Anti-Money Laundering & Counter-Terrorism Financing Policy

1. Policy Statement

Greenfinity Integrated Limited ("Greenfinity," "we," "us," or "our") is committed to the highest standards of Anti-Money Laundering ("AML") and Counter-Terrorism Financing ("CFT") compliance. This Policy outlines the procedures, controls, and practices we implement to detect, prevent, and report money laundering, terrorism financing, proliferation financing, and other financial crimes.

This Policy applies to all employees, officers, directors, contractors, and business partners of Greenfinity, as well as all borrowers using the Greenfinity One Platform.

2. Regulatory Framework

This Policy is developed in compliance with the following Nigerian laws, regulations, and international standards:

2.1 Nigerian Legislation

• Money Laundering (Prohibition) Act 2011 (as amended by the Money Laundering (Prevention and Prohibition) Act 2022)
• Terrorism (Prevention and Prohibition) Act 2022
• Economic and Financial Crimes Commission (EFCC) Establishment Act 2004
• Central Bank of Nigeria (CBN) AML/CFT Regulations 2013 (and subsequent amendments)
• CBN Know Your Customer (KYC) Manual
• Nigerian Financial Intelligence Unit (NFIU) Act 2018
• NFIU Modular KYC/AML Regulations
• CBN Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) Risk-Based Supervision Framework
• Proceeds of Crime (Recovery and Management) Act 2022

2.2 International Standards

• Financial Action Task Force (FATF) Recommendations
• Inter-Governmental Action Group against Money Laundering in West Africa (GIABA) Mutual Evaluations
• United Nations Security Council Resolutions relating to terrorism financing and sanctions
• Wolfsberg Group AML Principles

3. Compliance Governance

3.1 Chief Compliance Officer (CCO)

Greenfinity has appointed a designated Chief Compliance Officer who is responsible for the overall implementation, monitoring, and enforcement of this AML/CFT Policy. The CCO reports directly to the Board of Directors and has the authority to:

• Design and update AML/CFT policies and procedures
• Oversee the KYC/CDD process
• File Suspicious Transaction Reports (STRs) and Currency Transaction Reports (CTRs) with the NFIU
• Liaise with regulatory bodies including the CBN, EFCC, NFIU, and law enforcement agencies
• Conduct internal AML/CFT audits and risk assessments
• Escalate significant findings to the Board of Directors

3.2 AML/CFT Committee

An AML/CFT Committee, comprising senior management, the CCO, the DPO, and relevant department heads, meets quarterly to review:

• AML/CFT program effectiveness
• Risk assessment findings
• Regulatory developments and required policy updates
• Suspicious activity trends and reports
• Training completion and adequacy

4. Know Your Customer (KYC) and Customer Due Diligence (CDD)

4.1 Customer Identification Program (CIP)

All users must complete our KYC process before accessing financial services on the Platform. The CIP requires:

4.2 Standard Customer Due Diligence (CDD)

Standard CDD is performed for all users and includes:

1. Identity Verification: Confirmation of name, date of birth, and address using government-issued documents and independent verification databases.
2. NIN Verification: Validation through the National Identity Management Commission (NIMC) verification API.
3. BVN Verification: Validation through the Nigeria Inter-Bank Settlement System (NIBSS) BVN API.
4. Biometric Verification: Liveness check to ensure the person presenting documents is the true owner.
5. Sanctions Screening: All users are screened against United Nations, OFAC, EU, and Nigeria-specific sanctions and PEP watchlists at onboarding and periodically thereafter.
6. Adverse Media Screening: Review of publicly available information for any negative news or associations.

