Legal Hub

Last Updated: 5/11/2026‍

1. Overview

This Refund Policy explains how refund requests are handled in connection with the use of the software, technology, data, and program-administration services provided by Kashu, Inc. ("Kashu," "we," "us," or "our"), a Wyoming corporation, through the Kashu platform, mobile and web applications, websites, APIs, and related services (collectively, the "Services"). The Services consist of three integrated pillars: Platform Access, Transaction Intelligence, and Program Administration, as further described in the Kashu Terms of Service.

Kashu is a software platform. Kashu does not hold, transmit, or issue funds. Refund mechanics flow through Kashu's partners, as described in Section 3.

These rules exist to protect users, maintain regulatory and card-network compliance, and ensure proper reconciliation with Kashu's partners.

‍

2. Definitions

• "User," "you," or "your" — the U.S.-organized business entity that is a customer of Kashu, together with its Authorized Individuals.
• "Authorized Individual" — a natural person authorized to act on behalf of the User, including a beneficial owner, control person, authorized signatory, or authorized employee.
• "Program Account" — the account established for a business User to access the Services. Funds associated with a Program Account are held in custodial For-Benefit-Of (FBO) accounts at Fresno First Bank, Member FDIC, by Monarch Technologies, Inc.
• "Platform Service Fee" — the fee paid to Kashu in consideration of the three pillars of the Services, as described in the Terms of Service and the STSA.‍
• "Business Day" — a day, other than a Saturday, Sunday, or U.S. federal holiday, on which commercial banks in the United States are open for business.

‍

3. Custody and Refund Mechanics

Kashu has no legal, beneficial, or equitable interest in customer funds at any time and does not hold, transmit, settle, authorize, or directly issue refunds. Refund activity is performed by Kashu's partners, which include licensed acquirers and card payment providers, a licensed money transmitter, and a custodial bank. As of the date of this Policy, Kashu's partners include Monarch Technologies, Inc. (MSB Registration No. 31000186536125; NMLS ID 1908316), which holds customer funds in custodial For-Benefit-Of (FBO) accounts at Fresno First Bank, Member FDIC, and initiates ACH disbursements and ACH refunds where applicable. Card-funded transactions, including card-funded refunds, are authorized, settled, and issued by Kashu's acquirer and card payment providers in accordance with the rules of Visa, Mastercard, and other applicable card networks.

Kashu's role in connection with refunds is limited to reviewing requests, applying this Policy, and instructing the applicable Kashu partner to initiate approved refunds. Kashu does not directly process, authorize, settle, or issue any refund.

‍

4. Eligibility for Refunds

A refund may be approved if one of the following applies:

• Duplicate Charge, the same transaction was processed more than once.
• Incorrect Amount Charged, a system or processing error caused an inaccurate debit.
• Transaction Cancelled Before Settlement, the transaction was stopped prior to final clearing through the card network.
• System or Processing Error, a technical or network failure resulted in an invalid or incomplete charge.
• Compliance or Regulatory Requirement, a refund is required to satisfy AML, KYC, KYB, OFAC, sanctions, or card-network obligations.

Refunds will not be issued for:

• Completed and settled transactions initiated correctly by the User;
• Funds that have already been transferred, withdrawn, or disbursed from the Program Account;
• Platform Service Fees, except as described in Section 6;
• Transactions under review for dispute, fraud, chargeback, or compliance investigation;
• Requests submitted by a person who is not an Authorized Individual of the User.

‍

5. Refund Destination

Refunds are returned to the original funding instrument whenever possible, in accordance with the rules of the applicable card network, payment provider, and financial institution.

• If the funding instrument was a credit or debit card, the refund is issued back to the same card account by Kashu's partners in accordance with applicable card-network rules.
• If the funding instrument was a bank account, the refund is issued by ACH back to the originating account by Kashu's partners.
• Refunds will not be issued in cash, check, or to a financial instrument other than the original funding instrument.

If the original funding instrument has been closed or is otherwise unavailable, Kashu will work with its partners to determine the appropriate treatment, which may include holding the funds in the Program Account pending additional verification or returning the funds to the issuing institution in accordance with card-network or banking rules.

‍

6. Platform Service Fee

The Platform Service Fee is consideration for software, technology, data, and program-administration services rendered at the time of the transaction. Because those services, including KYB review, risk monitoring, sanctions screening, transaction-level data enrichment, reporting, and program administration, are performed and consumed at the moment of the transaction, the Platform Service Fee is earned upon transaction completion and is non-refundable, except in the following limited circumstances:

• The underlying transaction did not complete or did not settle, in which case the Platform Service Fee will not be charged;
• A duplicate transaction was processed in error, in which case the Platform Service Fee associated with the duplicate (and only the duplicate) will be refunded together with the duplicated principal;
• A refund of the Platform Service Fee is required by applicable law, regulator direction, or card-network rule.

Where a partial refund of principal is approved, the Platform Service Fee remains fully earned and non-refundable, except as set forth above.

‍

7. Processing Timeframes

Kashu typically instructs its partners to initiate approved refunds within two (2) Business Days of approval. Settlement of the refund to the original funding instrument is performed by Kashu's partners and the issuing or receiving financial institution, and typically results in funds appearing on the cardholder statement or in the receiving bank account within five (5) to ten (10) Business Days of instruction.

