AML/KYC Policy

Flowbit Finance L.L.C-FZ Version dated 6 July 2026 1. Important Notice This AML/KYC Policy (the “Policy”) describes the approach of Flowbit Finance L.L.C-FZ (”Flowbit”, “we”, “us”, or “our”) to preventing money laundering, terrorist financing, proliferation financing, fraud, abuse, sanctions violations, and any other unlawful use of Flowbit Services. This Policy shall be read together with the Flowbit Terms & Conditions, Privacy Policy, Fee Schedule, Cardholder Agreement, Restricted Countries and Prohibited Use Rules, Fraud Policy, Chargeback & Dispute Policy, and any other Flowbit documents that may be available and applicable. Flowbit is not a bank, deposit-taking institution, card issuer, payment system, electronic money institution, broker, dealer, exchange, investment adviser, or financial adviser. Flowbit provides technology, interface, operational, and service access to certain card, payment, digital, and partner services where available and applicable. Certain Flowbit features may be provided through third-party partners, including card issuers, BIN sponsors, payment processors, card networks, crypto/liquidity providers, custodians, identity verification providers, anti-fraud and compliance providers, and other infrastructure participants. Such partners may establish their own requirements relating to identity verification, transaction limits, sanctions controls, source of funds, countries, MCCs, merchants, and transactions. 2. Purpose of this Policy The purpose of this Policy is to establish transparent rules under which Flowbit may: • conduct KYC and Customer Due Diligence (CDD) checks; • review transactions, cards, top-ups, refunds, disputes, and chargebacks; • apply a risk-based approach; • perform sanctions screening, PEP screening, wallet screening, and anti-fraud checks; • request additional documents or explanations; • restrict, delay, reject, or suspend transactions where risks are identified; • protect Flowbit, its users, partners, and payment infrastructure from unlawful, fraudulent, or abusive activities. 3. Core Principles Flowbit applies a risk-based approach. This means that the scope of verification depends on the specific product, transaction amount, country, user profile, source of funds, transaction history, funding method, account behavior, verification results, and partner requirements. Flowbit may apply different levels of verification, including: • Basic Checks — basic registration and technical verification. • Customer Due Diligence (CDD) — verification of identity, contact details, device information, source of funds, or a specific transaction. • Enhanced Due Diligence (EDD) — additional verification where elevated risk is identified. • Ongoing Monitoring — continuous monitoring of transactions, account behavior, refunds, disputes, chargebacks, wallet addresses, merchants, MCCs, countries, and other risk indicators. Flowbit is not required to disclose its internal risk models, monitoring rules, thresholds, suspicious activity indicators, or the specific reasons behind any risk decision where such disclosure could compromise the security of the Services, violate partner requirements, interfere with an investigation, or facilitate abuse. 4. When Flowbit May Request KYC or Additional Information Flowbit may request KYC verification, additional documents, explanations, or supporting information in the following circumstances: • during registration or when issuing certain types of cards; • when increasing account or transaction limits; • when enabling certain features or services; • in connection with large, unusual, frequent, or atypical top-ups; • for crypto top-ups where required by a risk review, partner requirements, or applicable rules; • in relation to refunds, disputes, chargebacks, reversals, or suspected chargeback abuse; • where there are indications that another person’s identity, payment card, wallet, or payment instrument is being used; • where card testing, multiple declined transactions, attempts to circumvent limits, or the creation of multiple Accounts are detected; • where Flowbit is accessed from a prohibited, sanctioned, or high-risk jurisdiction; • where sanctions screening, PEP screening, adverse media checks, fraud databases, wallet risk assessments, or other compliance reviews generate a match or risk indicator; • upon request from a partner, card issuer, card network, payment provider, compliance provider, or competent authority; • where previously provided information appears incomplete, inaccurate, outdated, or inconsistent; • where Flowbit reasonably determines that verification is necessary to protect the Services, users, partners, or payment infrastructure. 