ANTI–MONEY LAUNDERING (AML), COUNTER TERRORIST FINANCING (CFT) AND COUNTER PROLIFERATION FINANCING (CPF) POLICY

Last update date: 13th August 2026

(Forming an integral part of the BuyUcoin Terms of Use)

1. INTRODUCTION

1.1. Parties, Legal Identity and Platform Description

IBLOCK TECHNOLOGIES PRIVATE LIMITED, a company incorporated under the laws of India, having its registered office at Noida, Uttar Pradesh, India (hereinafter referred to as the “Company”), owns and operates the digital platform known as “BuyUcoin” (the “BuyUcoin Platform”).

Unless the context otherwise requires, references to “BuyUcoin”, “Company”, “we”, “us”, or “our” shall include the Company, its shareholders, directors, officers, employees, subsidiaries, affiliates, representatives, and authorised agents.

The terms “User”, “you”, or “your” shall refer to any individual or entity that accesses, registers on, or uses the BuyUcoin Platform.

1.2. Nature and Binding Effect of this Policy

This Anti–Money Laundering (AML), Counter Terrorist Financing (CFT), and Counter Proliferation Financing (CPF) Policy (“AML Policy”) constitutes a legally binding agreement between BuyUcoin and the User and forms an integral and inseparable part of the BuyUcoin Terms of Use.

By accessing or using the BuyUcoin Platform, the User expressly acknowledges, accepts, and agrees to be bound by:

• this AML Policy;
• the Terms of Use; and
• all applicable laws and regulations.

Any breach of this AML Policy shall entitle BuyUcoin to take appropriate action, including suspension or termination of the User’s account and reporting of such breach to statutory or regulatory authorities.

1.3. Core Principles and Commitment of BuyUcoin

BuyUcoin is committed to conducting its business with the highest standards of integrity, transparency, and ethical conduct. The Company maintains a zero-tolerance approach towards money laundering, terrorist financing, proliferation financing, fraud, and any other unlawful activity.

BuyUcoin actively supports domestic and international efforts to combat financial crime and is committed to:

• preventing misuse of its platform;
• protecting legitimate Users; and
• maintaining trust in the virtual digital asset ecosystem.

1.4. Legal and Regulatory Framework

This AML Policy is framed in compliance with and pursuant to the following laws, rules, and guidelines, as amended from time to time:

• The Prevention of Money Laundering Act, 2002 (PMLA);
• The Prevention of Money Laundering (Maintenance of Records) Rules, 2005;
• FIU-IND AML & CFT Guidelines for Reporting Entities Providing Services Related to Virtual Digital Assets, updated as on 08 January 2026;
• Applicable FATF Recommendations, including the Travel Rule;
• Applicable notifications, circulars, advisories, and directions issued by competent Indian authorities.

Where there is any inconsistency, the applicable law shall prevail.

1.5. Definition and Meaning of Money Laundering

Money laundering is criminalised under the PMLA and includes any process or activity connected with the proceeds of crime.

As per Section 3 of the PMLA, money laundering includes:

“Any direct or indirect attempt to indulge, knowingly assist, knowingly be a party to, or actually be involved in any process or activity connected with the proceeds of crime and projecting it as untainted property.”

For interpretative guidance, BuyUcoin also relies on the definition provided by the Financial Action Task Force (FATF), which describes money laundering as the process of concealing the illicit origin of criminal proceeds so as to make them appear legitimate.

1.6. Suspicious Transactions

For the purposes of this AML Policy, the term “Suspicious Transaction” shall have the meaning assigned under Rule 2(1)(g) of the PMLA Rules and shall include any transaction which:

• gives rise to a reasonable ground of suspicion that it may involve proceeds of crime;
• appears to be conducted in circumstances of unusual or unjustified complexity;
• appears to lack economic rationale or lawful purpose; or
• gives rise to suspicion of terrorist or proliferation financing.

Suspicion may arise regardless of whether the transaction is completed, attempted, or merely contemplated.

