CUSTOMER IDENTIFICATION (KYC), AML/CFT AND SANCTIONS POLICY

Last updated: 01.07.2026

1․ General Provisions

1.1. This “Know Your Customer (KYC), Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) and Sanctions Compliance Policy” (the “Policy”) sets out the main principles of user identification, customer due diligence, risk assessment, Transaction checks, prevention of money laundering and terrorist financing, sanctions compliance and prevention of suspicious activity by “UNITRADE INTERNATIONAL” LLC, which operates the OurExchangeClub platform.

1.2. This Policy applies to all persons who visit the ourexchange.club Website, register on the Website, create a user account, undergo identification, create a request for a Transaction to purchase or sell Crypto-assets, use the Company’s services or participate in any way in Transactions conducted through OurExchangeClub.

1.3. This Policy forms an integral part of the OurExchangeClub Terms of Use, Privacy Policy and other policies published on the Website.

1.4. The Company carries out user identification, Transaction checks, risk assessment and compliance measures in accordance with applicable law, internal procedures, risk management principles and the requirements for providing services safely and lawfully.

1.5. The KYC, AML/CFT and sanctions checks carried out by the Company are intended to prevent the OurExchangeClub platform from being used for money laundering, terrorist financing, evasion of sanctions, fraud, corrupt activity, tax evasion, circulation of illicit funds or other unlawful purposes.

1.6. The Company may apply a risk-based approach to assess Users, Transactions, payments, Crypto-asset transfers, Crypto Wallet Addresses, payment sources, the origin of funds or Crypto-assets, and other material circumstances.

1.7. The Company has the right, at its discretion, to establish and change internal procedures for identification, requests for additional documents, Transaction checks, and the suspension, rejection, cancellation or return of Transactions, to the extent permitted by law.

1.8. The User must cooperate with the Company during identification, the provision of additional documents, explanations of the purpose of a Transaction, substantiation of the origin of funds or Crypto-assets, and other compliance checks.

1.9. If the User refuses to undergo identification, fails to provide required details or documents, provides false, incomplete, inconsistent or misleading information, or the Company cannot sufficiently assess the risk associated with the User or Transaction, the Company may reject registration, decline to approve the user account, suspend, cancel or reject the Transaction, restrict access to services or terminate its relationship with the User.

1.10. This Policy does not constitute legal, tax, financial or regulatory advice to the User. The User must independently assess the legal, tax, reporting and other obligations applicable to them.

2․ User Identification and the KYC Process

2.1. To use OurExchangeClub services, create a Transaction request, execute a Transaction or use specific functions, the User must undergo the identification and verification process in accordance with the procedure established by the Company.

2.2. Identification may be carried out through the Website, the Company’s internal tools, SumSub or the technological solutions of another third-party identification and verification service provider.

2.3. To identify an individual User, the Company may require an identity document, photograph, selfie, liveness check, details of residence or location, citizenship or residency details, contact details and other necessary information.

2.4. For a legal entity User, the Company may require the legal entity’s registration documents, articles of association or an equivalent document, documents confirming the authority of its director or representative, beneficial ownership details, information about participants or shareholders, tax or registration numbers, information about the nature of its activities and other necessary documents.

2.5. If the User acts in the name of, for the benefit of or for the account of another person, the User must disclose this to the Company in advance and provide documents and information concerning the relevant authority, beneficiary, represented person or person with the actual interest in the Transaction.

2.6. As part of identification, the Company may verify the User’s identity, the validity of documents, whether the document matches the User, liveness, legal capacity, capacity to act, authority to act as a representative, the beneficial owner, residency, risk profile and other material circumstances.

2.7. The User must provide accurate, complete, up-to-date and genuine details and documents. Providing false, altered, expired, incomplete, inconsistent or misleading documents or information may serve as grounds for rejecting registration, declining to approve the user account, suspending, rejecting or cancelling the Transaction, moving it to the return stage, or restricting access to services.

