M3SHLogin

AML, KYC & CTF Policy

Last Updated: October 7, 2026

Status: DRAFT — to be reviewed by qualified compliance/legal counsel before adoption.

This Policy sets out how M3-SH ("we"), operator of the

M3-SH card product, prevents money laundering, terrorist financing and sanctions

evasion across the jurisdictions in which we and our partners operate.

YOUR RESPONSIBILITY AND ZERO TOLERANCE FOR ILLEGAL ACTIVITY. You are solely and fully responsible for how you use your account, your cards and the service, and for complying with all laws that apply to you. M3-SH does not support, facilitate or tolerate money laundering, terrorist financing, sanctions evasion, violent crime, threats or extortion, human trafficking or sexual exploitation, any abuse or exploitation of children, illegal drugs or weapons, fraud or identity theft, hacking or stolen funds, darknet markets, illegal gambling, bribery, corruption, tax evasion or any other illegal activity. If we detect or reasonably suspect such activity, we may freeze or reverse transactions, block cards, close the account, preserve records and report to the competent authorities, and you are liable for the resulting losses.

1. Purpose and Scope

This Policy applies to all customers, products and transactions of M3-SH. Its goals

are to: (a) verify who our customers are; (b) detect and prevent the use of our product for

money laundering, terrorist financing, fraud or sanctions evasion; (c) report suspicious

activity through the proper channels; and (d) keep records as the law requires.

2. Our Role — Technology Provider, Not a Custodian

M3-SH is a technology company and program manager. **We do not take custody of or

control customer funds or crypto assets.** The regulated activities — holding and moving

funds, issuing cards, and filing regulatory reports — are performed by licensed partners

(the issuing partner, the sponsoring bank and the payment networks). We operate the software,

run customer due diligence through a specialized verification partner, apply this Policy, and

support our licensed partners' compliance obligations. Where a regulatory filing (such as

a Suspicious Activity Report) is legally owned by the licensed partner, we escalate to them

and cooperate fully.

3. Regulatory Framework

We align our program with the FATF 40 Recommendations (in particular Recommendation 15

on virtual assets and VASPs), the global standard, and with the applicable laws of the

jurisdictions we touch, identified by their codes below:

United States

31 U.S.C. § 5336 (beneficial-ownership reporting to FinCEN)

beneficial ownership: 31 C.F.R. § 1010.230

31 C.F.R. Chapter V

European Union

Regulation (EU) 2024/1620

Asia / Eastern jurisdictions (via FATF alignment and, where relevant, local law)

Cap. 615**)

Trafficking and Other Serious Crimes Act (CDSA); Terrorism (Suppression of Financing) Act

International sanctions: OFAC (US — 31 C.F.R. Chapter V), the EU consolidated list,

and UN Security Council sanctions lists.

4. Risk-Based Approach

We assess and score risk by customer type, geography, product use and transaction behavior,

and apply controls proportionate to that risk — lighter for low risk, enhanced for high risk.

5. Customer Due Diligence (CDD) / KYC

Before a customer can be issued a card or move funds, we verify identity through our

specialized verification partner:

government-issued ID and a biometric face-match (liveness).

and identification of directors and ultimate beneficial owners (25%+ ownership).

No card is issued and no withdrawal is allowed until verification is successfully completed

(green status).

6. Enhanced Due Diligence (EDD)

We apply EDD — additional checks and senior approval — to higher-risk situations, including

politically exposed persons (PEPs), customers connected to higher-risk jurisdictions, unusual

or complex activity, and elevated source-of-funds risk.

7. Sanctions Screening

We screen customers and, where applicable, counterparties against the OFAC, EU and UN

sanctions lists at onboarding and on an ongoing basis. We do not provide the service to

persons or entities in comprehensively sanctioned jurisdictions, or to anyone on an applicable

sanctions list, and we block or freeze on a match. As a first-line filter we also restrict

sign-ups from sanctioned-jurisdiction domains, without relying on that filter alone.

8. Ongoing Monitoring

We monitor transactions for patterns inconsistent with a customer's profile (structuring,

rapid pass-through, unexpected geographies, velocity spikes). Alerts are reviewed and, where

warranted, escalated.

9. Suspicious Activity Reporting

Where activity is suspicious, we escalate internally and to the licensed partner that holds

the reporting obligation, so that a Suspicious Activity Report (SAR) / Suspicious Transaction

Report (STR) is filed with the competent Financial Intelligence Unit. We do not "tip off" the

customer about a report.

10. Record-Keeping and Retention

We retain KYC/KYB, verification, screening and transaction records for the period required by

law — at least five (5) years after the end of the customer relationship — and make them

available to competent authorities and to our licensed partners on valid request.

11. Prohibited Customers and Activities

We do not serve, and we terminate on detection: persons on sanctions lists; persons in

comprehensively sanctioned jurisdictions; anonymous or shell arrangements that defeat

verification; and use of the product for illegal activity, including laundering proceeds of

crime or financing terrorism.

12. Source of Funds

For higher-risk customers and on request, we require information and evidence on the source

of funds and source of wealth, and decline or exit relationships where it cannot be

reasonably established.

13. Governance, Responsibility and Training

A designated compliance officer ([COMPLIANCE OFFICER / MLRO]) owns this program. Staff

receive AML/CTF training appropriate to their role. The program is independent of commercial

targets.

14. Review and Updates

This Policy is reviewed at least annually and whenever the law, our products or our partners

materially change.

15. Contact

Compliance contact: contact@m3sh.cards — M3-SH.

Services Business and/or hold other licenses for its role; (2) the named compliance

officer/MLRO; (3) the licensed partner that owns SAR/STR filing; (4) partner names, left

blank here until contracts are signed.*