1.7. Applicability and Scope

This AML Policy applies to:

• all Users of the BuyUcoin Platform;
• all transactions executed or attempted on the Platform;
• all employees, directors, officers, consultants, and agents of BuyUcoin;
• all third-party service providers engaged by BuyUcoin in KYC, compliance, custody, or technology functions.

The Policy governs onboarding, account maintenance, trading activity, deposits, withdrawals, and all related services.

1.8. Status of AML Policy as Part of Terms of Use

This AML Policy is incorporated into the BuyUcoin Terms of Use and shall be read harmoniously with them. Capitalised terms not defined herein shall have the meaning assigned under the Terms of Use.

In the event of conflict, BuyUcoin reserves the right to interpret and apply this Policy in a manner consistent with applicable law and regulatory expectations.

1.9. Policy Amendments and Updates

BuyUcoin reserves the right to modify, amend, or update this AML Policy at any time to reflect changes in:

• regulatory requirements;
• industry standards;
• business operations; or
• risk environment.

Such changes shall be effective prospectively unless otherwise specified. Continued use of the Platform constitutes acceptance of the revised Policy.

2. CUSTOMER ACCEPTANCE, KYC FRAMEWORK AND RISK CATEGORISATION

2.1. Purpose of Customer Acceptance and Due Diligence Framework

BuyUcoin has established a structured Customer Acceptance and Due Diligence framework to ensure that only legitimate users are permitted to access and use the BuyUcoin Platform. The objective of this framework is to identify Users, understand the nature of their activities, assess the risk associated with each User, and prevent the Platform from being used for money laundering, terrorist financing, proliferation financing, or any other unlawful activity.

No User shall be permitted to trade, deposit, or withdraw assets on the BuyUcoin Platform unless the applicable customer due diligence requirements have been completed to the satisfaction of the Company.

2.2. Customer Acceptance Policy

BuyUcoin reserves the right to accept or reject any User at its sole discretion, based on its assessment of compliance with applicable laws, regulatory expectations, and internal risk parameters.

At the time of account opening, during the course of transactions, or during periodic reviews, BuyUcoin may require a User to provide such information, declarations, and documentation as deemed necessary to verify the User’s identity, understand the nature of the User’s activities, and assess associated risks.

BuyUcoin shall not onboard or shall terminate the relationship with Users who are unable or unwilling to comply with the requirements of this AML Policy, who provide false or misleading information, or who are found to be associated with restricted, sanctioned, or fraudulent activities.

2.3. Prohibited Users and Activities

Without prejudice to other provisions of this Policy, BuyUcoin does not permit the onboarding or continued operation of accounts for Users who:

• Seek to maintain anonymity or provide fictitious information
• Are listed on applicable sanctions, terrorist, or restricted lists
• Are suspected of engaging in illegal, fraudulent, or unethical activities
• Attempt to use the Platform for cross-border transactions not permitted under Indian law
• Are found to be acting on behalf of undisclosed or unverifiable third parties

BuyUcoin may immediately restrict or terminate such accounts and report the matter to competent authorities where required.

2.4. Risk-Based Categorisation of Users

BuyUcoin adopts a risk-based approach to customer due diligence and categorises Users into low, medium, or high-risk categories based on an overall assessment of risk factors.

Risk categorisation is determined by evaluating, inter alia, the User’s identity profile, nature of business or occupation, transaction behaviour, expected activity on the Platform, geographic exposure, and regulatory guidance issued by governmental or intergovernmental bodies.

The risk categorisation assigned to a User is confidential and is used solely for internal risk management purposes. Users shall not be entitled to request disclosure of their risk categorisation. However, such information may be shared with law enforcement or regulatory authorities where required by law.

2.5. Customer Due Diligence and KYC Requirements

BuyUcoin conducts mandatory Customer Due Diligence (CDD) for all Users prior to enabling access to the Platform. CDD measures are proportionate to the risk profile of the User and are designed to establish the identity of the User and verify the authenticity of the information provided.

The Company may rely on a combination of document-based verification, electronic verification, biometric verification, and third-party verification services to complete the KYC process.