2.8. Successful technical completion of identification or a positive result from a third-party system does not in itself constitute automatic approval of the User or an unconditional right to use the services. Final approval of the User is given by the Company on the basis of internal checks and risk assessment.

2.9. The Company has the right to reject a User’s registration or decline to approve the user account if identification results are insufficient, the User’s risk profile is unacceptable, details are incomplete or inconsistent, documents have not been provided, or there are legal, compliance, security, AML/CFT, sanctions, fraud or other risks.

2.10. The Company may periodically update the User’s identification details, repeat checks, request new or additional documents and reassess the User’s risk profile, taking into account Transaction activity, changes in details, legal requirements, internal policies or risk management needs.

2.11. The User must promptly inform the Company of any change in their identification or contact details, residence, residency, legal status, authority to act as a representative, beneficial owners or other material details.

2.12. The Company is not obliged to disclose to the User all internal reasons, criteria or methods for rejecting identification, carrying out additional checks, declining to approve the user account or making a risk assessment if disclosure could impair the effectiveness of its compliance system, AML/CFT controls, sanctions risk management, fraud prevention, security or third-party rights.

3․ Risk-Based Approach and Customer Due Diligence

3.1. The Company applies a risk-based approach to its KYC, AML/CFT and sanctions compliance measures, taking into account User details, the nature, amount and frequency of the Transaction, payment method, type of Crypto-asset, blockchain network, Crypto Wallet Address, origin of funds or Crypto-assets, purpose of the Transaction and other material circumstances.

3.2. Under its risk-based approach, the Company may classify Users, Transactions, payment sources, Crypto-asset transfers or Crypto Wallet Addresses by risk as low, medium, high or other internal risk levels.

3.3. When assessing a User’s risk profile, the Company may consider the User’s citizenship, place of residence or location, residency, nature of activities, Transaction history, payment methods, Transaction amounts and frequency, source of Crypto-assets, purpose of the Transaction, presence of a beneficial owner, representative relationships and other applicable circumstances.

3.4. The Company may conduct customer due diligence to understand and assess the User’s identity, legal capacity, capacity to act, authority to act as a representative, beneficial owner, origin of funds or Crypto-assets, purpose of the Transaction and its economic rationale.

3.5. If a User or Transaction is assessed as high risk, the Company may conduct enhanced due diligence, including requesting additional documents, explanations, declarations, evidence of the origin of funds or Crypto-assets, proof of the payment source, confirmation of ownership or control of a Crypto Wallet Address, and other information.

3.6. The Company may apply simplified, standard or enhanced due diligence measures, depending on the risk level of the User or Transaction, applicable law, internal policies, Transaction size and nature, and the results of checks.

3.7. In assessing risks, the Company may use details provided by the User; Transaction details on the Website; payment and blockchain data; results from SumSub or other service providers; blockchain analysis tools; open sources; registers; and other sources permitted by law.

3.8. The Company has the right to reassess the User’s risk profile at any time, taking into account new information, Transaction behaviour, the results of additional document checks, legal or regulatory changes, changes to internal policies or other risk indicators.

3.9. A change in a User’s risk profile may result in additional checks, changes to Transaction limits, restrictions on payment or transfer methods, suspension, rejection, cancellation or return of a Transaction, or restrictions on access to services.

3.10. The Company is not obliged to disclose to the User its full risk assessment methodology, internal criteria, risk models, algorithms or the complete results obtained from verification sources if disclosure could impair its compliance, AML/CFT, sanctions risk management, fraud prevention or security systems.

4․ Requests for Additional Documents and Information

4.1. The Company has the right to request additional documents, information, explanations, declarations or corrections to details from the User for identification, customer due diligence, risk assessment, Transaction checks, prevention of money laundering and terrorist financing, sanctions compliance, fraud prevention, anti-corruption compliance, tax, accounting, legal or security purposes.

