KYC / AML Policy

Effective Date: August 31, 2026 Last Updated: August 31, 2026 Operator: Songhai LLC (d/b/a SonghaiPay)

1. Purpose and Commitment

SonghaiPay exists to move money, goods, and generosity between the United States and Africa quickly, affordably, and honestly. That mission depends on trust, and trust depends on keeping criminal money out of the corridors we serve. This Know Your Customer and Anti-Money Laundering Policy ("KYC / AML Policy" or "this Policy") explains, in plain language, how we identify our customers, how we monitor activity, what we are required to report, and what we ask of you in return.

Songhai LLC, a Georgia limited liability company doing business as SonghaiPay ("SonghaiPay," "we," "us," "our"), is committed to preventing the use of its platform for money laundering, terrorist financing, sanctions evasion, fraud, human trafficking, corruption, and any other financial crime. We maintain a risk-based anti-money laundering and countering-the-financing-of-terrorism ("AML/CFT") compliance program that is designed to meet the standards of the Bank Secrecy Act ("BSA") as amended by the USA PATRIOT Act, the implementing regulations of the Financial Crimes Enforcement Network ("FinCEN") at 31 CFR Chapter X, the sanctions programs administered by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"), and the requirements imposed on us contractually and operationally by our licensed partners.

SonghaiPay is a technology and program-management platform. We are not a bank, we do not accept deposits, and we do not ourselves hold customer funds. Regulated money transmission and payout services are performed by licensed partners identified in Section 4. SonghaiPay does not itself hold a money transmitter licence. Our AML/CFT program operates as the first line of defence within a wider compliance chain that includes those licensed partners, each of which maintains its own independent AML program and each of which may apply requirements that are stricter than ours.

Two commitments frame everything that follows. First, we will collect only the information we need to verify who you are and to satisfy our legal obligations, we will protect it, and we will not sell it. Second, where the law requires us to report activity or to freeze funds, we will comply — and in the specific case of a Suspicious Activity Report, federal law prohibits us from telling you or anyone else that a report has been filed. That prohibition is described in Section 12.2 and it is not negotiable.

This Policy should be read together with our Terms of Service, Privacy Policy, and Refund Policy. The current version of this Policy is always published at https://songhaipay.com/kyc-aml.

1.1 What this Policy is and is not

This Policy is a public-facing statement of principle and practice. It is deliberately not an internal operating manual. We do not publish our monitoring thresholds, our scenario rules, our risk-scoring weights, our alert-triage procedures, or the details of our investigative methods, because disclosing that information would help the very people the program is designed to stop. The absence of a specific number or method in this Policy should never be read as the absence of a control.

Nothing in this Policy constitutes legal, tax, or regulatory advice, and nothing in it creates rights beyond those provided by applicable law.

2. Scope

2.1 Services covered

This Policy applies to every product and service offered under the SonghaiPay brand, without exception:

1. Money transfers — remittances from the United States to twelve or more African countries, including Nigeria, Ghana, Kenya, and Senegal, with payout to mobile money wallets, bank accounts, or cash pickup.
2. Donations and charitable giving — contributions to verified causes in emergency relief, education, healthcare, and community development, whether added to a transfer or made on their own, as described at https://songhaipay.com/donate.
3. Shop & Send — purchase of goods in the United States for delivery to a recipient in Africa.
4. Airtime and data top-ups — instant carrier recharge to supported African mobile numbers.
5. The SonghaiPay wallet — a stored-value balance used to fund top-ups and transfers. Wallet balances are held with licensed partners and not by Songhai LLC. They are not FDIC-insured deposits and they earn no interest.

2.2 Persons covered

This Policy applies to all customers, senders, recipients, beneficiaries, donors, payout counterparties, and prospective customers, whether they use our website, our mobile applications, or any other channel we make available.

It applies equally to all SonghaiPay personnel: every employee, officer, and member of management, and every contractor, temporary worker, consultant, introducer, referral partner, and agent acting for or on behalf of SonghaiPay. Compliance with this Policy is a condition of employment and a condition of every contract we sign. Personnel who fail to follow it face disciplinary action up to and including termination, contract termination, and referral to law enforcement where the conduct warrants it.

2.3 Geographic scope

Our program covers the U.S. side of every transaction and the information we pass to our payout partners for the Africa side. Local requirements in each payout market — central bank rules, financial intelligence unit reporting, and local identification standards — are met by our licensed partners in those markets, with our cooperation and, where we hold the relevant data, our data.

