AML / CTF compliance program.

Part A — Company Information, Business Model, and Regulatory Scope

A.1 Company information

A.2 Business activities

MTX Finance Ltd. is a Money Services Business registered with FINTRAC. The firm provides, to corporate and high-net-worth-individual clients in approved jurisdictions, the following four services:

1. Foreign exchange — EUR-denominated payment and conversion services.
2. Funds remittance / money transfer — settlement and routing of EUR-denominated client funds via SEPA, through MTX's FCA-regulated EMI partner Cublox.
3. Virtual currency exchange — conversion between EUR and virtual currencies (primarily USDC, USDT, and BTC), executed through MTX's contracted exchange counterparty Crypto.com.
4. Virtual currency transfer — transfer of virtual currency on behalf of clients to whitelisted, pre-approved wallets following AML screening.

MTX does not provide custody of client virtual currency assets beyond the operational deposit/withdrawal flow, and does not provide deposit-taking banking services. Client fiat balances are safeguarded by Cublox under UK FCA e-money safeguarding requirements; MTX does not commingle or hold client fiat funds itself.

MTX does not accept cash for any transaction. Clients offering cash are redirected to alternative payment methods.

MTX is a user of stablecoins (USDC, USDT). MTX is not an issuer of any stablecoin. The Stablecoin Act (Royal Assent 2026-03-26) is monitored but does not directly capture MTX's activities at this time.

A.3 Service channels and counterparty arrangements

MTX operates on a non-face-to-face basis. Product workflows depend on integrated third-party service providers. The production provider stack, confirmed 2026-05-22, is:

A.4 Target market and jurisdictions served

MTX serves corporate and HNW-individual clients located in: European Union member states, the United Kingdom, and Canada (subject to provincial scope — see A.5.1 on the Quebec exclusion).

Clients in jurisdictions subject to Canadian sanctions, FATF black-listed jurisdictions, or other prohibited regions are not accepted. The list of prohibited jurisdictions is maintained as a separate operational document and reviewed at least annually.

A.5 Regulatory scope and applicable law

Primary regulator: Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). Primary statute: Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (PCMLTFR).

2026 statutory amendments: Strengthening Canada's Immigration System and Borders Act introduces six structural amendments to PCMLTFA, including a new Administrative Monetary Penalties framework, a statutory requirement that compliance programs be reasonably designed, risk-based, and effective, and a statutory definition of "anonymous client". The Budget 2025 Implementation Act contains the Stablecoin Act, which subjects stablecoin issuers (not users) to MSB obligations.

Other applicable law: Criminal Code (terrorist financing), Special Economic Measures Act (SEMA), United Nations Act, Justice for Victims of Corrupt Foreign Officials Act, PIPEDA, and the Retail Payment Activities Act (RPAA).

A.5.1 Quebec scope

MTX does not service Quebec-resident clients. Quebec residency is a disqualifying factor at onboarding, enforced through jurisdiction screening at application stage, a residency declaration on the application, and a cross-check against address and tax residency information.

A.5.2 Retail Payment Activities Act (RPAA)

MTX has assessed its fiat payment activities (specifically SEPA-routed EUR payments executed on behalf of corporate clients) as falling within the scope of the RPAA. MTX's RPAA registration application has been submitted to the Bank of Canada and is currently pending. In the interim, MTX operates in accordance with the substantive RPAA requirements on a voluntary-compliance basis.

A.5.3 Strong Borders Act 2026

Programs must now be reasonably designed, risk-based, and effective as a matter of law. MTX's program is sized to actual operations; the risk assessment drives control intensity proportional to risk; and effectiveness is evidenced through annual program review, biennial independent effectiveness review, STR quality assessment, and monitoring calibration reviews.

Part B — Money Laundering and Terrorist Financing Background

B.1 Money laundering

Money laundering is the process by which the proceeds of criminal activity are concealed and integrated into the legitimate economy. It is recognised internationally as following a three-stage process: placement, layering, and integration. Money laundering is a criminal offence under the Criminal Code of Canada and the PCMLTFA.

