KYC Policy

Last updated: 20 October 2026

This Know Your Client (KYC) Policy summarizes the onboarding, identity verification and due diligence standards applied by LUMEN PAYMENTS LIMITED to every client relationship.

1. Purpose and Regulatory Basis

LUMEN PAYMENTS LIMITED ("Lumen Payments" or the "Company") is a Money Services Business registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) under MSB registration number N300001690. Lumen Payments is not a bank. FINTRAC registration is not a licence, is not prudential supervision and does not mean endorsement by FINTRAC or the Government of Canada.

This Policy explains how we establish and confirm the identity of the clients we work with, and how we evaluate and control the risks each of them presents. It is built to satisfy the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its regulations, the guidance published by FINTRAC and the international standards of the Financial Action Task Force (FATF).

KYC is one part of a wider compliance program that combines verification, screening and monitoring to protect Lumen Payments, its clients and its banking partners from fraud, money laundering, terrorist financing and sanctions evasion. We do not open a business relationship or carry out any transaction until the required verification has been completed successfully.

2. Verification of Individuals

Onboarding starts when a business sends an enquiry to our team, and KYC checks run from that point until before the client agreement is signed. They apply to every individual who acts on behalf of a client or controls it, including directors, authorized signatories and beneficial owners.

For each of these individuals we:

• collect full legal name, date of birth, nationality and residential address;
• obtain a valid government-issued photo identity document and a recent proof of address;
• confirm identity using a method permitted under Canadian law, such as the government-issued photo identification method supported by liveness and biometric checks, the credit file method or the dual-process method.

3. Verification of Businesses and Due Diligence Levels

Our clients are businesses, so Know Your Business (KYB) verification sits at the centre of onboarding. For every client entity we confirm that it legally exists, how it is structured and that it is actively operating. We also identify every individual who owns or controls 25 percent or more of the entity, whether directly or indirectly. How far the review goes depends on the risk the client presents:

• Basic due diligence (low risk). We confirm the entity's legal existence, organizational structure and operating status, and identify its directors.
• Intermediate due diligence (medium risk). In addition, we obtain a full register of directors and shareholders, identify each ultimate beneficial owner and review an ownership chart that traces the complete chain of control.
• Enhanced due diligence (high risk). On top of the above, we require signed declarations of source of funds and source of wealth with supporting evidence, prepare background profiles of the beneficial owners, and carry out extended sanctions and adverse media screening and open-source research.

4. Risks Addressed at Onboarding

Each onboarding control responds to a specific risk:

• Identity fraud. We combine government-issued photo identification, proof of address and real-time identity verification, and use document authentication technology to spot altered or forged documents.
• Third-party funding. We ask for documentary evidence of source of funds and source of wealth, and we accept payments only from accounts held in the client's own name.
• Complex or opaque ownership. We request certificates of incorporation, registers of directors and shareholders and further KYB documents until we fully understand who owns and controls the client.
• High volumes or high values. Clients expected to send large numbers of transactions or high-value transactions receive enhanced due diligence, including a review of their financial statements and a documented assessment of their source of funds and wealth.

5. Sanctions, PEP and Adverse Media Screening

We screen every client and its related persons, and where appropriate its counterparties, both at onboarding and throughout the relationship. Screening covers:

• Canadian sanctions administered by Global Affairs Canada, including measures under the Special Economic Measures Act and the Justice for Victims of Corrupt Foreign Officials Act;
• the list of terrorist entities under the Criminal Code;
• United Nations Security Council sanctions;
• the OFAC lists maintained by the United States;
• FATF public statements.

We also establish whether any individual is a politically exposed person, the head of an international organization, or a family member or close associate of such a person. Where that is the case, we apply the additional measures the PCMLTFA requires, including approval by senior management. Adverse media searches and a review of transaction behaviour round out the screening process.

6. Client Risk Rating and Periodic Review

Each client is assigned a risk rating that reflects its geographic exposure, industry, ownership structure, background and its expected and actual transaction patterns. Ratings are not fixed: we reassess them whenever new information emerges. The review cycle follows the rating:

Outside the regular cycle, we ask for updated documents and information when an identity document expires, when a client's risk profile or transaction behaviour changes significantly, or when its beneficial ownership, shareholders or directors change. If a client does not provide the updates we request, we may restrict or end our services.

7. Restricted and High-Risk Jurisdictions

Lumen Payments does not provide services to individuals, entities or businesses located or incorporated in, or otherwise connected with, Afghanistan, Belarus, Cuba, Iran, Myanmar, North Korea, Russia, South Sudan, Sudan, Syria, Venezuela, Yemen or the territories of Ukraine currently occupied by Russia.

Where a client has links to a jurisdiction that FATF identifies as having strategic AML/CFT deficiencies, or that we otherwise assess as high risk, we apply enhanced due diligence and may decline the relationship. We keep this list under review and may change it as sanctions and risk assessments develop.

8. Transaction Monitoring and Regulatory Reporting

We monitor client activity on an ongoing basis and compare it with the profile established at onboarding. Activity that looks unusual or potentially suspicious is escalated to the Compliance Officer for review.

As the PCMLTFA requires, Lumen Payments files suspicious transaction reports, terrorist property reports, large cash transaction reports, electronic funds transfer reports and large virtual currency transaction reports with FINTRAC whenever the legal thresholds or conditions are met, and applies any ministerial directives that are in force.

We share client information with third parties only when it is needed for these regulatory reports or when a law, regulation, subpoena or court order compels disclosure. Beyond those legal duties, we do not share client information without the client's explicit consent.

9. Record Keeping and Data Security

As the PCMLTFA requires, we keep identification documents, verification records, transaction records, risk assessments, due diligence files and copies of reports for at least five years from the last transaction or the end of the business relationship. Records are stored so that they can be produced to FINTRAC within 30 days of a request. In line with PIPEDA, they are protected by access controls, encryption and secure storage. Our Privacy Policy gives more detail on how we handle personal information.

10. Compliance Officer and Staff Training

A designated Compliance Officer is responsible for putting this Policy into practice, for approving high-risk relationships and for the Company's communication with FINTRAC.

Every member of staff involved in onboarding and compliance receives training each quarter. The training covers Canadian client due diligence standards, how to validate identity documents, how to recognize red flags and the reporting obligations that apply under the PCMLTFA. We document who attended and what was covered, and review this as part of the two-year effectiveness review of our compliance program.

11. Contact

If you have questions about this KYC Policy or about the documents needed for onboarding, please contact our compliance team at compliance@lumenpayments.io. KYC documents should only be sent through the channel our compliance team gives you, not through the Website contact form.

LUMEN PAYMENTS LIMITED, registration number BC1582665, British Columbia, Canada, 5307 Victoria Drive #1277, Vancouver BC V5P 3V6, Canada. FINTRAC MSB registration number N300001690. Website: lumenpayments.io.