Monica AML and Counter-Financing of Terrorism Policy

1Purpose and scope

Monica Digital Assets Limited ("Monica") is committed to preventing the use of its platform for money laundering, terrorist financing, proliferation financing, fraud and other financial crime. This AML/CFT Policy (the "Policy") sets out the principles, controls and accountabilities that govern Monica's risk-based programme. It applies to all employees, contractors, directors, partners and authorised agents acting for or on behalf of Monica, and to every product and service Monica offers in Nigeria.

Monica operates strictly as a one way crypto to naira off ramp. Monica is not an exchange and not a bank. Crypto deposits and conversion are handled by licensed crypto exchanges, and Naira accounts, transfers and payouts are carried out by banking partners licensed by the CBN. Once the network confirms a deposit, the customer is owed the corresponding Naira amount, paid to the customer's verified Nigerian bank account. The AML/CFT programme described in this Policy is therefore designed to detect and prevent the entry of illicit value through crypto deposits and the laundering of value through the resulting Naira payments.

2What Monica is and is not

Monica is a crypto off ramp. It is not an exchange and it is not a bank. In practice that means:

• Naira accounts, transfers and payouts are carried out by banking partners licensed by the CBN;
• crypto deposits and conversion are handled by licensed crypto exchanges;
• Monica does not run an order book and does not let customers trade with each other;
• every customer is verified before any Naira is paid out, in one screen, with their NIN plus a selfie (see clause 5);
• every deposit and payout is screened and monitored for fraud, sanctions and money laundering red flags (see clauses 7 and 9);
• Monica keeps records and cooperates with lawful requests from competent authorities (see clauses 11 and 14);
• personal data is handled as described in Monica's Privacy Policy; and
• the controls in this Policy are written with reference to the Money Laundering (Prevention and Prohibition) Act 2022, the Terrorism (Prevention and Prohibition) Act 2022, the Nigeria Sanctions Act 2022 and the Financial Action Task Force (FATF) recommendations on virtual assets. Nothing on this page is a claim of registration, licensing or approval by any regulator.

3Governance and Compliance Officer

Monica's Board approves this Policy and oversees the AML/CFT programme. A designated Money Laundering Reporting Officer / Compliance Officer (the "Compliance Officer") of sufficient seniority and independence is responsible for the day-to-day operation of the programme and reports directly to the Board. The Compliance Officer has unrestricted access to customer records, system data and transaction logs and may pause or restrict any Account or transaction without prior notice where there is reasonable suspicion of financial crime.

4Risk-based approach

Monica adopts a risk-based approach calibrated to the nature, size, complexity and geographic reach of its business. An institution-wide risk assessment is conducted at least annually and reviewed whenever there is a material change in product, customer segment, technology, or applicable law. The assessment considers customer risk (including occupational and residence factors), product and service risk, channel risk, geographic risk and counterparty risk. Findings inform the calibration of CDD, monitoring rules, transaction limits and EDD triggers.

5Customer due diligence (CDD / KYC)

Before any Naira withdrawal is processed, Monica verifies who the customer is. Verification happens in one screen in the app and asks for two things:

• Your NIN. The customer enters his or her National Identification Number, which Monica checks against the National Identity Management Commission (NIMC) record.
• A selfie. The customer takes a live selfie in the app, which is matched to the NIMC photo to confirm that the person holding the phone is the person on the record.

Monica also confirms that the Nigerian bank account registered for payouts is held in the customer's legal name, through the NIBSS name check, and collects basic biographical data (legal name, date of birth, phone, email). Aggregate daily and monthly caps apply, and each customer is screened against sanctions, PEP and adverse media databases on onboarding and continuously thereafter. Verification records are kept current and refreshed on a risk sensitive basis. Where a customer cannot or will not complete verification, the Account is not activated for withdrawal and the relationship may be discontinued in accordance with Applicable Law. Higher limits may be granted on a case by case basis following Enhanced Due Diligence (see clause 6).

6Enhanced due diligence (EDD)

EDD is applied where the customer or activity presents a higher risk, including (without limitation):

• customers identified as Politically Exposed Persons (domestic, foreign or international organisation), or their close associates and family members;
• customers in higher-risk industries (gambling, other crypto businesses, money service businesses, cash intensive businesses);
• aggregate inflows or outflows that meet or exceed the reporting thresholds set in Nigerian law for cash equivalent transactions;
• transactions involving counterparties on high-risk jurisdiction lists, including FATF "Black List" and "Grey List" jurisdictions;
• unusual deposit patterns relative to a customer's stated profile;
• customers identified through screening hits requiring further investigation.

EDD measures include senior-management approval for continued service, source-of-funds and source-of-wealth verification, intensified ongoing monitoring, and where appropriate the imposition of lower limits or additional documentary evidence.

