Prohibited & Restricted Businesses

1. PURPOSE AND SCOPE

This Prohibited and Restricted Businesses Policy ("Policy") sets out the categories of business, activity, and counterparty that Kayana World Limited, Kayana for Business Limited, Kayana Ireland Limited, Kayana for Business Australia LLC, Kayana for Business Canada, and any other related entity under the Kayana company structure (collectively, "Kayana", "we", "us" or "our") will not onboard, will onboard only subject to enhanced conditions, or will onboard subject to standard due diligence.

This Policy applies group-wide, across every Kayana product and every entity, merchant, venue, Cause, Merchant, Partner, or customer onboarded through any of them, including:

• Kayana EPOS and Kayana Kiosk (point-of-sale and self-service ordering);
• Kayana Web Admin (venue, menu, and payment configuration);
• Kayana Online Ordering (customer-facing storefronts);
• Kayana Payments (online and card-present payment processing, pay-at-table, Stripe Connect);
• Kayana Partners Portal and KayanaTickets;
• Kayana Aid (donations, fundraising, and cause/charity registration);
• Adeyt (Kayana AI) and Kayana Voice, to the extent either is used to onboard, screen, or communicate with a counterparty in scope of this Policy; and
• any future Kayana product that onboards a business, individual, or organisation as a counterparty, merchant, venue, Cause, or Partner.

This Policy is stringent by design. Where a category of business is ambiguous, borderline, or not expressly addressed, the default position is to treat it as Restricted pending a documented risk assessment, not to treat it as permitted.

This Policy supplements, and does not replace, the Kayana Aid Global Privacy Policy, the Kayana Aid Global Platform Terms and Conditions, and any product-specific merchant agreement. Where a conflict arises, the more restrictive provision governs.

2. GOVERNING JURISDICTIONS AND REGULATORY BASIS

This Policy is designed to meet the requirements of, at minimum, the following jurisdictions in which Kayana or its PSPs, card network partners, or banking partners operate:

In addition, Kayana applies Visa, Mastercard, and other card network rules on prohibited and high-risk merchant categories globally, and defers to whichever standard is most restrictive where jurisdictions conflict.

3. DEFINITIONS

"Prohibited Business" means a category of business, activity, or counterparty that Kayana will not onboard or provide services to under any circumstances, regardless of licensing, documentation, or jurisdiction, save for a documented Board-level exception under Section 9.

"Restricted Business" means a category of business, activity, or counterparty that Kayana may onboard only subject to the enhanced conditions set out in Section 6, on a case-by-case basis, and subject always to the right to decline or terminate.

"High-Risk Restricted Business" means a subset of Restricted Business presenting materially elevated money-laundering, terrorist-financing, sanctions, reputational, or consumer-harm risk, requiring Compliance Committee approval before onboarding (see Section 6).

"Counterparty" means any Merchant, Cause, Partner, venue, or other person or entity onboarded to, or transacting through, any Kayana product.

"Sanctioned Party" means any individual, entity, vessel, or jurisdiction listed on, or majority-owned or controlled by a party listed on, any applicable UN, OFAC, OFSI/HMT, EU, UAE, KSA, Canadian, or Australian sanctions list.

4. RISK TIERING FRAMEWORK

Every category of business or activity addressed by this Policy falls into one of four tiers:

5. TIER 1 — PROHIBITED BUSINESSES

The following are prohibited across every Kayana product, in every jurisdiction, without exception in the ordinary course:

Illegal and Sanctioned Activity

• Any Sanctioned Party, or any business majority-owned or controlled by a Sanctioned Party;
• Any business operating in, or facilitating transactions with, a comprehensively sanctioned country or region (e.g. Cuba, Iran, North Korea, Syria, Russian-occupied Crimea/Donetsk/Luhansk, and any other jurisdiction subject to comprehensive sanctions from time to time);
• Terrorist financing, or any organisation designated as a terrorist organisation by the UN, US, UK, EU, UAE, KSA, Canada, or Australia;
• Money laundering services, unlicensed money transmission, or unlicensed virtual asset exchange;
• Any activity that is illegal under the law of the jurisdiction in which the Counterparty, Donor, or beneficiary is located, or the law of any jurisdiction in which Kayana operates;

Weapons, Drugs, and Regulated Substances

• Firearms, ammunition, explosives, or weapon components, including 3D-printable weapon files;
• Illegal drugs or controlled substances, and drug paraphernalia marketed for illegal drug use;
• Unlicensed pharmaceuticals, or pharmaceuticals requiring a prescription sold without one;

Sexual Content and Exploitation

• Child sexual abuse material in any form;
• Any business facilitating human trafficking, forced labour, or sexual exploitation;
• Escort services or prostitution, regardless of local legality;
• Non-consensual pornographic content, or content depicting or implying sexual conduct involving minors;