3. Regulatory Framework

SonghaiPay and its partners operate inside the framework summarised below. Where an obligation attaches to a licensed entity rather than to SonghaiPay, the table says so.

Where the requirements of two frameworks differ, we apply the stricter of the two.

4. Roles and Responsibilities of the Parties

Understanding who does what matters, because it determines who is legally accountable for each part of your transaction.

4.1 Songhai LLC as program manager

Songhai LLC operates the SonghaiPay brand, applications, and customer relationship. We design and run the customer experience, collect and verify identity information, screen customers and counterparties, monitor activity for suspicious patterns, escalate and investigate alerts, maintain records, train our people, and cooperate with our licensed partners and with law enforcement. Songhai LLC does not hold a money transmitter licence, is not a bank, and does not hold customer funds.

4.2 Stripe Payments Company (NMLS ID #1280479)

Payment processing for debit card, bank and ACH, and linked-account funding is provided by Stripe, Inc. and its affiliates. Stripe Payments Company is licensed for money transmission under NMLS ID #1280479 and is licensed and regulated as a money transmitter by state regulators including the New York State Department of Financial Services and the Georgia Department of Banking and Finance (Stripe licensing disclosures). Your use of the funding side of our service is also governed by the Stripe Services Agreement, the Stripe Consumer Terms, and the Stripe Privacy Policy.

Stripe applies its own minimum-age and legal-capacity requirements, its own sanctions and OFAC ineligibility rules, and its own prohibited and restricted business list. Stripe may verify your identity, request additional information, and suspend or decline activity where it believes the activity is unlawful, fraudulent, harmful, or presents an unacceptable level of risk. Stripe may collect and process identity documents and biometric identifiers derived from an identity document and a selfie for verification purposes, and applies AML/KYC, politically exposed person, and sanctions screening, together with export-control and high-risk-jurisdiction restrictions (Stripe Services Agreement).

4.3 Bridge Building Inc. (NMLS #2450917)

Bridge Building Inc., a Stripe company holding NMLS #2450917, holds money transmitter and virtual-currency licences in applicable U.S. states and provides money transmission and stablecoin settlement services for SonghaiPay transfers (Bridge U.S. licences and registrations). Bridge maintains its own BSA/AML program, sanctions screening, and reporting obligations.

4.4 Yellow Card Inc.

Payouts, local currency settlement, stablecoin on- and off-ramp, and mobile money and bank disbursement in Africa are provided by Yellow Card Inc. and its regional affiliates, including Yellow Card Financial South Africa (Yellow Card legal centre, Master Service Agreement, widget terms). Yellow Card holds operational licences and regulatory registrations across African markets and maintains jurisdiction-specific privacy policies for the EU, Nigeria, South Africa, and the United States, as well as a South Africa customer complaint policy (Yellow Card legal centre).

Yellow Card requires that a user be at least 18 years old, that the user satisfy Yellow Card's KYC/AML requirements, and that the user not be sanctioned by — or resident or a citizen of a country sanctioned by — the United States, the United Kingdom, or the European Union. Receiving accounts, whether mobile money, bank, or blockchain wallet, must be in the customer's own name and under the customer's sole control. Yellow Card may close an account without notice where fraud, money laundering, or terrorist financing is suspected or where a regulator or court so directs, and a customer may not close an account in order to avoid an investigation (Yellow Card Master Service Agreement).

4.5 Consequence for you

Because three regulated entities may touch a single transaction, you may be asked for information by SonghaiPay, and separately by a partner, and the answers must be consistent. A transaction that passes our checks may still be declined by a partner applying its own risk appetite, and we cannot override that decision.

5. The Five Pillars of Our AML Compliance Program

Our program is built on the five pillars that FinCEN requires of money services businesses and their program managers.

5.1 Designated Compliance Officer

Songhai LLC has appointed a qualified AML Compliance Officer with day-to-day responsibility for the design, implementation, and enforcement of this program. The Compliance Officer is a member of senior management, has direct access to the company's governing body, and has the authority and resources to carry out the role, including authority to block a transaction, freeze an account, escalate to a partner, and file or cause the filing of a report without needing commercial sign-off. Responsibilities include maintaining written policies, overseeing screening and monitoring systems, reviewing escalations, approving high-risk relationships, managing regulatory and law-enforcement correspondence, commissioning independent testing, and reporting on program health to management. The Compliance Officer can be reached at compliance@songhaipay.com.