B.2 Terrorist financing

Terrorist financing is the provision or collection of funds, by any means, directly or indirectly, with the intention that the funds be used (or knowledge that they will be used) to carry out terrorist activity. Unlike money laundering, terrorist financing does not require that the underlying funds be proceeds of crime.

B.3 MTX's responsibilities as an MSB

• Maintain a written, risk-based, effective compliance program.
• Appoint a Compliance Officer with appropriate authority and resources.
• Verify the identity of clients in accordance with prescribed methods.
• Conduct ongoing transaction monitoring of business relationships.
• File reports to FINTRAC for suspicious transactions, large virtual currency transactions, cross-border EFTs above threshold, and terrorist property.
• Comply with the Travel Rule for virtual currency transfers.
• Keep prescribed records for at least 5 years.
• Train staff on AML/CTF obligations and provide refresher training.
• Conduct an effectiveness review of the compliance program at least every two years.

B.5 ML/TF risks specific to MTX's business

• Cross-border EUR-denominated payments via SEPA: vulnerable to layering through international funds transfers; mitigated by transaction monitoring, beneficiary pre-approval, and EFT reporting.
• Fiat-to-crypto and crypto-to-fiat conversion: potential entry and exit points for illicit funds; mitigated by SumSub KYT screening, wallet whitelisting, source-of-funds review, and LVCTR reporting.
• Third-party deposits: increased complexity and risk of acting as a conduit; mitigated by mandatory source-of-funds review and Compliance Officer approval before EUR funds are accepted.
• OTC virtual currency deals: large discrete trades; mitigated by KYB-approved client base, signed-PDF wallet ownership proof, KYT screening, quote-confirmation workflow, and per-trade Compliance Officer review.
• Non-face-to-face channel: increased risk of impersonation; mitigated by SumSub remote identity verification, document authentication, and beneficial-ownership review.

Part C — Appointment of the Compliance Officer and Governance

C.1 Appointment

C.2 Responsibilities of the Compliance Officer

• Designing, implementing, and maintaining MTX's AML/CTF compliance program.
• Reviewing and updating this Program at least annually and following any material regulatory change.
• Conducting and approving the enterprise risk assessment and reviewing client risk ratings.
• Reviewing escalations from operations staff and authorising or rejecting transactions on a risk basis.
• Approving onboarding of new clients, particularly those classified as higher risk.
• Filing reports with FINTRAC (STR, LVCTR, EFTR, TPR) within the applicable timelines.
• Maintaining all records required by the PCMLTFR for the prescribed retention period.
• Designing and delivering AML/CTF training to all staff.
• Engaging or coordinating the biennial compliance program effectiveness review.
• Liaising with FINTRAC, law enforcement, and external counsel as required.

C.3 Authority and resources

• Halt any transaction pending compliance review.
• Decline any onboarding application without operational override.
• Restrict or terminate any client relationship on compliance grounds.
• Engage external counsel, consultants, or technical resources as required.
• Access all firm records, systems, and personnel for compliance purposes.

Part D — Risk Assessment

D.2.1 Products and services

D.2.2 Delivery channels

D.2.5 Enterprise risk conclusion

MTX assesses its overall inherent enterprise risk as Medium-High, primarily driven by the cross-border crypto/fiat conversion nature of its services and the non-face-to-face channel. With the controls described throughout this Program operating effectively, MTX assesses residual enterprise risk as Medium.

D.3.1 Client rating tiers and review cadence

Part E — Client Identification and Verification

MTX verifies the identity of all clients before establishing a business relationship using the methods prescribed by the PCMLTFR. As MTX's onboarding is non-face-to-face by default, MTX uses the Government-Issued Photo Identification Method via SumSub and, where not applicable, the Dual-Process Method.

E.4 Beneficial ownership

For each entity client, MTX identifies and verifies beneficial owners — individuals who directly or indirectly own or control 25% or more of the entity. Where MTX cannot reasonably establish beneficial ownership, the client is treated as high risk and the most senior managing officer is identified and verified; the Compliance Officer may decline the relationship.