5. Information and Documents That May Be Requested Depending on the circumstances, Flowbit may request the following information from an individual user: • full legal name; • date of birth; • nationality; • country of residence; • residential address; • email address and telephone number; • a valid government-issued identity document; • a selfie, liveness check, or other verification confirming that the identity document belongs to the user; • proof of address; • proof of source of funds; • proof of the source of digital assets; • proof of wallet ownership; • proof of ownership of a payment instrument; • an explanation regarding a specific transaction, top-up, refund, dispute, or chargeback; • screenshots, receipts, invoices, merchant confirmations, or any other documents reasonably required for verification. If the user acts on behalf of a company or other legal entity, Flowbit may additionally request: • company registration documents; • a business license or equivalent document; • information regarding directors, officers, managers, and authorized signatories; • information regarding beneficial owners (UBOs); • ownership and control structure; • proof of authority of the person acting on behalf of the company; • a description of the business model; • the company’s website, domain name, public pages, or other evidence of business activities; • the expected activity profile; • source of funds and source of wealth; • documents relating to transactions or counterparties; • any additional information required as part of a risk review, partner requirements, or applicable regulations. 6. Identity Verification and Accuracy of Information Users must provide accurate, complete, and up-to-date information. Users must not use another person’s identity documents, payment instruments, wallets, cards, Accounts, contact information, or otherwise impersonate another individual or entity. Flowbit may refuse to provide Services, restrict an Account, suspend a transaction, refuse card issuance, reduce limits, withhold refunds, or terminate access to the Services if a user: • fails to provide requested information; • provides incomplete, false, outdated, or inconsistent information; • refuses to explain the origin of funds or the purpose of a transaction; • uses another person’s information or documents; • attempts to circumvent Flowbit’s limits, verification procedures, or rules; • uses the Services for unlawful, fraudulent, or abusive purposes. 7. Sanctions, PEP, and Adverse Media Screening Flowbit may screen users, beneficial owners, wallets, transactions, countries, merchants, and counterparties against sanctions lists, terrorist lists, politically exposed person (PEP) databases, adverse media sources, fraud databases, wallet risk databases, and other relevant data sources where necessary for security, compliance, partner requirements, or applicable regulations. Flowbit may restrict, delay, reject, or block a transaction, Account, card, Virtual Balance, crypto top-up, refund, or any other Service where a match or potential match is identified with sanctions lists, terrorist lists, PEP databases, adverse media, fraud indicators, wallet risk assessments, or other compliance risk signals. Flowbit may request additional information from the user in order to resolve a potential false positive or verify the legitimacy of a transaction. 8. Wallet Screening and Crypto-Related Checks Where a user utilizes crypto top-ups, digital assets, blockchain transactions, or wallet addresses, Flowbit may perform wallet screening and blockchain transaction analysis. Flowbit may consider, among other factors: • wallet address; • blockchain network; • transaction hash; • transaction amount and digital asset; • source of incoming funds; • associated wallet risk score; • connections to mixers, tumblers, darknet marketplaces, scams, hacks, ransomware, sanctioned entities, gambling services, high-risk exchanges, fraud schemes, or other high-risk sources; • attempts to structure or split transactions; • frequency and transaction patterns; • whether the transaction is consistent with the user’s expected activity profile. Flowbit may reject, delay, return, or refuse to credit a crypto top-up where the transaction does not comply with the requirements of the relevant Service, partner requirements, internal risk review, sanctions rules, AML/KYC requirements, or other applicable restrictions. 9. Source of Funds and Source of Wealth Flowbit may request evidence of the source of funds or the source of digital assets where a transaction, Account activity, or the user’s risk profile requires additional verification. Such documentation may include, without limitation: • bank statements; • cryptocurrency exchange statements; • proof of income; • employment verification; • invoices; • contracts; • tax documents; • sale agreements; • trading history; • proof of wallet ownership; • cryptocurrency exchange withdrawal confirmations; • any other documents reasonably demonstrating the lawful origin of funds or digital assets. Failure to provide such documentation may result in delays, refusal to credit funds, reduced limits, Account restrictions, withheld refunds, or termination of the user’s access to the Services. 