AML AND SANCTIONS POLICY

Last updated: 1 July 2026

‍

ARBONUM L.L.C-FZ, a limited liability company registered under the laws of the United Arab Emirates (Registration No. 2310797, registered office: Business Center 1, M Floor, The Meydan Hotel, Nad Al Sheba, Dubai, UAE) and ROWLING LIMITED, a limited liability company registered under the laws of the Republic of Cyprus (Registration No. HE 237792, registered office: Christabel House, 118 Agias Fylaxeos St., 3087 Limassol, Cyprus) — together, "Arbonum" — are committed to preventing money laundering, terrorist financing and violations of international sanctions across all of their operations.

Arbonum is a service through which corporate clients engage independent specialists ("contractors") to provide IT, creative and digital services, and through which those contractors are paid. This activity places Arbonum in the flow of cross-border payments to individuals in a large number of countries. Arbonum treats the associated risk of money laundering, terrorist financing and sanctions circumvention as one of the principal risks of its business.

This Policy applies to both companies, to their management and employees, and to any person engaged to perform counterparty verification, compliance or payment processing functions on their behalf. Both companies operate to a single standard; where the local law of one of them is stricter, the local requirement prevails.

‍

1. Legal framework

Arbonum's compliance programme is designed with reference to the FATF Recommendations (International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation), Directive (EU) 2015/849 as amended by Directive (EU) 2018/843, and Directive (EU) 2018/1673, together with the other applicable laws of the jurisdictions in which Arbonum operates:

Cyprus (Rowling Limited). The Prevention and Suppression of Money Laundering and Terrorist Financing Laws (Law 188(I)/2007, as amended); Law 58(I)/2016 on the implementation of restrictive measures. The EU restrictive-measures regulations — including Council Regulation (EU) No 269/2014, Council Regulation (EU) No 833/2014 and Council Regulation (EU) No 765/2006 — are directly applicable and binding on the company irrespective of its licensing status.

UAE (Arbonum L.L.C-FZ). Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering, as amended by Federal Decree-Law No. 26 of 2021; Cabinet Decision No. 10 of 2019; Cabinet Decision No. 74 of 2020 on targeted financial sanctions and the lists of the UN Security Council and the UAE Cabinet; the UAE Local Terrorist List; and the applicable rules of the Meydan Free Zone Authority.

Sanctions regimes screened against: the United Nations; the European Union (the EU Consolidated Financial Sanctions List and Regulations No 269/2014, No 833/2014 and No 765/2006, each as amended); the United Kingdom (the UK Sanctions List and the OFSI Consolidated List); the United States (OFAC — the SDN List and country programmes; the BIS Entity List); and the UAE (the Local Terrorist List).

The autonomous EU, UK and US regimes are applied by both companies as a single standard. Where such application would be legally problematic in a given jurisdiction, the activity concerned is not carried out by that company at all; the standard is not lowered.

‍

2. Governance and regulatory status

Arbonum maintains internal Rules of Procedure for AML/CTF and sanctions compliance, approved by the management of both companies. A designated Compliance Officer is responsible for the day-to-day operation of the programme, reports directly to management, and has the authority to approve, restrict or refuse any business relationship or transaction. That decision cannot be overridden by commercial management. The Compliance Officer is the escalation point for sanctions matches and suspicious activity and authorises any approach to the authorities. Detailed operating procedures — including screening parameters, review intervals and internal risk indicators — are not published; they are provided to counterparties, partner financial institutions, auditors and regulators on request.

Regulatory status. Neither of the Arbonum companies is a licensed financial or payment institution, an obliged entity under AML legislation, or a DNFBP in its jurisdiction. This follows from the business model: Arbonum contracts with the client and separately with the contractor as its own subcontractor, receives its own consideration and pays its subcontractors from its own funds; Arbonum does not hold client or contractor funds, does not maintain accounts or wallets for them, does not transmit funds as agent for a third party, and does not provide currency exchange, money remittance or crypto-asset services.

The requirements of this Policy are applied as an internal standard, as a contractual commitment to clients and banking partners, and as a risk management measure. A number of obligations apply irrespective of licensing status and are complied with unconditionally — see sections 1 and 7.

