PROHIBITED JURISDICTIONS AND ACTIVITIES POLICY

• current and prospective clients;

• authorised platform users;

• business and technology partners;

• merchants and sub-merchants introduced through a client;

• payment instructions and transaction metadata processed through supported integrations; and

• any person using or attempting to use KereX services.

• products or services that are unlawful in any relevant jurisdiction;

• money laundering, terrorist financing or proliferation financing;

• human trafficking, forced labour, slavery or exploitation;

• sexual services, prostitution or exploitative adult services;

• child sexual abuse material or exploitation of minors;

• terrorism, violent extremism or unlawful violence;

• illegal drugs, narcotics, cannabis, drug paraphernalia or unauthorised controlled substances;

• unlawful weapons, ammunition, explosives or dangerous materials;

• counterfeit goods, piracy or deliberate intellectual-property infringement;

• stolen property, stolen financial instruments or stolen credentials;

• cybercrime, malware, ransomware, hacking-for-hire or dark-web marketplaces;

• forged identity documents or fraudulent company documents;

• unlawful sale, trafficking or disclosure of personal data;

• Ponzi schemes, pyramid schemes, fraudulent investment schemes or deceptive get-rich-quick models;

• unlicensed financial, payment, lending, investment, insurance or money-transfer services;

• bribery, corruption, unlawful political financing or tax evasion;

• illegal wildlife trade, cultural-property trafficking or environmental crime;

• shell banks or entities intended to conceal beneficial ownership; or

• any activity designed primarily to facilitate or conceal criminal conduct.

• money laundering;

• terrorist financing;

• proliferation financing;

• sanctions evasion;

• export-control evasion;

• bribery or corruption;

• unlawful concealment of ownership or source of funds;

• trafficking in proceeds of crime; or

• transactions lacking a legitimate economic or commercial purpose.

• appears on the UAE Local Terrorist List or UN Consolidated List;

• is owned or controlled by a designated person;

• acts on behalf of or at the direction of a designated person; or

• would cause KereX or a service partner to breach applicable sanctions or export-control requirements.

• banks, payment institutions, PSPs, payment facilitators and money-service businesses;

• remittance, foreign-exchange and money-transfer services;

• virtual-asset businesses, crypto exchanges, wallets, brokers and stablecoin services;

• licensed gambling, betting, lottery, fantasy-sports or skill-gaming businesses;

• marketplaces, platforms, aggregators and businesses processing payments for third parties;

• charities, foundations, non-profit organisations and crowdfunding platforms;

• dealers in precious metals, gemstones and other high-value goods;

• cash-intensive businesses;

• lending, credit, debt collection, investment or insurance services;

• licensed pharmaceutical, healthcare or telemedicine businesses;

• political organisations, campaign financing and lobbying services;

• online tipping, creator monetisation and user-generated-content platforms; and

• other sectors with elevated regulatory, fraud, chargeback or financial-crime risk.

• valid licences and registrations;

• ownership and management information;

• AML, sanctions, fraud and customer-verification procedures;

• source-of-funds information;

• financial statements or processing history;

• transaction-flow diagrams;

• merchant and sub-merchant controls;

• website and product review;

• partner approval; and

• enhanced or periodic review.

• transactions involving stolen accounts, cards, credentials or identity documents;

• false invoices, fictitious transactions or fabricated commercial purposes;

• transaction laundering or processing for an undisclosed business;

• undisclosed merchants, sub-merchants or nested payment providers;

• unauthorised third-party collections or payouts;

• circular transfers, self-funding or artificial transaction activity;

• rapid movement or withdrawal of funds inconsistent with the approved business model;

• structuring or splitting transactions to avoid limits or controls;

• fraudulent refunds, reversals or chargeback manipulation;

• unauthorised use of customer or counterparty funds;

• misrepresentation of the sender, beneficiary, merchant of record or payment purpose;

• alteration or substitution of QR codes, beneficiary details or payment identifiers;

• resale, sharing or transfer of platform credentials;

• use of another person’s account without authority;

• concealment of location, ownership or counterparties to avoid restrictions;

• interference with monitoring, security or verification controls; or

• any activity that KereX or a service partner reasonably believes may be unlawful or fraudulent.

• service partner;

• payment method;

• currency;

• transaction direction;

• sender and beneficiary type;

• licensing requirements;

• sanctions exposure;

• local law; and

• the client’s approved business model.

• breach applicable UAE or international law;

• involve a designated or prohibited person;

• violate a service partner’s restrictions;

• require an unavailable regulatory permission;

• involve a jurisdiction where reliable verification cannot be completed; or

• expose KereX or a service partner to unacceptable legal or financial-crime risk.

• incorporation and ownership documents;

• licences and regulatory registrations;

• identity information for directors, owners and authorised persons;

• business-model and payment-flow descriptions;

• websites, applications and customer journeys;

• expected countries, currencies, volumes and transaction values;

• source-of-funds or source-of-wealth information;

• contracts, invoices and supporting transaction records;

• AML, sanctions, fraud and security policies;

• information about merchants, customers, beneficiaries or counterparties; and

• evidence required by a bank, PSP or other service partner.

• ownership, management or business activity changes;

• a new product, country or route is requested;

• documents expire;

• actual activity differs from the approved profile;

• suspicious or unusual activity is identified;

• a service partner requests further information; or

• legal or regulatory requirements change.

• reject an onboarding application;

• refuse or withdraw approval for a business model or route;

• request additional information;

• delay or decline to forward a technical instruction;

• restrict an API key, account, feature or environment;

• suspend or terminate platform access;

• notify or consult the relevant service partner;

• preserve technical logs and supporting records;

• require remediation before restoring access; or

• cooperate with a lawful request from a competent authority.

• comply with this Policy and applicable law;

• use services only for the approved business model;

• provide complete and accurate information;

• disclose all merchants, sub-merchants and payment intermediaries where requested;

• maintain required licences and permissions;

• notify KereX of material business, ownership or regulatory changes;

• ensure that downstream users comply with applicable restrictions;

• monitor their own activity and counterparties;

• cooperate with KereX and service-partner reviews; and

• promptly report suspected prohibited or unlawful activity.