4.2. Additional documents or information may be requested at any stage of User registration, identification, user account approval, verification of a Transaction request, execution of a Transaction, acceptance of a payment, transfer of funds, receipt or transfer of a Crypto-asset, making a return, checks after a Transaction or assessment of corruption, sanctions, fraud or other compliance risks.

4.3. The Company may request documents and information confirming the User’s identity, residence or location, citizenship, residency, tax residency, legal capacity, capacity to act, authority to act as a representative, registration of a legal entity, beneficial owner, nature of activities or other material circumstances.

4.4. The Company may request documents or explanations substantiating the origin of funds and income, payment source, ownership of a bank account, bank card, EasyWallet or another payment instrument, source from which Crypto-assets were acquired or received, ownership or control of a Crypto Wallet Address, the purpose and economic rationale of a Transaction, and the absence of any connection between the Transaction and corrupt activity, illicit remuneration, bribery, impermissible links with public officials or other unlawful influence.

4.5. Additional documents may include, without limitation, bank statements, payment receipts, documents evidencing the source of income, agreements, invoices, tax or accounting documents, documents evidencing salary or business income, the history of Crypto-asset acquisitions, blockchain transaction data, evidence of control of a Crypto Wallet, anti-corruption declarations, information about Transaction beneficiaries or intermediaries, explanations of possible links with public officials or politically exposed persons, declarations or other substantiation requested by the Company.

4.6. The Company may set requirements for the form, language, quality, completeness, validity and submission deadline of additional documents or information. Where necessary, the Company may require translation, notarisation, an apostille, legalisation or other certification of documents to the extent permitted by law.

4.7. The User must submit the requested documents and information accurately, completely, legibly, in an up-to-date and authentic form, within the period specified by the Company.

4.8. If the User does not submit the requested documents or information, submits them late or in an incomplete, inconsistent, false, altered, illegible or misleading form, or if the Company cannot sufficiently rule out money laundering, terrorist financing, evasion of sanctions, fraud, corrupt activity, bribery, illicit remuneration, tax or other legal risks, the Company may decline to approve the user account, refuse to accept or execute the Transaction, suspend, reject or cancel the Transaction or move it to the return stage, restrict access to services or terminate its relationship with the User.

4.9. Submission of additional documents or information does not in itself guarantee approval of the User, confirmation of the Transaction or its execution. The Company retains the right to conduct further examination and final assessment of the User, Transaction and details provided.

4.10. The Company may verify the authenticity, completeness and compliance of documents and information provided by the User using its internal tools, SumSub or other third-party services, and on the basis of bank or payment data, blockchain analysis, open sources, registers, sanctions, PEP, anti-corruption or other compliance sources, and other sources permitted by law.

4.11. The Company is not obliged to disclose to the User all the reasons and criteria for requesting additional documents, the progress of checks, verification sources, risk indicators or internal assessments if disclosure could impair compliance, AML/CFT, sanctions risk management, anti-corruption controls, fraud prevention or security systems.

4.12. The Company may retain additional documents, information, explanations and declarations provided by the User, and the results of checking them, for legal, accounting, tax, compliance, anti-corruption control, security, dispute resolution and evidentiary purposes.

5․ Transaction Checks and Monitoring

5.1. The Company has the right to check and monitor Transactions created, pending, being executed, completed, rejected, cancelled or at the return stage through OurExchangeClub for KYC, AML/CFT, sanctions, anti-corruption, fraud prevention, tax, legal, security and risk management purposes.

5.2. Transaction checks and monitoring may be carried out when a Transaction request is created and at the stages of confirming a Transaction, payment, transfer of a Crypto-asset, payment of funds, return or monitoring after the Transaction.

5.3. The Company may check the type, amount, frequency and exchange rate of a Transaction, payment method and source, type of Crypto-asset, blockchain network, Crypto Wallet Address, transaction hash, blockchain confirmations, purpose and economic rationale of the Transaction, beneficial owner, persons involved and other material circumstances related to the Transaction.

