Acceptable Use Policy

Last Updated: 7/13/2026 | Version 1.4

1. Introduction and Purpose

This Acceptable Use Policy ("Policy" or "AUP") sets forth the rules governing the use of the software, technology, data, and program-administration services provided by Kashu, Inc. ("Kashu," "we," "us," or "our"), a Wyoming corporation, through the Kashu platform, mobile and web applications, websites, APIs, and related services (collectively, the "Services"). The Services consist of three integrated pillars: Platform Access, Transaction Intelligence, and Program Administration, as further described in Kashu's Terms of Service.

This Policy is designed to ensure that all activity conducted through Kashu's systems complies with applicable laws, card-network rules, partner-institution requirements, and industry best practices, and to define the conduct expected of all users of the Services.

You are independently responsible for complying with all applicable federal, state, and local laws in all of your actions related to your use of the Services. You must also comply with this Policy, the Kashu Terms of Service, the Kashu Software & Technology Services Agreement ("STSA") (the master platform agreement for the Kashu Wallet, entered into between Kashu and each business customer at onboarding; it does not apply to Kashu Pay payment-processing services), and any other agreement or disclosure presented to you in connection with the Services. Any violation of this Policy constitutes a violation of the Terms of Service and may result in suspension or termination of your program account.

2. Scope and Application

This Policy applies to all users of the Services, including the business entity using the Services ("User" or "you") and all individuals authorized to access the Services on the entity's behalf, including beneficial owners, control persons, authorized signatories, and authorized employees ("Authorized Individuals").

2.1 Application to Kashu Pay. This Policy applies to both the Kashu Wallet and to Kashu Pay, our payment-acceptance and card-processing service. For merchants using Kashu Pay, the prohibited categories in Section 6 and the pre-approval categories in Section 7 apply not only to the merchant's own use of the Services but also to the goods and services the merchant sells to, and the transactions it accepts from, its customers and cardholders. A merchant may not accept card payments through Kashu Pay for any product, service, or business activity that is prohibited under Section 6, or that has not received any pre-approval required under Section 7.

The Services are made available exclusively to businesses organized under the laws of the United States and operating in the United States. Use of the Services from sanctioned jurisdictions, or by individuals or entities appearing on any U.S. government sanctions, denied-party, or politically-exposed-person list, is prohibited.

This Policy applies to all transactions processed, initiated, instructed, or received through Kashu's systems.

3. Definitions

• "Services" — the Kashu platform, software, mobile and web applications, APIs, and related technology, data, and program-administration offerings.
• "Program Account" — the account established for a business User to access the Services. Funds associated with a Program Account are held in custodial FBO accounts at Fresno First Bank by Monarch Technologies, Inc., not by Kashu.
• "Authorized Individuals" — the natural persons authorized to act on behalf of the User, including beneficial owners, control persons, authorized signatories, and authorized employees.
• "Material Change" — any change to KYB information that would, if known at onboarding, have materially affected Kashu's eligibility, risk, or compliance determination, including changes in entity name, structure, jurisdiction, beneficial ownership of 25% or more, control persons, primary business activity, registered or operating address, or linked bank account.
• "Business Day" — a day, other than a Saturday, Sunday, or U.S. federal holiday, on which commercial banks in the United States are open for business.

4. Custody and Fund Control

Kashu has no legal, beneficial, or equitable interest in customer funds at any time. Funds associated with a Program Account are held by Monarch Technologies, Inc. (MSB Registration No. 31000186536125; NMLS ID 1908316) in custodial For-Benefit-Of ("FBO") accounts at Fresno First Bank, Member FDIC.

Kashu's enforcement authority under this Policy is limited to (a) suspending or terminating access to the Services; and (b) instructing Monarch and the underlying financial institutions to initiate, hold, freeze, or release funds in accordance with this Policy, applicable law, lawful third-party requests, and the rules of the underlying financial institutions. Kashu does not hold, transfer, or release funds directly.

5. Permitted Uses

The Services may be used to:

• Operate the financial activities of a U.S.-organized business entity in good standing;
• Fund the Program Account using authorized, lawfully-obtained credit, debit, or bank accounts held in the User's legal name;
• Initiate transfers from the Program Account to verified bank accounts owned by the User or by KYB-verified counterparties of the User in connection with bona fide business activity;
• Access reporting, analytics, transaction-level data enrichment, and program-administration features provided by the Services;
• Conduct legitimate business-to-business commercial activity consistent with the User's declared line of business and KYB profile.