‍

3. Risk-based approach

Every client and every contractor is assigned a risk rating — low, medium or high — with the reasons recorded. The rating determines the depth of verification and the frequency of periodic review. A rating is revisited immediately on an adverse screening alert, a change in the ownership structure, a change of country or bank, a material change in the payment profile, adverse media, or a change to the country lists.

Enhanced due diligence (EDD), with the approval of the Compliance Officer, is applied where any of the following is present: a connection with a jurisdiction to which section 8 applies enhanced due diligence; a politically exposed person (PEP), a family member or a close associate of a PEP among the owners or management; an opaque or unexplainedly layered ownership structure; a recently incorporated company with no demonstrable activity; a payment profile inconsistent with the stated business; a request for a service close to a restricted category; or an unresolved adverse screening or media result.

There is no de minimis threshold: identity verification and sanctions screening are mandatory for all counterparties before any payment. Where a material information gap cannot be closed, the relationship is refused or terminated; commercial value is not a ground for exception.

‍

4. Client due diligence (KYB)

Arbonum's clients are legal entities, predominantly game development, software and digital marketing studios. A relationship is not activated and a client may not invite contractors until verification is complete and the activation decision has been recorded. Verification comprises:

1. Jurisdiction — the country of incorporation, the countries of operation and the countries of the founders and beneficial owners are checked against section 8 and the FATF lists.
2. Identification of the company — name, legal form, registration number, addresses and constitutional documents, verified against official corporate registry data rather than client-supplied copies alone.
3. Screening — the company, its directors and its beneficial owners are screened against sanctions lists, PEP data, official registries and adverse media.
4. Representatives — identification of the persons acting for the client and verification of their authority.
5. Ownership and control — identification of all direct and indirect shareholders and of every ultimate beneficial owner (more than 25% of the ownership interest, or control by other means). Layered and nominee structures are unwound to natural persons. Where a beneficial owner cannot be established, senior management is identified and the reasons recorded.
6. Relationship profile — the expected services, volumes, contractor headcount and payment corridors are recorded at onboarding so that subsequent activity can be tested against them.
7. Consistency with the stated business — the website, released products, app-store presence and public footprint confirm that the services requested correspond to genuine activity.
8. Activation decision — recorded in writing, stating the risk rating, the approved scope of services, the evidence relied on and the person who took the decision.

Arbonum does not onboard: persons subject to sanctions and persons owned or controlled by them; companies from the countries and territories listed in section 8, or companies controlled by persons from them; anonymous and unverifiable counterparties; companies with no demonstrable economic activity; persons who refuse to disclose their beneficial owners or who provide false information; clients in the sectors excluded by section 6; and clients who, in the assessment of the compliance function, are using the service to move money rather than to procure genuine services.

‍

5. Contractor due diligence (KYC)

Invitation only. A contractor is onboarded solely on the invitation of a client that has already been verified. External applications without a client reference are not accepted. The inviting client is recorded on the contractor's file.

Verification is mandatory before activation and before any payment. It is performed through the integrated SumSub system and comprises: collection of name, date of birth, nationality, address and country of residence; checking of the identity document for authenticity and signs of tampering; a biometric liveness check and facial comparison against the document; detection of forged, reused and synthetic images; screening against sanctions lists, PEP data and adverse media; and filters that reject documents issued by the authorities of unrecognised and occupied territories, including documents issued by the authorities of the Russian Federation in the occupied regions of Ukraine.

Location controls. A stated address is by itself a weak control for remote workers. Arbonum therefore applies several independent location indicators — technical, banking and documentary — and any material inconsistency between them is resolved before activation or payment. Accounts at bank branches in restricted territories are rejected. The use of anonymising infrastructure does not resolve the question of location and is not accepted as an explanation; where the actual location cannot be established, access is refused.

Where there is a reasonable suspicion that a contractor is located in, or is providing services from, a country or territory listed in section 8, access is closed and no payment is made.

Ongoing monitoring. Contractor records are subject to automated continuous screening; alerts are reviewed within one business day. Documents are re-verified on expiry and at intervals determined by the risk rating. Re-verification is triggered immediately by a change of country of residence or of bank, a screening alert, or adverse media.

Activation requires a recorded decision of the compliance function. A "clear" system result is a necessary but not a sufficient condition.