5.4. The Company may check a Transaction to determine whether it is or may be connected with money laundering, terrorist financing, evasion of sanctions, fraud, corrupt activity, bribery, illicit remuneration, impermissible links with public officials or politically exposed persons, tax evasion, circulation of illicit funds or other unlawful activity.

5.5. For Transactions involving Crypto-assets, the Company may check the risk associated with the Crypto Wallet Address, blockchain transaction history, possible origin of Crypto-assets, the chain of preceding or subsequent transfers, and possible links to high-risk addresses, mixers, darknet markets, hacking incidents, fraud, sanctions or other suspicious sources.

5.6. When Armenian dram payments are made or received, the Company may check the payment source; payer or recipient details; bank account, bank card, EasyWallet, EasyPay payment or cash operation details; payment purpose and documents; payment time; and compliance with the Transaction terms.

5.7. The Company has the right to decline to accept a payment made by a third party, funds received from a third party’s account, a Crypto-asset transferred from a third party’s Crypto Wallet or a Transaction for the benefit of a third party unless that third party’s involvement has been disclosed in advance, substantiated and accepted by the Company.

5.8. If unusual, disproportionate, suspicious or high-risk circumstances arise during a Transaction check, the Company may request additional documents, explanations or declarations, extend the verification period, suspend the Transaction, restrict access to the user account, reject or cancel the Transaction or move it to the return stage.

5.9. A Transaction may be considered unusual or high risk if it is inconsistent with the User’s risk profile, Transaction history, stated purpose, origin of funds or Crypto-assets, payment source, economic rationale of the Transaction or the Company’s internal risk criteria.

5.10. To check a Transaction, the Company may use details provided by the User; Transaction and technical data available on the Website; payment or bank data; blockchain data; verification results from SumSub or other third parties; blockchain analysis tools; sanctions, PEP, anti-corruption, fraud prevention or other compliance sources; open sources; registers; and other means permitted by law.

5.11. Conducting a Transaction check or monitoring, requesting additional documents or temporarily suspending a Transaction does not constitute a breach of the Company’s obligations if done for the purposes of this Policy, the Terms of Use, applicable law, internal policies, security or risk management.

5.12. The Company is not obliged to disclose to the User the full process of Transaction checks and monitoring, risk indicators, internal criteria, verification sources or complete third-party verification results if disclosure could impair its AML/CFT, sanctions, anti-corruption, fraud prevention, security or compliance systems.

6․ Sanctions, PEP and Anti-Corruption Checks

6.1. The Company has the right to conduct sanctions, politically exposed person (PEP), anti-corruption, AML/CFT, fraud prevention and other compliance checks on Users, beneficial owners, representatives, payers, recipients, other participants in a Transaction, Crypto Wallet Addresses, payment details and Transactions.

6.2. Sanctions checks may be carried out to identify possible links with international, foreign or local sanctions lists, restrictive measures, prohibited or high-risk persons, organisations, countries, territories, blockchain addresses or other risk sources.

6.3. The Company may reject a User’s registration, decline to approve the user account, suspend, reject or cancel the Transaction or move it to the return stage if the User, beneficial owner, representative, payer, recipient, Crypto Wallet Address, source of the Transaction or another person or detail related to the Transaction has a link to sanctions, restrictive measures, prohibited activity or high-risk sources.

6.4. The Company may identify and screen politically exposed persons (PEPs) to determine whether the User, beneficial owner, representative, beneficiary of the Transaction or another person associated with it is a PEP, a member of a PEP’s family, a close associate or a person connected with someone of similar status.

6.5. PEP status or a link to public officials does not necessarily result in refusal of services in itself, but may be grounds for enhanced due diligence, requests for additional documents, closer examination of the origin of funds or Crypto-assets, clarification of the Transaction’s purpose or restrictions on the Transaction.

6.6. The Company may conduct anti-corruption checks to determine whether the User, Transaction, payment source, origin of Crypto-assets, beneficial owner, intermediary or another person associated with the Transaction is linked to bribery, illicit remuneration, abuse of office, trading in influence, unlawful commissions, corruption risks in the public or private sector or other unlawful influence.

