Know Your Customer and Anti-Money-Laundering Policy (draft)

DRAFT v0.1 — 19 August 2026 — prepared for review by qualified counsel; not yet in force.

Key points (summary only — not binding; the numbered clauses prevail)
Every business on the Platform is verified before it can trade: the legal entity, its Authorised Users, its directors and its ultimate beneficial owners holding [25]% or more.
Required documents depend on entity type (airline, lessor, MRO, OEM, broker, teardown broker) and typically include registration and tax documents, proof of address, signatory ID, a UBO chart, and aviation licences or approvals where applicable (for example Part-145, Part-21 or AS9120).
All verified parties are screened against sanctions lists, politically exposed person (PEP) lists and adverse media — at onboarding and on an ongoing basis.
Accounts are risk-rated; high-risk countries, complex ownership, unusual deal patterns and cash-intensive counterparties trigger enhanced due diligence.
Re-verification takes place every [12] months for higher-risk accounts and every [24] months for standard-risk accounts, and whenever material details change.
Transactions are monitored for red flags such as prices far from market, rapid resale, third-party payments and split payments.
Vistason may refuse, suspend or terminate accounts and Deals, and may be required to report suspicions to authorities without telling you.
KYC records are kept for [5] years after the relationship ends. Questions: [compliance@vistason.com].

1. Purpose

1.1 This Know Your Customer and Anti-Money-Laundering Policy (the "Policy") describes how PostReach AI Limited ("Vistason") identifies and verifies the businesses and people who use the Vistason Platform, and how it detects and responds to money-laundering, terrorist-financing, fraud and sanctions risk. It forms part of the Vistason Terms of Service (the "Terms") and must be read with the Export Control and Sanctions Policy, the Settlement and Payments Terms, the Acceptable Use Policy and the Privacy Policy. Capitalised terms not defined here have the meaning given in the Terms.

1.2 Verification serves three purposes: (a) platform integrity — a managed marketplace for aviation material only works if every counterparty is a real, lawful business, and verification is a service to every user who trades here; (b) settlement requirements — Vistason facilitates an advance trade payment between Buyer and Seller: the Buyer pays the purchase price into the Settlement Account, which Vistason operates and instructs and which is held with [PAYMENT SERVICES PROVIDER] (the "Payment Services Provider"), a regulated institution. Vistason holds those funds as marketplace operator pending the Seller's performance and the Buyer's acceptance and then releases them to the Seller net of fees, so it must know who both parties are before it accepts a payment for a Deal or releases one, and the Payment Services Provider must satisfy its own customer due-diligence obligations in respect of the account and the payments made through it; and (c) legal requirements — anti-money-laundering, counter-terrorist-financing and sanctions laws applicable to Vistason, to the Payment Services Provider and to users in their own jurisdictions. Vistason carries out these checks as the operator of the marketplace: it is not a bank or a payment institution, and it does not hold Settlement Funds in trust or in any fiduciary capacity.

1.3 Vistason may use a specialist verification provider ([KYC PROVIDER]) to perform document collection, identity checks and screening, and may pass verification information to the Payment Services Provider where that provider must satisfy its own due-diligence obligations in respect of a payment. Personal data processed for verification is handled as described in the Privacy Policy.

1.4 The Platform serves businesses only. Verification is a condition of trading: an account may browse limited content before verification, but may not publish listings, make or accept offers, bid in tenders, or send or receive funds until verification is complete.

2. Who is verified

2.1 The entity. The legal entity that opens the account (company, partnership or other business form) is identified and verified: legal name, legal form, registration number, registered office, principal place of business, and nature of business.

2.2 Authorised Users. Each natural person who acts for the entity on the Platform under the Admin, Approver, Lister, Buyer or Viewer roles is identified. Identity documents are collected at minimum for the person who signs up the entity and accepts the Terms (the "signatory") and for Admin users; Vistason may extend document checks to other roles on a risk basis.

2.3 Directors and beneficial owners. The entity must disclose: (a) its directors or equivalent officers; and (b) every ultimate beneficial owner ("UBO") who directly or indirectly owns or controls [25]% or more of the entity's shares or voting rights, or who otherwise exercises control. Where no such person exists, the entity must identify its senior managing official(s). UBO information must be supported by an ownership chart under clause 3.