Kashu does not control downstream processing or settlement timelines. Delays may occur due to additional verification, intermediary-bank holds, card-network settlement cycles, or compliance review.

‍

8. How to Request a Refund

To request a refund, an Authorized Individual must submit a written request to the address listed in Section 16 (Contact Information) with the following details:

• Business legal name and Employer Identification Number (EIN);
• Program Account identifier;
• Name, title, and role of the Authorized Individual submitting the request;
• Transaction ID, date, and amount;
• Funding instrument identifier (e.g., last four digits of the card or bank account);
• Detailed reason for the refund request;
• Any supporting documentation.

For security, additional identity verification or supporting documentation may be required before a review can begin.

‍

9. Review and Approval Process

All refund requests are reviewed by Kashu's Risk and Compliance teams. Each request is assessed to confirm that:

• The transaction qualifies under the eligibility criteria in Section 4;
• There is no indication of fraud, misuse, chargeback abuse, or AUP violation;
• The refund complies with Visa, Mastercard, and other applicable card-network rules; and
• The refund complies with applicable banking, AML, KYC, KYB, OFAC, and sanctions standards.

Refunds are approved or denied at Kashu's sole discretion in accordance with this Policy and applicable law. If denied, the requesting Authorized Individual will receive a written explanation. Once an approved refund has been instructed and settled by Kashu's partners, the refund is final.

‍

10. High-Value Refunds

Refund requests for amounts exceeding ten thousand U.S. dollars (US$10,000) may require additional verification, enhanced due diligence, and sign-off by Kashu's Finance or Compliance officers. These reviews ensure that high-value refund instructions are consistent with anti-money-laundering standards, card-network settlement requirements, and the rules of Kashu's partners. Processing times for high-value refunds may be extended.

‍

11. Holds and Freezes

Kashu may instruct its partners to hold or freeze a refund amount, or to delay an instruction, pending compliance review, dispute investigation, regulatory cooperation, or partner direction. Refunds released after a hold are subject to the same downstream processing timelines as approved refunds.

‍

12. Refunds vs. Chargebacks

Refunds are reviewed by Kashu and, if approved, instructed by Kashu to the applicable Kashu partner. Chargebacks, by contrast, are initiated by a cardholder through their issuing bank under the dispute process defined by the applicable card network, and are processed by the card network, the cardholder's issuing bank, and Kashu's partners without Kashu's involvement in the decisioning step.

If a chargeback is filed while a refund request is pending, Kashu will suspend its refund review until the chargeback is resolved by the card network. Card-network rules and the cardholder's agreement with the issuing bank govern chargeback rights, not this Policy. Duplicate or coordinated refund and chargeback claims for the same transaction may result in account suspension, instructions to hold funds in the Program Account.

‍

13. Compliance and Limitations

All refunds are subject to applicable:

• Visa, Mastercard, and other applicable card-network operating regulations;
• Banking, AML, KYC, KYB, OFAC, and sanctions compliance standards;
• The processing, settlement, and ACH rules of Kashu's partners; and
• Kashu's internal Risk Management and Fraud Prevention policies and the Acceptable Use Policy.

Kashu reserves the right to deny, delay, or instruct the hold of refunds that:

• Conflict with ongoing investigations, legal holds, or regulatory cooperation;
• Appear to circumvent AML, KYB, sanctions screening, or fraud-prevention controls;
• Are otherwise inconsistent with card-network, partner, financial-institution, or regulatory obligations.

Refund instructions may be reversed by Kashu's partners where fraudulent behavior, chargeback misuse, or non-compliance is identified after issuance.

‍

14. Liability Disclaimer

Kashu is not responsible for delays or actions caused by Kashu's partners, card networks, issuing banks, intermediary banks, network outages, or other third-party financial institutions or processors.

Refunds are issued only to the verified original funding instrument. Kashu bears no liability for losses arising from changes to user banking details, account closures, card expirations, or instructions provided by the User that are subsequently disputed. A refund cannot exceed the original transaction amount.

‍

15. Relationships to Other Policies

This Policy forms part of, and is incorporated by reference into, the Kashu Terms of Service and the Kashu Software & Technology Services Agreement ("STSA"), and is read together with the Acceptable Use Policy, the Privacy Policy, and any other published Kashu compliance documents. In the event of any conflict between these documents, the order of precedence is: (1) STSA → (2) Terms of Service → (3) Acceptable Use Policy → (4) this Refund Policy. All other policies and disclosures are subordinate to the above.

‍

16. Contact Information

For refund requests, questions about this Policy, or to check the status of a submitted refund, you may contact us as follows:

Kashu, Inc

Attn: Refunds — Risk & Compliance

1603 Capitol Ave, Ste 415 #674380

Cheyenne, WY 82001

Email: help@kashupay.com

Support Hours: Monday – Friday, 9:00 AM – 6:00 PM (CST)

‍

17. Modifications

Kashu reserves the right to modify or update this Policy at any time to reflect changes in regulations, card-network rules, the requirements of Kashu's partners, or internal processes. Non-material changes are effective upon posting. Material changes will be communicated through the Services or by email at least thirty (30) days before they take effect, unless a shorter period is required by law, regulator direction, or partner-institution requirements. Your continued use of the Services after the effective date constitutes acceptance of the modified Policy.