2.6. KYC Requirements for Individual Users

For individual Users, BuyUcoin may require submission of officially valid documents, including but not limited to:

• Aadhaar card or other government-issued identity document containing proof of identity and address
• Permanent Account Number (PAN) card
• Live selfie photograph and liveness verification
• Bank account details for linkage with the User account

BuyUcoin may require additional documentation or information depending on the risk profile of the User or regulatory requirements.

2.7. KYC Requirements for Corporate and Non-Individual Users

For corporate entities, partnerships, proprietorships, or other non-individual Users, BuyUcoin may require submission of documents including, but not limited to:

• Certificate of incorporation or registration.
• Memorandum and Articles of Association or partnership deed.
• Corporate PAN and GST registration certificate, where applicable.
• Board resolution or authorisation letter permitting the entity to transact on the BuyUcoin Platform.
• Identification and address proof of authorised signatories, directors, partners, and beneficial owners.
• Ultimate Beneficial Ownership (UBO) declaration identifying all natural persons exercising ownership or control.
• Source of Funds declaration.
• Anti Money Laundering declaration.
• 6 months' bank statement or a cancelled cheque.
• Income Tax Return of the last 3 years (where the entity is established within 3 years, ITR of all directors of the last 3 years)

BuyUcoin reserves the right to seek additional documentation where ownership structures are complex or where enhanced due diligence is required.

2.8. Reliance on Third-Party Verification

For the purpose of verifying identity and documents, BuyUcoin may rely on licensed and regulated third-party service providers, including KYC verification agencies, database providers, and technology vendors. Such reliance does not absolve BuyUcoin of its regulatory obligations, and appropriate oversight is maintained over such third parties.

2.9. Ongoing Due Diligence and Periodic Updates

Customer due diligence is an ongoing process. BuyUcoin may periodically review and update User information based on risk categorisation, transaction behaviour, or changes in regulatory requirements.

Users are required to promptly update BuyUcoin in the event of any material change in their personal, financial, or business information. Failure to comply with update requirements may result in account restriction or suspension.

2.10. Consequences of Inadequate or Unsatisfactory KYC

Where BuyUcoin finds that the information or documents provided by a User are inadequate, unverifiable, inconsistent, or false, the Company may, at its discretion, refuse to activate the account, restrict transactions, require re-verification, or terminate the User’s account.

Such actions may be accompanied by reporting to regulatory or law enforcement authorities, where applicable.

3. ENHANCED DUE DILIGENCE, HIGH-RISK USERS AND SOURCE OF FUNDS

3.1. Purpose of Enhanced Due Diligence

BuyUcoin recognises that certain Users, transactions, or activities may present a higher risk of money laundering, terrorist financing, or proliferation financing. In such cases, standard customer due diligence measures may not be sufficient. Enhanced Due Diligence (“EDD”) is therefore applied to obtain a deeper understanding of the User, the source of funds, and the nature of transactions conducted on the BuyUcoin Platform.

The objective of EDD is to ensure that higher-risk relationships are subject to proportionately higher scrutiny and control, in line with regulatory expectations and international best practices.

3.2. Identification of High-Risk Users

A User may be classified as high-risk based on one or more of the following factors:

The User’s risk profile, including occupation, business activity, or financial background, indicates elevated risk. The User is a Politically Exposed Person (PEP), or is related to or associated with a PEP. The User is involved in high-value, high-frequency, or unusual transactions. The User interacts with unhosted wallets or third-party platforms outside the BuyUcoin ecosystem. The User is linked to jurisdictions identified as high-risk or subject to enhanced monitoring by competent authorities. The User is associated with adverse media reports relating to financial crime, fraud, or other unlawful conduct.

BuyUcoin may update the risk classification of a User at any time based on ongoing monitoring or new information.

3.3. Politically Exposed Persons (PEPs)

Politically Exposed Persons include individuals who are or have been entrusted with prominent public functions, as well as their immediate family members and close associates.

BuyUcoin applies enhanced scrutiny to PEP relationships due to the increased risk of corruption and misuse of funds. Prior to onboarding or continuing a relationship with a PEP, BuyUcoin may obtain additional information regarding the PEP’s source of funds and source of wealth and may require senior management approval. PEP accounts are subject to enhanced ongoing monitoring.

