AML / CFT Policy

1. Introduction and Purpose

Redivian Limited ("Redivian") is committed to the highest standards of Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) compliance. This policy sets out our obligations and procedures for preventing, detecting, and reporting money laundering, terrorist financing, and other financial crimes in connection with our Services.

This policy is established in accordance with the following primary legislation and regulatory frameworks:

• Money Laundering (Prevention and Prohibition) Act 2022 (ML(PP)A 2022)
• Terrorism (Prevention and Prohibition) Act 2022
• Central Bank of Nigeria (CBN) AML/CFT/CPF Regulations 2023
• CBN Know Your Customer (KYC) Manual
• Nigerian Financial Intelligence Unit (NFIU) Guidelines
• Financial Action Task Force (FATF) 40 Recommendations, as implemented in Nigeria
• Proceeds of Crime (Recovery and Management) Act 2022

2. Key Definitions

For the purposes of this policy:

• Money Laundering: The process by which the proceeds of crime are concealed or disguised to make them appear as legitimate funds. Under the ML(PP)A 2022, this includes placement, layering, and integration of proceeds of a predicate offence.
• Terrorist Financing (TF): The provision or collection of funds, by any means, directly or indirectly, with the intention or knowledge that they are to be used to carry out terrorist acts or by terrorist organisations.
• Proliferation Financing (PF): The provision of funds or financial services used in the manufacture, acquisition, development, or use of weapons of mass destruction.
• Know Your Customer (KYC): The process of verifying the identity of customers and assessing the risks associated with their activities.
• Customer Due Diligence (CDD): The measures taken to identify and verify the identity of customers and beneficial owners, and to understand the nature and purpose of the business relationship.
• Enhanced Due Diligence (EDD): Additional measures applied to higher-risk customers, including Politically Exposed Persons (PEPs) and users from high-risk jurisdictions.
• Simplified Due Diligence (SDD): Reduced CDD measures applicable where the risk of money laundering is demonstrably low, subject to CBN approval.
• Politically Exposed Person (PEP): An individual who is or has been entrusted with a prominent public function in Nigeria or internationally, including heads of state, senior politicians, judicial officers, senior military officials, and their immediate family members and known close associates.
• Suspicious Transaction Report (STR): A mandatory report filed with the NFIU where there are reasonable grounds to suspect that a transaction involves the proceeds of crime or is connected to terrorist financing.
• Currency Transaction Report (CTR): A mandatory report filed with the NFIU for cash transactions exceeding ₦5,000,000 for individuals or ₦10,000,000 for corporate entities within a single business day.
• Beneficial Owner: A natural person who ultimately owns or controls a customer, or on whose behalf a transaction is being conducted.

3. Risk-Based Approach

Redivian adopts a risk-based approach (RBA) to AML/CFT compliance, as required by FATF recommendations and the CBN AML/CFT Regulations 2023. This means we allocate compliance resources proportionally to the level of money laundering and terrorist financing risk posed by individual customers, products, geographic exposures, and delivery channels.

3.1 Risk Categories

Customers are assessed and assigned one of the following risk categories:

• Low Risk: Individuals with verified Nigerian identity documents, stable transaction patterns consistent with their stated income, and no adverse information. May be subject to Simplified Due Diligence where permitted.
• Medium Risk: Customers whose transaction patterns, geographic exposure, or business activity presents moderate risk indicators. Standard Customer Due Diligence applies.
• High Risk: Politically Exposed Persons, customers with connections to high-risk jurisdictions identified by FATF, customers with adverse media coverage, business types with inherent AML risk, or customers exhibiting unusual transaction patterns. Enhanced Due Diligence applies.

3.2 Product Risk Assessment

Redivian conducts periodic risk assessments of all products and Services, including:

• Minttapp: Financial agreements between users carry moderate inherent risk. The structured nature of agreements, bilateral signing requirements, and spending wallet mechanism mitigate risk. Monitoring focuses on structuring patterns and unusual agreement frequency.
• DashDosh: Digital gifting presents risk of use for layering. Controls include transaction limits, recipient identity verification for amounts above defined thresholds, and pattern monitoring.
• CreditLens: Credit profiling services present lower ML/TF risk but must ensure data accuracy and prevent manipulation of credit profiles.
• Redivian Platform API: Developer access introduces the risk of third-party ML/TF exposure. Developer onboarding includes enhanced due diligence and ongoing monitoring of API usage patterns.