2.4 Changes. The entity must notify Vistason within [14] days of any change to its legal name, ownership meeting the UBO threshold, directors, signatory or registered office, and must keep Authorised User lists current. Failure to notify is grounds for suspension.

3. Documents required

3.1 The standard documentation set for every entity is: (a) certificate of incorporation or equivalent registration extract (issued or confirmed within the last [6] months); (b) tax or VAT registration number and evidence where not shown on the registry extract; (c) proof of registered or trading address (registry extract, utility bill or bank statement no older than [3] months); (d) government-issued photo ID of the signatory (and other persons per clause 2.2); (e) an ownership/UBO chart down to natural persons, signed by a director, with registry or shareholder evidence for each layer where requested; and (f) evidence of the signatory's authority to bind the entity where it is not apparent from the registry.

3.2 In addition, by entity type, and in each case where applicable to the business as declared:

(a) Airlines — air operator certificate (AOC) or operating licence;

(b) Lessors — evidence of leasing activity (for example registry entries, portfolio references or a lease management agreement) where the entity is not otherwise well documented;

(d) OEMs and production organisations — production organisation approval (for example Part-21/POA) or equivalent evidence of manufacturer status;

(e) Brokers and parts distributors — distributor accreditation where held (for example ASA-100 or AS9120), business licences where required locally;

(f) Teardown brokers — evidence of teardown/disassembly activity (for example a teardown facility relationship, aircraft purchase records or disassembly project references) where requested on a risk basis.

Absence of an optional accreditation is not by itself a ground for refusal, but affects risk rating and the checks applied.

3.3 Documents must be provided in [English or Spanish] or accompanied by a translation, as legible originals or certified/verified copies where requested. Vistason may verify documents against public registries and may require video identification or certified documents where remote verification is inconclusive.

4. Screening

4.1 The entity, its directors, UBOs, signatory and Admin users are screened against: (a) the sanctions lists described in the Export Control and Sanctions Policy (OFAC, EU, UN, UK OFSI and others); (b) politically exposed person (PEP) lists — a PEP connection is not a bar but triggers enhanced due diligence; and (c) adverse media, including reports of fraud, parts counterfeiting, smuggling, sanctions evasion, corruption or insolvency misconduct.

4.2 Screening runs at onboarding, continuously or periodically against list updates, and again before Deals as described in the Export Control and Sanctions Policy. Potential matches are handled per that Policy: the account or Deal is held until the match is resolved.

5. Risk rating and enhanced due diligence

5.1 Each account receives a risk rating (standard / elevated / high) based on factors including: country of incorporation, operation and ownership; entity type and transparency of ownership; accreditation status; expected transaction types and volumes; and screening results.

5.2 Enhanced due diligence (EDD) applies, without limitation, where: (a) the entity, an owner or a counterparty is connected to a high-risk country ([PLACEHOLDER — e.g. countries identified by FATF or the EU as high-risk third countries, and countries adjacent to comprehensively sanctioned territories]); (b) the ownership structure is complex, opaque, or involves nominee shareholders, bearer shares, trusts or multiple offshore layers; (c) a PEP is an owner, director or signatory; (d) the account's deal patterns are unusual for its declared business (see clause 7); (e) the counterparty operates in a cash-intensive way or proposes unusual payment arrangements; or (f) adverse media or prior platform conduct warrants it.

5.3 EDD measures may include: additional documents (audited accounts, bank references, source-of-funds or source-of-wealth evidence), senior-management approval of the relationship, certified documents or video identification, site or facility verification, lower transaction limits, per-deal compliance review, and more frequent re-verification.

6. Ongoing monitoring and re-verification

6.1 Verification is not a one-time event. Vistason monitors accounts on an ongoing basis: screening against list updates, registry checks, document expiry tracking, and review of trading behaviour.

