Anti-Money Laundering and Counter-Terrorism Financing Policy

How SwapEazi prevents its platform being used to launder money or to finance terrorism, and how that work divides between SwapEazi and the licensed partners who perform the regulated steps in a payment.

1. Purpose and scope

SwapEazi (Pty) Ltd ("SwapEazi") operates a software platform that businesses in Southern Africa use to arrange, authorise, track and reconcile payments to suppliers in South Africa. This policy sets out how we prevent that platform being used to launder money or to finance terrorism.

It applies to every business that uses the platform, every payment arranged through it, every person who works on it, and every third party we rely on to perform part of a payment.

The policy is written for two readers. The first is a colleague who needs to know what to do. The second is a licensed partner, a bank or a regulator who needs to know what we do before they will work with us.

1.1 Current operating status

As at the effective date of this version, no corridor is carrying customer payments. The platform is built and has been tested end to end, and it is opening to first users. Corridors are described throughout this policy in the present tense because the controls apply from the first payment, not from some later date.

This is stated plainly for a reason. A partner assessing us should know that the control environment described here is in place ahead of volume rather than retro-fitted to it, and should not infer an operating history that does not yet exist. Where this policy says what we do, it means what the platform is built to do and what we are committed to doing from the first payment onward.

A pay-in partner for the collection leg is not yet contracted. Until one is, no corridor requiring that leg can carry a payment, and none is offered as available.

2. Our role and the role of licensed partners

SwapEazi provides software. It is not a bank, a payment institution, a money transmitter, an authorised dealer or a foreign exchange provider, and it does not take custody of customer funds at any point in a payment.

The regulated steps in a payment are collecting funds from the buyer, converting currency, and paying the beneficiary. Each of those steps is performed by a licensed financial partner in the market where the step takes place. Regulatory responsibility for a regulated step sits with the partner that performs it. Those partners run their own anti-money-laundering programmes and are supervised by their own regulators.

That division does not reduce what we do. We carry out the checks set out in this policy on our own account, because a licensed partner will decline a payment we should have stopped first, and because knowing who our customers are and what they are paying for is the only way the platform is worth using.

Where a partner requires information about a customer or a payment in order to meet its own obligations, we provide it. Where our checks and a partner's checks reach different conclusions, the stricter conclusion applies.

SwapEazi's position is that it provides software and does not itself perform a regulated financial service. Its intention is to register with the Financial Intelligence Centre and to meet the obligations that follow from that registration, and to rely on licensed partners for every regulated step in a payment rather than to hold a licence of its own for those steps.

3. Applicable frameworks

This policy is informed by the following:

• The Financial Action Task Force (FATF) Recommendations, and in particular the risk-based approach, customer due diligence, beneficial ownership, wire transfer and record keeping recommendations
• South Africa: the Financial Intelligence Centre Act 38 of 2001 (FICA), the Money Laundering and Terrorist Financing Control Regulations, and the Financial Intelligence Centre's directives and guidance notes
• South Africa: the Protection of Constitutional Democracy against Terrorist and Related Activities Act 33 of 2004 (POCDATARA) and the Prevention of Organised Crime Act 121 of 1998 (POCA)
• South African Reserve Bank exchange control rules applying to cross-border commercial payments
• The anti-money-laundering and counter-terrorism financing law of each corridor market in scope, in both directions: Zambia, Zimbabwe, Botswana, Malawi, Mozambique, Namibia, Lesotho and Eswatini
• The compliance requirements of each licensed partner that performs a regulated step in a payment

Where the law of a corridor market and South African law both apply to a payment, we meet both. Where they conflict, we escalate rather than choose.

4. Customer acceptance and know your business

SwapEazi accepts businesses. It does not accept individuals paying in a personal capacity, and it is not available for personal or family transfers.

4.1 What we collect before a business can pay

• Certificate of incorporation or equivalent registration document, and the registration number
• Registered address and principal place of business
• Proof that the business is trading, such as recent financial statements, a tax clearance certificate or a trade licence
• Identity documents for each director and each authorised signatory
• Proof of address for each director and each authorised signatory
• A bank account in the name of the business, in the country the business is registered in
• A description of the business, what it buys, and who it buys from

4.2 Risk rating

Every business is risk rated at onboarding. The rating takes account of the country it operates from, its sector, its ownership, the size and frequency of the payments it expects to make, and whether any party to it appears on a sanctions, politically exposed person or adverse media result.