3.4. Enhanced Due Diligence Measures

Where a User is classified as high-risk, BuyUcoin may undertake one or more of the following EDD measures:

The collection of additional identification or business documentation beyond standard KYC requirements. Obtaining a detailed declaration and supporting evidence regarding the source of funds and source of wealth. Collection and review of recent bank statements, income tax returns, or audited financial statements. Conducting enhanced screening against sanctions, adverse media, and regulatory enforcement databases. Seeking senior management or compliance approval prior to permitting certain transactions. Applying enhanced transaction monitoring thresholds and controls.

The extent of EDD applied shall be proportionate to the level of risk identified.

3.5. Source of Funds and Source of Wealth Verification

BuyUcoin requires Users, particularly high-risk Users, to provide information and documentation demonstrating the legitimate origin of funds used on the BuyUcoin Platform.

Source of funds refers to the immediate origin of the funds used for a specific transaction, while source of wealth refers to the broader accumulation of a User’s total wealth. BuyUcoin may require Users to submit declarations, bank statements, salary slips, business income records, or other relevant documentation to verify both.

Inadequate, inconsistent, or unverifiable source of funds information may result in transaction restrictions, account suspension, or termination.

3.6. High-Value Transactions and Additional Controls

Transactions involving high values, unusual frequency, or patterns inconsistent with the User’s known profile may trigger enhanced scrutiny.

BuyUcoin may impose transaction limits, cooling-off periods, or additional verification requirements for such transactions. In certain cases, BuyUcoin may delay or refuse processing of transactions until satisfactory clarification and documentation is obtained.

3.7. Adverse Media Screening

BuyUcoin conducts adverse media screening to identify Users who may be associated with criminal activity, financial misconduct, or other reputational risks.

Where adverse media is identified, BuyUcoin assesses the credibility, relevance, and severity of the information and may apply enhanced due diligence measures, restrict account activity, or terminate the relationship as appropriate.

3.8. Unsuccessful Enhanced Due Diligence

Where Enhanced Due Diligence cannot be completed to BuyUcoin’s satisfaction, or where the risk associated with a User cannot be adequately mitigated, BuyUcoin may take one or more of the following actions:

Restriction or suspension of the User’s account. Termination of the business relationship. Filing of a Suspicious Transaction Report with FIU-IND. Refusal to process further transactions.

Such actions shall be taken in accordance with applicable laws and internal escalation procedures.

3.9. Confidentiality of EDD Processes

All information collected during Enhanced Due Diligence and risk assessments is treated as confidential and is used solely for compliance and risk management purposes. BuyUcoin does not disclose the existence or outcome of EDD reviews to Users, except where required by law.

3.10. Ongoing Monitoring of High-Risk Users

High-risk Users are subject to enhanced ongoing monitoring. This includes more frequent review of transactions, periodic reassessment of risk classification, and regular updates of KYC and EDD information.

BuyUcoin reserves the right to reclassify Users and adjust controls at any time based on evolving risk factors.

4. TRANSACTION MONITORING, RED FLAGS AND SUSPICIOUS TRANSACTION REPORTING

4.1. Objective of Transaction Monitoring

BuyUcoin maintains a comprehensive transaction monitoring framework to identify, assess, and respond to suspicious or unusual activity on the BuyUcoin Platform. The objective of transaction monitoring is to ensure early detection of potential money laundering, terrorist financing, proliferation financing, fraud, market abuse, or other unlawful activities, and to take timely and appropriate action in accordance with applicable law.

Transaction monitoring is conducted on a continuous basis and applies to all transactions executed or attempted on the Platform, irrespective of transaction value.

4.2. Monitoring Framework

BuyUcoin employs a combination of automated systems, rule-based alerts, and manual review mechanisms to monitor transactions. Monitoring parameters are designed based on the risk profile of Users, transaction behaviour, historical activity, and regulatory guidance.

The monitoring framework is periodically reviewed and updated to address emerging risks, changes in product offerings, and evolving regulatory expectations.

