Anti-Money Laundering (AML) & Know Your Customer (KYC) Policy

This Policy is established in compliance with applicable Kenyan law, including:

• •Proceeds of Crime and Anti-Money Laundering Act, 2009 (POCAMLA), as amended;
• •Proceeds of Crime and Anti-Money Laundering Regulations, 2013;
• •Financial Reporting Centre Act, 2012 (FRC Act);
• •Prevention of Terrorism Act, 2012;
• •Kenya Information and Communications Act (KICA);
• •Central Bank of Kenya guidelines on digital payment platforms;
• •Kenya Data Protection Act, 2019.

All employees, contractors, agents, and third-party service providers of Riosiri Capital Investments Proprietary Limited are required to comply with this Policy. Non-compliance may result in disciplinary action and/or reporting to the relevant authorities.

Money Laundering

the process by which proceeds of crime are disguised to appear as legitimate funds, as defined under POCAMLA.

Terrorist Financing

the provision or collection of funds with the intention that they be used to carry out a terrorist act.

Customer Due Diligence (CDD)

the process of verifying the identity of customers and understanding the nature of their business.

Enhanced Due Diligence (EDD)

additional verification measures applied to higher-risk customers.

Politically Exposed Person (PEP)

an individual who holds or has held a prominent public position, including their family members and close associates.

Suspicious Transaction Report (STR)

a report submitted to the Financial Reporting Centre (FRC) regarding a transaction suspected of involving money laundering or terrorist financing.

Beneficial Owner

the natural person who ultimately owns or controls a customer entity.

This Policy applies to:

• •All landlords and property managers who register on the Platform;
• •All payment notifications, references, matches, records, and reconciliation entries processed through the Platform;
• •All employees, directors, contractors, and agents of Riosiri Capital Investments Proprietary Limited;
• •All third-party service providers who handle customer data or transactions on our behalf.

4.1 Standard CDD — Individual Landlords. Before activating any landlord account, we will collect and verify:

• •Full legal name (as per National ID or Passport);
• •National Identity Card (both sides) or valid Passport;
• •KRA PIN Certificate;
• •Proof of residential address (utility bill or bank statement not older than 3 months);
• •Mobile phone number (for M-Pesa identity linking);
• •Proof of property ownership or written authority to manage (Title Deed, Lease, or Power of Attorney).

4.2 Standard CDD — Corporate / Company Landlords. For companies and registered entities:

• •Certificate of Incorporation;
• •CR12 (Register of Directors and Shareholders) not older than 12 months;
• •Company KRA PIN;
• •Memorandum and Articles of Association;
• •Board Resolution authorising use of the Platform and naming authorised signatories;
• •National ID or Passport of all directors and beneficial owners holding 10% or more ownership;
• •Proof of company registered address.

4.3 Verification Process. All KYC documents will be verified using the following methods:

• •Document authenticity check against known fraud indicators;
• •Cross-referencing with IPRS (Integrated Population Registration System) where available;
• •Cross-referencing with the Business Registration Service (BRS) for corporate customers;
• •Sanctions screening against UN, OFAC, EU, and local regulatory watchlists;
• •PEP screening against publicly available databases.

Enhanced Due Diligence will be applied in the following circumstances:

• •The customer is identified as a Politically Exposed Person (PEP) or a close associate or family member of a PEP;
• •The customer is from a country identified by FATF as high-risk or non-cooperative;
• •The transaction volumes or patterns are inconsistent with the customer's stated business profile;
• •The customer is a company with complex ownership structures or nominee shareholders;
• •The customer requests anonymity or declines to provide standard KYC documents.

EDD measures may include:

• •Senior management approval for account activation;
• •Additional identity documents and source of funds declarations;
• •Enhanced ongoing monitoring of transactions;
• •More frequent review of the customer's risk profile.

We apply a risk-based approach to AML/KYC compliance. Customers are classified into three risk tiers:

Low Risk

Individual, 1-5 residential units, verified ID, Kenyan resident — Standard CDD, annual review.

Medium Risk

Company landlord, 6-20 units, high transaction volumes — Standard CDD + transaction monitoring, 6-monthly review.

High Risk

PEP, foreign national, complex ownership, large portfolio, high-risk jurisdiction — EDD, senior management approval, quarterly review, source of funds declaration.

We continuously monitor all transactions on the Platform for indicators of suspicious activity, including:

• •Transactions that are inconsistent with a landlord's declared property portfolio or tenant base;
• •Unusual payment patterns, including multiple small transactions to circumvent reporting thresholds (structuring);
• •Payments from or to individuals or entities on sanctions watchlists;
• •A rapid sequence of payment records with no clear rental purpose;
• •Customers who provide inconsistent information or frequently change account details.

Where we have reasonable grounds to suspect that a transaction involves money laundering or terrorist financing, we are legally obligated under the FRC Act to file a Suspicious Transaction Report (STR) with the Financial Reporting Centre (FRC) of Kenya.

Our STR process:

• •The Compliance Officer reviews flagged transactions;
• •If suspicion is confirmed, an STR is filed with the FRC within 3 Business Days;
• •Records of the STR and supporting documentation are retained for 7 years;
• •The account may be suspended pending investigation without notice to the customer.

In compliance with POCAMLA and the FRC Act, we retain the following records for a minimum of 7 years:

• •All KYC documents and verification records;
• •Transaction records including dates, amounts, parties, and payment references;
• •Suspicious Transaction Reports and supporting documentation;
• •Risk assessment records for all customers;
• •Staff AML training records.

Records will be made available to the FRC, relevant law enforcement agencies, and regulatory bodies upon lawful request.

We screen all customers and transactions against the following sanctions and watchlists upon onboarding and on an ongoing basis:

• •United Nations Security Council Sanctions List;
• •Office of Foreign Assets Control (OFAC) Specially Designated Nationals List;
• •European Union Consolidated Sanctions List;
• •Kenyan Government and regulatory watchlists as published by the FRC and relevant authorities.

Any customer or transaction matching a sanctions list entry will be immediately blocked, and the matter will be escalated to the Compliance Officer and reported to the FRC.

The Company has appointed a designated Compliance Officer responsible for overseeing AML/KYC compliance. The Compliance Officer is responsible for:

• •Ensuring this Policy is implemented and updated;
• •Reviewing and filing Suspicious Transaction Reports;
• •Liaising with the FRC and other regulatory bodies;
• •Conducting and coordinating staff AML training;
• •Conducting periodic risk assessments.

Compliance Officer Name

[Compliance Officer Name]

Email

compliance@rentvaultpay.com

Phone

+254 [Phone Number]

All employees and contractors with access to customer data or transactions are required to:

• •Complete AML/KYC induction training before commencing work;
• •Complete annual AML refresher training;
• •Report any suspected money laundering or fraud immediately to the Compliance Officer.

Customers who fail to meet our KYC requirements or are found to be engaged in money laundering, terrorist financing, or fraud will be subject to:

• •Immediate suspension or termination of their Platform account;
• •Reporting to the Financial Reporting Centre (FRC), the Directorate of Criminal Investigations (DCI), or other relevant authorities;
• •Civil and/or criminal prosecution under POCAMLA, the Prevention of Terrorism Act, or other applicable Kenyan law.

This Policy will be reviewed annually and updated as required to reflect changes in applicable law, regulatory guidance, or our business operations. Material updates will be communicated to all users.

Legal Entity

Riosiri Capital Investments Proprietary Limited

Trading As

RentVault Pay

Compliance Email

compliance@rentvaultpay.com

Website

www.rentvaultpay.com

Regulatory Reference

Financial Reporting Centre (FRC) — www.frc.go.ke