Last Updated: 5/11/2026 | Version 2.0

1. Overview

Kashu, Inc. ("Kashu," "we," "us," or "our"), a Wyoming corporation, operates a software platform that provides business financial-operations tooling, Platform Access, Transaction Intelligence, and Program Administration, on top of regulated payment and banking rails operated by Kashu's partners.

As part of the Program Administration pillar of the Services, Kashu maintains a Customer Identification Program ("CIP") to verify the identity of the business entities that use Kashu and the individuals associated with those entities. The CIP supports the customer-identification, customer-due-diligence, and anti-money-laundering obligations of Kashu's partners under the Bank Secrecy Act (BSA), the USA PATRIOT Act, the FinCEN Customer Due Diligence Rule (31 CFR 1010.230), the Corporate Transparency Act and its Beneficial Ownership Information rule, OFAC sanctions programs, and applicable state law.

This CIP is a customer-facing summary of how Kashu collects and verifies identity information. It does not modify, replace, or limit Kashu's internal compliance procedures or the regulatory obligations of Kashu's partners.

‍

2. Definitions

• "Services" — the Kashu platform, software, mobile and web applications, APIs, and related technology, data, and program-administration offerings.
• "User," "you," or "Customer" — the U.S.-organized business entity that uses the Services, together with its Authorized Individuals.
• "Authorized Individual" — a natural person authorized to act on behalf of the User, including a beneficial owner, control person, authorized signatory, or authorized employee.
• "Beneficial Owner" — each natural person who, directly or indirectly, owns twenty-five percent (25%) or more of the equity interests of the User.
• "Control Person" — a single natural person with significant managerial control or authority over the User, such as a Chief Executive Officer, Chief Financial Officer, Managing Member, General Partner, President, Vice President, or Treasurer.‍
• "Program Account" — the account established for a business User to access the Services.

‍

3. Who Must Be Identified

The Services are available exclusively to businesses organized under the laws of the United States. Before a Program Account can be opened or used, Kashu must identify and verify:

• The business entity itself;
• Each Beneficial Owner;
• The Control Person; and
• Each Authorized Individual who will access or transact on the Services.

All Authorized Individuals must be at least twenty-one (21) years of age and must be authorized to act on behalf of the User.

‍

4. Information We Collect

4.1 Business Information

• Legal entity name, jurisdiction of formation, and date of formation;
• Employer Identification Number (EIN) and other applicable tax identifiers;
• Registered, operating, and mailing addresses (no P.O. boxes for primary addresses);
• Primary business activity, industry classification, and merchant category;
• Formation documents (e.g., articles of incorporation or organization, operating agreement, certificate of good standing);
• Linked bank account information and financial-institution identifiers;
• FinCEN Beneficial Ownership Information (BOI) report identifiers, where applicable.

4.2 Beneficial Owner and Control Person Information

• Full legal name;
• Date of birth;
• Residential address (no P.O. boxes);
• Social Security Number, Individual Taxpayer Identification Number (ITIN), or, for non-U.S. persons, passport number and country of issuance;
• Government-issued photo identification (e.g., U.S. driver's license, state ID, or passport);
• Beneficial-ownership percentage, role, title, and authority within the User.

4.3 Authorized Individual Information

• Full legal name;
• Date of birth;
• Email address and telephone number;
• Government-issued photo identification;
• Role, title, and authority within the User.

4.4 Biometric Information

In connection with identity verification, Kashu's identity-verification partner may collect biometric identifiers and biometric information, including facial geometry derived from a selfie image matched against a government-issued identification document. Collection and use of biometric information is subject to the Biometric Data Notice in the Kashu Privacy Policy.

‍

5. How We Verify

Kashu uses a combination of automated and manual methods to verify the information collected under Section 4, including:

• Verification of formation, registration, and good-standing status through Secretary of State records and other authoritative business registries;
• Cross-checking identifying information against government, credit-bureau, and third-party data sources;
• Document authenticity review of government-issued identification, including security-feature analysis;
• Biometric and liveness verification of natural persons through Kashu's identity-verification partner;
• Validation of linked bank account ownership;
• Verification of beneficial-ownership disclosures against the FinCEN BOI database, where applicable;
• Manual review and enhanced due diligence by Kashu's Compliance team for higher-risk profiles or transactions.

If verification cannot be completed, Kashu may request additional information or documentation, restrict or delay access to the Services, or decline to open the Program Account, as described in Section 8.

‍

6. Sanctions and Watchlist Screening

Kashu screens the User, each Beneficial Owner, the Control Person, each Authorized Individual, and linked counterparties against U.S. and international sanctions and watchlists, including:

• The U.S. Department of the Treasury Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list and Consolidated Sanctions list;
• U.S. Department of Commerce Bureau of Industry and Security (BIS) Denied Persons, Entity, and Unverified lists;
• U.S. Department of State debarred-parties lists;
• Politically Exposed Persons (PEP) and adverse-media screening;
• Card-network and partner-institution screening requirements.

Screening occurs at onboarding and on an ongoing basis. A match or potential match may result in account hold, restriction, declination, or termination, and may be reported to regulators and Kashu's partners as required by applicable law.

‍

7. Risk-Based Approach and Enhanced Due Diligence

Kashu applies a risk-based approach to identity verification and ongoing monitoring. Risk factors considered include, without limitation:

• Industry, NAICS, and business activity;
• Geographic factors, including the location of the business, its owners, and counterparties;
• Ownership structure, including the presence of foreign ownership, layered entities, or politically exposed persons;
• Transaction volume, size, frequency, and counterparty patterns;
• Funding sources and program-account activity patterns;
• Public-records, regulatory, and adverse-media findings.