10. Ongoing Monitoring Flowbit may conduct ongoing monitoring of transactions and Account activity throughout the user’s relationship with the Services. Monitoring may include, among other things: • deposits, top-ups, withdrawals, and payments; • card transactions; • declined transactions; • merchants, Merchant Category Codes (MCCs), and transaction jurisdictions; • refunds, disputes, chargebacks, and reversals; • crypto top-ups and wallet addresses; • device intelligence, IP addresses, session data, and device behavior; • login attempts; • customer support communications; • transaction frequency and behavioral patterns; • indicators of card testing; • indications that an Account is being used by an unauthorized third party; • indicators of refund or chargeback abuse. Flowbit may review and reassess a user’s risk profile at any time during the provision of the Services. 11. Enhanced Due Diligence (EDD) Flowbit may apply Enhanced Due Diligence (EDD) where a user, transaction, country, merchant, wallet, MCC, source of funds, or Account activity presents an elevated level of risk. EDD measures may include, without limitation: • requesting additional documents; • verification of the source of funds; • verification of the source of digital assets; • verification of the source of wealth; • confirmation of wallet ownership; • confirmation of ownership of a payment instrument; • enhanced transaction analysis; • manual review of the Account; • approval by an authorized Flowbit employee or partner; • reduction of transaction or Account limits; • temporary restrictions on transactions; • prohibition of specific features, countries, merchants, MCCs, or funding methods. 12. Prohibited and High-Risk Activities Users must not use Flowbit for any unlawful, fraudulent, deceptive, sanctioned, abusive, or high-risk activity. Without limitation, users are prohibited from using Flowbit in connection with: • money laundering; • terrorist financing; • proliferation financing; • sanctions evasion or circumvention; • funds derived from illegal activities; • fraud, scams, phishing, card testing, or account takeover; • abuse of refunds, disputes, or chargebacks; • the use of another person’s cards, wallets, identity documents, or Accounts; • the sale or purchase of prohibited goods or services; • gambling, betting, casinos, or other high-risk gaming activities; • adult content, pornography, escort services, or sexual services; • narcotics, controlled substances, weapons, ammunition, or explosive materials; • counterfeit documents, stolen goods, or counterfeit products; • attempts to circumvent transaction limits, geographic restrictions, merchant rules, or card program requirements; • any activity prohibited by Flowbit, its partners, card issuers, card networks, merchants, or applicable law. Flowbit may prohibit or restrict specific merchants, Merchant Category Codes (MCCs), countries, transaction categories, funding methods, wallets, digital assets, platforms, services, or usage scenarios that are considered prohibited, unsupported, or high-risk. 13. Refunds, Disputes, Chargebacks, and Abuse Flowbit may review refunds, disputes, chargebacks, reversals, and related transactions for indications of fraud, abuse, unjustified disputes, negative balances, reversal of provisional credits, or other operational and financial risks. Where Flowbit reasonably suspects abuse of refunds, disputes, or chargebacks, Flowbit may: • restrict the user’s Account; • suspend or block a card; • place a hold on available funds; • refuse a refund; • charge applicable fees; • offset amounts against any negative balance, expenses, penalties, fees, or other obligations owed by the user; • request additional documents or explanations; • share relevant information with partners, card issuers, card networks, anti-fraud providers, compliance providers, or competent authorities; • terminate the user’s access to the Services. 14. Actions Taken by Flowbit in Response to Risk or Violations Where Flowbit identifies or reasonably suspects a risk, violation, fraudulent activity, sanctions match, AML/KYC issue, abuse, or breach of partner requirements, Flowbit may, to the extent permitted under applicable law: • request additional information or documentation; • delay a transaction; • reject a transaction; • refuse to issue a card; • reduce transaction or Account limits; • restrict specific Services or features; • suspend an Account; • block a card; • place a temporary hold on funds pending completion of a review; • refuse a refund; • offset debts, negative balances, fees, expenses, or dispute and chargeback fees against available funds; • terminate the user’s relationship with Flowbit; • disclose relevant information to partners, service providers, card networks, compliance providers, anti-fraud providers, or competent authorities; • take any other reasonable measures necessary to protect Flowbit, its users, partners, or the payment infrastructure. Flowbit may implement such measures without prior notice where providing notice could increase risk, violate partner requirements, interfere with an investigation, reveal internal risk controls, or facilitate abuse. 