Corporate Governance

Last updated: 20 October 2026

This page summarizes how LUMEN PAYMENTS LIMITED is directed, managed and held to account.

1. Purpose and Corporate Status

This document sets out the corporate governance framework of LUMEN PAYMENTS LIMITED ("Lumen Payments" or the "Company"). The Company is incorporated in British Columbia, Canada, under registration number BC1582665, and has its registered office at 5307 Victoria Drive #1277, Vancouver BC V5P 3V6, Canada. It is registered as a Money Services Business with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) under MSB registration number N300001690, and it is subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its regulations. Lumen Payments is not a bank. FINTRAC registration is not a licence, is not prudential supervision and does not mean endorsement by FINTRAC or the Government of Canada.

The framework explains how authority is distributed, how decisions are taken and how accountability is kept in place. Its aim is a Company that is run prudently, within the law and for the long-term benefit of its shareholders, clients and banking partners.

2. Composition of the Board

The Board of Directors is the main body overseeing the Company's general management and strategic direction. It may have up to three directors, and at least one of them should be an independent non-executive director. Each director must bring suitable professional qualifications, sound judgment and personal integrity. New directors go through a full induction on the Company's business model, internal control framework and risk profile.

Both executive and non-executive directors may sit on the Board. Executive directors take an active part in running the Company day to day. Non-executive directors bring independent judgment and strategic oversight, and challenge management where needed. Whatever their role, all directors owe the same fiduciary duties to the Company under the Business Corporations Act (British Columbia).

3. Responsibilities of the Board

Ultimate responsibility for the Company's strategy, regulatory compliance and overall performance rests with the Board. In meeting that responsibility, the Board:

makes sure the Company fulfils its obligations under the PCMLTFA and towards FINTRAC;
gives proper weight to privacy and data protection duties under PIPEDA;
takes informed decisions on operational and financial risks;
keeps the services offered within the Company's defined risk appetite;
encourages a culture of integrity and accountability across the organization;
communicates openly and transparently with regulators, banking partners and other stakeholders.

4. Board Meetings and Conflicts

Directors are expected to attend every regular and special Board meeting, in person or by electronic means. Formal minutes record attendance, discussions and decisions. They are approved at the next meeting and kept with the Company's records.

Every director must promptly declare in writing any actual or potential conflict between their personal or business affairs and their duties to the Company. These declarations are entered in the Company's register of directors' declarations, and a director with a conflict does not take part in the decision concerned. If a material conflict continues, the director may be asked to consider leaving the Board.

5. The Ultimate Beneficial Owner

The ultimate beneficial owner (UBO) does not hold a corporate office unless formally appointed as a director or officer. The UBO may give high-level strategic guidance but does not normally take part in day-to-day management. All dealings between the UBO and the Board are transparent and documented.

The Board makes sure that the UBO's shareholder rights are respected. These include voting on matters reserved to shareholders, pre-emptive rights when new shares are issued, access to corporate records within legal limits, dividends when declared, and dissent and appraisal rights under applicable corporate law.

6. Executive Management

The Board delegates day-to-day management to a small executive team:

the Chief Executive Officer puts the corporate strategy into effect and oversees the Company's operations;
the Head of Operations runs daily activities and coordinates the work of the different functions;
the Head of Risk identifies, assesses and manages operational and other risks;
the Head of Information Technology is responsible for the technology infrastructure and for keeping it aligned with security standards;
the Managing Director represents the Company in Canada and manages its relationship with FINTRAC.

7. Approval of New Products and Services

The Company does not launch any new product or service without Board approval. Each proposal goes through a documented, risk-based assessment of operational, financial, reputational, legal and compliance risks, including exposure to money laundering and terrorist financing, as well as cybersecurity and data protection risks. The assessment must be completed, and its conclusions built into the Company's controls, before the product or service is made available to clients.

8. Anti-Money Laundering and Anti-Terrorist Financing Program

Lumen Payments runs a compliance program designed to meet the requirements of the PCMLTFA. A designated Compliance Officer, given enough authority and resources for the role, oversees all anti-money laundering and anti-terrorist financing obligations and reports directly to the Board. The program is documented in written policies and procedures approved by the Board, and it rests on a documented risk assessment that shapes a risk-based approach to client due diligence. Our KYC Policy describes the onboarding and due diligence part of the program.

Transaction monitoring systems flag unusual patterns, and the compliance team reviews automatically generated alerts before any report is filed with FINTRAC. Every employee receives regular training on anti-money laundering and anti-terrorist financing. The effectiveness of the whole program is reviewed at least every two years, and the results are reported to senior management.

9. Information Security and Technology Risk

The Company operates a structured framework for governing cybersecurity. It includes regular assessments of technology and information security risks, controls that support compliance with PIPEDA, an incident response plan for security breaches, and periodic security audits and vulnerability testing. Material incidents are reported to the Board without delay.

10. Internal and External Audit

The internal audit function gives the Board independent assurance about how well internal controls, risk management and governance processes are working. The Board may also appoint external auditors. Internal and external auditors alike must stay independent of the activities they examine and follow high professional standards. Their findings are tracked until they are resolved.

11. Disclosure, Reporting and Code of Ethics

The Board makes sure that the Company meets every disclosure and reporting obligation under Canadian law, including, where required, accurate descriptions of its internal control systems, risk management framework and audit processes.

Lumen Payments is committed to doing business with honesty, transparency and accountability. Every director, officer and employee must comply with applicable law, including the PCMLTFA and FINTRAC guidance. The Company has zero tolerance for bribery, corruption and financial crime, and it promotes equal opportunity and a workplace built on professionalism and mutual respect.

12. Contact

Questions about the governance of Lumen Payments can be sent to info@lumenpayments.io. Formal legal notices should be addressed to legal@lumenpayments.io or by post to LUMEN PAYMENTS LIMITED, 5307 Victoria Drive #1277, Vancouver BC V5P 3V6, Canada.

LUMEN PAYMENTS LIMITED, registration number BC1582665, British Columbia, Canada. FINTRAC MSB registration number N300001690. Website: lumenpayments.io.