7Ongoing transaction monitoring

Every Order and every Account is subject to continuous, rule-based and behavioural transaction monitoring. Indicative red flags include, without limitation:

• structuring or "smurfing" of deposits to avoid reporting or limit thresholds;
• rapid in-and-out movement of value with no apparent economic rationale;
• activity inconsistent with the customer's stated occupation, location or profile;
• deposits originating from blockchain addresses associated with known illicit activity (mixers, sanctioned addresses, darknet markets, ransomware, scam wallets) per reputable onchain analytics providers;
• multiple Accounts apparently controlled by the same person;
• repeated failed verification attempts followed by successful entry from a different device;
• any matter the Compliance Officer determines warrants further enquiry.

Confirmed suspicions are escalated to the Compliance Officer for investigation and, where appropriate, reporting and customer action.

8Suspicious activity reporting

Where the Compliance Officer has reasonable grounds to suspect that funds processed through the platform are the proceeds of crime or are connected with terrorist financing, Monica files a Suspicious Transaction Report (STR) with the competent Nigerian authority within the timelines set by law, and files threshold transaction reports where applicable. Monica is bound by the statutory "tipping off" prohibition and will not disclose to a customer that a report has been or is being filed.

9Sanctions and PEP screening

All customers are screened on onboarding and continuously thereafter against:

• the United Nations Security Council Consolidated Sanctions List;
• the OFAC Specially Designated Nationals (SDN) and Sectoral Sanctions Identifications (SSI) Lists;
• the European Union Consolidated Financial Sanctions List;
• the United Kingdom Office of Financial Sanctions Implementation (OFSI) Consolidated List;
• Nigerian sanctions lists maintained by the Nigerian Sanctions Committee;
• commercially available PEP and adverse-media databases.

Positive matches are escalated and resolved before any service is provided. Where a true match is confirmed, the Account is blocked and reported as required by law.

10Prohibited customers, transactions and jurisdictions

Monica does not knowingly provide services to persons or entities involved in money laundering, terrorist financing, proliferation financing, narcotics or weapons trafficking, sexual exploitation, child abuse material, ransomware or extortion, unlicensed gambling, or sanctions evasion. Monica does not service customers from jurisdictions where the provision of crypto-asset services is unlawful or where doing so would breach sanctions binding on Monica or its partners. Deposits suspected of originating from such activity will be blocked, reported to the competent authority and dealt with in accordance with directions from competent authorities.

11Record-keeping

Monica retains CDD records, transaction records, screening hits, internal investigations, suspicious-activity reports and supporting documentation for a minimum of five (5) years from the end of the customer relationship or the completion of the relevant transaction, whichever is later, as required by Nigerian anti money laundering law. Records are held in secure, access-controlled systems and are made available on lawful request from a competent authority.

12Training and awareness

All staff complete mandatory AML/CFT training at induction and at least annually thereafter. Customer-facing staff and the Compliance team complete additional, role-specific training covering red flags, sanctions, the Travel Rule, ethics and the consequences of non-compliance. Training records are retained as part of the compliance file.

13Third-party reliance and outsourcing

Where Monica relies on third parties (for example, KYC vendors, onchain analytics providers, the licensed crypto exchanges that handle deposits and conversion, and the banking partners licensed by the CBN that carry out Naira payouts), it conducts due diligence on those providers, contracts on terms that preserve Monica's ability to run its own AML/CFT controls, and reviews performance against agreed service levels. Outsourcing does not transfer Monica's own responsibility for these controls.

14Cooperation with law enforcement and competent authorities

Monica cooperates with lawful requests from competent Nigerian and foreign authorities, including the Economic and Financial Crimes Commission (EFCC), the Nigeria Police Force, the Central Bank of Nigeria (CBN), other competent Nigerian authorities, and equivalent foreign authorities acting through Mutual Legal Assistance Treaties or recognised channels of cooperation.

Lawful requests for production of records, account freezing, or disclosure of customer information should be directed to:

Law-enforcement and regulator channel:
Compliance Officer, Monica Digital Assets Limited
[email protected]
Lagos, Nigeria

Requests must be made on official letterhead, signed by an authorised officer, and accompanied by a copy of the underlying legal instrument (such as a court order, a statutory production notice, or a sanctioned mutual legal assistance request). Monica acknowledges receipt within two (2) business days of receipt of a valid request.

15Whistleblowing

Any employee, contractor or member of the public who suspects financial crime or non-compliance with this Policy may report confidentially to [email protected]. Monica protects whistleblowers from retaliation in line with applicable Nigerian whistleblower protections.

16Review and updates

This Policy is reviewed at least annually and whenever there is a material change in product, technology, applicable law or risk profile. Changes are approved by the Board and communicated to all relevant staff.

17Contact

Compliance Officer
Monica Digital Assets Limited
[email protected]
Lagos, Nigeria