‍

6. Scope of services and excluded sectors

Clients order services only from Arbonum's predefined catalogue; services outside the catalogue are not provided. Arbonum's core specialisation is IT and creative digital services for game development, software and digital marketing. Services may be added to the catalogue only with the prior approval of the compliance function.

Arbonum does not provide, facilitate or pay for services connected with: adult content; gambling and betting; arms, ammunition, or military and dual-use goods; precious metals, precious stones or unrefined commodities; unlicensed financial services, money remittance or crypto-asset services; unlicensed pharmaceuticals or controlled substances; debt collection; high-yield investment schemes and multi-level marketing; malware and surveillance or fraud tooling; or any activity that is unlawful in the jurisdiction of the client, of the contractor or of the paying company.

EU restrictions on the provision of services. The catalogue has been mapped against the categories of services restricted by Article 5n of Council Regulation (EU) No 833/2014 and Article 1jc of Council Regulation (EU) No 765/2006 (IT consultancy and computer services, software supply, business and management consulting, public relations, advertising, market research, product design, technical testing and, with effect from 25 May 2026, managed security services). Such services are not provided to the Government of Russia or of Belarus or to legal persons established in Russia or Belarus, and system controls block any such order. The mapping is updated on each amendment of those Regulations and on each extension of the catalogue.

‍

7. Sanctions screening and action on a match

No Arbonum company may, directly or indirectly, enter into a relationship with, make funds available to, or provide services to a person on a sanctions list, a person owned or controlled by such a person, or a person acting on their behalf.

When screening is performed: at onboarding (the client, its directors, shareholders, beneficial owners and representatives; every contractor); continuously, through automated monitoring of the active portfolio; before every payment, covering the payee, the receiving bank and any intermediary bank; on any material update to a list, through re-screening of the entire active portfolio; and on any change of ownership, control, country of residence or bank.

Ownership and control. Screening is not limited to an exact name match. An assessment is made of whether the counterparty is owned or controlled by a listed person, applying the US 50 Percent Rule and the EU ownership and control criteria. Where this cannot be established with reasonable confidence, the relationship or the payment does not proceed.

Where a match is confirmed or probable:

1. The transaction is not executed and the relationship is suspended. Blocking is the default; release requires a positive, documented decision.
2. The matter is escalated to the Compliance Officer on the same business day.
3. Any funds held for the benefit of that person are frozen and are not released, moved or set off.
4. The competent authority of the relevant jurisdiction is notified of the freeze, without delay and within the period prescribed by law.
5. Any other Arbonum company with exposure to the same person is informed.
6. Neither the counterparty nor any third party is informed of the fact, content or consideration of such a notification. Where a relationship is suspended or terminated, a neutral form of words agreed with the compliance function is used.

Suspicion of money laundering. An employee who knows, suspects or has reasonable grounds to suspect money laundering, terrorist financing, sanctions circumvention or fraud must report it to the Compliance Officer immediately and in any event within one business day. The threshold is suspicion, not certainty. The Compliance Officer records the analysis and the conclusion and determines the further action to be taken, including whether to approach the authorities.

‍

8. Countries and territories Arbonum does not work with

For reasons of sanctions, country and reputational risk, Arbonum does not accept clients or contractors registered, resident or operating in the following countries, and does not make or accept payments to or from them:

Afghanistan · Burundi · Central African Republic · Cuba · Democratic People's Republic of Korea · Democratic Republic of the Congo · Eritrea · Guinea-Bissau · Haiti · Iran · Iraq · Lebanon · Libya · Mali · Myanmar · Nicaragua · Somalia · South Sudan · Sudan · Syria · Venezuela · Yemen · Zimbabwe

Unrecognised, occupied and disputed territories. No services are provided and no payments are made in respect of: Crimea and the city of Sevastopol; the so-called Donetsk and Luhansk People's Republics, the occupied parts of the Zaporizhzhia and Kherson regions and any other occupied territories of Ukraine; Transnistria; Nagorno-Karabakh / "Artsakh"; Abkhazia; South Ossetia; Somaliland; Northern Cyprus ("TRNC"); the Sahrawi Arab Democratic Republic and the territory of Western Sahara outside internationally recognised administration. Identity documents issued by the authorities of these territories are not accepted. Documents issued by the authorities of the Russian Federation in the occupied territories of Ukraine, including passports issued to residents of those territories, are not accepted.