Where elevated risk is identified, Kashu may apply Enhanced Due Diligence ("EDD"), including additional documentation requests, source-of-funds review, in-depth ownership-structure analysis, additional sanctions and adverse-media screening, and senior-Compliance approval prior to account activation or specific transactions.

‍

8. If We Cannot Verify

If Kashu cannot reasonably verify the identity of the User or any required individual, Kashu may:

• Decline to open the Program Account;
• Restrict, suspend, or terminate access to the Services;
• Instruct Kashu's partners to hold or freeze funds pending resolution;
• Refer the matter to internal review for potential filing of a Suspicious Activity Report (SAR) by Kashu's partners; and
• Notify regulators and partner institutions as required by applicable law.

Kashu does not provide reasons for adverse identification decisions in cases where doing so could compromise an ongoing investigation or violate confidentiality obligations imposed by law.

‍

9. Notice to Customers

Important information about procedures for opening a new Program Account: To help the government fight the funding of terrorism and money-laundering activities, federal law requires financial institutions to obtain, verify, and record information that identifies each person who opens an account. What this means for you: when you open a Program Account, we will ask for the business's name, address, taxpayer identification number, and other information that will allow us to identify the business. We will also ask for the name, address, date of birth, taxpayer identification or passport number, and other information that will allow us to identify each Beneficial Owner, the Control Person, and each Authorized Individual. We may also ask to see identifying documents.

‍

10. Ongoing Monitoring and Refresh

Identity verification does not end at account opening. Kashu conducts ongoing monitoring of identifying information, account activity, and partner-institution feedback. Kashu may request that the User update or re-verify information, in whole or in part, when:

• A government-issued identification document expires or appears invalid;
• Ownership, control-person, or material business information changes (which must be reported within ten (10) business days under the Acceptable Use Policy);
• Activity patterns or risk factors trigger Enhanced Due Diligence;
• Sanctions, watchlist, or adverse-media findings warrant additional review;
• Kashu's partners or applicable regulators require refreshed information.

‍

11. Recordkeeping

Kashu retains identifying information, descriptions of documents reviewed, and records of verification methods and outcomes for a minimum of five (5) years following closure of the Program Account, or for such longer period as required by applicable law, regulator direction, or partner-institution requirements. Records are stored using encryption in transit and at rest, role-based access controls, and other safeguards as further described in the Kashu Privacy Policy.

‍

12. Data Security and Privacy

Information collected under this CIP is used solely for identity verification, ongoing monitoring, regulatory compliance, and the operation of the Services. Kashu does not sell or share customer identification data for marketing purposes. Handling of personal information, biometric data, and Sensitive Personal Information is further described in the Kashu Privacy Policy.

‍

13. Reliance and Partner Coordination

Kashu performs the procedures described in this CIP in support of the customer-identification, customer-due-diligence, and anti-money-laundering obligations of Kashu's partners. Kashu's partners include the licensed money transmitter and custodial bank that hold customer funds, the acquirers and card payment providers that authorize and settle card transactions, the identity-verification provider, and other compliance vendors. Kashu shares verification information with these partners as necessary to satisfy regulatory and contractual obligations.

‍

14. Compliance and Oversight

Kashu's CIP is administered by the Compliance Department, under the oversight of a designated BSA Compliance Officer. The CIP is reviewed at least annually for consistency with applicable law, partner-institution requirements, and industry best practices. Kashu personnel with CIP responsibilities receive periodic training, and Kashu's compliance program is subject to independent testing in accordance with applicable BSA/AML requirements.

‍

15. Relationship to Other Policies

This CIP is incorporated by reference into the Kashu Terms of Service and is read together with the Kashu Software & Technology Services Agreement ("STSA"), the Acceptable Use Policy, the Privacy Policy, and the Refund Policy. In the event of any conflict between these documents, the order of precedence is: (1) STSA → (2) Terms of Service → (3) Acceptable Use Policy → (4) this CIP and the Refund Policy. All other policies and disclosures are subordinate to the above.

‍

16. Modifications

Kashu reserves the right to modify or update this CIP at any time to reflect changes in regulations, partner requirements, or internal processes. Non-material changes are effective upon posting. Material changes will be communicated through the Services or by email at least thirty (30) days before they take effect, unless a shorter period is required by law, regulator direction, or partner-institution requirements. Your continued use of the Services after the effective date constitutes acceptance of the modified CIP.

‍

17. Contact Information

For questions about this CIP, identity-verification status, or assistance completing verification, you may contact us as follows:

Kashu, Inc

Attn: Customer Support

1603 Capitol Ave, Ste 415 #674380

Cheyenne, WY 82001

Email: help@kashupay.com

‍

Last Updated: 5/11/2026 | Version 1.3

1. Introduction and Purpose

This Acceptable Use Policy ("Policy" or "AUP") sets forth the rules governing the use of the software, technology, data, and program-administration services provided by Kashu, Inc. ("Kashu," "we," "us," or "our"), a Wyoming corporation, through the Kashu platform, mobile and web applications, websites, APIs, and related services (collectively, the "Services"). The Services consist of three integrated pillars: Platform Access, Transaction Intelligence, and Program Administration, as further described in Kashu's Terms of Service.

