AML / KYC policy.

Anti-Money Laundering & Know Your Customer Policy — EnterPayment OÜ, trading as EnterPay.

/ 01Introduction

EnterPayment OÜ, trading as EnterPay (Registry Code: 17391111, registered in Estonia), operates a cryptocurrency payment facilitation platform that enables merchants to accept digital asset payments with settlement in fiat currency.

We take our obligations to prevent financial crime seriously. This policy sets out our approach to anti-money laundering (AML), counter-terrorist financing (CTF), and know your customer (KYC) compliance. It applies to our platform, our merchant relationships, and all activities carried out through EnterPay services. This policy is reviewed annually.

/ 02Our commitment

EnterPay is committed to:

• Preventing our platform from being used for money laundering, terrorist financing, fraud, sanctions evasion, or other financial crime;
• Complying with all applicable AML/CTF laws and regulations;
• Co-operating fully with competent authorities, regulators, and law enforcement agencies;
• Applying a risk-based approach to compliance;
• Maintaining a culture of compliance across our organisation.

/ 03Regulatory framework

Estonia & European Union

• RahaPTS — Estonian Anti-Money Laundering and Counter-Terrorist Financing Prevention Act;
• MiCA — EU Markets in Crypto-Assets Regulation, applicable from 30 December 2024;
• GDPR — EU General Data Protection Regulation.

UAE / Dubai

• Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating Terrorism Financing;
• Applicable regulations issued by CBUAE, DFSA, and VARA.

International standards

• FATF Recommendations — in particular R.10 (Customer Due Diligence), R.15 (Virtual Assets), R.16 (Travel Rule), and R.20 (Suspicious Transaction Reporting).

/ 04How our platform works

EnterPay is a technology platform. We do not hold, custody, exchange, or transmit funds or digital assets on our own account. Our regulated financial partners are primarily responsible for end-customer KYC, transaction monitoring, and suspicious activity reporting. EnterPay is primarily responsible for merchant onboarding (KYB) and operates an additional, risk-based identity verification layer at the terminal through our integration with Didit (didit.me).

/ 05Merchant onboarding & KYB

Before any merchant is permitted to use the EnterPay platform, we conduct Know Your Business (KYB) due diligence.

What we verify

• Business identity: certificate of incorporation, business registration details, and trading name;
• Beneficial ownership: identity of all natural persons who ultimately own or control 25% or more of the business;
• Directors and officers: government-issued identity documents for all directors;
• Business address: current proof of business address;
• Business activity: description of the merchant's business, customer base, and sector.

Screening

All merchants and their beneficial owners are screened against international sanctions lists (OFAC, EU, UN, UK, UAE), PEP databases, and adverse media databases.

/ 06Customer identity verification (KYC)

EnterPay provides merchants with the ability to activate identity verification at the terminal, powered by Didit (didit.me) — an ISO 27001-certified, GDPR-compliant identity verification platform. KYC may be triggered based on transaction value, customer jurisdiction, or merchant configuration.

/ 07Sanctions screening

EnterPay is committed to full compliance with all applicable international sanctions regimes including OFAC, EU Consolidated List, UN Consolidated List, UK HM Treasury, and UAE sanctions. Any potential sanctions match is immediately escalated to our MLRO for review.

/ 08Transaction monitoring & fraud prevention

EnterPay and its regulated financial partners operate a layered transaction monitoring framework. Our Didit integration includes biometric liveness detection (iBeta Level 1 certified), document tampering detection, and a reusable KYC system that flags previously identified fraudulent identities.

/ 09Suspicious activity reporting

Where an investigation concludes that a suspicion is founded, a Suspicious Activity Report (SAR) will be filed with the relevant Financial Intelligence Unit. We are legally prohibited from informing any person that a SAR has been filed.

/ 10Prohibited activities & merchants

EnterPay will not provide services to merchants engaged in:

• Unlicensed gambling or online gaming;
• Weapons, firearms, or ammunition dealing;
• Adult entertainment;
• Narcotics or controlled substances;
• Counterfeit goods;
• Shell companies with no identifiable beneficial owner;
• Any entity subject to international sanctions;
• Pyramid schemes or unlicensed investment solicitation;
• Any activity illegal in the jurisdiction of operation.

/ 11Record keeping

• Merchant KYB files — retained for 5 years from the date of termination;
• Transaction records — retained for 5 years from the date of the transaction;
• KYC verification records — retained for 5 years;
• SAR/STR records — retained confidentially by our MLRO for 5 years.

See our Privacy Policy for full details of how we handle personal data.

/ 12Training & awareness

All EnterPay personnel with AML/KYC responsibilities complete AML awareness training on joining and annually thereafter.

/ 13Questions & contact

Compliance Team
EnterPayment OÜ
Rahumäe tee 6b-67, Kristiine, Tallinn 13415, Estonia
Email: compliance@enterpay.io

This policy was last updated on 27th of February 2026.