MTD-POL-01 · AML/CTF Policy (v4.2)

Mittenda Limited · AML/CTF Policy (v4.2) · specimen excerpt

Synthetic specimen. Mittenda Limited is a fictional firm. This document is invented, derived from scenarios seen in practice, and contains deliberate deficiencies for demonstration. It is not a template and must not be adopted.

Document control: MTD-POL-01 · owner: Head of Financial Crime (MLRO) · approved: the Board, 12 February 2026 · classification: Internal · supersedes: v4.1.1 · next review due: February 2027.

[Earlier versions omitted]

Contents

1. Purpose and legal basis
2. Scope
3. Business-wide risk assessment
4. Governance and oversight
5. Customer due diligence
6. Customer verification
7. Enhanced measures and politically exposed persons
8. Ongoing monitoring
9. Suspicious transaction reporting
10. Transfers of funds and crypto-assets
11. Sanctions and restrictive measures
12. Training and awareness
13. Record retention

Appendix A: Definitions

Sections in bold are excerpted below.

1. Purpose and legal basis

1.1 This Policy governs the prevention of money laundering and terrorist financing, under Mittenda's Financial Crime Framework. It gives effect to the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, as amended, to Directive (EU) 2015/849, as amended, and to Regulation (EU) 2023/1113, and prepares for the application of Regulation (EU) 2024/1624, which applies from July 2027. It has regard to the applicable guidance of the competent authority and of the European supervisory authorities.

1.2 It applies to all Mittenda business, including its payment services and its crypto-asset services, and is given effect through the Standards and Procedures made under it.

1.3 This Policy is approved by the Board and reviewed at least annually, and on any material change to the business or to the applicable legislation.

[Section 2 omitted]

3. Business-wide risk assessment

3.1 Mittenda's exposure to money laundering and terrorist financing is assessed in the business-wide financial crime risk assessment performed under the Financial Crime Framework §5, across its customers, products and services, delivery channels, geographies and transaction types.

3.2 The assessment is documented, kept up to date, and made available to the competent authority on request.

3.3 The conclusions of the assessment calibrate the Standards made under this Policy and the risk-based procedures beneath them, and are considered by the Board against the appetite set in the Risk Appetite Statement.

[Sections 4 and 5 omitted]

6. Customer verification

6.1 The identity of every customer is established at onboarding: for natural persons, the full legal name, date of birth and residential address; for legal persons, the registered legal name, registered number and registered office, together with the natural persons authorised to act.

6.2 Customer identity is verified at onboarding against documents, data or information obtained from a reliable and independent source. For legal persons, the existence of the legal person is verified against the relevant companies register, and the authority of the natural persons acting for it is evidenced.

6.3 Verification is refreshed on a material change to the customer's identity information, on the expiry of an identity document relied upon, and in any case in accordance with the periodic review cycle set by the Customer Due Diligence Standard.

6.4 Records evidencing verification are retained in accordance with the Record Retention Policy.

[Sections 7 onward and Appendix A omitted]