4.3. Risk-Based Monitoring Approach

The intensity and frequency of transaction monitoring applied to a User depend on the User’s risk classification. Higher-risk Users and transactions are subject to enhanced monitoring, lower thresholds for alert generation, and more frequent reviews.

BuyUcoin may adjust monitoring thresholds dynamically based on changes in transaction behaviour, risk indicators, or intelligence received from internal or external sources.

4.4. Red Flag Indicators

BuyUcoin monitors for a range of red flags that may indicate suspicious activity. These include, but are not limited to, transactions that lack economic rationale, transactions inconsistent with the User’s stated profile or expected activity, rapid movement of funds into and out of the Platform, structuring of transactions to avoid thresholds, and repeated high-value transactions without a clear business purpose.

Additional red flags include interaction with wallets or platforms associated with illicit activity, attempts to circumvent platform controls, and unusual patterns involving newly created or dormant accounts.

The presence of one or more red flags does not automatically indicate wrongdoing but triggers further review and investigation.

4.5. High-Value and Unusual Transactions

Transactions involving unusually high values, sudden spikes in trading volume, or patterns inconsistent with historical behaviour are subject to enhanced scrutiny. BuyUcoin may conduct additional verification, seek clarifications from the User, or temporarily restrict transactions pending review.

Where explanations or supporting documentation are unsatisfactory or inconsistent, BuyUcoin may escalate the matter in accordance with internal procedures.

4.6. Cross-Border and Restricted Transactions

BuyUcoin does not permit Users to initiate cross-border transactions on the Platform where such transactions are not permitted under applicable Indian law. Any attempt to initiate restricted or prohibited transactions is flagged for immediate review and may result in account restriction, termination, and regulatory reporting.

4.7. Investigation and Review of Alerts

All alerts generated through transaction monitoring systems are reviewed by the Compliance team. The review process includes analysis of transaction history, User profile, KYC information, source of funds data, and any other relevant information.

Investigations are documented in accordance with internal procedures, and outcomes are recorded for audit and regulatory purposes.

4.8. Suspicious Transaction Reporting (STR)

Where, after investigation, BuyUcoin forms a reasonable suspicion of money laundering, terrorist financing, or proliferation financing, a Suspicious Transaction Report is filed with the Financial Intelligence Unit – India (FIU-IND) in the prescribed manner and within applicable timelines.

STRs are filed irrespective of whether the transaction is completed, attempted, or declined, and regardless of the amount involved.

4.9. Confidentiality and Non-Tipping Off

BuyUcoin strictly maintains the confidentiality of Suspicious Transaction Reports and related investigations. Users are not informed of the filing or contemplated filing of an STR, and no information that may amount to tipping off is disclosed to the User or any third party.

Any breach of confidentiality obligations by employees or agents may result in disciplinary action and legal consequences.

4.10. Escalation and Internal Governance

Material or complex cases identified through transaction monitoring are escalated internally to senior compliance personnel and, where required, to the Principal Officer or Designated Director.

BuyUcoin maintains clear internal escalation procedures to ensure timely decision-making and regulatory compliance in high-risk cases.

4.11. Actions Following Identification of Suspicious Activity

Depending on the nature and severity of the risk identified, BuyUcoin may take one or more of the following actions:

Restriction or suspension of the User’s account. Delay or refusal of transaction processing. Termination of the User relationship. Filing of an STR or other regulatory reports. Cooperation with law enforcement or regulatory authorities as required under applicable law.

Such actions are taken in a proportionate manner, consistent with legal and regulatory obligations.

4.12. Continuous Improvement of Monitoring Controls

BuyUcoin regularly reviews the effectiveness of its transaction monitoring systems and controls. Feedback from investigations, audits, regulatory inspections, and industry developments is used to enhance monitoring rules, thresholds, and detection capabilities.

5. SANCTIONS COMPLIANCE, TRAVEL RULE, UNHOSTED WALLETS AND RESTRICTED ACTIVITIES

5.1. Sanctions Compliance Framework

BuyUcoin is committed to complying with all applicable sanctions laws and regulations issued by competent national and international authorities. The Company maintains a sanctions compliance framework designed to prevent onboarding or continued access by individuals, entities, or wallet addresses that are subject to sanctions, embargoes, or restrictive measures.

