Anti-Money Laundering (AML) Policy

QvaPay, Inc. (Delaware) is a money services business registered with FinCEN (BSA ID 31000329382692: money transmission and prepaid access). It operates under the Bank Secrecy Act and the Cuban Assets Control Regulations (CACR) administered by OFAC. Its Chief Compliance Officer / BSA Officer reports to the Board of Directors.

There is no unverified tier. No account is opened, and no account receives value, without documentary identity verification (government ID, liveness and face match) and a clean sanctions screening.

Business accounts also provide their constitutive documents and tax identification, verification of every partner (in Cuba, at any percentage; outside Cuba, at 25% or more, plus a control person), an interview and enhanced due diligence.

Your information must be accurate and current. If your residence changes, you must tell us: your account type depends on it (section 6).

Sanctions Sentinel, QvaPay's screening service, screens every party and every address: at registration, on each funding, on each transfer before release, on each withdrawal, and every time the lists are updated.

Lists: the OFAC SDN List; the Cuba Restricted List, for direct and indirect transactions; prohibited officials of the Government of Cuba and prohibited members of the Cuban Communist Party (31 CFR §§ 515.337–515.338); the 50 percent rule; and digital-currency addresses designated under Executive Order 14404.

We serve Cuba's independent private sector (31 CFR § 515.340): verified individuals, MIPYMEs, CNAs and TCPs, and those who pay them from the United States and the rest of the world.

We never serve: Cuban state entities; Cuban state banks; regime-affiliated processors; prohibited officials of the Government of Cuba and prohibited members of the Cuban Communist Party; persons on the SDN List; or comprehensively sanctioned jurisdictions. No QvaPay funds transit the Cuban state banking system.

A purpose attestation, selected from fixed text, is collected on every funding and on every disposition toward Cuba (remittance, private-sector payment, donation, top-up) and on every crypto withdrawal to your own wallet. Every payment for goods also requires the invoice, the classification and license exception declared by the exporter, the export filing number (AES/ITN) and the transport document showing departure from the United States.

What you attest is recorded with its date. A false attestation is grounds for closing the account and for reporting.

Your account is typed by the verified residence of its holder (Cuba, United States or international), not only by the identity document.

Since September 30, 2026, a Cuban account can receive payments and remittances from the United States; pay U.S. sellers for goods shipped from the United States and for U.S. internet, software and telecommunications services; and withdraw to Cuba or to its own wallet. It cannot pay suppliers outside the United States or withdraw to any bank account outside Cuba.

U.S. accounts, and anyone who has declared U.S.-person status, do not take part in the CUP/MLC P2P market.

Each flow and its authorization are set out at Permitted fund flows.

• Payments to third parties without identifying the beneficiary, and any anonymous transfer.
• Using the account on someone else's behalf without declaring it; lending the account; using proxies or any means to hide your identity, location or residence.
• Using P2P payment methods that are not in your own name.
• Splitting transactions to avoid thresholds or controls.
• Any transaction with the persons or entities in section 4, or prohibited by the CACR or U.S. sanctions.
• Fraud, money laundering, terrorist financing or sanctions evasion.

QvaPay does not receive or disburse cash. When a withdrawal is settled in cash or to a card in Cuba, a P2P market peer settles it from their own funds. QvaPay records the transaction and both parties.

QvaPay Bouncer reviews every ledger movement: velocity, structuring, purpose versus attestation, counterparty spread, and pass-through patterns. We may hold a transaction, request documentation, restrict your account or close it.

On a confirmed sanctions match, the account is restricted, the QUSD balance is frozen, onchain QUSD is blocked and the corresponding reserve is segregated; the block is reported to OFAC within 10 business days. Blocked funds are not returned or released without OFAC authorization.

Originator and beneficiary information is recorded on every transmittal of $3,000 or more (Travel Rule).

QvaPay files suspicious activity reports with FinCEN when warranted; the law prohibits notifying the customer. It participates in information sharing among financial institutions under section 314(b). It cooperates with lawful requests from regulators and law enforcement, and keeps its records for five years (BSA) and ten years (sanctions).

• Keep your information accurate and current, and report any change of residence.
• Respond to documentation requests on time.
• Use only payment methods in your own name.
• Do not let third parties use your account.

Breach of this policy may result in held transactions, restriction or closure of the account, and reporting to the authorities where required.