Country-based enhanced due diligence. Clients and contractors connected with jurisdictions included by the FATF in its list of jurisdictions under increased monitoring are accepted only under EDD, with the approval of the Compliance Officer.

Russia and Belarus. Contractors are accepted only under EDD and only where all of the following conditions are met: individual sanctions screening at onboarding and on a continuous basis, including the receiving bank; confirmation that the person is not listed and is not controlled by a listed person; confirmation that the service does not breach the restrictions in section 6; payment only to a bank that is not subject to blocking sanctions and is not excluded from SWIFT, with the bank re-screened before each payment; no payments to third parties or to accounts at branches in the territories listed above; and the approval of the Compliance Officer.

Maintenance of the list. The list is maintained by the Compliance Officer, reviewed against the current lists of the UN, the EU, the United Kingdom, the United States, the UAE and the FATF at least quarterly and on every material change to those lists, and approved by management. Each version is retained with its date. The absence of a country from the list does not mean the absence of risk; the risk rating always applies.

‍

9. Payment controls

●      No payment is released until verification, screening and activation of the payee are complete.

●      Payments are made only to an account held in the contractor's own name. Payments to third parties, to nominees or "on behalf of" arrangements are not made.

●      Cash is not used.

●      Every payment is screened against the payee, the receiving bank and any intermediary bank before release. A blocked payment remains blocked until released in writing by the compliance function.

●      No payments are made to accounts at branches in the territories listed in section 8, or to banks subject to blocking sanctions or excluded from SWIFT.

●      The person who initiates a payment may not approve its release.

Monitoring. Activity is compared on an ongoing basis against the profile recorded at onboarding. Deviations from that profile, and patterns matching Arbonum's internal risk indicators, are investigated by the compliance function before any further payment is released. The outcome of the review is recorded regardless of the result.

‍

10. Refusal and termination

Arbonum refuses onboarding, suspends access, blocks a payment or terminates a relationship where: verification cannot be completed or the counterparty does not provide the information requested; documents are false, forged or materially incomplete; a sanctions match is confirmed or cannot be excluded; there is a suspicion of money laundering, terrorist financing, sanctions circumvention or fraud; the counterparty is connected with a country or territory listed in section 8; or a service is requested outside the approved scope or in an excluded sector.

Decisions are recorded with reasons and entered on an internal decline list; a counterparty on that list may not be onboarded by another Arbonum company without the approval of the Compliance Officer. Termination is managed so as to avoid tipping off. Frozen funds remain frozen after termination.

‍

11. Record keeping and training

Retention. Verification materials, evidence of verification, screening results and alert dispositions, risk ratings, decisions and their reasons, transaction records and versions of this Policy are retained for at least five years from the end of the relationship or the date of the transaction, and longer where required by law or by a competent authority. Records are retained in a form that allows individual transactions and decisions to be reconstructed and are provided on request from a competent authority without undue delay. Arbonum retains its own copy of the evidence, including where verification was performed through SumSub. The AML/CTF retention period takes precedence over shorter commercial retention periods.

Responsibility where functions are outsourced. The use of SumSub and of subscription databases (including Firmas.lv) does not transfer responsibility: every onboarding, screening and payment decision remains Arbonum's decision. Screening configuration — the lists enabled, the matching thresholds, and the PEP and monitoring parameters — is documented, approved by the Compliance Officer and subject to change control. Where a provider is unavailable, onboarding and payments stop rather than continuing manually.

Training. Employees engaged in onboarding, payments and compliance receive training before being given access to the relevant systems. Training covers typologies, risk indicators, restrictions on the provision of services, escalation procedures and the prohibition on tipping off. Ad hoc briefings are issued following any material change to sanctions measures or lists.

Review and breaches. This Policy is reviewed at least annually and immediately on any material change of law, of the lists, of the business model or of the ownership structure; each version is approved by the management of both companies. A breach of this Policy is a disciplinary matter and may be grounds for termination. The current version is provided to counterparties, banking partners, auditors and regulators on request at compliance@arbonum.com.

‍