15. Suspicious Activity and Prohibition of Tipping-Off Flowbit may investigate suspicious transactions and suspicious activity. Where required or permitted by applicable law, partner rules, or security requirements, Flowbit may disclose relevant information to competent authorities, partners, or service providers. Flowbit may be prohibited from disclosing, and therefore may decline to disclose, the existence, content, status, or details of any suspicious activity report, investigation, compliance review, sanctions review, risk assessment, or communication with competent authorities where such disclosure is prohibited, restricted, or could prejudice an investigation. 16. Reliance on Third-Party Providers Flowbit may engage independent third-party service providers to perform identity verification, liveness checks, sanctions screening, PEP screening, adverse media screening, wallet screening, fraud monitoring, transaction monitoring, document verification, device intelligence, compliance reviews, and other verification or security procedures. The use of third-party providers does not necessarily mean that Flowbit controls every aspect of the provider’s independent processing of personal data. In certain circumstances, card issuers, payment partners, card networks, compliance providers, or other service providers may process information in accordance with their own legal obligations, internal policies, regulatory requirements, and privacy policies. 17. Record Retention Flowbit may retain AML/KYC, Customer Due Diligence (CDD), Enhanced Due Diligence (EDD), transaction monitoring, sanctions screening, wallet screening, customer support, dispute, chargeback, fraud, and other related records for as long as reasonably necessary to provide the Services, maintain security, comply with partner requirements, satisfy compliance obligations, and fulfill accounting, tax, audit, legal, risk management, and operational purposes. Certain records may be retained for at least five (5) years following the closure of an Account, completion of a transaction, termination of the user’s relationship with Flowbit, or the conclusion of any related dispute, investigation, review, or legal proceeding, unless a longer retention period is required or permitted by applicable law, partner requirements, service provider obligations, card network rules, court orders, regulatory authorities, or competent governmental authorities. 18. Processing of Personal Data Personal data, identity documents, technical information, transaction data, wallet data, risk indicators, sanctions screening results, fraud indicators, and other relevant information are processed in accordance with the Flowbit Privacy Policy. The user acknowledges and understands that, for the purposes of AML/KYC compliance, security, fraud prevention, card services, crypto top-ups, disputes, chargebacks, and the operation of partner services, Flowbit may disclose or transfer relevant information to third parties, including card issuers, BIN sponsors, payment service providers, card networks, crypto and liquidity providers, custodians, KYC providers, anti-fraud providers, compliance providers, professional advisers, and competent authorities where required or permitted. 19. User Responsibilities Users are responsible for: • providing accurate, complete, and up-to-date information; • responding promptly to requests from Flowbit; • refraining from using another person’s identity, documents, cards, wallets, payment instruments, or Accounts; • not attempting to circumvent transaction limits, verification procedures, or other restrictions; • using the Services solely for lawful purposes; • maintaining the security of their device, Telegram account, email account, one-time passwords (OTP), PIN, passwords, card details, and wallet credentials; • notifying Flowbit immediately of any suspected unauthorized activity, compromised access, unauthorized transactions, security incidents, or operational errors. 20. Changes to this Policy Flowbit may amend or update this Policy from time to time in order to reflect changes to the Services, partner requirements, applicable laws, internal risk controls, AML/KYC procedures, sanctions requirements, card program rules, or Flowbit’s operational model. Updates may be published through the Flowbit website, mobile application, Telegram Mini App, email, push notifications, customer support channels, or other electronic communication methods. By continuing to use the Services after an updated version of this Policy becomes effective, the user acknowledges and agrees to the revised Policy. 21. Contact Information Flowbit Finance L.L.C-FZ Registration Number: 2541754 Registered Address: Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates Email: <a href="mailto:company@flowbitfinance.com" rel="noopener noreferrer">company@flowbitfinance.com</a>