Sanctions Compliance Policy

This Sanctions Compliance Policy (hereinafter — the "Policy") establishes the principles and procedures for compliance with sanctions restrictions by RBY Commerce Ltd. (hereinafter — the "Company", "MulenPay").

The purpose of the Policy is to prevent the use of the Company services for circumventing international sanctions, financing prohibited activities, as well as to minimise legal, financial, and reputational risks.

The Company adheres to a zero-tolerance principle towards violations of sanctions legislation and applies a risk-based approach when assessing clients, partners, and transactions.

This Policy applies to:

• users of MulenPay services;
• merchants;
• partners;
• service providers;
• representatives of clients;
• beneficial owners of clients;
• counterparties of the Company.

The Company screens clients and counterparties for the presence of sanctions restrictions in accordance with international sanctions programmes, including but not limited to:

• sanctions of the United Nations Security Council;
• sanctions of the European Union (EU);
• sanctions of the United Kingdom (UK Sanctions List);
• sanctions of the United States Office of Foreign Assets Control (OFAC);
• other internationally recognised sanctions regimes.

The Company is entitled to use third-party databases, compliance monitoring systems, and sanctions screening solutions.

The Company is entitled to conduct screening of:

• clients;
• merchants;
• beneficial owners;
• company directors;
• authorised representatives;
• business partners.

Screening may be conducted:

• before the commencement of cooperation;
• during the course of service provision;
• upon a change in the ownership structure of the client;
• upon the emergence of suspicions or elevated risk.

The Company does not provide services to persons and organisations:

• included in international sanctions lists;
• subject to sanctions restrictions;
• controlled by sanctioned persons;
• acting in the interests of sanctioned persons;
• using the Company services to circumvent sanctions.

The Company is entitled to refuse service even in the absence of direct inclusion in sanctions lists if there are reasonable suspicions of the client being connected with sanctioned activity.

The Company is entitled to restrict or prohibit the provision of services to clients connected with jurisdictions in respect of which international sanctions or elevated restrictions apply.

The Company independently determines the list of restricted jurisdictions based on:

• applicable sanctions programmes;
• requirements of payment partners;
• requirements of banks;
• internal risk management procedures.

The Company carries out continuous monitoring of client activity and transactions in order to identify:

• attempts to circumvent sanctions;
• the use of nominee persons;
• concealed beneficial owners;
• shell companies;
• unusual transactions;
• transactions without an apparent economic purpose.

Where necessary, the Company is entitled to request additional information and documents.

Upon identifying sanctions risks, the Company is entitled to:

• refuse registration;
• refuse the connection of services;
• restrict access to the services;
• temporarily suspend service provision;
• terminate cooperation;
• request additional documentation;
• conduct Enhanced Due Diligence of the client.

The adoption of the said measures is carried out at the discretion of the Company and does not require prior notification of the client.

Clients undertake to:

• provide accurate information;
• immediately notify the Company of changes in the ownership structure;
• not use the Company services to circumvent sanctions restrictions;
• provide documents at the request of the Company;
• comply with applicable legislation and international sanctions requirements.

The client bears full responsibility for:

• the accuracy of the information provided;
• the lawfulness of its activities;
• compliance with sanctions requirements;
• the actions of its representatives, employees, and beneficial owners.

The Company bears no liability for losses of the client arising as a result of the application of the measures provided for by this Policy.

The Company is entitled to transfer information about clients to:

• banks and payment partners;
• compliance service providers;
• government authorities;
• law enforcement authorities;
• other authorised organisations,

if such transfer is required by legislation, contractual obligations, or is necessary for compliance with sanctions requirements.

The Company reserves the right to amend this Policy at any time.

The new version takes effect from the moment of its publication on the Website.

Continued use of the Company services signifies the consent of the client to the current version of the Policy.