This Policy is designed to ensure that all activity conducted through Kashu's systems complies with applicable laws, card-network rules, partner-institution requirements, and industry best practices, and to define the conduct expected of all users of the Services.

You are independently responsible for complying with all applicable federal, state, and local laws in all of your actions related to your use of the Services. You must also comply with this Policy, the Kashu Terms of Service, the Kashu Software & Technology Services Agreement ("STSA"), and any other agreement or disclosure presented to you in connection with the Services. Any violation of this Policy constitutes a violation of the Terms of Service and may result in suspension or termination of your program account.

‍

2. Scope and Application

This Policy applies to all users of the Services, including the business entity using the Services ("User" or "you") and all individuals authorized to access the Services on the entity's behalf, including beneficial owners, control persons, authorized signatories, and authorized employees ("Authorized Individuals").

The Services are made available exclusively to **businesses organized under the laws of the United States and operating in the United States**. Use of the Services from sanctioned jurisdictions, or by individuals or entities appearing on any U.S. government sanctions, denied-party, or politically-exposed-person list, is prohibited.

This Policy applies to all transactions processed, initiated, instructed, or received through Kashu's systems.

‍

3. Definitions

• "Services" — the Kashu platform, software, mobile and web applications, APIs, and related technology, data, and program-administration offerings.
• "Program Account" — the account established for a business User to access the Services. Funds associated with a Program Account are held in custodial FBO accounts at Fresno First Bank by Monarch Technologies, Inc., not by Kashu.
• "Authorized Individuals" — the natural persons authorized to act on behalf of the User, including beneficial owners, control persons, authorized signatories, and authorized employees.
• "Material Change" — any change to KYB information that would, if known at onboarding, have materially affected Kashu's eligibility, risk, or compliance determination, including changes in entity name, structure, jurisdiction, beneficial ownership of 25% or more, control persons, primary business activity, registered or operating address, or linked bank account.‍
• "Business Day" — a day, other than a Saturday, Sunday, or U.S. federal holiday, on which commercial banks in the United States are open for business.

4. Custody and Fund Control

Kashu has no legal, beneficial, or equitable interest in customer funds at any time. Funds associated with a Program Account are held by Monarch Technologies, Inc. (MSB Registration No. 31000186536125; NMLS ID 1908316) in custodial For-Benefit-Of ("FBO") accounts at Fresno First Bank, Member FDIC.

Kashu's enforcement authority under this Policy is limited to (a) suspending or terminating access to the Services; and (b) instructing Monarch and the underlying financial institutions to initiate, hold, freeze, or release funds in accordance with this Policy, applicable law, lawful third-party requests, and the rules of the underlying financial institutions. Kashu does not hold, transfer, or release funds directly.

‍

5. Permitted Uses

The Services may be used to:

• Operate the financial activities of a U.S.-organized business entity in good standing;
• Fund the Program Account using authorized, lawfully-obtained credit, debit, or bank accounts held in the User's legal name;
• Initiate transfers from the Program Account to verified bank accounts owned by the User or by KYB-verified counterparties of the User in connection with bona fide business activity;
• Access reporting, analytics, transaction-level data enrichment, and program-administration features provided by the Services;
• Conduct legitimate business-to-business commercial activity consistent with the User's declared line of business and KYB profile.

Any use that exceeds the scope of this Section, or that falls within Sections 6 or 7 without the required pre-approval, is a violation of this Policy.

‍

6. Prohibited Activities

You may not use the Services for any activity that violates any law, statute, ordinance, regulation, card-network rule, or partner-institution requirement. Without limitation, the following activities are prohibited.

6.1 Illegal or Restricted Products and Services

• Narcotics, steroids, controlled substances, or products presenting consumer-safety risk
• Drug paraphernalia
• Cannabis, CBD, hemp, and hemp-derived products (federally restricted regardless of state legality)
• Cigarettes, tobacco, e-cigarettes, vaping products, and related supplies where restricted by law
• Stolen goods, including digital goods, virtual assets, or access credentials
• Content promoting hate, violence, racial or other discriminatory intolerance, or financial exploitation of a crime
• Obscene, indecent, or sexually explicit content or services, including adult content, cam, escort, and adult-entertainment platforms
• Materials infringing copyright, trademark, right of publicity, right of privacy, or other proprietary rights
• Ammunition, firearms, firearm parts, accessories, or regulated weapons
• Unlawful high-yield investment programs, unregistered securities, or unregistered debt instruments
• Content or items that encourage, promote, or instruct others to engage in illegal activity

6.2 Fraud, Misrepresentation, and Unfair Practices

• Misrepresenting the nature of your business, products, services, or counterparties
• Falsifying or omitting material information to Kashu, its partners, or regulators
• Pyramid schemes, Ponzi schemes, matrix programs, "get-rich-quick" schemes, and recruitment-based multi-level marketing
• Fake, altered, stolen, or synthetic identities, accounts, or payment instruments
• Circumventing Kashu's KYB, KYC, AML, sanctions-screening, fraud-detection, or transaction-monitoring controls
• Impersonating Kashu, its partners, or any other entity
• Operating shell companies, nominee entities, or entities lacking bona fide business operations