4.3 Enhanced Due Diligence (EDD)

Enhanced Due Diligence is applied to higher-risk customers and scenarios, including:

• Politically Exposed Persons (PEPs): Current or former senior government officials, their family members, and close associates. PEPs require senior management approval for onboarding.
• High-Value Transactions: Transactions exceeding ₦5,000,000 (five million Naira) or the equivalent in foreign currency.
• High-Risk Jurisdictions: Users from or transacting with countries identified by FATF as having strategic deficiencies in AML/CFT regimes.
• Complex or Unusual Transactions: Transactions with no apparent economic or lawful purpose.
• Non-Face-to-Face Relationships: Enhanced measures for diaspora users who cannot attend physical verification.

EDD measures include:

• Additional documentation requirements (source of wealth, source of funds)
• More frequent account monitoring and transaction reviews
• Senior management approval for onboarding and continued relationship
• Annual relationship reviews

4.4 Ongoing Monitoring

CDD is not a one-time exercise. We conduct ongoing monitoring, including:

• Continuous transaction monitoring against established user profiles
• Periodic KYC refresh (at minimum every 2 years for standard-risk customers, annually for high-risk customers)
• Re-screening against updated sanctions and PEP lists
• Event-triggered reviews (e.g., significant changes in transaction patterns, adverse media findings)

5. Transaction Monitoring

5.1 Automated Monitoring

All financial transactions on the Platform are monitored using a combination of rule-based and risk-based detection systems. These systems flag transactions that may indicate:

• Structuring or "smurfing" (breaking large transactions into smaller amounts to evade reporting thresholds)
• Rapid movement of funds with no clear economic rationale
• Transactions inconsistent with the customer's known profile, income, or business
• Unusual patterns such as round-trip transactions or back-to-back loans
• Transactions involving high-risk jurisdictions
• Sudden large deposits or withdrawals without prior history

5.2 Reporting Thresholds

5.3 Suspicious Transaction Reports (STRs)

When a transaction or pattern of transactions is deemed suspicious, the CCO shall file an STR with the NFIU within the timeframe prescribed by law. Key principles governing STR filing:

• STRs are filed regardless of the transaction amount.
• Filing is made through the NFIU's designated electronic reporting portal (goAML).
• The filing of an STR is confidential. "Tipping off" — informing the subject of a report that an STR has been or will be filed — is a criminal offense under Section 7 of the Money Laundering (Prohibition) Act.
• The decision to file an STR does not require certainty of criminal conduct; a reasonable suspicion is sufficient.
• All STRs and related documentation are retained for a minimum of 7 years.

6. Risk Assessment

6.1 Institutional Risk Assessment

Greenfinity conducts a comprehensive AML/CFT risk assessment at least annually, evaluating risks across the following dimensions:

• Customer Risk: Types of borrowers served, including diaspora users, PEPs, and high-net-worth individuals.
• Product/Service Risk: Risk profiles associated with our credit products.
• Geographic/Jurisdictional Risk: Risk associated with operating across Nigerian states and international diaspora jurisdictions.
• Channel/Delivery Risk: Risks inherent in mobile-first, non-face-to-face service delivery.
• New Technology Risk: Emerging risks from digital innovation, mobile payments, and fintech models.

6.2 Customer Risk Categorization

Each customer is assigned a risk rating based on:

7. Record Keeping

In accordance with Section 3 of the Money Laundering (Prohibition) Act and CBN AML/CFT Regulations, we maintain the following records:

• Customer identification and verification records: Minimum 7 years from the end of the business relationship.
• Transaction records: Minimum 7 years from the date of the transaction.
• STR/CTR records: Minimum 7 years from the date of filing.
• Internal investigation files: Minimum 7 years from the closure of the investigation.
• Training records: Minimum 5 years from the training date.
• Audit reports: Minimum 7 years from the audit date.

All records are stored securely with AES-256 encryption and are accessible only to authorized personnel on a need-to-know basis.