A standard rating attracts the checks in this policy. A high rating attracts enhanced due diligence, which means senior approval before the first payment, more evidence of source of funds, and a shorter review cycle.

4.3 Who we will not take on

• A business we cannot identify, or whose beneficial owners we cannot establish
• A business that will not tell us what it buys or who it buys from
• A shell company with no demonstrable trading activity
• A business, owner or signatory subject to sanctions, or connected to a sanctioned party
• A business in a sector we do not serve, or in a jurisdiction subject to a FATF call for action
• A business that asks us to pay a party other than the supplier named on the invoice

We may decline a business without giving a reason, and we may stop acting for one at any time.

5. Beneficial ownership

We identify every natural person who ultimately owns or controls a customer business, directly or indirectly, at or above a 25 per cent holding, and every natural person who exercises effective control by other means.

Where ownership runs through another company, a trust or a partnership, we work through each layer until we reach natural persons. A corporate shareholder is not a beneficial owner and is not recorded as one.

Where no natural person meets the threshold, we record the senior managing official as the beneficial owner and note why.

We verify each beneficial owner's identity, and we screen each one under section 8. Beneficial ownership is confirmed with the customer at each periodic review, and the customer is required to tell us when it changes.

6. Source of funds and the business account rule

A payment is funded from a bank account in the name of the customer business, held in the country that business is registered in. We do not accept funds from a personal account, from a third party, or from an account in a country unconnected to the customer.

This one rule removes most of the risk in a trade payment. A supplier payment funded from a business account by a business we have identified, to a supplier we have verified, against an invoice we have seen, is a payment with a traceable origin and a documented purpose.

We ask for evidence of source of funds where the payment is large relative to what the business told us to expect, where the funding pattern changes, where the business is high risk, or where the money appears to have arrived shortly before the payment with no trading explanation.

Evidence may include bank statements, audited financial statements, a loan or facility agreement, or documentation of the sale that generated the funds. We do not proceed on an assurance alone.

7. Underlying trade documentation

Every payment must correspond to a real purchase of goods or services. We require the commercial invoice, and we check it against the payment.

• The invoice names the customer as the buyer
• The invoice names the supplier as the seller, and the beneficiary account belongs to that supplier
• The amount paid matches the invoice, or the difference is explained
• The goods or services described are consistent with what the customer told us it buys
• Supporting documents, such as a purchase order, proforma invoice, bill of lading, packing list or customs declaration, are requested where the payment or the customer warrants it

Trade-based money laundering works by misdescribing goods, misstating quantity or misstating price. We look for invoices that do not match the trade the customer described, prices that do not match the goods, repeat invoices for the same shipment, and round-sum invoices without detail.

A payment without an invoice we accept is not made. We do not finance trade, we do not lend against an invoice, and we do not advance funds ahead of settlement.

8. Sanctions screening, PEP screening and adverse media

We screen the customer business, its directors, its authorised signatories, its beneficial owners, the supplier, and the beneficiary account holder.

8.1 Lists

• United Nations Security Council Consolidated List
• South Africa: the Targeted Financial Sanctions list maintained under section 26A of FICA
• United States Office of Foreign Assets Control, including the Specially Designated Nationals list
• European Union Consolidated Financial Sanctions List
• United Kingdom HM Treasury Office of Financial Sanctions Implementation Consolidated List
• Sanctions and watchlists applying in each corridor market

8.2 Politically exposed persons

We screen for domestic and foreign politically exposed persons, for prominent officials of international organisations, and for their close associates and immediate family members. A politically exposed person is not refused for that reason alone. The relationship requires senior approval, enhanced due diligence on source of funds and source of wealth, and closer ongoing monitoring.

8.3 Adverse media

We check for credible reporting connecting a party to financial crime, corruption, sanctions evasion, terrorism or organised crime. An adverse media result is assessed on its substance and its source. It is recorded whether or not it changes the decision.

8.4 When we screen, and what a match does

Screening runs at onboarding, when a new supplier or beneficiary account is added, before each payment, and when a list changes. A potential match suspends the payment immediately. No payment proceeds while a match is open. A false positive is cleared and recorded with the reason. A confirmed match is escalated under section 10, the payment is not made, and the funds are not returned until we have taken advice on whether returning them is lawful.