6.3 Financial and Regulatory Evasion

• Unlicensed money transmission, money services business, or remittance activity
• Operating as a payment service provider, third-party payment processor, payment facilitator, or payment aggregator
• Currency exchange, check cashing, or off-shore banking services
• Cryptocurrency or digital-asset exchanges, mixers, tumblers, custodial wallets, ATMs, mining-as-a-service, and NFT marketplaces
• Initial Coin Offerings, token sales, or unregistered digital-asset offerings
• Debt-elimination, debt-consolidation, credit-repair, payday-lending, and title-lending services
• Transactions designed to finance or refinance debts funded by a credit card
• Corruption, bribery, kickbacks, or political-influence payments
• Violation of U.S. economic sanctions, or transactions involving any party listed by OFAC or any other restricted-party list
• Tax evasion or concealment of financial activity

6.4 Unsafe or Unregulated Commerce

• Sale of products or services before the seller has lawful possession or control
• Activity violating consumer-protection, data-protection, or lending laws
• Sale of counterfeit or "grey market" goods
• Activity associated with products identified by regulators as fraudulent or high-risk
• Facilitating transactions for merchants engaged in illegal or prohibited activity through third-party processors
• Pseudo-pharmaceuticals or nutraceuticals making unsubstantiated medical claims

6.5 Transaction Pattern Restrictions

Independent of the underlying activity, the following transaction patterns are prohibited because they undermine the integrity of the Services, AML controls, or card-network rules:

• Structuring transactions to evade reporting, monitoring, or regulatory thresholds
• Funneling business activity unrelated to your declared line of business through the Program Account
• Transaction laundering, miscoding, or misrepresenting the nature of underlying activity to Kashu, card networks, or acquirers
• Aggregating or factoring — accepting funds or initiating transfers on behalf of unrelated third parties
• Splitting a transaction to avoid program limits, network thresholds, or compliance controls
• Circular, wash, or self-dealing transactions intended to inflate volume or generate artificial activity
• Velocity gaming — rapid in/out movement of funds without commensurate underlying business purpose

‍

7. Activities Requiring Pre-Approval

Certain activities may be permitted only with Kashu's prior written approval and may require enhanced underwriting, documentation, licensing verification, or partner-institution consent. You must obtain Kashu's written consent before using the Services in connection with the following categories (examples are illustrative, not exhaustive):

• Transportation — airlines, air charter services, air taxi, scheduled or non-scheduled passenger transport, and marine charter.
• Charitable / Non-Profit — accepting donations as a registered charity or nonprofit organization.
• High-Value Goods — dealers in jewels, precious metals, precious stones, coins, or bullion.
• Gambling, Gaming, and Contests — gambling, betting, lotteries, sweepstakes, fantasy sports, or other prize-based activities, even where lawful.
• Prescription and Medical — sale or fulfillment of prescription products, medical devices, procedures, treatments, telehealth, or medical tourism.
• Dating and Relationship Services — dating, matchmaking, or platforms facilitating personal or romantic relationships.
• Live Streaming and Broadcasting — platforms or services involving user-generated live video, audio, or interactive content.
• File Sharing and Data Storage — cyberlockers, remote file sharing, or storage platforms allowing public upload or download.
• Alcohol — sale, distribution, or fulfillment of alcoholic beverages.
• Marketplaces and Aggregators — e-commerce platforms enabling third-party sellers to list or sell products or services.
• Cross-Border Transfers — international wire transfers or cross-border remittances.
• High-Ticket Subscriptions — subscription services with annual commitments exceeding $5,000.
• Coaching and Information Products — coaching, mentorship, or information-product businesses, particularly those offering refund or guarantee terms.
• Travel and Tourism — travel agencies, tour operators, vacation rentals, and timeshare programs.
• Auctions and Consignment — auction houses, consignment shops, and similar resale platforms.
• Government and Public Sector — government contracting, public-sector procurement, and politically-exposed-person related activity.

Failure to obtain Kashu's prior written approval before engaging in any of the foregoing activities through the Services constitutes a violation of this Policy.

‍

8. User Responsibilities

You agree to:

• Use the Services only for lawful, bona fide business purposes consistent with Section 5;
• Provide true, accurate, complete, and current information during onboarding, KYB, KYC, and transaction activity;
• Comply with all applicable laws and rules, including the Bank Secrecy Act, the USA PATRIOT Act, OFAC regulations, the FCPA, applicable state money-transmission and consumer-protection laws, and Visa, Mastercard, and other applicable card-network rules;
• Maintain appropriate books, records, and supporting documentation for all transactions;
• Cooperate with Kashu's periodic re-verification, enhanced due diligence, and information requests;
• Restrict access to the Services to Authorized Individuals and safeguard account credentials;
• Not engage in any activity that could damage, disable, overburden, or interfere with the Services, Kashu's infrastructure, or Kashu's reputation.

‍

9. Business Information Accuracy and KYB Update Obligation

You certify that all KYB and Program-Account information you provide is accurate, complete, and current as of the date submitted. You agree to notify Kashu in writing within ten (10) Business Days of any Material Change, including but not limited to:

• Change in legal entity name, structure, or jurisdiction;
• Change in beneficial ownership of twenty-five percent (25%) or more;
• Change in control persons or authorized signatories;
• Change in primary business activity or industry classification;
• Change in registered or operating address;
• Change in linked bank account or financial-institution relationships;
• Receipt of any subpoena, regulatory inquiry, enforcement action, or material litigation affecting the entity, its owners, or control persons.