5.2 Written Policies, Procedures, and Internal Controls

This Policy sits at the top of a documented control framework: internal standard operating procedures for onboarding, identity verification, screening disposition, alert triage, investigation, escalation, reporting, recordkeeping, and partner oversight. Controls include system-enforced verification gating before a customer can transact, automated screening at defined lifecycle points, risk-based transaction limits, dual review and maker-checker approval for sensitive decisions, segregation of duties between commercial and compliance functions, complete audit logging of compliance actions, and change control over rules and thresholds. Internal procedures are reviewed at least annually and whenever the law, our products, or our risk profile changes materially.

5.3 Ongoing Training

All personnel receive AML/CFT and sanctions training at onboarding and at least annually thereafter, with role-specific modules for customer support, operations, engineering, marketing, and partner management. Training covers what money laundering and terrorist financing look like in remittance and humanitarian corridors, red-flag recognition, sanctions basics, escalation duties, the no-tip-off rule, data protection, and the personal consequences of non-compliance. Completion is tracked and mandatory; unfinished training is escalated to management. Additional briefings are issued when a new typology, sanctions change, or regulatory development requires it. Training records are retained as described in Section 18.

5.4 Independent Testing and Audit

The program is independently tested at least annually, and more often where risk warrants, by a qualified party who is not involved in day-to-day compliance operations — either an internal function independent of the Compliance Officer or an external firm. Testing evaluates design and operating effectiveness across CIP, CDD and EDD, screening, monitoring, reporting, recordkeeping, training, and partner oversight, using transaction sampling and control walkthroughs. Findings are documented, rated, assigned an owner and a remediation deadline, reported to senior management, and tracked to closure. Test results are also made available to our licensed partners as part of their oversight of us.

5.5 Customer Due Diligence

The fifth pillar requires that we know who our customers are, understand the nature and purpose of their use of our services, maintain that understanding over time, and monitor for activity that does not fit it. Sections 6 through 8 set out how we do this.

6. Customer Identification Program

We operate a Customer Identification Program ("CIP") consistent with the standards established under Section 326 of the USA PATRIOT Act and 31 CFR Chapter X. No customer may send money, make a donation, place a Shop & Send order, purchase airtime, or fund a wallet before verification is complete.

6.1 Information we collect

At a minimum we collect, at account opening:

• full legal name;
• residential street address (a post office box alone is not sufficient);
• date of birth, which must show the customer is at least 18 years old;
• a government-issued identification number, which for U.S. persons is typically a Social Security number or Individual Taxpayer Identification Number and for non-U.S. persons is a passport number, alien identification number, or other government-issued number together with the country of issuance;
• verified email address and mobile telephone number;
• nationality or country of residence;
• occupation or source of income, and expected purpose and volume of activity.

For transfers we also collect recipient information: recipient full name, country, payout method, and the mobile money, bank, or wallet details required to complete the payout, plus the sender's stated relationship to the recipient.

6.2 Documents we accept

Acceptable identity documents include an unexpired U.S. or foreign passport, a U.S. state-issued driver's licence or identification card, a U.S. permanent resident card, an employment authorisation document, a consular identification card where permitted, and a national identity card issued by a government authority. Documents must be unexpired, legible, and complete, showing all four edges. Where address confirmation is required we accept a recent utility bill, bank or card statement, lease agreement, or government correspondence dated within the period we specify at the time of request.

6.3 Electronic and documentary verification

We verify identity by non-documentary electronic means wherever possible, comparing the information you provide against independent and reputable data sources such as credit bureau and identity databases, government and public records, telecommunications and device data, and address validation services. Where electronic verification is inconclusive, where risk indicators are present, or where a partner or regulation requires it, we use documentary verification and review the identity document itself, including authenticity, tamper, and data-consistency checks.

6.4 Identity document plus selfie liveness and biometric matching

For most customers, verification includes capturing an image of a government-issued identity document together with a live selfie. We then perform a liveness check designed to confirm that a real person is present rather than a photograph, mask, replayed video, or synthetic image, and a biometric facial comparison between the selfie and the photograph on the identity document. Our licensed partner Stripe may likewise collect and process identity documents and biometric identifiers derived from an identity document and a selfie for verification purposes (Stripe Services Agreement).