Any use that exceeds the scope of this Section, or that falls within Sections 6 or 7 without the required pre-approval, is a violation of this Policy.

6. Prohibited Activities

You may not use the Services for any activity that violates any law, statute, ordinance, regulation, card-network rule, or partner-institution requirement. Without limitation, the following activities are prohibited.

6.1 Illegal or Restricted Products and Services

• Narcotics, steroids, controlled substances, or products presenting consumer-safety risk
• Drug paraphernalia
• Cannabis, CBD, hemp, and hemp-derived products (federally restricted regardless of state legality)
• Cigarettes, tobacco, e-cigarettes, vaping products, and related supplies where restricted by law
• Stolen goods, including digital goods, virtual assets, or access credentials
• Content promoting hate, violence, racial or other discriminatory intolerance, or financial exploitation of a crime
• Obscene, indecent, or sexually explicit content or services, including adult content, cam, escort, and adult-entertainment platforms
• Materials infringing copyright, trademark, right of publicity, right of privacy, or other proprietary rights
• Ammunition, firearms, firearm parts, accessories, or regulated weapons
• Unlawful high-yield investment programs, unregistered securities, or unregistered debt instruments
• Content or items that encourage, promote, or instruct others to engage in illegal activity

6.2 Fraud, Misrepresentation, and Unfair Practices

• Misrepresenting the nature of your business, products, services, or counterparties
• Falsifying or omitting material information to Kashu, its partners, or regulators
• Pyramid schemes, Ponzi schemes, matrix programs, "get-rich-quick" schemes, and recruitment-based multi-level marketing
• Fake, altered, stolen, or synthetic identities, accounts, or payment instruments
• Circumventing Kashu's KYB, KYC, AML, sanctions-screening, fraud-detection, or transaction-monitoring controls
• Impersonating Kashu, its partners, or any other entity
• Operating shell companies, nominee entities, or entities lacking bona fide business operations

6.3 Financial and Regulatory Evasion

• Unlicensed money transmission, money services business, or remittance activity
• Operating as a payment service provider, third-party payment processor, payment facilitator, or payment aggregator
• Currency exchange, check cashing, or off-shore banking services
• Cryptocurrency or digital-asset exchanges, mixers, tumblers, custodial wallets, ATMs, mining-as-a-service, and NFT marketplaces
• Initial Coin Offerings, token sales, or unregistered digital-asset offerings
• Debt-elimination, debt-consolidation, credit-repair, payday-lending, and title-lending services
• Transactions designed to finance or refinance debts funded by a credit card
• Corruption, bribery, kickbacks, or political-influence payments
• Violation of U.S. economic sanctions, or transactions involving any party listed by OFAC or any other restricted-party list
• Tax evasion or concealment of financial activity

6.4 Unsafe or Unregulated Commerce

• Sale of products or services before the seller has lawful possession or control
• Activity violating consumer-protection, data-protection, or lending laws
• Sale of counterfeit or "grey market" goods
• Activity associated with products identified by regulators as fraudulent or high-risk
• Facilitating transactions for merchants engaged in illegal or prohibited activity through third-party processors
• Pseudo-pharmaceuticals or nutraceuticals making unsubstantiated medical claims

6.5 Transaction Pattern Restrictions

Independent of the underlying activity, the following transaction patterns are prohibited because they undermine the integrity of the Services, AML controls, or card-network rules:

• Structuring transactions to evade reporting, monitoring, or regulatory thresholds
• Funneling business activity unrelated to your declared line of business through the Program Account
• Transaction laundering, miscoding, or misrepresenting the nature of underlying activity to Kashu, card networks, or acquirers
• Aggregating or factoring — accepting funds or initiating transfers on behalf of unrelated third parties
• Splitting a transaction to avoid program limits, network thresholds, or compliance controls
• Circular, wash, or self-dealing transactions intended to inflate volume or generate artificial activity
• Velocity gaming — rapid in/out movement of funds without commensurate underlying business purpose

6.6 Prohibited Card-Acceptance Practices (Kashu Pay). When using Kashu Pay to accept card payments, you additionally may not:

• submit, "factor," or process transactions on behalf of, or that belong to, any other party, or that did not arise from a bona fide sale between you and your own customer (transaction laundering or aggregation);
• accept card payments for any business, product, or service other than the one disclosed in your merchant application and approved during underwriting, or misrepresent your business type or Merchant Category Code (MCC);
• process cash advances, provide scrip, or otherwise convert a card transaction into cash except as expressly authorized;
• split a single transaction into multiple transactions, or structure transactions, to evade limits, fees, or card-network rules;
• impose any surcharge, minimum, or maximum transaction amount except as permitted by Applicable Law and card-network rules;
• submit any transaction you know or should know to be fraudulent, unauthorized, or not authorized by the cardholder;
• store, retain, or transmit full payment-card or cardholder data in violation of the Payment Card Industry Data Security Standard (PCI-DSS); or
• fail to deliver purchased goods or services, or fail to honor a valid refund, return, or dispute for a transaction accepted through Kashu Pay.

7. Activities Requiring Pre-Approval

Certain activities may be permitted only with Kashu's prior written approval and may require enhanced underwriting, documentation, licensing verification, or partner-institution consent. You must obtain Kashu's written consent before using the Services in connection with the following categories (examples are illustrative, not exhaustive):

• Transportation — airlines, air charter services, air taxi, scheduled or non-scheduled passenger transport, and marine charter.
• Charitable / Non-Profit — accepting donations as a registered charity or nonprofit organization.
• High-Value Goods — dealers in jewels, precious metals, precious stones, coins, or bullion.
• Gambling, Gaming, and Contests — gambling, betting, lotteries, sweepstakes, fantasy sports, or other prize-based activities, even where lawful.
• Prescription and Medical — sale or fulfillment of prescription products, medical devices, procedures, treatments, telehealth, or medical tourism.
• Dating and Relationship Services — dating, matchmaking, or platforms facilitating personal or romantic relationships.
• Live Streaming and Broadcasting — platforms or services involving user-generated live video, audio, or interactive content.
• File Sharing and Data Storage — cyberlockers, remote file sharing, or storage platforms allowing public upload or download.
• Alcohol — sale, distribution, or fulfillment of alcoholic beverages.
• Marketplaces and Aggregators — e-commerce platforms enabling third-party sellers to list or sell products or services.
• Cross-Border Transfers — international wire transfers or cross-border remittances.
• High-Ticket Subscriptions — subscription services with annual commitments exceeding $5,000.
• Coaching and Information Products — coaching, mentorship, or information-product businesses, particularly those offering refund or guarantee terms.
• Travel and Tourism — travel agencies, tour operators, vacation rentals, and timeshare programs.
• Auctions and Consignment — auction houses, consignment shops, and similar resale platforms.
• Government and Public Sector — government contracting, public-sector procurement, and politically-exposed-person related activity.

Failure to obtain Kashu's prior written approval before engaging in any of the foregoing activities through the Services constitutes a violation of this Policy.

8. User Responsibilities

You agree to:

• Use the Services only for lawful, bona fide business purposes consistent with Section 5;
• Provide true, accurate, complete, and current information during onboarding, KYB, KYC, and transaction activity;
• Comply with all applicable laws and rules, including the Bank Secrecy Act, the USA PATRIOT Act, OFAC regulations, the FCPA, applicable state money-transmission and consumer-protection laws, and Visa, Mastercard, and other applicable card-network rules;
• Maintain appropriate books, records, and supporting documentation for all transactions;
• Cooperate with Kashu's periodic re-verification, enhanced due diligence, and information requests;
• Restrict access to the Services to Authorized Individuals and safeguard account credentials;
• Not engage in any activity that could damage, disable, overburden, or interfere with the Services, Kashu's infrastructure, or Kashu's reputation.

9. Business Information Accuracy and KYB Update Obligation

You certify that all KYB and Program-Account information you provide is accurate, complete, and current as of the date submitted. You agree to notify Kashu in writing within ten (10) Business Days of any Material Change, including but not limited to:

• Change in legal entity name, structure, or jurisdiction;
• Change in beneficial ownership of twenty-five percent (25%) or more;
• Change in control persons or authorized signatories;
• Change in primary business activity or industry classification;
• Change in registered or operating address;
• Change in linked bank account or financial-institution relationships;
• Receipt of any subpoena, regulatory inquiry, enforcement action, or material litigation affecting the entity, its owners, or control persons.