Sanctions screening is conducted at the time of onboarding and on an ongoing basis using reliable databases and screening tools. Where a User or transaction is identified as potentially linked to a sanctioned individual, entity, or jurisdiction, BuyUcoin takes immediate action to restrict account activity and escalate the matter to the Compliance function for further review.

5.2. Handling of Sanctions Matches

Potential sanctions matches are reviewed promptly to determine whether the match is a true positive, false positive, or requires further investigation. Confirmed sanctions matches result in immediate restriction or freezing of the account, cessation of transaction processing, and reporting to the appropriate authorities in accordance with applicable law.

BuyUcoin does not permit any transactions or services that would result in a breach of applicable sanctions requirements.

5.3. Travel Rule Compliance

BuyUcoin has implemented controls to comply with the Travel Rule obligations applicable to Virtual Digital Asset transactions, as prescribed under applicable law and regulatory guidance.

The Company collects, verifies, and retains required originator and beneficiary information for qualifying VDA transactions. Where transactions involve another Virtual Asset Service Provider, BuyUcoin may transmit or receive required information through secure channels or interoperable messaging systems, subject to regulatory requirements.

In cases where Travel Rule compliance cannot be satisfactorily ensured, BuyUcoin may restrict, delay, or refuse to process the transaction.

5.4. Manual and Transitional Travel Rule Measures

Where technological interoperability with counterpart Virtual Asset Service Providers is unavailable or limited, BuyUcoin may adopt interim or manual measures to obtain and verify required information. Such measures may include User declarations, supporting documentation, and enhanced due diligence.

Transactions may be processed only after compliance with Travel Rule requirements is reasonably satisfied, based on the risk assessment conducted by BuyUcoin.

5.5. Unhosted Wallet Transactions

Unhosted wallets, also referred to as self-custody wallets, present elevated money laundering and terrorist financing risks due to the absence of intermediary controls. BuyUcoin applies enhanced scrutiny to transactions involving unhosted wallets.

Users may be required to provide declarations confirming ownership or control of the unhosted wallet, submit supporting evidence such as screenshots or transaction histories, and undergo additional verification, including video-based confirmation, where necessary.

BuyUcoin reserves the right to impose transaction limits, apply enhanced monitoring, or refuse transactions involving unhosted wallets where risks cannot be adequately mitigated.

5.6. Privacy Coins and Anonymity-Enhancing Services

BuyUcoin does not permit the use of privacy-focused virtual assets or anonymity-enhancing services that materially impede traceability and regulatory oversight. This includes, but is not limited to, privacy coins, mixers, tumblers, and other obfuscation mechanisms.

Any attempt to deposit, withdraw, or transact using such services may result in immediate restriction of the User’s account, investigation, and reporting to appropriate authorities.

5.7. Prohibited and Restricted Activities

BuyUcoin strictly prohibits the use of its Platform for any illegal or unlawful purpose. This includes activities related to money laundering, terrorist financing, proliferation financing, fraud, market manipulation, or any activity in violation of applicable laws or regulations.

The Company reserves the right to restrict, suspend, or terminate User accounts involved in prohibited or restricted activities and to take appropriate legal or regulatory action.

5.8. Cross-Border Transactions and Jurisdictional Restrictions

BuyUcoin operates in accordance with applicable Indian laws and does not permit Users to initiate cross-border transactions where such transactions are not permitted. Transactions involving jurisdictions identified as high-risk or subject to restrictions may be subject to enhanced scrutiny or outright prohibition.

5.9. Monitoring and Review of Restricted Activities

The Compliance function continuously monitors for attempts to circumvent platform controls or engage in restricted activities. Where such attempts are identified, BuyUcoin may take immediate preventive and corrective action, including reporting to competent authorities.

6. RECORD KEEPING, LAW ENFORCEMENT COOPERATION, TRAINING, AUDIT AND GOVERNING LAW

6.1. Maintenance and Preservation of Records

BuyUcoin maintains comprehensive records relating to customer identification, account files, business correspondence, and transaction history in accordance with applicable laws and regulatory requirements. Records are maintained in a manner that enables timely retrieval and reconstruction of individual transactions, where required.