6.7. The Company may request anti-corruption declarations, substantiation of the origin of funds and income, information about Transaction beneficiaries or intermediaries, explanations of links with public officials or PEPs, agreements, payment documents or other evidence from the User to assess and rule out corruption risks.

6.8. The Company may decline to accept or reject a Transaction that may be linked to bribery, illicit remuneration, an impermissible link with a public official or PEP, an unlawful commission, gift, compensation, use of influence, a coerced or non-transparent payment or another corruption risk.

6.9. The Company may conduct checks through internal systems; SumSub or other third-party verification services; sanctions lists; PEP data sources; blockchain analysis tools; bank or payment data; open sources; public or private registers; information from competent authorities; or other sources permitted by law.

6.10. If checks reveal sanctions, PEP, corruption, AML/CFT, fraud, tax, legal, security or other compliance risks, the Company may request additional documents, extend the verification period, restrict services, suspend, reject or cancel the Transaction or move it to the return stage, or terminate its relationship with the User.

6.11. The Company is not obliged to disclose to the User the complete sources, methods, internal criteria, results or risk indicators of sanctions, PEP, anti-corruption or other compliance checks if disclosure could impair its compliance, AML/CFT, sanctions, anti-corruption control, fraud prevention or security systems.

6.12. The User must not use OurExchangeClub services to evade sanctions, make impermissible payments to public officials or PEPs, make corrupt payments, pay bribes or unlawful commissions, commit fraud or pursue other unlawful purposes.

7․ Prohibited Activities and Impermissible Transactions

7.1. The User is prohibited from using the OurExchangeClub Website, user account, Transaction environment or the Company’s services for any unlawful, suspicious, fraudulent or non-transparent purpose, or any purpose contrary to this Policy, the Terms of Use, applicable law or the Company’s internal policies.

7.2. OurExchangeClub services must not be used for money laundering, terrorist financing, evasion of sanctions, corrupt activity, bribery, illicit remuneration, impermissible remuneration of public officials or politically exposed persons, fraud, tax evasion, circulation of illicit funds or other unlawful activity.

7.3. The User is prohibited from creating Transactions or making payments, transfers or Crypto-asset operations if their source, purpose, beneficiary, payment method, Crypto Wallet Address or economic rationale of the Transaction is or may be connected with unlawful, suspicious, sanctions-related, fraudulent, corrupt or other high-risk activity.

7.4. The User is prohibited from providing false, altered, incomplete, inconsistent or misleading details or documents, or details or documents concerning another person; or concealing the beneficial owner, the true purpose of the Transaction, the origin of funds or Crypto-assets, the payment source or other material circumstances related to the Transaction.

7.5. The User is prohibited from acting in the name of, for the benefit of or for the account of another person without disclosing this to the Company in advance and providing the relevant authority, beneficiary details and necessary documents.

7.6. The use of third parties’ bank accounts, bank cards, EasyWallet, payment instruments, Crypto Wallet Addresses or other financial or technical means is prohibited unless their use has been disclosed in advance, substantiated and accepted by the Company.

7.7. The User is prohibited from creating or using multiple user accounts, making self-referrals or false registrations, abusing the referral system, artificially splitting Transactions, circumventing limits or taking other actions that may distort the Company’s risk assessment, compliance checks or Transaction monitoring.

7.8. The User is prohibited from using OurExchangeClub services for Crypto-assets, funds or Transactions linked to hacking incidents, stolen funds, fraudulent schemes, mixers, darknet markets, illegal betting, drugs, weapons, sanctioned addresses, terrorist financing or other prohibited sources.

7.9. The User is prohibited from entering into Transactions whose purpose or result may be to circumvent legal, tax, accounting, licensing, declaration, sanctions, AML/CFT, anti-corruption or other mandatory requirements.