Biometric data is used only to verify identity, detect fraud, and meet legal obligations. It is not sold, not used for advertising, and not used to build a general-purpose facial recognition capability. Where state or foreign biometric privacy law requires separate notice, consent, or a retention schedule, we provide it, and we delete biometric identifiers when the purpose is exhausted or the applicable statutory retention period ends, whichever is later. Full detail is in our Privacy Policy.

6.5 If verification fails

If we cannot verify your identity to the required standard, we will normally give you a chance to fix the problem — for example by resubmitting a clearer document image, retaking a selfie, correcting a typographical error in your name or date of birth, or providing an additional document. Where verification still cannot be completed, we may decline to open the account, restrict the account to view-only, refuse or reverse a pending transaction, place a hold on funds pending resolution, or close the account. Where a transaction is not completed and we hold funds you paid, those funds are returned to the originating payment method in accordance with our Refund Policy and applicable law, except where law or a sanctions obligation requires us to block rather than return them. We are not always able to tell you the specific reason a verification decision was made, and in some circumstances the law prohibits us from doing so.

7. Customer Due Diligence and Enhanced Due Diligence

7.1 Risk-based tiers

Every customer is assigned a risk rating at onboarding and re-rated as activity develops. The rating determines how much information we require, what limits apply, and how closely activity is reviewed.

7.2 Risk factors we weigh

Other factors we consider include the payout method, the customer's channel and device history, prior alerts and disputes, the plausibility of the sender-recipient relationship, and the outcome of earlier information requests.

7.3 What Enhanced Due Diligence may require

Where EDD applies we may ask for, and condition continued service on receiving:

• source of funds for the specific transaction, such as a payslip, employment letter, benefit statement, bank statement showing the credit, invoice, sale contract, or grant award;
• source of wealth more generally, such as evidence of business ownership, tax filings, sale of property, inheritance documents, or investment records;
• purpose of the transfer, described specifically rather than generically;
• relationship to the recipient, and where relevant supporting evidence such as a family document, school or hospital invoice addressed to the recipient, or a contract;
• supporting documents for the underlying transaction, including invoices, receipts, shipping documents, or a signed declaration;
• for PEPs, additional detail on the public function held, the source of the funds relative to that function, and senior compliance approval before the relationship continues.

Information supplied under EDD is treated as confidential KYC data (Section 19). We may verify it independently. Providing false, altered, or fabricated documents is grounds for immediate closure and may itself be reported.

7.4 Ongoing due diligence and refresh

Customer information is refreshed on a risk-based cycle and on trigger events — a significant change in behaviour, a new sanctions or PEP match, a change of name, address, or nationality, an alert or dispute, a partner request, or the expiry of an identity document. We may ask you to re-verify at any time; continued use of the service is conditional on your doing so.

8. Sanctions Screening

8.1 Lists we screen against

We and our partners screen against, at minimum, OFAC's Specially Designated Nationals and Blocked Persons List and OFAC's Consolidated Sanctions List (covering non-SDN programmes), OFAC sectoral and comprehensive country programmes, United Nations Security Council consolidated sanctions lists, European Union consolidated sanctions lists, and United Kingdom sanctions lists including the OFSI consolidated list. We also screen against relevant denied-party, debarment, and law-enforcement lists, and against internal lists of persons previously exited for financial-crime reasons.

Yellow Card independently requires that a user must not be sanctioned by, or a resident or citizen of a country sanctioned by, the United States, the United Kingdom, or the European Union (Yellow Card Master Service Agreement), and Stripe applies its own sanctions ineligibility and export-control restrictions (Stripe Services Agreement).

8.2 When we screen

Screening is performed at onboarding, before any transaction is released, and on an ongoing basis. We screen senders, recipients, beneficiaries, donors, charitable causes and their local distribution partners, Shop & Send merchants and delivery counterparties, payout counterparties, and our own vendors and agents. We screen names, aliases and transliterations, dates of birth, addresses, nationalities, identification numbers, and, where relevant, wallet or account identifiers, using fuzzy matching calibrated to catch spelling and transliteration variants.