Transaction records, including details relating to the nature, value, date, and parties to the transaction, are preserved for a minimum period of five (5) years from the date of the transaction. Customer identification records and KYC documentation are preserved during the subsistence of the User relationship and for a minimum period of five (5) years from the date of closure of the User account.

All records are stored securely and protected against unauthorised access, alteration, or destruction.

6.2. Data Security and Confidentiality

BuyUcoin implements appropriate technical and organisational measures to safeguard customer data and compliance records. Access to AML-related information is restricted to authorised personnel only and is provided strictly on a need-to-know basis.

Confidentiality of customer data and compliance information is maintained in accordance with applicable data protection and information security laws, subject to lawful disclosure requirements.

6.3. Disclosure to Regulatory and Law Enforcement Authorities

BuyUcoin is required to cooperate with government authorities, regulators, law enforcement agencies, courts, and tribunals within the territory of India.

Where required by law or pursuant to a valid legal request, BuyUcoin may disclose customer information, transaction data, and compliance records to competent authorities, including but not limited to the Financial Intelligence Unit – India (FIU-IND), Enforcement Directorate, police authorities, or judicial bodies.

Such disclosures may be made in circumstances including, but not limited to, compliance with legal process, protection of BuyUcoin’s legal rights, prevention or detection of unlawful activity, or safeguarding public interest.

6.4. Law Enforcement Requests and Assistance Mechanism

All requests received from law enforcement or regulatory authorities are centrally handled by the Compliance and Legal teams. Requests are verified for authenticity, scope, and legal validity prior to processing.

Where the requested data is available in BuyUcoin’s systems, the information is provided securely within the stipulated timelines. Where no relevant data is available, a formal nil response is submitted to the requesting authority. Records of all requests and responses are maintained for audit and regulatory purposes.

6.5. Employee Screening and Training

BuyUcoin ensures that employees involved in customer onboarding, transaction processing, compliance, and investigations are suitably qualified and trained. Background checks may be conducted for employees in sensitive roles, subject to applicable law.

All employees receive AML/CFT awareness training at the time of onboarding and periodic refresher training thereafter. Employees with specific compliance responsibilities receive enhanced role-based training to ensure effective implementation of this Policy.

6.6. Internal Controls and Compliance Oversight

BuyUcoin maintains internal controls and reporting structures to ensure effective implementation of this AML Policy. The Compliance function monitors adherence to the Policy and escalates material issues to senior management and the Board, as appropriate.

The Designated Director and Principal Officer oversee the effectiveness of AML controls and ensure that adequate resources are allocated for compliance.

6.7. Audit and Independent Review

The AML framework and implementation of this Policy are subject to periodic internal and external audits. Audits assess the adequacy and effectiveness of controls, systems, and procedures and identify areas for improvement.

Audit findings are reviewed by senior management, and corrective actions are implemented within defined timelines. The Policy is reviewed at least annually or earlier in the event of material regulatory or business changes.

6.8. Breach of Policy and Disciplinary Action

Any breach of this AML Policy by a User may result in restriction, suspension, or termination of the User’s account and reporting to relevant authorities where required.

Any breach of this Policy by employees, officers, or agents of BuyUcoin may result in disciplinary action, including termination of employment or engagement, in accordance with internal policies and applicable law.

6.9. Governing Law and Jurisdiction

This AML Policy shall be governed by and construed in accordance with the laws of India, including the Prevention of Money Laundering Act, 2002 and the Information Technology Act, 2000, and rules framed thereunder.

Any disputes arising out of or in connection with this AML Policy shall be subject to the exclusive jurisdiction of the courts at Noida, Uttar Pradesh, India.

6.10. Policy Approval and Effective Date

This AML Policy has been approved by the Board of Directors of IBlock Technologies Private Limited and is effective from the date of such approval. The Policy shall remain in force until amended or replaced in accordance with applicable law and internal governance processes.