AML, Sanctions and Business-Access Policy

1. Technology scope and regulatory boundaries

All transaction principal and settlement funds are processed by independent, appropriately licensed or authorized financial institutions, or, for lawful supported on-chain transfers, by smart contracts controlled by the merchant or an independent third party. A smart contract is not itself a licensed institution and does not replace any required authorization. FinLinks does not control those contracts or their administrative keys and has no authority to sign, redirect, freeze, or retain transaction principal. FinLinks does not provide merchant or end-user financial accounts, pooled balances, stored value, deposit products, yield, or personal remittance or retail currency-exchange services.

FinLinks supports lawful B2B use and must comply with laws actually applicable to its activities. Describing software as TSP does not establish a regulatory exemption. Any MSB registration is not government endorsement or authorization for every activity or jurisdiction. This policy does not treat institution-specific CDD rules as universally applicable to software providers.

2. Business verification and internal controls

Before approved software access, business identity, registration, ownership, authorized-signatory information, intended use and relevant provider requirements may be reviewed proportionately to risk. Merchants must supply accurate documents and update material changes. Enhanced review may be needed for higher-risk activities. Provider KYB and acceptance remain independent.

FinLinks must maintain appropriate written risk procedures, assigned compliance responsibility, staff guidance and training, and periodic review proportionate to its actual role and applicable obligations. No unsupported certification, continuous automated screening capability, or universal statutory five-pillar requirement is asserted.

3. Sanctions and prohibited uses

Unlawful activity, sanctions evasion, fraud, deceptive aggregation, unlicensed regulated business, and unauthorized use of financial data are prohibited. Apply current legally relevant sanctions, designations, ownership/control rules, and licensing exceptions rather than relying solely on an embedded country list. Additional commercial risk restrictions must be identified as company policy rather than statutory comprehensive sanctions.

Screening of business parties, provider instructions or wallet metadata, where enabled and legally justified, supports access risk review. FinLinks may decline to forward an instruction or suspend API access; only the responsible provider or competent authority can lawfully restrict or freeze underlying funds. It cannot guarantee detection of every prohibited transaction.

4. Escalation, reporting, and confidentiality

Potentially suspicious activity should be escalated to the compliance contact, investigated proportionately, and referred or reported to the appropriate provider or authority where law requires or permits. FinLinks files a SAR only where a reporting duty applicable to its actual activities requires it, and must preserve any applicable reporting confidentiality. Nothing requires disclosure of a SAR, confidential review, or restricted information to a merchant.

5. Records, fees, and independent execution

Verification, access-review and instruction-data records are retained only for justified business purposes and specific applicable legal periods; not every record is automatically subject to the same five-year rule. Retention triggers, access restrictions and lawful holds must be documented consistently with the Privacy Policy.

Transaction, conversion, clearing, and network fees are charged or deducted by the applicable licensed or authorized provider under its agreement with the merchant. FinLinks does not deduct fees from merchant receipts, intercept incoming principal, or remit a net settlement balance. The merchant pays FinLinks separately invoiced technology software service fees under an agreed order form. Receipt of payment for FinLinks' own software services is not receipt of customer transaction principal. FinLinks never holds, handles, or retains merchant or end-user transaction principal or settlement funds.

Underlying payment execution, foreign exchange, clearing, and movement of funds are carried out by independent third-party institutions under their own authorizations and agreements. FinLinks only forwards merchant-authorized instructions and orchestrates APIs and data records. FinLinks is not a guarantor, co-obligor, settlement counterparty, or agent of those institutions and does not assume joint or several liability for their outages, delays, insolvency, rejected instructions, reversals, or failed settlements. To the extent permitted by law, losses attributable solely to an independent provider are that provider's responsibility under its applicable agreement. This allocation does not excuse FinLinks' own breach or any liability that cannot lawfully be excluded.

This policy is an operational notice, not a separate guarantee of transaction success or a waiver of statutory duties. Contractual remedies are governed by the accepted MSA and Terms, subject to mandatory law.

6. Contact and updates

Finlinks Global Solutions LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States. Legal and privacy: legal@finlinksglobal.com. Software support: support@finlinksglobal.com. Compliance: compliance@finlinksglobal.com.

Review this policy when services, laws or provider requirements change. Material contractual changes require the acceptance or notice procedure in the relevant agreement.