4. Customer Due Diligence (KYC/CDD)

4.1 When CDD Applies

Redivian conducts Customer Due Diligence:

• When establishing a new customer relationship
• When carrying out a transaction above prescribed thresholds
• When there is a suspicion of money laundering or terrorist financing, regardless of any exemption or threshold
• When there are doubts about the veracity or adequacy of previously obtained customer identification data
• At periodic review intervals determined by the customer's risk rating

4.2 Individual Customer KYC Requirements

For individual (retail) customers, we collect and verify:

• Full legal name (verified against government ID)
• Date of birth
• Residential address (current and verifiable)
• Bank Verification Number (BVN) — primary identity anchor in Nigeria
• National Identification Number (NIN) where applicable
• Government-issued photo ID (International Passport, Driver's Licence, or Voter's Card)
• Phone number linked to the BVN
• Source of funds declaration for high-value transactions

4.3 Business / Corporate Customer KYB Requirements

For corporate and business customers (Know Your Business — KYB), we collect and verify:

• Company name and registered address
• CAC registration number and Certificate of Incorporation
• Memorandum and Articles of Association
• Tax Identification Number (TIN)
• Details of all directors and significant shareholders (holding more than 5% of shares)
• Beneficial ownership declaration identifying all individuals who ultimately own or control more than 25% of the entity
• Business description and source of funds
• Proof of business address (utility bill or bank statement not older than 3 months)

4.4 Enhanced Due Diligence (EDD)

EDD is mandatory for Politically Exposed Persons, customers with connections to FATF high-risk or non-cooperative jurisdictions, customers whose transaction volumes are inconsistent with their stated profile, non-face-to-face customers for high-value services, and any customer flagged by our automated monitoring systems.

EDD measures include:

• Senior management approval before establishing or continuing the relationship
• Enhanced source of wealth and source of funds verification
• Increased frequency of transaction monitoring
• More frequent periodic reviews (at least annually)
• Identification and verification of any PEP relationships

4.5 Verification Process

Identity verification is conducted using Redivian's approved identity verification partners (currently QoreID and SmileID), which perform real-time checks against the National Identity Management Commission (NIMC) database, BVN records maintained by the CBN, and other authoritative government databases. Liveness checks are required to prevent impersonation.

5. Transaction Monitoring

Redivian operates an automated transaction monitoring system that analyses all transactions in real time and flags unusual or potentially suspicious activity for review by our compliance team.

5.1 Monitoring Indicators

Our system monitors for the following indicators of potential ML/TF activity:

• Transactions that are inconsistent with a customer's stated business activity or income level
• Rapid movement of funds into and out of accounts (layering indicators)
• Structuring — multiple transactions just below reporting thresholds
• Unusual frequency or volume of Minttapp agreement creation
• Agreements created and immediately sold on the marketplace without apparent commercial rationale
• Transactions involving counterparties in FATF high-risk jurisdictions
• Sudden changes in transaction patterns inconsistent with historical behaviour
• Transfers to or from PEPs not previously disclosed during onboarding
• Round-number transactions inconsistent with the stated purpose
• Dormant accounts that suddenly become active with large transactions

5.2 Reporting Thresholds

In accordance with NFIU Guidelines, Redivian files:

• Currency Transaction Reports (CTR): For cash transactions exceeding ₦5,000,000 for individuals or ₦10,000,000 for corporate entities within any single business day
• Suspicious Transaction Reports (STR): Within 24 hours of establishing reasonable suspicion, regardless of transaction amount
• Terrorism Financing Reports: Immediately upon establishing reasonable grounds, in accordance with the Terrorism (Prevention and Prohibition) Act 2022

5.3 Transaction Limits

Redivian imposes transaction limits calibrated to customer risk ratings. These limits are reviewed periodically and may be adjusted based on verified customer information. Customers may request limit increases subject to provision of additional documentation and approval by the compliance team.

6. Suspicious Activity Reporting

6.1 Obligation to Report

Redivian is legally obligated under the ML(PP)A 2022 and CBN regulations to file Suspicious Transaction Reports with the Nigerian Financial Intelligence Unit (NFIU) where there are reasonable grounds to suspect that a transaction involves the proceeds of crime, is connected to terrorist financing, or violates any provision of applicable AML/CFT legislation.

6.2 Internal Reporting Process

Any Redivian employee or contractor who becomes aware of suspicious activity must report it immediately to the Compliance Officer using the internal STR reporting channel. The Compliance Officer will review the report and, where warranted, file an STR with the NFIU within the required timeframe.

6.3 Tipping Off Prohibition

It is a criminal offence under Nigerian law to disclose to a customer or any third party that an STR has been filed or that they are under investigation for money laundering or terrorist financing. All employees are prohibited from tipping off suspects. Enquiries about account restrictions should be directed to the Compliance Officer.

6.4 No Liability for Good Faith Reports

Redivian and its employees are protected from civil and criminal liability for filing STRs in good faith, even if the suspicion later proves unfounded, provided the report was made honestly and without malice.

