AML/CTF Policy Statement

Last updated: May 2026

CARDSTREAM PAYMENT SYSTEMS LTD (MSB registration number: C100000953), incorporated in Canada under company registration number 1001161051, with registered office at 1907 Baseline Road, Unit 104, Ottawa, Ontario, K2C0C7, Canada (hereinafter "Cardstream", "we", "us", or "our"), is committed to maintaining the highest standards of Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) compliance.

This statement sets out our public position on the prevention of money laundering and terrorist financing and reflects our obligations under applicable Canadian law and internationally recognised standards.

1. Regulatory Status

Cardstream Payment Systems Ltd is registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a Money Services Business (MSB). We operate in full compliance with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its associated regulations.

We align our compliance framework with the guidance of the Financial Action Task Force (FATF) and applicable international sanctions regimes, including those administered by the Office of Foreign Assets Control (OFAC), the United Nations, the European Union, and His Majesty’s Treasury (HMT).

2. Our Commitment

Cardstream takes a zero-tolerance approach to money laundering, terrorist financing, and all forms of financial crime. We are committed to:

  • Fully complying with all applicable AML/CTF laws and regulatory requirements
  • Cooperating with FINTRAC and relevant law enforcement authorities
  • Maintaining an effective, risk-based compliance programme overseen by a dedicated Compliance Officer
  • Ensuring our services are not used to facilitate financial crime of any kind

Our AML/CTF programme is approved by the Board of Directors and is subject to ongoing review and independent audit.

3. Risk-Based Approach

We apply a risk-based approach to all client relationships and transactions. The nature and extent of our due diligence and monitoring measures are determined by the level of risk associated with each client, product, service, delivery channel, and jurisdiction.

We assess risk across multiple dimensions, including but not limited to the client’s business nature and complexity, ownership and control structure, jurisdictional

exposure, and transaction profile. Higher-risk relationships are subject to enhanced scrutiny and controls.

4. Client Due Diligence

We verify the identity of all clients, their authorised representatives, and their Ultimate Beneficial Owners before establishing a business relationship. We do not maintain anonymous accounts or transact with unidentified parties.

Our due diligence measures are applied on an ongoing basis throughout the client relationship and are updated whenever material changes occur or when our risk assessment requires it. Clients who are unable or unwilling to provide required information will not be onboarded or will have their relationship terminated.

5. Sanctions Compliance

We screen all clients, associated persons, and transactions against applicable international sanctions lists, including those maintained by OFAC, the United Nations, the European Union, and HMT. Screening is conducted at onboarding and on a continuous basis thereafter.

Any confirmed sanctions match results in immediate blocking of the account or transaction and reporting to the relevant competent authority. We do not conduct business with sanctioned individuals, entities, or jurisdictions.

6. Transaction Monitoring

We monitor client transactions on an ongoing basis to detect activity that is inconsistent with a client’s known profile or that may indicate money laundering or terrorist financing. Where there are reasonable grounds to suspect that a transaction is connected to financial crime, we file a Suspicious Transaction Report (STR) with FINTRAC without delay.

We observe all applicable reporting obligations under the PCMLTFA, including requirements related to electronic funds transfers and the FINTRAC Travel Rule.

7. Prohibited Relationships

We do not provide services to clients whose activities are unlawful or who present an unacceptable risk of financial crime. This includes, among others, entities with no genuine economic activity, unlicensed financial service providers, individuals or entities appearing on applicable sanctions lists, and clients who cannot be satisfactorily identified.

We reserve the right to decline or terminate any business relationship that is inconsistent with our risk appetite or compliance obligations, at our sole discretion and without obligation to provide reasons.

8. Politically Exposed Persons

We apply enhanced due diligence to clients or associated persons identified as Politically Exposed Persons (PEPs), their family members, or close associates, in accordance with the PCMLTFA and FINTRAC guidance. Such relationships require Compliance Officer approval and are subject to elevated ongoing monitoring.

9. Record Keeping

We maintain records of all client due diligence, transaction data, and compliance decisions in accordance with the retention requirements under the PCMLTFA. Records are maintained in a form that enables timely access by FINTRAC upon a lawful request.

10. Staff Training

All employees receive AML/CTF training before commencing client-facing duties and on a regular basis thereafter. Training covers applicable legislation, typologies of financial crime, internal procedures, and individual reporting obligations.

11. Governance

Our AML/CTF programme is overseen by a Compliance Officer who reports to senior management and the Board of Directors. The programme is reviewed and updated regularly to reflect changes in applicable law, regulatory guidance, and our operational risk environment. Independent audits of the programme are conducted periodically.

12. Contact

For questions relating to this policy or our AML/CTF compliance programme, please contact:

CARDSTREAM PAYMENT SYSTEMS LTD

1907 Baseline Road, Unit 104, Ottawa, Ontario, K2C0C7, Canada

Compliance enquiries: Compliance@cardstreampayments.com

General enquiries: info@cardstreampayments.com