7.10. The Company has the right to reject, suspend or cancel any Transaction or move it to the return stage, and to restrict access to the user account or services, if there is a reasonable suspicion that the User has breached the requirements of this section or that the Transaction is connected with prohibited, suspicious or high-risk activity.

7.11. If the prohibitions in this section are breached, the Company may terminate its relationship with the User, retain and use relevant data for evidentiary, legal, compliance and security purposes, and provide information to competent authorities where prescribed by law.

7.12. The Company is not obliged to disclose to the User all its internal reasons for restricting, rejecting, suspending or terminating a Transaction or user account if disclosure could impair its compliance, AML/CFT, sanctions, anti-corruption, fraud prevention or security systems.

8․ Suspicious Activity and Cooperation with Competent Authorities

8.1. The Company has the right to detect, assess, investigate and, where necessary, respond to suspicious, unusual, disproportionate or high-risk circumstances related to Users, Transactions, payments, Crypto-asset transfers, Crypto Wallet Addresses or other activities.

8.2. Conduct, a Transaction or a circumstance may be regarded as suspicious activity if it is inconsistent with the User’s risk profile, Transaction history, stated purpose, origin of funds or Crypto-assets, payment source, economic rationale of the Transaction or the Company’s internal risk criteria.

8.3. Suspicious activity may include, without limitation, providing false or inconsistent details, failing to provide additional documents, concealing the true purpose of a Transaction, failing to disclose the beneficial owner, undisclosed third-party involvement, artificially splitting Transactions, circumventing limits, Transactions of unusual frequency or size, and the use of risky Crypto Wallets, payment instruments or sources.

8.4. A Transaction or conduct that may be linked to money laundering, terrorist financing, evasion of sanctions, corrupt activity, bribery, illicit remuneration, impermissible links with public officials or PEPs, fraud, tax evasion or other unlawful activity may also be regarded as suspicious activity.

8.5. If the Company detects or reasonably suspects suspicious activity, it may request additional documents, explanations or declarations, extend the verification period, restrict access to the user account, suspend, reject or cancel the Transaction, move it to the return stage or terminate its relationship with the User.

8.6. The Company may retain details, documents, communications, technical records, payment data, blockchain data, Crypto Wallet Addresses, risk assessments and internal compliance notes relating to suspicious activity for legal, compliance, security, dispute resolution and evidentiary purposes.

8.7. The Company has the right to provide information, documents or data to competent state authorities, courts, law enforcement agencies, regulators, tax authorities or other competent persons in the cases and manner prescribed by law, if required by applicable law or a lawful request from a competent authority, or if necessary for the Company to fulfil its legal obligations.

8.8. In cooperating with competent authorities, the Company may provide the User’s identification details, Transaction and payment data, Crypto-asset transfer data, blockchain transaction hashes, Crypto Wallet Addresses, documents, communications, risk assessments or other necessary information to the extent permitted by law.

8.9. The Company may refrain from informing the User about providing data to competent authorities, an internal investigation into suspicious activity, suspension of a Transaction or compliance measures if informing the User is prohibited by law, may obstruct the checks, impair AML/CFT, sanctions, anti-corruption, fraud prevention or security systems, or breach a requirement of a competent authority.

8.10. Investigating suspicious activity, cooperating with competent authorities, and retaining or providing data do not constitute a breach by the Company of the Terms of Use or this Policy if carried out for the purposes of applicable law, legal obligations, internal policies, security or risk management.

8.11. The Company is not obliged to disclose to the User the complete process of assessing suspicious activity, internal criteria, risk indicators, verification sources, details of communications with competent authorities or the results of checks if disclosure could impair its compliance, AML/CFT, sanctions, anti-corruption, fraud prevention or security systems.

9․ Suspension, Rejection, Cancellation and Return of a Transaction

9.1. The Company has the right to suspend, reject or cancel a Transaction or move it to the return stage at any stage if there are KYC, AML/CFT, sanctions, anti-corruption, fraud prevention, tax, legal, security, technical or risk management grounds.