9. Ongoing monitoring and rescreening

We monitor payments against what we know about the customer. The pattern we expect is recorded at onboarding, and monitoring looks for departures from it.

• Payment values or frequency well outside the profile the customer gave us
• Payments split to sit below a threshold
• A sudden change in the supplier base, or a new supplier taking a large share of volume
• A change of beneficiary banking details on an existing supplier
• Payments to a country unconnected to the customer's stated trade
• Funds arriving and being paid out immediately with no trading explanation
• A pattern of cancelled or reversed payments

Customer records are reviewed on a cycle set by risk rating. A review is also triggered by a change in ownership, a change in the business, an adverse screening result, or an escalation.

All parties are rescreened when a sanctions list is updated, not only at the next scheduled review.

10. Escalation and internal reporting

Anyone at SwapEazi who sees something that does not look right escalates it. There is no threshold to clear first and no requirement to be certain.

An escalation goes to the compliance function, which holds the payment, gathers the facts, records the decision and its reasons, and decides whether the matter must be reported to the authorities under section 11.

A payment under escalation is not released until the escalation is closed. The person who raised it is not required to justify raising it, and is protected from any adverse consequence for having done so.

We do not tell a customer that they are the subject of an escalation or a report to the authorities. Doing so is a criminal offence.

The compliance function is held by Msingathi Majola, director.

11. Reporting to the authorities

Where there is a suspicion that funds are the proceeds of unlawful activity, or that a payment relates to terrorist financing, a report is made to the South African Financial Intelligence Centre. Reports are made within the period the law allows, and in the form the Centre requires.

Where a party is found on a targeted financial sanctions list, the property is frozen and reported as the law requires, and no payment is made.

Where a corridor market requires a report to its own financial intelligence unit, that report is made as well.

Reports made, and decisions not to report, are both recorded with reasons.

SwapEazi intends to register with the Financial Intelligence Centre and to report directly. Until that registration is complete, a reportable matter is escalated under section 10 and raised with the licensed partner performing the regulated step, which reports under its own registration.

12. Record keeping and retention

We keep, for at least five years from the end of the relationship or from the date of the payment, whichever is later:

• Customer identification and verification records, including beneficial ownership
• The risk rating and the reasoning behind it
• Every invoice and supporting trade document accepted for a payment
• A record of every payment: parties, amount, currency, rate applied, fees, dates and status
• Screening results, including cleared false positives and the reason for clearing them
• Escalations, the decisions taken and the reasoning
• Reports made to the authorities, and the decision record where a report was considered and not made
• Training records

Records are held so that a payment can be reconstructed end to end. Where an investigation or a legal requirement demands it, records are kept for longer. Personal information in these records is handled under our privacy policy.

13. Training

Everyone at SwapEazi completes anti-money-laundering and counter-terrorism financing training before they start work that touches a customer or a payment, and at least once a year after that.

Training covers this policy, the law behind it, how trade-based money laundering works, how to recognise the indicators in section 9, how to escalate, and the offence of tipping off. People in customer-facing and payment-operations roles receive training specific to those roles.

Training is recorded. Completion is a condition of continued access to customer and payment systems.

14. Policy owner, review cycle and version history

This policy is owned by Msingathi Majola, director, and approved by the board of SwapEazi (Pty) Ltd.

It is reviewed at least once a year, and sooner if the law changes, if we open a corridor in a new market, if we change licensed partner, or if an incident shows the policy is not working.

Version history

• Version 2.1, 16 August 2026. Adds section 1.1, current operating status, stating that no corridor is yet carrying customer payments and that a pay-in partner is not yet contracted. Corrects section 3, which described corridor markets as ones we operate from; they are markets in scope, in both directions. No control, threshold or responsibility in this policy is changed by this version.
• Version 2.0, 7 August 2026. Rewritten for business-to-business trade payments. Sets out the division of responsibility between SwapEazi and licensed partners, adds beneficial ownership, source of funds, the business account rule and underlying trade documentation, and removes the consumer identity-verification and crypto-asset provisions of version 1.0.
• Version 1.0, 1 June 2026. First published.

Questions about this policy, and requests for a copy for partner due diligence, go to the address below.

Contact

Questions or requests under this policy: hello@swapeazi.io