AML / CFT Policy

Sage Advance Global Services Ltd (“Sage”, “the Company”) is committed to the highest standards of anti-money laundering (AML), counter-financing of terrorism (CFT), and counter-proliferation financing (CPF) compliance. This Policy governs the Company’s AML/CFT/CPF compliance programme (the “Programme”).

All directors, officers and employees are required to read, understand and comply with this Policy. We will not knowingly facilitate money laundering, terrorist financing, sanctions evasion, or proliferation financing, and we will report suspicious activity to Ghana’s Financial Intelligence Centre as required by law.

The Programme is designed to comply with, among others:

• Anti-Money Laundering Act, 2020 (Act 1044).
• Virtual Asset Service Providers Act, 2025 (Act 1154).
• SEC Guidelines for the Operation of the Securities Regulatory Sandbox, 2026.
• Guidance issued by the Financial Intelligence Centre (FIC).
• Financial Action Task Force (FATF) Recommendations as applicable to virtual asset service providers.
• Ghana’s National Risk Assessment findings and GIABA mutual evaluation reports.

This Policy applies to all Sage staff — directors, officers, employees, temporary staff, contractors and secondees — and to all virtual asset brokerage activities conducted by Sage in or from Ghana.

Board of Directors — sets the tone from the top, ensures the AMLCO has sufficient seniority and resources, approves material Policy updates, and receives at least annual AMLCO reports.

Senior management — allocates resources to the Programme and enforces compliance across the business.

AML Compliance Officer (AMLCO) / MLRO — owns day-to-day operation of the Programme, files STRs with the FIC, reviews screening matches, and reports to the Board.

All employees — apply the Programme in their day-to-day work, escalate red flags to the AMLCO, complete mandatory training, and do not tip off clients.

Sage maintains a documented ML/TF/PF risk assessment covering client, product, geography and delivery-channel risk. The assessment is reviewed at least annually and whenever there is a material change to Sage’s business, products, client base or regulatory environment. Findings drive our client risk-rating model and CDD standards.

Sage performs risk-based CDD on every client before establishing a business relationship. Standard CDD includes:

• collecting government-issued ID and biometric liveness verification;
• verifying residential or registered address;
• identifying beneficial owners holding 10% or more of a corporate client;
• screening against sanctions, PEP and adverse-media databases; and
• establishing source of funds and, where appropriate, source of wealth.

Where a client refuses to provide required information, or where information cannot be verified to Sage’s satisfaction, we do not open the account and consider whether an STR is required. Ongoing due diligence continues throughout the relationship.

EDD applies where risk is elevated, including where:

• the client or a related party is a Politically Exposed Person (PEP), or an immediate family member or close associate;
• the client is connected to a higher-risk jurisdiction;
• expected volumes or transaction patterns are inconsistent with the client’s stated profile; or
• screening or monitoring produces a true-positive alert.

EDD measures include additional verification, senior-management approval of the relationship, closer scrutiny of source of wealth, and enhanced ongoing monitoring.

Sage screens all clients, beneficial owners and connected parties against international and Ghanaian sanctions lists, PEP databases and adverse-media sources at onboarding, on an ongoing basis, and whenever list updates occur. All alerts are reviewed and documented by the AMLCO. Pending transactions are suspended until an alert is resolved.

Sage monitors all transactions on the Platform against a suite of rules calibrated to the risk assessment. Blockchain wallet screening is performed at deposit and withdrawal using an approved analytics provider. Red flags — unusual urgency, indifference to pricing, transaction structuring, high-risk wallet exposure, mismatched origin/destination — are escalated for review.

Where Sage forms a suspicion that funds, assets or a transaction may be related to money laundering, terrorist financing or proliferation financing, the AMLCO files an STR with the FIC as soon as reasonably practicable. STRs are strictly confidential. Sage and its staff are protected under statutory safe-harbour provisions when reporting in good faith, and are prohibited from tipping off the client or any third party about an investigation or filing.

Sage complies with the FATF Travel Rule as applied under Act 1154. On qualifying virtual asset transfers, originator and beneficiary information — including name, wallet address, and identifying detail such as physical address, national identity number, customer identifier, or date and place of birth — is collected and transmitted with the transfer, subject to data-protection safeguards.

Sage will not transact with counterpart VASPs that cannot meet the Travel Rule’s minimum information standard, or that operate from Prohibited Jurisdictions.

Sage does not onboard or transact with:

• persons or entities on any applicable sanctions list (UN, EU, UK, US OFAC, Ghanaian);
• persons resident in, or entities incorporated in, jurisdictions that are FATF-blacklisted or subject to comprehensive sanctions;
• unlicensed money service businesses, unlicensed VASPs, or shell entities;
• persons or entities engaged in illegal gambling, weapons trading, human trafficking or other predicate offences; and
• anonymous or numbered accounts.

All staff complete mandatory AML/CFT/CPF training on joining Sage and at least annually thereafter. Training is role-relevant and includes red-flag typologies, sanctions and PEP handling, Travel Rule obligations, STR procedures, and case studies from crypto-related enforcement actions. Records of attendance and assessment are kept.

Sage keeps CDD records, transaction records, screening results, internal reports and STR documentation for at least five years after the end of the client relationship or the date of the transaction, whichever is later, in accordance with Act 1044.

The Programme is subject to periodic independent review — internal audit or a suitably qualified external reviewer — to test the design and effectiveness of controls. Findings and remediation actions are reported to the Board.

Tipping off a client or third party that an STR has been filed, or that an investigation is underway, is prohibited and may be a criminal offence. Staff who report concerns in good faith through the whistleblowing channel are protected from dismissal, demotion, harassment or any other adverse treatment.

Concerns about financial crime or the operation of the Programme can be raised confidentially with the AML Compliance Officer at info@thesageglobal.com. Regulatory contact details: FIC — info@fic.gov.gh; SEC VASP Supervision — vasp@sec.gov.gh.