Failure to maintain accurate KYB information may result in suspension or termination of the Program Account and reporting to applicable regulators and partner institutions.

‍

10. Monitering, Compliance, and Enforcement

Kashu actively monitors activity on the Services for suspicious, prohibited, or non-compliant conduct. Kashu may, in its discretion and without prior notice:

• Suspend, restrict, or terminate your access to the Services;
• Instruct Monarch and the underlying financial institutions to freeze, hold, or release funds in the Program Account pending review or resolution;
• Request additional information, including invoices, identification, source-of-funds documentation, beneficial-ownership records, or other business documentation;
• Reverse, decline, or refuse to process any transaction;
• Report activity to law enforcement, regulators, card networks, acquirers, and partner financial institutions.

Kashu does not hold or control funds and cannot release, transfer, or distribute funds directly. All fund-movement actions described in this Section are effected by instruction to Monarch and the underlying institutions in accordance with their rules and applicable law.

‍

11. Suspension, Termination, and Appeals

Kashu reserves the right to suspend or terminate access to the Services at any time, with or without notice, for any reason permitted under this Policy, the Terms of Service, the STSA, applicable law, or partner-institution direction.

Appeals. If your Program Account is suspended or terminated, you may submit a written appeal within ten (10) Business Days of the suspension or termination notice to legal@kashupay.com. An appeal must include (a) the Program Account identifier; (b) a clear factual rebuttal addressing the basis for the action; (c) supporting documentation; and (d) the contact information of the Authorized Individual submitting the appeal. Kashu will acknowledge receipt of the appeal within five (5) Business Days and will issue a written determination within thirty (30) Business Days. Kashu's determination on appeal is final.

Suspension or termination does not relieve you of any obligations or liabilities accrued prior to such action. Funds held by Monarch in the Program Account remain subject to applicable laws, partner-institution rules, and any holds or freezes instructed by Kashu, by Monarch, or by lawful third-party request.

‍

12. Reporting Violations

Users, partners, and third parties may report suspected violations of this Policy by contacting:

Email: legal@kashupay.com

If you are uncertain whether your intended use of the Services complies with this Policy, you should contact Kashu's Compliance team for written clarification before engaging in the activity.

‍

13. Disclosure to Third Parties

You acknowledge and agree that Kashu may disclose information regarding suspected or actual violations of this Policy, including the identity of the User and Authorized Individuals, account activity, transaction records, and supporting documentation, to Monarch Technologies, Fresno First Bank, SoftPoint, card networks, acquirers, regulators, law-enforcement authorities, courts, and other parties as necessary to investigate, enforce, or comply with applicable law, partner-institution requirements, or this Policy.

‍

14. Enforcement Actions

Violations of this Policy may result in any combination of the following:

• Immediate suspension or permanent termination of the Program Account;
• Instructions to Monarch to freeze, hold, or release funds in the Program Account;
• Disclosure to and investigation by partner financial institutions, card networks, regulators, and law enforcement;
• Civil or criminal legal action;
• Recovery of losses, damages, fines, penalties, chargebacks, and reasonable attorneys' fees caused by your conduct;
• Placement on internal or industry watch lists, including processor and acquirer terminated-merchant files where applicable.

‍

15. Relationships to Other Policies

This Policy forms part of, and is incorporated by reference into, the Kashu Terms of Service and the Kashu Software & Technology Services Agreement ("STSA"), and is read together with the Privacy Policy and any other published Kashu compliance documents. In the event of any conflict between these documents, the order of precedence is: (1) STSA → (2) Terms of Service → (3) this Policy. All other policies and disclosures are subordinate to the above.

‍

16. Modifications

Kashu reserves the right to amend or update this Policy at any time. Non-material changes are effective upon posting. Material changes will be communicated through the Services or by email at least thirty (30) days before they take effect, unless a shorter period is required by law, regulator direction, or partner-institution requirements. Your continued use of the Services after the effective date constitutes acceptance of the modified Policy.

‍

17. Contact Information

Questions regarding this Policy or its application may be directed to:

Kashu, Inc

Attn: Legal Department

1603 Capitol Ave, Ste 415 #674380

Cheyenne, WY 82001

Email: legal@kashupay.com

Last Updated: 5/11/2026 | Version 2.0

Kashu, Inc. ("Kashu") is a software platform that supports business financial operations on top of regulated payment and banking rails operated by Kashu's partners. The Services are made available exclusively to U.S.-organized businesses, and consist of three integrated pillars: Platform Access, Transaction Intelligence, and Program Administration, as further described in the Kashu Terms of Service.

As part of the Program Administration pillar, Kashu maintains an Anti-Money Laundering ("AML") and Bank Secrecy Act ("BSA") compliance program that supports the customer-identification, customer-due-diligence, sanctions-screening, and suspicious-activity-detection obligations of Kashu's partners under the Bank Secrecy Act, the USA PATRIOT Act, FinCEN regulations including the Customer Due Diligence Rule (31 CFR 1010.230), the Corporate Transparency Act and its Beneficial Ownership Information rule, OFAC sanctions programs, and applicable state law.

This Statement is a customer-facing summary of Kashu's AML program. It does not modify, replace, or limit Kashu's internal compliance procedures or the regulatory obligations of Kashu's partners.

