internal risk controls.

Meridian may screen Users, beneficial owners, counterparties, and blockchain wallet addresses against sanctions lists and other compliance databases.

Sanctions screening may include, where applicable:

• United Nations sanctions
• United States sanctions administered by OFAC
• European Union sanctions
• United Kingdom sanctions
• and other sanctions programs that Meridian determines are relevant to its compliance framework

Meridian reserves the right to suspend, reject, or terminate Services where sanctions concerns are identified.

Nothing in this Policy obligates Meridian to provide Services to any person or entity subject to sanctions or other legal restrictions.

14. Politically Exposed Persons (PEPs)

Meridian applies a risk-based approach to relationships involving Politically Exposed Persons ("PEPs"), their family members, and close associates.

Where appropriate, Meridian may perform:

• enhanced identity verification
• additional background checks
• source of funds verification
• source of wealth verification
• senior compliance approval
• enhanced transaction monitoring
• periodic compliance reviews

PEP status does not automatically prevent a User from accessing the Platform but may result in additional compliance measures.

15. Source of Funds and Source of Wealth

Meridian may request information regarding the origin of assets or financial resources used in connection with the Platform.

Depending on the assessed level of risk, Users may be asked to provide documentation relating to:

• employment income
• business income
• investments
• inheritance
• sale of assets
• company revenues
• mining activities
• other lawful sources of funds

Meridian may request supporting documentation where reasonably necessary to understand the origin of assets.

Failure to provide requested information may result in restrictions or termination of Services.

16. Suspicious Activity

Meridian maintains internal procedures for identifying and responding to potentially suspicious activity.

Indicators of suspicious activity may include, without limitation:

• unusual transaction patterns
• rapid movement of Digital Assets
• attempts to conceal beneficial ownership
• use of false identification documents
• inconsistent customer information
• transactions lacking apparent economic purpose
• unusual blockchain exposure
• sanctions indicators
• attempts to circumvent compliance procedures
• multiple linked accounts
• suspected fraud

Meridian evaluates suspicious activity using a risk-based approach and may escalate matters for further review.

17. Internal Escalation

Where compliance concerns arise, Meridian may escalate matters internally for additional review.

Escalation may involve:

• additional compliance personnel
• senior management review
• legal review
• enhanced due diligence
• transaction suspension
• account restrictions
• requests for additional documentation

Compliance decisions are based on Meridian's internal risk assessment and applicable legal obligations.

Meridian is not required to disclose the internal rationale supporting compliance decisions.

18. Regulatory Reporting

Where required or permitted by Applicable Law, Meridian may report information relating to suspected unlawful activity to competent governmental authorities.

Such reporting may include:

• suspicious transaction reports
• sanctions-related reports
• fraud reports
• law enforcement requests
• regulatory inquiries
• court orders
• legally required disclosures

Meridian may be prohibited by law from informing a User that such a report has been made.

Nothing in this Policy requires Meridian to delay or refrain from making legally required reports.

19. Record Keeping

Meridian maintains records relating to customer onboarding, identity verification, compliance reviews, transactions, communications, investigations, and other compliance activities in accordance with applicable legal obligations and internal compliance procedures.

Records may include:

• customer identification information
• KYC documentation
• Enhanced Due Diligence documentation
• beneficial ownership information
• transaction records
• blockchain analytics results
• sanctions screening results
• compliance reviews
• internal investigation records
• communications relating to compliance matters
• audit logs
• regulatory correspondence

Records are retained only for as long as reasonably necessary to:

• comply with Applicable Law
• satisfy regulatory obligations
• support investigations
• resolve disputes
• protect Meridian's legal rights
• maintain Platform security

Following expiration of the applicable retention period, records may be securely deleted, anonymized, or otherwise disposed of in accordance with Meridian's internal retention procedures.

20. Compliance Governance

Meridian maintains internal governance procedures designed to support effective compliance management.

The compliance framework may include:

• written internal policies
• documented procedures
• risk assessments
• internal controls
• escalation procedures
• periodic policy reviews
• management oversight
• independent compliance assessments where appropriate

Compliance procedures are periodically reviewed and updated to reflect changes in:

• Applicable Law
• regulatory expectations
• emerging financial crime risks
• technology
• business operations
• cybersecurity threats

21. Employee Training

Meridian seeks to ensure that employees and authorized personnel involved in the operation of the Platform receive appropriate compliance awareness and training.