Failure to maintain accurate KYB information may result in suspension or termination of the Program Account and reporting to applicable regulators and partner institutions.

10. Monitering, Compliance, and Enforcement

Kashu actively monitors activity on the Services for suspicious, prohibited, or non-compliant conduct. Kashu may, in its discretion and without prior notice:

• Suspend, restrict, or terminate your access to the Services;
• Instruct Monarch and the underlying financial institutions to freeze, hold, or release funds in the Program Account pending review or resolution;
• Request additional information, including invoices, identification, source-of-funds documentation, beneficial-ownership records, or other business documentation;
• Reverse, decline, or refuse to process any transaction;
• Report activity to law enforcement, regulators, card networks, acquirers, and partner financial institutions.

Kashu does not hold or control funds and cannot release, transfer, or distribute funds directly. All fund-movement actions described in this Section are effected by instruction to Monarch and the underlying institutions in accordance with their rules and applicable law.

11. Suspension, Termination, and Appeals

Kashu reserves the right to suspend or terminate access to the Services at any time, with or without notice, for any reason permitted under this Policy, the Terms of Service, the STSA, applicable law, or partner-institution direction.

Appeals. If your Program Account is suspended or terminated, you may submit a written appeal within ten (10) Business Days of the suspension or termination notice to legal@kashupay.com. An appeal must include (a) the Program Account identifier; (b) a clear factual rebuttal addressing the basis for the action; (c) supporting documentation; and (d) the contact information of the Authorized Individual submitting the appeal. Kashu will acknowledge receipt of the appeal within five (5) Business Days and will issue a written determination within thirty (30) Business Days. Kashu's determination on appeal is final.

Suspension or termination does not relieve you of any obligations or liabilities accrued prior to such action. Funds held by Monarch in the Program Account remain subject to applicable laws, partner-institution rules, and any holds or freezes instructed by Kashu, by Monarch, or by lawful third-party request.

12. Reporting Violations

Users, partners, and third parties may report suspected violations of this Policy by contacting:

Email: legal@kashupay.com

If you are uncertain whether your intended use of the Services complies with this Policy, you should contact Kashu's Compliance team for written clarification before engaging in the activity.

13. Disclosure to Third Parties

You acknowledge and agree that Kashu may disclose information regarding suspected or actual violations of this Policy, including the identity of the User and Authorized Individuals, account activity, transaction records, and supporting documentation, to Monarch Technologies, Fresno First Bank, SoftPoint, card networks, acquirers, regulators, law-enforcement authorities, courts, and other parties as necessary to investigate, enforce, or comply with applicable law, partner-institution requirements, or this Policy.

14. Enforcement Actions

Violations of this Policy may result in any combination of the following:

• Immediate suspension or permanent termination of the Program Account;
• Instructions to Monarch to freeze, hold, or release funds in the Program Account;
• Disclosure to and investigation by partner financial institutions, card networks, regulators, and law enforcement;
• Civil or criminal legal action;
• Recovery of losses, damages, fines, penalties, chargebacks, and reasonable attorneys' fees caused by your conduct;
• Placement on internal or industry watch lists, including processor and acquirer terminated-merchant files where applicable.

15. Relationships to Other Policies

This Policy forms part of, and is incorporated by reference into, the Kashu Terms of Service and the Kashu Software & Technology Services Agreement ("STSA"), and is read together with the Privacy Policy and any other published Kashu compliance documents. In the event of any conflict between these documents, the order of precedence is: (1) STSA → (2) Terms of Service → (3) this Policy. All other policies and disclosures are subordinate to the above.

16. Modifications

Kashu reserves the right to amend or update this Policy at any time. Non-material changes are effective upon posting. Material changes will be communicated through the Services or by email at least thirty (30) days before they take effect, unless a shorter period is required by law, regulator direction, or partner-institution requirements. Your continued use of the Services after the effective date constitutes acceptance of the modified Policy.

17. Contact Information

Questions regarding this Policy or its application may be directed to:

Kashu, Inc.

Attn: Legal Department

1603 Capitol Ave, Ste 415 #674380

Cheyenne, WY 82001

Email: legal@kashupay.com