Tovanix AML / Anti-Money Laundering Policy

Tovanix AML / Anti-Money Laundering Policy, covering on-chain business compliance framework, suspicious activity reporting process, and sanctions list screening mechanisms.

Tovanix Anti-Money Laundering and Compliance Policy

Effective Date: May 20, 2026 · Last Updated: September 29, 2026

This Anti-Money Laundering and Compliance Policy (hereinafter, this "Policy") is established by Astrenix Inc. (File #20261586266 · 1500 N GRANT ST STE R, Denver, CO 80203, US), the operating entity of Tovanix, and applies to all users who, through the Tovanix platform, use any business module involving crypto assets, virtual cards, cross-border payments, or other highly sensitive services.

Tovanix is committed to complying with the U.S. Bank Secrecy Act (BSA), the USA PATRIOT Act, the FinCEN compliance requirements applicable to Money Services Businesses (MSB), the sanctions rules of the Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury, as well as the anti-money laundering (AML), counter-terrorist financing (CFT), and counter-proliferation financing (CPF) laws and regulations of the countries and regions in which we operate.

This Policy forms an integral part of the Tovanix Terms of Service. In the event of any conflict with the Terms of Service, this Policy shall prevail.

---

1. Policy Objectives

1. Prevention of money laundering, terrorist financing, and sanctions evasion: to prevent illicit funds from entering or flowing through the Tovanix platform

2. Protection of compliant users: to safeguard the service experience of law-abiding users through tiered risk controls

3. Responsiveness to regulatory requirements: to cooperate with regulatory inquiries from the United States, the countries in which the platform operates, and international organizations

4. Preservation of the industry ecosystem: to build a compliant ecosystem together with upstream exchanges, card networks, SMS / SMTP carriers, and other partners

2. Platform Compliance Structure

| Role | Responsibilities |

|---|---|

| Chief Compliance Officer (CCO) | Overall responsibility for the compliance program, reporting directly to the Board of Directors |

| AML Compliance Function | Day-to-day KYT and sanctions screening, restricted-account appeal verification, and suspicious activity reporting |

| Risk Engineering Team | Automated rules engine, anomaly monitoring, and model evaluation |

| Legal Team | Regulatory communications, responses to legal process, and cross-border compliance advice |

| Data Protection Team | Protection of appeal-verification materials, cross-border transfers, and personal information compliance |

We apply a dual-review (four-eyes) mechanism and exit audits to compliance positions to ensure that no single individual can circumvent the compliance process.

3. Account Verification and Transaction Monitoring

Tovanix does not require KYC for registration or normal use of any business line. There is no KYC tier, self-service enrollment, or KYC-based limit or feature unlock for accounts in good standing. Individual transactions remain subject to payment-provider rules and platform risk controls.

Only an account that has actually been restricted needs to provide identity-verification materials when appealing to have that restriction lifted. The materials requested depend on the reason for the restriction and are reviewed by a person. Submitting materials does not guarantee that a restriction will be lifted. A declined payment or a risk alert alone is not an account restriction and does not trigger a KYC requirement.

Verification materials collected for an appeal are used for that review and handled under the Privacy Policy and Data Processing Agreement.

4. KYT (Transaction Monitoring) Rules

We conduct real-time KYT monitoring of all on-chain transactions, covering the following risk dimensions:

4.1 On-Chain Risk Label Screening

Through on-chain data partners (Chainalysis / Elliptic / TRM Labs or comparable services), we screen the following addresses:

Darknet marketplace addresses

Known scam, extortion, and ransom addresses

Wallet addresses subject to OFAC SDN sanctions

"Tainted funds" addresses flagged by card networks or upstream exchanges

Addresses associated with mixers (such as Tornado Cash)

4.2 Behavioral Risk Controls

Multiple small split transactions within a short period (suspected structuring / smurfing)

Multiple accounts registered from the same IP / device fingerprint (suspected multi-account money laundering)

Access at unusual times or from unusual geographic locations

Funds or device linkage to previously deactivated accounts

4.3 Disposition Measures

| Risk Level | Measures |

|---|---|

| Low | Recorded by the system; transaction permitted |

| Medium | Transaction suspended; the user is required to provide a supplementary declaration of source of funds |

| High | Transaction rejected; related funds frozen; investigation initiated |

| Critical | Account frozen immediately; a SAR (Suspicious Activity Report) is filed with FinCEN |

5. Sanctions Compliance

5.1 Sanctions List Screening

We screen the following sanctions lists in real time:

OFAC SDN List (Specially Designated Nationals)

OFAC Sectoral Sanctions Identifications List

UN Consolidated Sanctions List

EU Consolidated Financial Sanctions List

UK HM Treasury Sanctions List

5.2 Restricted Jurisdictions

Tovanix does not provide services to the following jurisdictions:

Jurisdictions subject to comprehensive OFAC sanctions: Cuba, Iran, North Korea, Syria, and Crimea / Donetsk / Luhansk (occupied regions of Ukraine)

Other jurisdictions subject to comprehensive UN / EU / UK sanctions

Jurisdictions where local law expressly prohibits crypto asset business (for example, certain Central Asian and North African countries)

If you access the platform from a restricted jurisdiction, we will:

Refuse registration

Freeze existing accounts (if an IP change to a restricted jurisdiction is detected)

Withhold refunds (for sanctions compliance purposes, the funds must remain frozen pending regulatory disposition)

5.3 Users with Multiple Nationalities

If you hold multiple nationalities or your place of residence differs from your nationality, we conduct sanctions screening on the basis of your actual place of residence. You are obligated to declare your place of residence truthfully; a false declaration will result in your account being frozen.

6. Suspicious Activity Reports (SAR)

In accordance with U.S. FinCEN regulations, we will file a Suspicious Activity Report with FinCEN in the following circumstances:

Suspicious crypto transactions of ≥ $5,000, individually or in aggregate

Transactions involving structuring

Transactions involving sanctioned jurisdictions or listed parties

Transactions involving known fraud, extortion, or money laundering patterns

Suspicious activity involving internal employees

The filing of a SAR is protected under BSA Section 5318(g)(2), and we will not disclose to the reported user the existence or content of any SAR (tip-off prohibition).

7. Internal Controls

7.1 Employee Training

All employees attend anti-money laundering compliance training at least once per year

Risk, compliance, and customer support staff receive specialized training each quarter

New employees complete a foundational AML / OFAC course within 30 days of onboarding

7.2 Independent Audits

An independent third party audits the AML program annually

Special audits are initiated following significant incidents

Audit reports are submitted to regulators upon request

7.3 Record Retention

| Data Type | Retention Period |

|---|---|

| Account-restriction appeal verification materials (if any) | As required by applicable law and the Privacy Policy |

| Transaction records | 5 years |

| SARs and supporting evidence | 5 years |

| KYT hit records | 5 years |

| Training records | 5 years |

8. User Responsibilities and Cooperation

As a Tovanix user, you undertake to:

1. Provide true, accurate, and complete registration information and, when appealing an account restriction, truthful verification materials

2. Refrain from using the platform for money laundering, terrorist financing, sanctions evasion, or any other unlawful activity

3. Refrain from holding accounts on behalf of others, lending your account, or transferring your account to any other person

4. Cooperate promptly in providing materials upon receipt of a compliance investigation notice

5. Refrain from attempting to circumvent sanctions screening by technical means (VPN / proxies / false identities)

In the event of a breach of any of the foregoing, we reserve the right to immediately freeze the account, withhold funds, and report the matter to law enforcement authorities.

9. Information Security

Materials submitted for an account-restriction appeal are handled under the Privacy Policy and Data Processing Agreement. Normal business use does not collect KYC materials.

10. Compliance Inquiries and Whistleblowing

If you become aware of suspicious transactions, compliance deficiencies, or employee misconduct on the Tovanix platform, you may report them through the following channels:

Compliance reporting email: [email protected] (subject prefix [Compliance])

Anonymous reporting: submissions via the Tor network are supported (see the "Compliance Center" in the console for details)

We undertake to protect the identity of whistleblowers and to conduct an independent investigation into the matters reported.

11. Changes to This Policy

This Policy is updated from time to time in response to changes in applicable law and business developments. Material changes will be announced through in-platform messages, email, and website notices, with a public notice period of at least 14 days before taking effect.

Continued use of the services constitutes acceptance of the amended Policy; if you do not agree, you may close your account before the changes take effect.

12. Contact Us

Compliance inquiries: [email protected] (subject prefix [AML] or [Compliance])

Operating entity: Astrenix Inc. (File #20261586266)

Registered office address: 1500 N GRANT ST STE R, Denver, CO 80203, United States

Regulatory counterparts: FinCEN (Financial Crimes Enforcement Network) and OFAC (Office of Foreign Assets Control, U.S. Department of the Treasury)