Anti-Money-Laundering & Counter-Terrorist-Financing Policy

1. Statement of commitment

Sentrix is committed to preventing its products and operations from being used to facilitate money laundering, the financing of terrorism, proliferation financing, sanctions evasion or other financial crime. We maintain a risk-based financial-crime programme appropriate to a technology vendor serving regulated financial institutions, and we build capabilities into our platform that help customers meet their own obligations.

Sentrix is a technology vendor, not a bank or licensed financial institution. It is not itself a party to our customers' regulated relationships with their end users, is not a "financial institution" or "designated non-financial business or profession" (DNFBP) as defined under UAE law, and does not itself file suspicious-activity reports on customers' behalf. This policy therefore addresses (a) our own financial-crime programme and (b) how the platform enables our customers' AML/CTF and KYC/KYB programmes.

2. Legal & regulatory framework

Our programme, and the capabilities we provide to customers, are designed with reference to:

• UAE Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations, and Cabinet Decision No. 10 of 2019 (its implementing regulation), as amended.
• Guidance and rules issued by UAE supervisory authorities, including the Central Bank of the UAE (CBUAE) and, for free-zone entities, the DFSA (DIFC) or FSRA (ADGM).
• The Financial Action Task Force (FATF) 40 Recommendations and the risk-based approach they establish.
• Applicable targeted financial sanctions regimes — the UN Security Council Consolidated List and the UAE Local Terrorist List administered by the UAE Cabinet, together with OFAC, EU and UK lists where relevant to a relationship.

Where the Sentrix contracting entity's free zone imposes its own AML rulebook, that rulebook applies to our own programme to the extent stated in the executed agreement.

3. Risk-based approach

Consistent with the FATF standards and UAE law, we take a risk-based approach: we identify and assess the money-laundering and terrorist-financing risk arising across our commercial relationships, delivery channels and geographies, and we calibrate the depth of our controls to that risk. Higher-risk situations attract enhanced measures; lower-risk situations attract proportionate, simplified measures. The platform mirrors this model for customers — thresholds, rules and screening intensity are configurable so each institution can encode its own documented risk appetite.

4. Governance & the MLRO

Senior management holds ultimate responsibility for the financial-crime programme. A designated Money Laundering Reporting Officer (MLRO) — a role identified by name in the executed agreement rather than in this public policy — is responsible for programme maintenance, internal escalation, liaison with authorities and independent oversight, with sufficient authority, seniority and resources to act on financial-crime concerns. The compliance function is independent of commercial lines of business.

5. Customer due diligence (CDD) & enhanced due diligence (EDD)

Because we contract with businesses, we perform risk-based due diligence on the organisations we onboard as customers, which may include:

• Verifying the identity and legitimacy of the contracting entity from reliable, independent sources.
• Understanding the nature of the business, its regulatory status and the purpose of the relationship.
• Identifying beneficial ownership and control structure where relevant to risk.
• Screening the counterparty and associated parties against sanctions, PEP and watchlist sources.
• Applying enhanced due diligence — additional verification, source-of-funds understanding and senior sign-off — to higher-risk relationships, including those involving PEPs or higher-risk jurisdictions.

6. Sanctions & PEP screening

We do not knowingly do business with sanctioned parties. Our commercial screening references applicable sanctions regimes — the UN Consolidated List, the UAE Local Terrorist List, and OFAC, EU and UK lists where relevant — and we will block, decline or exit relationships where a party is sanctioned or where dealing would breach sanctions law. Politically exposed persons and their associates are identified and subject to enhanced measures. Potential matches are reviewed and escalated through the compliance function; targeted-financial-sanctions obligations (including freezing and reporting) are actioned without delay where they apply to us.

7. Transaction monitoring & suspicious-activity reporting

Within our own operations, personnel are required to identify and escalate indicators of financial crime through a defined internal process to the MLRO. Where a legal reporting obligation applies to Sentrix, the MLRO is responsible for making the report to the UAE Financial Intelligence Unit (FIU) through the goAML portal, and for any related suspicious-transaction, suspicious-activity or funds-freeze reporting required by law. We prohibit "tipping off" — disclosing that a report has been or may be made — where the law so requires.

Reporting responsibility rests with the regulated institution. For end-user activity, the customer — as the regulated financial institution or DNFBP — determines what is suspicious and files the corresponding report with the FIU. Sentrix provides the monitoring, alerting, case and evidence tools that support that determination; it does not make regulatory reports on the customer's behalf.

8. Record-keeping

We retain records of due diligence, screening, monitoring and any internal or external reports for at least five years after the end of the relationship or the completion of the transaction, or longer where law requires. The platform enables customers to configure equivalent retention for the records they generate, in line with their own UAE record-keeping obligations.

9. How the platform supports customers

The greatest AML value Sentrix delivers is to our customers' own programmes. The platform provides:

• Identity verification inputs and orchestration for KYC and KYB.
• Sanctions, PEP and adverse-media screening against configurable lists and thresholds.
• Real-time risk decisioning with explainable rules and scores and reason codes on every call.
• Ongoing monitoring and re-screening as risk, behaviour or lists change.
• Case management for review, disposition and escalation, with role-based access controls. Dual-control ("four-eyes") approval on high-impact overrides is on our roadmap, not yet a shipped control.
• Append-only audit trails of decisions and overrides to support the evidence customers provide to examiners. Cryptographic tamper-evidence (hash-chaining / WORM export) is on our roadmap.
• Configurable thresholds so each customer can encode its own risk appetite and regulatory requirements.

In this evaluation environment, screening providers operate in sandbox and results are simulated; customers connect production providers under their own regulated programme.

10. Training, culture & independent review

Relevant personnel receive financial-crime awareness training appropriate to their role, refreshed periodically and when the law or risk landscape changes. We foster a culture in which raising concerns is expected and protected, and we subject the programme to periodic independent review to test its effectiveness and keep it current.

11. Data protection & contact

Financial-crime controls are operated consistently with our data-protection commitments in the Privacy Policy and DPA. For AML or compliance queries, contact compliance@sentrix.world.