9.2. A Transaction may be suspended if additional identification or documents, verification of the origin of funds or Crypto-assets, clarification of the payment source, assessment of the risk associated with a Crypto Wallet Address, clarification of the purpose or economic rationale of the Transaction, or sanctions, PEP, anti-corruption or other compliance checks are required.

9.3. A Transaction may be rejected or cancelled if the User fails to provide required documents or information, provides false, incomplete, inconsistent, altered or misleading details, refuses to cooperate, does not undergo identification, is not approved by the Company or fails to meet its risk and compliance requirements.

9.4. A Transaction may be rejected, cancelled or moved to the return stage if the Company cannot sufficiently rule out the risks of money laundering, terrorist financing, evasion of sanctions, corrupt activity, bribery, illicit remuneration, impermissible links with public officials or PEPs, fraud, tax evasion, circulation of illicit funds or other unlawful activity.

9.5. A Transaction may be suspended, rejected or cancelled if a payment, source of funds, Crypto-asset transfer, Crypto Wallet Address, transaction hash, blockchain transaction history or other details related to the Transaction are linked to high-risk, suspicious, sanctions-related, fraudulent, corrupt or other impermissible sources.

9.6. The Company may suspend, reject or cancel a payment made by a third party, funds received from a third party’s account, a Crypto-asset transferred from a third party’s Crypto Wallet or a Transaction for the benefit of a third party unless that third party’s involvement has been disclosed in advance, substantiated and accepted by the Company.

9.7. During suspension of a Transaction, the Company may temporarily refrain from providing payment or transfer details, paying funds, transferring a Crypto-asset or completing the Transaction, or may restrict the User’s ability to conduct Transactions until the necessary checks have been completed.

9.8. If a Transaction cannot be executed but the Company has already received the User’s funds or Crypto-asset, the Company may move the Transaction to the return stage in a manner permitted by law, technically possible and consistent with compliance requirements.

9.9. A return may be made using the same method or another method accepted by the Company, taking into account the nature of the Transaction, payment or transfer method, the User’s identification results, legal and compliance requirements, technical capabilities and risk assessment.

9.10. Applicable bank, payment, blockchain network, partner organisation, cash servicing, third-party or other actual costs may be deducted from the amount or Crypto-asset returned if incurred during processing, checking, attempting to execute or returning the Transaction, or other necessary actions.

9.11. If a return cannot be made for technical, legal, sanctions, AML/CFT, anti-corruption, security or other compliance reasons, the Company may keep the Transaction suspended or incomplete until the circumstances are clarified, additional checks are completed or instructions are received from a competent authority.

9.12. Suspension, rejection, cancellation or transfer of a Transaction to the return stage, or a delay in making a return, does not constitute a breach of the Company’s obligations if carried out for the purposes of this Policy, the Terms of Use, applicable law, legal obligations, internal policies, security or risk management.

9.13. The Company is not obliged to disclose to the User all the reasons, criteria, sources or results concerning suspension, rejection, cancellation or return of a Transaction or its internal compliance assessment if disclosure could impair its AML/CFT, sanctions, anti-corruption, fraud prevention, security or compliance systems.

10․ Data Retention, Confidentiality and Internal Controls

10.1. The Company may retain data, documents, communications, technical records and internal compliance notes relating to KYC, AML/CFT, sanctions, PEP, anti-corruption, fraud prevention, Transaction checks and risk assessment for legal, accounting, tax, security, dispute resolution and evidentiary purposes.

10.2. The data retained may include the User’s identification details, identity documents, photographs, selfies, liveness check results, details of a legal entity and beneficial owners, additional documents, details of the origin of funds and Crypto-assets, proof of payment source, Crypto Wallet Addresses, transaction hashes, risk assessments, verification results and Transaction history.

10.3. The Company may retain data on suspicious, rejected, suspended, cancelled or return-stage Transactions, internal assessments, risk indicators, compliance decisions and the documents underlying them for periods permitted by law and necessary for those purposes.

