AML / CFT Policy

Plaitr is committed to preventing money laundering, terrorist financing, proliferation financing, and sanctions evasion through any product or service delivered on or through the Plaitr platform. This Policy is approved by Plaitr's senior management and reviewed at least annually.

This Policy is aligned with the FATF 40 Recommendations and the national AML/CFT frameworks applicable in the jurisdictions where Plaitr or its licensed partners operate, including (without limitation) the U.S. Bank Secrecy Act and OFAC sanctions program, the EU Anti-Money-Laundering Directives and the Markets in Crypto-Assets Regulation (MiCA), the UK Money Laundering Regulations 2017, the UAE AML/CFT framework and VARA/ADGM rules, the Singapore Payment Services Act, and the Prevention of Money Laundering Act and RBI Master Directions in India.

Plaitr is self-custodial. Balances live in a Squads smart account owned by the User's business and signed by the User's Privy wallet. Plaitr does not hold funds and does not hold a signing key. Fiat processing rails (ACH, SEPA, wires, and card issuance when live) are delivered by licensed payment partners (e.g. Bridge, Align) under their own licences. Regulated AML/CFT programs (jurisdiction-specific KYB, transaction monitoring on the underlying fiat rails, and regulator-facing suspicious activity reporting) are operated by those payment partners under the licence covering the User's corridor and currency.

Independently of the payment partners, Plaitr operates its own platform-level AML/CFT program that applies to every User of the platform regardless of which rails they use. It covers:

• Onboarding gate: KYB information collection, UBO verification via Didit at the 25% threshold, and acceptable-use screening against the Restricted Businesses List before a wallet is provisioned.
• Platform-layer sanctions and PEP screening: Users, directors, authorised signatories, and beneficial owners screened against OFAC, UN, EU, UK OFSI, India MHA/UAPA, UAE and adverse-media data at onboarding, on list updates, and prior to enabling any fiat rail. Confirmed hits block platform access before the User reaches a payment partner.
• Wallet-level activity monitoring:ongoing behavioural monitoring of on-chain and platform activity for consistency with the User's declared business profile, with rules for velocity, structuring, high-risk counterparties, and purpose-mismatch. Above-threshold activity is held for review by Plaitr Compliance.
• Escalation and reporting:internal escalation to Plaitr's Principal Officer / MLRO; where warranted, information is shared with the relevant payment partner so that partner can meet its regulatory reporting obligations, and Plaitr files its own report where legally required.
• Record retention: KYB, screening, monitoring, and case-management records retained for a minimum of five years post-relationship, or longer where local law requires.

The result is a two-layer program: Plaitr's internal controls apply to every User before any regulated rail is reached; the payment partner's regulated program then applies at the moment a fiat rail is used.

Plaitr's Compliance function is accountable to senior management for this Policy, for the gating program, and for responding to partner and regulator information requests. Material changes to the Policy require senior-management sign-off.

Plaitr conducts an enterprise-wide risk assessment covering customer, geographic, product, and channel risk factors. The assessment is reviewed at least annually and on material change (new product, new jurisdiction, new partner). See the Risk Assessment Framework.

Plaitr conducts business-only KYB in accordance with the KYB & Customer Due Diligence Policy. Beneficial-ownership checks are performed by Didit. Full, jurisdiction-specific KYB (entity verification, identity verification of record, and transaction monitoring) is performed by the licensed payment partner covering the User's corridor before that fiat rail is enabled.

Sanctions and PEP screening on regulated transaction flows is performed by the licensed payment partner covering the User's corridor, under that partner's own program. Partners screen against the lists that apply to the rails they run: OFAC in the US, UK OFSI, EU CFSP, India MHA/UAPA, UAE, and others.

At the platform layer, Plaitr additionally screens Users, directors, authorised signatories, and beneficial owners at onboarding and on list updates, and blocks platform access on a confirmed sanctions hit before it can reach a payment partner. Full detail is set out in the Sanctions Policy.

Regulated transaction monitoring on the underlying payment and stablecoin rails is performed by the licensed partner. Plaitr monitors platform-level activity for consistency with the User's declared business profile and for compliance with the Acceptable Use and Restricted Businesses policies, and escalates concerns to the relevant partner.

In accordance with FATF Recommendation 16 (the Travel Rule) and equivalent national regulations (including EU Regulation 2023/1113), for cross-border virtual asset transfers involving counterparties exceeding statutory thresholds (e.g., USD $1,000 / EUR €1,000), Plaitr and its licensed VASP partners transmit required originator and beneficiary information (including entity names, account identifiers, and national identity numbers where applicable) securely between ordering and beneficiary financial institutions prior to settlement.

Where Plaitr identifies activity giving rise to suspicion of money laundering, terrorist financing, sanctions evasion, or other financial crime, Plaitr will (a) notify the relevant licensed partner so that the partner can meet its regulatory reporting obligations to the competent Financial Intelligence Unit (for example FinCEN, the NCA, EEA FIUs, the UAE FIU via goAML, STRO, or FIU-IND) and (b) file its own report where directly required by law. Tipping-off is strictly prohibited.

Plaitr retains gating, screening, and monitoring records for a minimum of five years, or longer where required by applicable law. Regulated transaction records are maintained by the licensed partner.

Plaitr personnel receive AML/CFT training appropriate to their role at induction and periodically thereafter, reflecting current typologies and regulatory expectations relevant to a non- custodial platform.

Report a compliance concern or ask about this Policy: compliance@plaitr.com.