8. Sanctions Compliance

Greenfinity maintains a robust sanctions compliance program that includes:

• Screening all customers, counterparties, and transactions against the following sanctions lists:
  • United Nations Security Council Consolidated List
  • US Office of Foreign Assets Control (OFAC) SDN List
  • European Union Consolidated Sanctions List
  • UK HM Treasury Sanctions List
  • Nigeria-specific designated lists
• Automated real-time screening at onboarding and on each transaction
• Periodic batch re-screening against updated lists
• Immediate escalation and account freezing for confirmed matches
• Reporting confirmed matches to relevant authorities

9. Employee Training and Awareness

All Greenfinity employees, officers, and Super Agents receive AML/CFT training that covers:

• Overview of money laundering and terrorism financing typologies
• Legal and regulatory obligations under Nigerian law
• Red flags and indicators of suspicious activity
• KYC/CDD procedures and requirements
• Internal reporting procedures and escalation protocols
• Consequences of non-compliance, including criminal liability
• Tipping-off offenses and confidentiality obligations

Training is mandatory for all new employees within 30 days of joining and is refreshed annually. Specialized training is provided for the CCO, compliance team, and customer-facing staff. Training completion records are maintained as part of our record-keeping obligations.

10. Whistleblowing and Internal Reporting

Greenfinity maintains a confidential internal reporting mechanism for employees to report suspected money laundering, terrorism financing, or other financial crimes without fear of retaliation.

• Reports may be made to the CCO directly via secure internal channels.
• Anonymous reporting is supported and encouraged.
• Whistleblower protections are in place in accordance with Nigerian law.
• All reports are investigated promptly and confidentially.
• Retaliation against whistleblowers is strictly prohibited and constitutes grounds for disciplinary action up to and including termination.

11. Independent Audit

The AML/CFT program is subject to independent audit at least annually. The audit evaluates:

• Adequacy and effectiveness of AML/CFT policies and procedures
• Compliance with applicable laws and regulations
• Quality of KYC/CDD processes and documentation
• Effectiveness of transaction monitoring systems
• Timeliness and quality of STR/CTR filings
• Adequacy of employee training
• Remediation of previously identified deficiencies

Audit findings are reported to the Board of Directors and the CCO. Material findings are communicated to the CBN and/or NFIU as required.

12. Cooperation with Authorities

Greenfinity cooperates fully with law enforcement, regulatory bodies, and judicial authorities in AML/CFT matters. This includes:

• Responding promptly to lawful requests for information from the EFCC, NFIU, CBN, Nigeria Police Force, and courts of competent jurisdiction.
• Facilitating account freezing or restriction orders issued by competent authorities.
• Providing testimony or evidence in legal proceedings related to financial crimes.
• Participating in inter-agency taskforce initiatives as requested.

13. Penalties for Non-Compliance

Non-compliance with this Policy or applicable AML/CFT laws may result in:

13.1 For Employees and Agents

• Disciplinary action, including termination of employment or contract
• Criminal prosecution under the Money Laundering (Prohibition) Act (penalties include imprisonment of up to 14 years and fines)
• Civil liability for damages

13.2 For Users

• Immediate account suspension or termination
• Reporting to the NFIU and/or EFCC
• Forfeiture of funds associated with suspicious transactions
• Criminal prosecution

13.3 For Greenfinity

• Regulatory sanctions by the CBN
• Fines and penalties under the Money Laundering (Prohibition) Act (up to ₦25,000,000 for corporate entities per offense)
• Revocation of licenses
• Reputational damage

14. Policy Review

This Policy is reviewed and updated at least annually, or more frequently in response to:

• Changes in applicable laws or regulations
• Updates to FATF Recommendations or GIABA evaluations
• Findings from internal or external audits
• Lessons learned from identified suspicious activities or enforcement actions
• Changes to Greenfinity's products, services, or risk profile

15. Contact

For questions regarding this AML/CFT Policy, or to report suspicious activity, please contact:

Chief Compliance Officer
Greenfinity Integrated Limited
Email: compliance@greenfinityone.com

Nigerian Financial Intelligence Unit (NFIU)
Website: https://nfiu.gov.ng