‍

1. Program Governance

Kashu's AML program is administered by a designated BSA Compliance Officer who reports directly to senior management and to the Board of Directors or its equivalent. The BSA Compliance Officer oversees daily operations of the program, coordinates with Kashu's partners on referrals and reporting, manages training and policy maintenance, and monitors regulatory developments.

‍

2. Customer Identification and Verification (KYB and KYC)

Before a Program Account can be activated, Kashu verifies the identity of the business entity (Know Your Business, "KYB"), each Beneficial Owner of 25% or more, the Control Person, and each Authorized Individual who will access the Services (Know Your Customer, "KYC"). Verification data may include formation documents, Employer Identification Number, registered and operating addresses, beneficial-ownership disclosures, government-issued identification, and biometric identity verification.

Kashu's procedures align with the Customer Identification Program requirements that apply to its partners, and are further described in the Kashu Customer Identification Program. Biometric identity verification is handled in accordance with the Biometric Data Notice in the Kashu Privacy Policy.

‍

3. Customer Due Diligence and Ongoing Monitoring

Kashu applies a risk-based approach to customer due diligence:

• Business users are risk-rated at onboarding and reviewed periodically.
• Higher-risk customers are subject to Enhanced Due Diligence ("EDD") procedures.
• Transactions and account activity are monitored on an ongoing basis using automated tools that detect unusual activity, velocity patterns, structuring behavior, and inconsistencies with the User's declared business profile.
• Accounts exhibiting suspicious or inconsistent activity are escalated for manual review.

Risk factors evaluated for EDD include, without limitation:

• Industry, merchant category, and business activity;
• Geographic factors, including the location of the business, its owners, and counterparties;
• Ownership structure, including foreign ownership, layered entities, or politically exposed persons;
• Transaction volume, size, frequency, and counterparty patterns; and
• Public-records, regulatory, and adverse-media findings.

‍

4. Sanctions and Watchlist Screening

The User entity, each Beneficial Owner, the Control Person, each Authorized Individual, and linked counterparties are screened against U.S. and international sanctions and watchlists, including:

• U.S. Department of the Treasury Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) and Consolidated Sanctions lists;
• U.S. Department of Commerce Bureau of Industry and Security (BIS) Denied Persons, Entity, and Unverified lists;
• U.S. Department of State debarred-parties lists;
• Politically Exposed Persons (PEP) and adverse-media databases; and
• Card-network and partner-institution screening requirements.

Screening occurs at onboarding and on an ongoing basis. A match or potential match may result in account hold, restriction, declination, or termination, and may be reported to Kashu's partners and to regulators as required by applicable law.

‍

5. Suspicious Activity Reporting (SAR)

When suspicious activity is detected, Kashu's Compliance team conducts an internal review and escalates findings to Kashu's partners — including Monarch Technologies, Inc., the licensed money transmitter (MSB Registration No. 31000186536125; NMLS ID 1908316) — for the filing of Suspicious Activity Reports with FinCEN in accordance with applicable thresholds and timing requirements. Kashu may also notify law enforcement or regulatory authorities where permitted, and cooperates fully with official investigations and subpoenas.

Federal law prohibits disclosure of the existence or content of a SAR. Kashu and its personnel comply with all confidentiality and non-disclosure requirements applicable to suspicious activity reporting.

‍

6. Training and Awareness

All employees receive AML and sanctions compliance training upon hire and at least annually thereafter. Training covers BSA/AML fundamentals, recognizing red flags, sanctions screening, data privacy obligations, escalation procedures, and SAR confidentiality. Personnel with compliance responsibilities receive role-specific training and are subject to competency assessments.

‍

7. Recordkeeping

Kashu maintains records of customer identification data, verification methods and outcomes, transaction history, sanctions-screening results, and compliance reviews for a minimum of five (5) years following closure of the Program Account, or for such longer period as required by applicable law, regulator direction, or partner-institution requirements. Records are stored using encryption in transit and at rest, role-based access controls, and other safeguards described in the Kashu Privacy Policy.

‍

8. Independent Review

Kashu's AML program is subject to periodic independent audits and risk assessments to verify its design and operational effectiveness. Findings are reviewed by the BSA Compliance Officer and senior management, and corrective actions are tracked to completion in accordance with applicable BSA/AML expectations.

‍

9. Commitment to Integrity

Kashu is committed to upholding the highest standards of ethics, transparency, and regulatory compliance. Our objective is to provide U.S. businesses with modern business financial-operations tooling, while ensuring that the Kashu platform and the infrastructure of Kashu's partners are never used to facilitate money laundering, terrorist financing, sanctions evasion, fraud, or other illicit financial activity.

‍

10. Relationship to Other Policies

This Statement should be read together with the Kashu Customer Identification Program, Acceptable Use Policy, Privacy Policy, Terms of Service, Refund Policy, and Software & Technology Services Agreement (STSA). In the event of any conflict between this customer-facing summary and Kashu's internal compliance procedures, the internal procedures — administered by the Compliance Department under the oversight of the designated BSA Compliance Officer — shall control with respect to BSA/AML matters.

‍

11. Contact

For questions regarding this Statement or to report suspicious activity, please contact us as follows:

Kashu, Inc.

Attn: BSA/AML Compliance — Legal Department

1603 Capitol Ave, Ste 415 #674380

Cheyenne, WY 82001

Email: legal@kashupay.com