E.5 Anonymous client prohibition

MTX's onboarding workflow forbids account activation before identity verification is complete. There is no gap between account activation and CDD; no client transacts on the MTX platform until full identification and verification is completed.

Part F — Beneficial Ownership, Third Parties, and PEPs

F.2 Third-party determination

For third-party deposit flows, MTX requires identification of the third-party sender, documentation of the third-party's source of funds, documentation of the relationship between the third party and the client, and Compliance Officer review and approval before MTX accepts the EUR funds.

F.3 Politically Exposed Persons and Heads of International Organizations

PEP/HIO status is determined at onboarding via direct disclosure, automated SumSub screening, and daily rescreening of all active clients. For confirmed foreign PEPs, HIOs, and their family/close associates, MTX obtains Compliance Officer approval, establishes source of wealth and source of funds with documentary evidence, and conducts enhanced ongoing monitoring including quarterly transaction reviews.

Part G — Ongoing Monitoring

G.2.1 Alert thresholds and rules

• Single transaction at or above CAD 10,000 equivalent — automatic compliance review.
• Aggregate transaction volume per client exceeding CAD 10,000 in a defined period.
• Transactions deviating from client profile by 100% or more.
• SumSub KYT risk score above threshold set by Compliance Officer.
• Sending/receiving from high-risk jurisdictions or wallets associated with mixers, darknet, or sanctioned addresses.
• Structuring patterns — multiple sub-threshold transactions in short periods.
• OTC trades above CAD 10,000 — pre-trade Compliance Officer approval.

Part H — Reporting Obligations

H.2.2 Tipping-off prohibition

It is a criminal offence under the PCMLTFA to disclose to the client, or to any unauthorised third party, that an STR has been filed or is being contemplated. Internal knowledge of STR filings is restricted to a need-to-know basis.

Part I — Record Keeping

All records are retained for a minimum of 5 years from the date of the transaction, or from the end of the business relationship, whichever is later. Records are stored such that they can be provided to FINTRAC within 30 days of request, with secure controlled access, backups, and full audit logging.

Part J — Travel Rule for Virtual Currency Transfers

MTX complies with FINTRAC's Travel Rule for virtual currency transfers initiated on behalf of clients. Applicable threshold: CAD 1,000. Required information for each qualifying transfer: originator and beneficiary name, address, and account or wallet reference number, transmitted via SumSub using supported protocols.

J.6 Self-hosted wallets

• Mandatory wallet whitelisting before any transaction.
• SumSub KYT screening of the wallet address.
• Signed PDF proof of wallet ownership for OTC flows (client name and wallet address).
• Retention of originator and beneficiary information notwithstanding the data-exchange exemption.

Part K — Sanctions and Watchlist Screening

• Canadian SEMA sanctions list.
• Justice for Victims of Corrupt Foreign Officials Act listings.
• United Nations Act sanctions.
• Criminal Code (terrorist entities) listings.
• OFAC SDN list (United States).
• EU consolidated sanctions list.
• UK HMT consolidated list.

Onboarding: full screening of all individuals and the entity before account activation, via SumSub. Ongoing: daily rescreening of all active clients. Transaction-specific: counterparty screening at the point of transaction. Confirmed match: account frozen immediately and Compliance Officer notified.

Part L — Training Program

All MTX staff, contractors, and directors with access to client data, transactions, or systems handling either receive AML/CTF training. Initial training is completed before access to systems / client data, with refresher training at least annually and ad hoc training within 30 days of any material regulatory change. Each module has a written assessment with an 80% passing score; records are retained for 5 years.

Part M — Program Review and Effectiveness Testing

The Compliance Officer conducts an annual review of this Program covering regulatory updates, filings retention, risk assessments, sampling of high-risk client files (minimum 10%), and quality review of alerts and STR decisions.

FINTRAC requires a comprehensive effectiveness review of the AML/CTF compliance program at least once every two years, conducted by a competent, independent party, with sampling, walkthroughs, gap analysis, and a remediation plan, signed off by senior management.

Appendix — Provider Stack and Integration Map