Training programs may include:

• anti-money laundering
• sanctions compliance
• fraud prevention
• cybersecurity awareness
• data protection
• financial crime indicators
• suspicious activity identification
• internal reporting procedures
• regulatory developments

Training content and frequency may vary depending upon an individual's responsibilities.

22. Third-Party Compliance Providers

Meridian may engage qualified third-party service providers to assist in fulfilling compliance obligations.

Such providers may perform services including:

• identity verification
• document authentication
• biometric verification
• blockchain analytics
• sanctions screening
• politically exposed person screening
• adverse media screening
• fraud detection
• transaction monitoring
• compliance technology services

Meridian remains responsible for the overall operation of its compliance framework and seeks to engage providers that maintain appropriate security, confidentiality, and operational standards.

23. High-Risk Jurisdictions

Meridian applies enhanced scrutiny to relationships involving jurisdictions assessed as presenting elevated legal, regulatory, sanctions, corruption, or financial crime risks.

Risk assessments may consider:

• international sanctions
• governmental restrictions
• corruption indicators
• terrorism financing risks
• financial crime risks
• public guidance issued by competent authorities
• Meridian's internal risk assessments

Meridian may:

• decline onboarding
• apply Enhanced Due Diligence
• restrict certain Services
• prohibit specific Transactions
• terminate existing relationships where reasonably necessary

Meridian does not publish a fixed list of restricted jurisdictions and may update internal risk assessments without prior notice.

24. Travel Rule Compliance

Where applicable to the Services provided and where required by Applicable Law, Meridian may implement procedures intended to facilitate compliance with virtual asset transfer information requirements commonly referred to as the "Travel Rule."

Such procedures may include:

• collection of originator information
• collection of beneficiary information
• verification of transfer details
• exchange of information with eligible counterparties where legally required
• retention of transfer records

Where the Travel Rule is not applicable to a particular transaction or jurisdiction, Meridian may nevertheless apply appropriate risk-based controls.

25. Regulatory Cooperation

Meridian may cooperate with:

• courts
• regulators
• financial intelligence units
• law enforcement agencies
• governmental authorities
• sanctions authorities
• tax authorities
• supervisory agencies
• other competent authorities

Cooperation may include:

• responding to lawful requests
• production of records
• preservation of evidence
• freezing or restricting Digital Assets where legally required
• implementation of court orders
• compliance with sanctions obligations
• assistance in financial crime investigations

Nothing in this Policy limits Meridian's ability to comply with lawful governmental requests.

26. Data Protection

Personal Data processed for compliance purposes is handled in accordance with the Meridian Privacy Policy and applicable data protection laws.

Compliance information is processed only for legitimate business, legal, regulatory, security, or fraud prevention purposes.

Access to compliance information is restricted to authorized personnel and service providers with a legitimate business need.

Appropriate administrative, technical, and organizational safeguards are implemented to protect compliance-related information.

27. Policy Updates

Meridian may amend this AML & Compliance Policy from time to time to reflect:

• changes in Applicable Law
• regulatory guidance
• developments in financial crime prevention
• technological improvements
• operational changes
• business developments

Updated versions become effective upon publication unless a later effective date is specified.

Continued use of the Platform following publication constitutes acceptance of the updated Policy.

28. Contact Information

Questions regarding this AML & Compliance Policy may be submitted through Meridian's official communication channels published on the Platform.

Compliance requests, regulatory communications, and legal inquiries should be directed to the designated compliance contact published on the Meridian Website.

29. Relationship with Other Policies

This AML & Compliance Policy should be read together with the following Meridian legal documents:

• Terms of Service
• Privacy Policy
• KYC Policy
• Custody Policy
• Risk Disclosure
• Fees Policy
• Cookie Policy
• Prohibited Use Policy
• Legal Requests Policy
• Complaints Policy

Where another Meridian policy specifically governs a particular subject matter, that policy shall apply in conjunction with this AML & Compliance Policy.

30. Effective Date

This AML & Compliance Policy is effective from the date stated above and remains in force until amended or replaced by Meridian S.A.