AML and Sanctions Policy

1. Purpose

Untappd Labs Inc., doing business as MedFX, is committed to preventing the use of its Services for money laundering, terrorist financing, sanctions evasion, fraud and other financial crime. This policy summarises the controls we and our licensed banking partners apply. It is not a complete description of our internal procedures.

2. Governance

We maintain a compliance programme overseen by a designated compliance officer with the authority and resources to act. The programme is reviewed regularly and updated when laws, risks or partner requirements change.

3. Risk-based approach

We assess risk by customer type, ownership structure, country, specialty, expected volume, payment rails and the countries of the payers. Higher-risk relationships get enhanced due diligence and closer monitoring. Some jurisdictions and industries are restricted or prohibited, as described in our Regulatory Disclosures.

4. Customer due diligence

• Every clinic completes know-your-business (KYB) verification before an account opens.
• We identify and verify owners, directors and others who control the clinic, and screen them against sanctions and watch lists.
• We confirm professional licences for the practitioners who receive payments.
• We understand the purpose and expected pattern of the clinic’s activity and compare actual activity to it.
• We refresh information on a risk basis and when something changes.

5. Sanctions screening

We screen clinics, owners and relevant counterparties against applicable sanctions lists, including those of the United States (OFAC), the European Union, the United Kingdom and the United Nations. We do not process payments to or from comprehensively sanctioned jurisdictions or persons.

6. Transaction monitoring

Payments are monitored for unusual patterns such as unexpected volumes, structuring, rapid movement of funds, payments from unrelated third parties and links to high-risk jurisdictions. Transactions may be held while we review them, and we may ask for supporting documents such as an agreement with the patient or an invoice.

7. Reporting

Where required, we and our partners report suspicious activity to the competent financial intelligence unit or other authority. The law may prohibit us from telling you that a report has been made.

8. Record keeping

We keep identification, verification and transaction records for the period the law requires, usually at least five years after the relationship ends.

9. Training

People who work on onboarding, payments and support receive compliance training when they join and at least once a year.

10. Independent review

The effectiveness of the programme is reviewed periodically by internal or external reviewers.

11. Contact

Questions about this policy can be sent to support@specie.finance. To report suspected misuse of the Services, write to the same address with the subject line “Compliance”.