6.2 Accounts are re-verified periodically: at least every [12] months for high and elevated risk accounts and every [24] months for standard-risk accounts, and in any event upon a trigger event — a material change under clause 2.4, a screening alert, an unusual transaction, a dispute suggesting misrepresentation, or a request from the Payment Services Provider. During re-verification, trading may continue unless a concern justifies a hold.

7. Transaction monitoring and red flags

7.1 Vistason monitors Deals and payment flows for indicators of money laundering, fraud or sanctions evasion. Red flags include, without limitation: (a) a price far above or below the evident market value of the material without commercial explanation; (b) rapid resale of the same material, particularly at a loss or between related parties; (c) attempted payment by or to third parties, or requests to route funds through accounts not in the party's own name (prohibited under the Settlement and Payments Terms); (d) payments split across multiple transfers or accounts without prior approval; (e) reluctance to provide KYC information, end-use statements or trace documentation; (f) shipping instructions inconsistent with the declared destination or buyer; (g) counterparties with no plausible aviation business; and (h) deal structures that appear designed to obscure the origin of funds or the destination of goods.

7.2 Where a red flag arises, Vistason may pause the Deal, withhold release of the Settlement Funds, ask questions and require documents. Users must respond promptly and truthfully. Unresolved red flags lead to refusal of the Deal and may lead to account termination and reporting.

8. Refusal and termination

8.1 Vistason may refuse to open an account, decline a Deal, suspend trading or terminate the relationship where: verification cannot be completed; documents are false, expired or inconsistent; screening identifies a confirmed sanctions match; risk is outside Vistason's or the Payment Services Provider's appetite; or the user breaches this Policy. Where the law allows, Vistason will say which documents are missing; where the law prohibits disclosure (for example tipping-off rules), Vistason may refuse or terminate without giving reasons.

8.2 Termination under this Policy is handled under the Terms. Settlement Funds held for an open Deal at the time are dealt with under the Settlement and Payments Terms and applicable law, which may require them to be held or blocked.

9. Reporting obligations

9.1 Vistason and the Payment Services Provider may be legally required to report suspicious activity to competent authorities — for example a suspicious activity/transaction report to the financial intelligence unit of [JURISDICTION — e.g. SEPBLAC in Spain] or the equivalent body in another jurisdiction ([SAR-STYLE REPORT PLACEHOLDER PER JURISDICTION]) — and to cooperate with law enforcement. Where tipping-off prohibitions apply, Vistason will not inform you that a report has been made and may be required to continue, pause or exit the relationship without explanation.

9.2 Nothing in this Policy obliges Vistason to proceed with any transaction, and Vistason is not liable for loss caused by a hold, refusal, report or termination made in good faith under this Policy or applicable law.

10. Record retention and data protection

10.1 KYC records — identification documents, verification results, screening results, risk assessments, correspondence and decisions — are retained for [5] years after the business relationship ends, or longer where the law of a relevant jurisdiction requires. Transaction records are retained for [10] years as described in the Privacy Policy.

10.2 Personal data collected under this Policy is processed in accordance with the GDPR and the Privacy Policy, with Vistason acting as controller for account, user and KYC data. Verification providers, the Payment Services Provider and screening providers act as processors or independent controllers as described in the Privacy Policy. Individuals' data-protection rights are subject to legal limits where exercising them would conflict with AML obligations (for example retention duties or tipping-off prohibitions).

11. Cooperation duty

11.1 Each user must cooperate with Vistason's verification and monitoring, and with any further information the Payment Services Provider requires in respect of a payment: provide requested information and documents promptly (normally within [10] business days), ensure the information is true, accurate and current, and not conceal ownership, control, the identity of counterparties or the nature of transactions. Providing false or misleading KYC information is a material breach of the Terms and may be a criminal offence.

12. Governance, changes and contact

12.1 Vistason maintains internal responsibility for this Policy ([COMPLIANCE OFFICER ROLE PLACEHOLDER]), trains relevant staff, and reviews this Policy at least annually and when the law or the Payment Services Provider's requirements change.

12.2 Vistason may amend this Policy at any time with effect on posting to the Platform, giving advance notice of material changes where reasonably practicable. Questions and notifications under this Policy: [compliance@vistason.com].