Built for trust and regulatory compliance

QvaPay, Inc. (Delaware) has been registered with FinCEN since May 3, 2026, the date on which it assumed the operation of qvapay.com and adopted its Board-approved BSA/AML program. FinCEN MSB registration (BSA ID) 31000329382692: money transmission and prepaid access. Principal office: 818 Leahy Cir, Des Plaines, IL 60016.

The Company is governed by a Board of three directors, one of them independent. The Chief Compliance Officer / BSA Officer reports to the Board, not to the CEO.

An independent review of the program has been engaged with a qualified external reviewer.

State money transmission license applications are in process.

QvaPay maintains a written AML program. AML program adopted by the Board effective May 3, 2026; the program and risk assessment in effect were adopted by written consent of the Board effective September 9, 2026. It rests on the four pillars (internal controls, a designated compliance officer, training and independent review) plus customer due diligence (CDD).

The program is reviewed at least annually and on any material change.

There is no unverified tier. No account moves value (sends, withdraws, buys or sells) without documentary identity verification through a KYC provider and a clean sanctions screening. A balance received by an account that is not yet verified stays frozen until its identity is approved; a transfer to an unregistered email that nobody claims is returned to the sender. This applies to every account, including accounts opened before May 3, 2026.

Business accounts come in four types: self-employed worker (TCP), expanded-capacity TCP, MIPYME or CNA, and business outside Cuba (U.S. or international).

For MIPYMEs: constitutive documents and tax ID (NIT), presence in the public registry of economic actors kept by the Ministry of Economy and Planning (every state entity is excluded), KYC of every partner at any ownership percentage, an interview and enhanced due diligence.

For U.S. and international companies: beneficial owners at 25% or more and a control person.

Sanctions Sentinel (sdn.qvapay.com), the Company's own screening service, screens every party and every address: at registration, on each funding, on each transfer before release, on each withdrawal, and continuously each time the lists refresh.

Lists: the OFAC SDN List, the Cuba Restricted List (direct and indirect transactions, § 515.209 as amended effective September 30, 2026), prohibited officials of the Government of Cuba and prohibited members of the Cuban Communist Party (31 CFR §§ 515.337–515.338), the 50 percent rule, and digital-currency addresses listed under Executive Order 14404.

QvaPay Bouncer monitors every row of the ledger: velocity, structuring, purpose versus attestation, counterparty spread, and pass-through and funnel patterns. On a failed check it restricts the account and generates the report for the Chief Compliance Officer.

Confirmed match: the account is restricted, the QUSD balance is frozen, onchain QUSD is blocked through the contract's blocklist and the underlying USDC reserve is segregated into a blocked-property account; the block is reported to OFAC within 10 business days (31 CFR §§ 501.603–501.604).

We serve Cuba's independent private sector (31 CFR § 515.340) —verified individuals, MIPYMEs, CNAs and TCPs— and those who pay them from the United States and the rest of the world.

Never:

• Cuban state entities;
• Cuban state banks;
• regime-affiliated processors (for example, FINCIMEX);
• prohibited officials and prohibited members of the Cuban Communist Party;
• persons on the SDN List;
• comprehensively sanctioned jurisdictions (Iran, North Korea, Syria, Crimea/Donetsk/Luhansk).

No QvaPay funds transit the Cuban state banking system.

P2P market: CUP/MLC ↔ QUSD conversion takes place between independent Cubans using their own funds, at a free market rate, with no bank or state processor. Taking or posting offers to buy or sell QUSD for CUP/MLC is a function of Cuban and international accounts; U.S. accounts do not take part in that exchange (31 CFR § 515.329).

A purpose attestation is collected on every funding and on every disposition toward Cuba (remittance · private-sector payment · donation · top-up), and, on every payment for goods, the invoice, the classification and the license exception declared by the U.S. exporter, the export filing number (AES/ITN) and the transport document showing departure from the United States.

The Company maintains a pending request for interpretive guidance before OFAC concerning the P2P exchange and import financing for the independent private sector (Case ID CU-2025-1426925-1), expanded on September 30, 2026 with a request for a specific license covering payments to suppliers outside the United States and the international withdrawals of Cuban businesses, both suspended since that date.

Since September 30, 2026 a Cuban account can receive payments and remittances from the United States, pay U.S. sellers and suppliers for goods shipped from the United States (of any origin, including goods leaving a U.S. foreign-trade zone) and for internet, software and telecommunications services, and withdraw to Cuba or to its own wallet. It cannot pay suppliers outside the United States or withdraw to any bank account outside Cuba. Account type follows verified residence, not only the identity document: a Cuban national permanently resident outside Cuba holds a U.S. or international account (31 CFR § 515.505). See Permitted fund flows.

Originator and beneficiary records are kept on every transmittal of $3,000 or more, including in aggregate, and are written at execution. On business payments executed by the Company, the business is the transmittor and the Company is its financial institution.

Eight daily queries (Bouncer); weekly review by the Chief Compliance Officer; Suspicious Activity Reports filed through BSA E-Filing when warranted. No physical cash is accepted or disbursed: the Currency Transaction Report does not apply.

QUSD is a U.S.-dollar-denominated stored-value unit issued by QvaPay, Inc., backed one-to-one by a USDC reserve held in the Company's dedicated cold and hot reserve wallets, redeemable at par, and operated toward the requirements of the GENIUS Act under the plan published at /transparency/genius. The reserve is maintained one-to-one against outstanding QUSD; the Company pays no interest or yield on QUSD balances; the Company publishes a monthly reserve disclosure at www.qvapay.com/transparency/qusd.

Customer value is held as QUSD on the Company ledger. It is never held at the bank: the Company's U.S. bank account receives funding deposits, disburses Company-executed payouts and pays Company expenses; its balance is not part of the reserve.

QUSD moves on the ledger only between registered, screened users. QUSD withdrawn onchain to the holder's own wallet moves on the Stacks blockchain under the SIP-010 contract, whose blocklist is administered by the Company; the holder's keys are generated and held on the holder's own device — the Company never holds them.

Ledger balances are Company-administered and can be frozen; onchain QUSD in the holder's own wallet is non-custodial.

The Savings product is a separate interest-bearing balance (currently 3.75% APR on the savings balance); QUSD held as QUSD earns nothing.

Five years for BSA records; ten years for sanctions records (31 CFR § 501.601, as amended).

QvaPay applies administrative, technical, and physical safeguards to protect customer information. Sensitive identifiers are encrypted at rest, access is limited on a need-to-know basis, and security controls are reviewed on an ongoing basis.

QvaPay cooperates with lawful requests from regulators and law enforcement. Examiners, financial institution partners, and law enforcement may contact the compliance function using the details below.

The Company maintains a Disaster Recovery and Business Continuity Plan with designated successors for each officer, tested at least annually.