10.4. Data retention may continue after the end of the relationship with the User, a request to close the user account or cessation of use of the services if necessary for the purposes of applicable law, legal obligations, AML/CFT, sanctions, anti-corruption, tax, accounting, security, dispute resolution or evidence.

10.5. The Company takes reasonable technical, organisational and administrative measures to safeguard the confidentiality and security of compliance data, documents and internal assessments.

10.6. Internal KYC, AML/CFT, sanctions, PEP, anti-corruption and risk assessment materials, criteria, notes, risk models, verification sources and reasons for decisions may be treated as the Company’s internal and confidential information.

10.7. The Company may limit access to this information to those employees, representatives, service providers, advisers or partners who need it to perform their functions or for compliance checks, security, legal obligations or risk management.

10.8. The Company may employ internal control, verification, recordkeeping, audit, legal advice, technical security and compliance measures to implement this Policy properly, prevent breaches and reduce risks.

10.9. The Company may review previously collected data about Users, Transactions, payments, Crypto-asset transfers and Crypto Wallet Addresses if new circumstances or risk indicators, legal or regulatory changes, a request from a competent authority or a change in the Company’s internal policies arise.

10.10. A User’s request to erase or restrict data, or cease its processing, cannot serve as grounds for the immediate erasure or non-retention of data necessary for KYC, AML/CFT, sanctions, anti-corruption, tax, accounting, legal, security, dispute resolution or evidentiary purposes.

10.11. The Company may provide data to competent state authorities, courts, law enforcement agencies, regulators, tax authorities or other competent persons in the cases and manner prescribed by law, and may retain the fact and content of such disclosure and related communications.

10.12. The provisions of this section apply in conjunction with the Privacy Policy. Further rules on the processing, transfer and retention of personal data and the User’s rights are set out in the OurExchangeClub Privacy Policy.

11․ Amendments to the Policy and Final Provisions

11.1. The Company has the right to amend, supplement, update or adopt a new version of this Policy at any time, taking into account legislative, regulatory, technical, operational, security, compliance, AML/CFT, sanctions, anti-corruption, risk management or internal policy changes.

11.2. The amended version of the Policy is published on the Website or made available to the User through official communication channels designated by the Company.

11.3. Amendments take effect upon publication on the Website or on another date specified in the amended Policy, unless applicable law requires otherwise.

11.4. The User must regularly review the current version of the Policy. Continued use of the Website, user account or OurExchangeClub services after amendments constitutes the User’s acceptance of the amended Policy.

11.5. If the User does not agree with this Policy or its amendments, the User must not use the Website, create a Transaction request or execute a Transaction and must cease using OurExchangeClub services.

11.6. A finding that any provision of this Policy is invalid, unlawful or inapplicable does not affect the validity, legality or applicability of its remaining provisions.

11.7. This Policy applies in conjunction with the Terms of Use, Privacy Policy, and other policies, rules, procedures, tariffs and limits published on the Website.

11.8. If a provision of this Policy conflicts with a provision of another document published on the Website, the provision specifically governing the relationship concerned shall apply unless the Company has expressly provided otherwise.

11.9. The Armenian version of this Policy is the primary and prevailing version. In the event of any conflict, difference or discrepancy in interpretation between the Armenian version and translations into English, Russian or any other language, the Armenian version shall prevail.

11.10. This Policy applies throughout the User’s use of the Website, user account or OurExchangeClub services and to the extent that any of its provisions, by their nature, should continue to apply after the end of the relationship between the User and the Company.

11.11. The User may contact the Company through the official contact channels specified on the Website about this Policy or matters concerning compliance checks, KYC, AML/CFT, sanctions, PEP, anti-corruption or risk assessment.

11.12. Messages sent through unofficial communication channels, including social networks, personal messaging services or third parties, may not be regarded as an official application, request or notice unless the Company has expressly accepted them as official communications.