Deceptive and Predatory Practices

• Counterfeit goods, replica products, or products infringing third-party intellectual property;
• Pyramid schemes, Ponzi schemes, matrix programmes, or multi-level marketing structured primarily around recruitment income rather than genuine product sales;
• Fake or fraudulent charities, or Causes misrepresenting the identity of the beneficiary, the use of funds, or registered charitable status;
• Get-rich-quick schemes, pseudo-investment schemes, or unregistered investment offerings;
• Deceptive telemarketing, or negative-option / free-trial billing structured to obscure recurring charges;
• Sale of stolen goods, or goods obtained through burglary, robbery, or fraud;
• Sale of essays, academic papers, or credentials intended to facilitate academic fraud;
• Sale of hacking tools, malware, spyware, DDoS-for-hire, or unauthorised access/surveillance services;

Other Absolute Prohibitions

• Sale of human organs, human remains, or human body parts;
• Trade in endangered or protected species, or products derived from them, contrary to CITES or local wildlife law;
• Unlicensed gambling, unlicensed lotteries, unlicensed sports betting, or gambling accessible to minors;
• Any Cause purporting to fund, or found to be funding, illegal armed groups or activity prohibited under this Section, regardless of the stated charitable purpose;
• Virtual asset / cryptocurrency businesses (exchanges, wallets, ATMs, token issuance), including Causes seeking to accept or convert cryptocurrency donations;
• Money services businesses, remittance providers, and currency exchanges;
• Licensed gambling, betting, lottery, and daily fantasy sports operators;
• Adult content and adult entertainment businesses (where legal in the relevant jurisdiction);
• Debt collection agencies, debt consolidation, credit repair, and payday/high-cost short-term lending;
• Firearms retailers or shooting ranges operating fully within local law (distinct from Tier 1 firearm components/illegal weapons);
• Politically exposed persons (PEPs) as Counterparties, account holders, or Cause administrators;
• Causes or Merchants operating in, or primarily serving, a jurisdiction subject to sectoral (as opposed to comprehensive) sanctions, or a jurisdiction on the FATF high-risk/increased-monitoring list;
• Businesses or Causes with prior card network, PSP, or bank terminations for compliance reasons;
• Non-profit or Cause structures with opaque, nominee, or unverifiable beneficial ownership;
• Crowdfunding for individual medical, legal, or personal-hardship causes (identity and beneficiary verification required beyond standard KYC);
• Political parties, political campaigns, lobbying organisations, and advocacy groups engaged in electoral activity;

6. TIER 2 AND TIER 3 - RESTRICTED BUSINESSES

Tier 2 - High-Risk Restricted

• Businesses primarily generating revenue from recurring/subscription billing to consumers with a history of elevated chargeback rates (travel clubs, timeshare resale, continuity/negative-option models generally);

Tier 3 - Restricted (documentary evidence of registration, licensing required before activation)

• Alcohol and tobacco sales (valid licence required, age-verification controls required);
• Vaping and e-cigarette products (valid licence required, jurisdiction-dependent);
• CBD, hemp, and legal cannabis-derived products (valid licence required; note this remains Tier 1-prohibited in jurisdictions where illegal, including under US federal law notwithstanding state legalisation, and in the UAE and KSA);
• Pawn shops, and buy-here-pay-here / high-risk auto financing;
• Travel agencies, tour operators, and airlines/timeshare (advance-payment risk; deposit and delivery-date documentation required);
• Nutraceuticals, supplements, and businesses making health/medical claims;
• Multi-level marketing structured around genuine product sales, subject to evidence the business model is not primarily recruitment-based;
• Businesses located in, or accepting funds from, a jurisdiction subject to enhanced due diligence under FATF guidance (grey list);
• Religious organisations and houses of worship (standard registration/charitable-status verification required);
• Import/export businesses and international trade financing (denied-party screening required for counterparties, not just the Merchant itself);

Tier 2 and Tier 3 approval is never permanent. Approval is tied to the facts presented at onboarding and is revoked automatically if the Counterparty's activity, ownership, or risk profile materially changes.

7. JURISDICTION-SPECIFIC OVERLAYS

The categories above apply globally as a floor. The following jurisdiction-specific rules apply in addition, and govern where a jurisdiction imposes a stricter standard than the global list:

United Arab Emirates

• Cryptocurrency and virtual asset businesses require prior VARA (Dubai) or equivalent Emirate-level licensing; absent this, treat as Tier 1 prohibited, not merely Tier 2 restricted.
• Unlicensed fundraising or collection of donations without Islamic Affairs and Charitable Activities Department (IACAD) or equivalent local authorisation is prohibited.
• Alcohol sales require a valid UAE trade licence and are prohibited outside licensed premises.

Saudi Arabia

• Any unlicensed public fundraising or charitable collection is prohibited; only Causes registered with the National Center for Non-Profit Sector or equivalent SAMA-recognised authority may be onboarded.
• Alcohol, gambling, and adult content are Tier 1 prohibited without exception, regardless of treatment elsewhere in this Policy.
• Cryptocurrency businesses are treated as Tier 1 prohibited absent explicit SAMA authorisation.

United States

• Cannabis and cannabis-derived products (including hemp/CBD exceeding applicable THC thresholds) are Tier 1 prohibited notwithstanding state-level legalisation, given continued federal illegality and card network policy.
• Firearms and ammunition sales require compliance with the card networks' current prohibited-merchant classification; treat as Tier 1 absent explicit, documented network approval.
• State-specific money-transmitter licensing must be verified for any Tier 2 money-services Counterparty.