7. Sanctions Screening

Redivian screens all customers, beneficial owners, and transaction counterparties against:

• The UN Security Council Consolidated Sanctions List
• The Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) List
• The European Union Consolidated Sanctions List
• The UK HM Treasury Financial Sanctions List
• The Nigerian Terrorism (Prevention and Prohibition) Act designation lists
• NFIU and CBN domestic sanctions and watchlists

Screening is conducted at onboarding, at each transaction, and on a regular batch basis against updated lists. Potential matches are escalated to the Compliance Officer for review. Confirmed matches result in immediate account freezing and reporting to the appropriate authorities without notifying the customer.

8. Record Keeping

In compliance with the ML(PP)A 2022 and CBN regulations, Redivian maintains the following records for a minimum of five (5) years from the date of the transaction or the end of the business relationship, whichever is later:

• All customer identification and verification documents obtained during KYC/KYB
• Records of all transactions, including Minttapp agreements, wallet funding, withdrawals, and DashDosh gifts
• All Suspicious Transaction Reports and Currency Transaction Reports filed with the NFIU
• Records of internal investigations and compliance decisions
• Training records for all staff on AML/CFT obligations
• Risk assessments and their supporting documentation

All records are stored securely with access restricted to authorised personnel. Records are available for inspection by the CBN, NFIU, EFCC, ICPC, or any other competent authority upon lawful request.

9. Training and Awareness

Redivian is committed to ensuring that all personnel with AML/CFT responsibilities receive appropriate and ongoing training. Our training programme includes:

• Mandatory AML/CFT induction training for all new employees before they commence duties
• Annual refresher training covering legislative updates, typologies, and internal policy changes
• Role-specific training for compliance, customer support, and technology teams
• Awareness materials on emerging ML/TF typologies relevant to Nigerian fintech
• Training records maintained for regulatory inspection

Failure to complete mandatory training within prescribed timeframes may result in restricted system access until training is completed.

10. Governance and Oversight

10.1 Compliance Officer

Redivian designates a Compliance Officer responsible for the day-to-day implementation and oversight of this AML/CFT Policy. The Compliance Officer has direct access to senior management and the authority to act independently of business units on compliance matters.

10.2 Management Responsibility

Senior management is responsible for fostering a culture of compliance, providing adequate resources for AML/CFT functions, approving high-risk customer relationships, and reviewing compliance reports on a regular basis.

10.3 Independent Audit

Redivian's AML/CFT controls are subject to independent audit at least annually. Audit findings are reported to senior management and remediation actions are tracked to completion.

10.4 Policy Review

This policy is reviewed at least annually and updated as necessary to reflect changes in applicable laws, regulations, and typologies. Material changes are communicated to all relevant personnel and published at redivian.com/aml-policy.

11. Regulatory Cooperation

Redivian is committed to full and transparent cooperation with Nigerian regulatory and law enforcement authorities. This includes:

• Timely response to all lawful requests for information from the CBN, NFIU, EFCC, ICPC, and the courts
• Immediate compliance with account freezing orders and asset seizure directives
• Participation in CBN AML/CFT examinations and on-site inspections
• Submission of all mandatory periodic reports within prescribed deadlines
• Engagement with NFIU typologies and red flag guidance publications

Redivian does not obstruct, delay, or impede any lawful investigation or regulatory examination.

12. Whistleblowing

Redivian maintains a confidential whistleblowing channel through which employees, contractors, and the public may report suspected AML/CFT violations, policy breaches, or unethical conduct without fear of retaliation.

Reports may be submitted to compliance@redivian.com or through the whistleblowing portal accessible within the Redivian platform. All reports are treated with strict confidentiality and investigated by the Compliance Officer or, where the Compliance Officer is implicated, by external legal counsel.

Retaliation against any person who makes a good-faith report of suspected AML/CFT violations is prohibited and will result in disciplinary action.

Redivian Products

This policy applies to all products and services offered by Redivian Limited, including:

• Minttapp — Bills of exchange marketplace for structured lending and debt trading
• DashDosh — Digital gifting platform for individuals and businesses
• CreditLens — Non-banking credit scoring and financial reputation platform
• Insights — Business due diligence and financial intelligence
• Redivian Platform — Developer API for financial infrastructure

For full details on each product, visit redivian.com.

13. Contact

For questions about this AML/CFT Policy, to report suspicious activity, or to contact our Compliance Officer:

• Email: compliance@redivian.com
• Whistleblowing: compliance@redivian.com (confidential)
• Address: Compliance Officer, Redivian Limited, Lagos, Nigeria

To report financial crime directly to Nigerian authorities:

• NFIU: nfiu.gov.ng
• EFCC: efcc.gov.ng
• CBN: cbn.gov.ng