United Kingdom

• Gambling Counterparties require a valid UK Gambling Commission licence; unlicensed gambling is Tier 1 prohibited.
• Charitable Causes soliciting UK donations should be checked against the Charity Commission register where claiming registered charity status; misrepresentation of charitable status is Tier 1 prohibited under Section 5.
• Claims management companies and high-cost short-term credit providers require FCA authorisation evidence before Tier 2 approval.

European Union / EEA

• Virtual asset service providers require MiCA-compliant authorisation in the relevant member state; absent this, treat as Tier 1.
• Cross-border fundraising for political campaigns is subject to member-state-specific political finance law and requires local legal sign-off before Tier 2 approval.

Canada

• Money services businesses require FINTRAC registration; absent this, treat as Tier 1.
• Cannabis retailers require full compliance with the Cannabis Act and provincial licensing; absent both, treat as Tier 1.

Australia

• Gambling Counterparties require compliance with the Interactive Gambling Act 2001 and relevant state licensing; unlicensed online gambling is Tier 1 prohibited.
• Charitable Causes claiming Deductible Gift Recipient (DGR) status must be verified against the Australian Business Register before activation.

8. SANCTIONS AND WATCHLIST SCREENING

Every Counterparty, and every individual with beneficial ownership or control of 25% or more of a Counterparty (10% or more for Tier 2 categories), must be screened against:

• the UN Consolidated Sanctions List;
• OFAC's Specially Designated Nationals (SDN) List;
• OFSI/HMT's UK Sanctions List;
• the EU Consolidated Sanctions List;
• UAE Local Terrorist List;
• Canadian and Australian consolidated sanctions lists; and
• any adverse media or politically exposed persons (PEP) screening result flagged by Kayana's screening provider.

A confirmed sanctions match results in immediate rejection or termination and, where required by law, a report to the relevant authority (e.g. OFSI, OFAC, FINTRAC). No Compliance Committee override is available for a confirmed sanctions match.

9. GOVERNANCE AND EXCEPTIONS

Tier 1 categories admit no exception in the ordinary course of business. Where an exceptional circumstance is believed to justify a departure from Tier 1 (for example, a change in law), any exception requires:

• a written risk assessment prepared by Group Compliance;
• documented sign-off from the Kayana Board or its delegated Risk Committee; and
• a time-limited approval, reviewed no less than every 6 months.

Tier 2 approvals require sign-off from at least two members of the Compliance Committee, one of whom must be the Money Laundering Reporting Officer (MLRO) or Compliance Officer. Tier 3 approvals may be granted by Group Compliance directly, subject to documentary conditions being satisfied and recorded.

10. ONGOING MONITORING AND ESCALATION

Approval under this Policy is not a one-time event. Kayana will:

• re-screen all Counterparties against sanctions and watchlists on an ongoing basis, and immediately upon any applicable list update;
• monitor transaction patterns for indicators of a Counterparty's actual activity diverging from its declared business category (e.g. a registered retail Merchant processing volumes consistent with an unlicensed money-services business);
• monitor chargeback, refund, and complaint rates against Tier 2/3 thresholds set by Group Compliance, and escalate any Counterparty exceeding those thresholds for review;
• require Tier 2 and Tier 3 Counterparties to promptly notify Kayana of any change in ownership, licensing status, or business activity; and
• treat any failure to make such notification as a material breach permitting immediate suspension.

11. ENFORCEMENT

Where Kayana identifies a Counterparty operating in a Prohibited or undisclosed Restricted category, Kayana may, without notice:

• suspend or terminate the Counterparty's account and access to all Kayana products immediately;
• withhold or reverse settlements, and apply reserves or set-off rights under the applicable product terms;
• report the matter to relevant law enforcement, financial intelligence units, or regulators where required or permitted by law; and
• retain records of the Counterparty and the basis for termination for the period required under applicable AML record-keeping law (generally not less than 5 years).

These enforcement rights are in addition to, and do not limit, Kayana's rights under the Kayana Aid Global Platform Terms and Conditions and any other applicable product terms, including the right of recovery, right of set-off, and reserve account provisions.

12. POLICY REVIEW AND OWNERSHIP

This Policy is owned by Group Compliance and reviewed no less than annually, and additionally upon any material change in applicable law, card network rules, or Kayana's product footprint or jurisdictional presence.

Category lists in Sections 5 and 6 are illustrative of the risk this Policy is designed to control, not exhaustive. Group Compliance retains discretion to treat an unlisted category as Prohibited or Restricted where its risk profile is materially similar to a listed category.

13. CONTACT

Questions regarding this Policy, or requests for a Tier 2/Tier 3 risk assessment, should be directed to Group Compliance:

Kayana for Business Limited

Registered Office: Office No 211, Al Hudaiba Mall, 2nd Floor, Dubai, UAE

Compliance Email: compliance@kayana.co.uk

Website: www.kayanaforbusiness.com