8.3 List rescreening

Our entire customer and counterparty base is rescreened whenever a relevant list is updated and on a recurring schedule, so that a person who was clear at onboarding but is designated later is identified promptly. Rescreening also runs after any change to a customer's identifying details.

8.4 Blocking, rejecting, and reporting

Potential matches are escalated for human review before any adverse action, and transactions are held while review is in progress. Where a true match is confirmed:

• Blocking — where OFAC requires it, funds and property in which a blocked person has an interest are frozen. Blocked funds are not returned to the sender, are placed in a blocked account as required, and cannot be released without OFAC authorisation.
• Rejecting — where the transaction is prohibited but no blockable property interest exists, the transaction is rejected and not processed.
• Reporting — the licensed partner, or SonghaiPay where the obligation attaches to us, files the required report with OFAC within the statutory period, and files the annual report of blocked property where applicable.

We cannot lift a block, return blocked funds, or resend a blocked transfer at a customer's request. If you believe you have been matched in error, contact compliance@songhaipay.com and we will review the match and correct our records where the match is false. Where a genuine designation exists, the remedy lies with the sanctions authority, not with us.

9. Politically Exposed Persons and Adverse Media

We screen customers and counterparties for politically exposed person ("PEP") status, covering senior government, judicial, military, state-owned enterprise, and international-organisation officials, senior political party figures, and the immediate family members and close associates of such persons. Being a PEP is not a crime and is not by itself a reason for refusal. It is a reason for closer scrutiny, because such persons may be exposed to bribery and corruption risk. PEP relationships require enhanced due diligence, senior compliance approval, closer attention to source of funds and source of wealth, and ongoing enhanced review.

We also conduct adverse media screening against reputable news and public-record sources for indications of involvement in fraud, corruption, money laundering, terrorist financing, trafficking, organised crime, or sanctions evasion. Hits are assessed for relevance, credibility, recency, and identity certainty; we do not act on a bare name coincidence. Where a credible and relevant match is confirmed, we escalate to EDD and, depending on severity, restrict, exit, or report the relationship.

10. Transaction Monitoring and Reporting

10.1 Ongoing monitoring

We monitor activity across all services continuously, combining automated detection with human review. Automated monitoring evaluates transactions and customer behaviour against risk models and scenario rules covering, among other things, velocity and volume anomalies, patterns consistent with the avoidance of reporting requirements, network relationships between senders and recipients, device and location inconsistencies, wallet pass-through behaviour, and mismatches between observed activity and the customer's stated profile. Alerts are triaged, investigated, documented, and dispositioned by trained analysts, with escalation to the Compliance Officer where warranted. Manual monitoring supplements this through customer-support escalations, internal referrals from any employee, partner notifications, and thematic reviews of specific corridors, causes, or typologies. As stated in Section 1.1, we do not publish our thresholds, scenarios, or model logic.

10.2 Suspicious Activity Reports and the no-tip-off rule

Where activity is known, suspected, or has reason to be suspected of involving funds derived from illegal activity, of being designed to evade Bank Secrecy Act requirements, of serving no apparent lawful or business purpose, or of facilitating criminal activity, a Suspicious Activity Report ("SAR") is filed with FinCEN within the statutory deadline, whether by SonghaiPay or by the licensed partner in whose name the obligation sits. We investigate and escalate promptly and refer matters to our partners so that filings are made on time.

No tip-off. Federal law prohibits any financial institution, and any director, officer, employee, or agent of one, from notifying any person involved in a transaction that a SAR has been filed or from otherwise disclosing the existence or contents of a SAR, except as expressly permitted by law. Accordingly:

• We will never tell you, your recipient, or any third party that a SAR has been filed or is being considered.
• Our staff cannot confirm or deny the existence of a SAR, even if you ask directly, and even if you consent.
• If your transaction is delayed, declined, or your account is restricted, we may not be able to explain the reason, and our inability to explain must not be read as an admission that a report exists.
• Do not ask our support team to confirm whether a report was filed; they are legally barred from answering and the request will not change the outcome.

Requests for SAR information from anyone other than an authorised government authority acting through proper channels are refused and are themselves escalated to the Compliance Officer.

10.3 Currency Transaction Reports

SonghaiPay does not accept physical cash from customers. Where cash is involved anywhere in the chain — for instance at a partner's agent location — the responsible licensed entity files Currency Transaction Reports for currency transactions exceeding the statutory threshold, in accordance with 31 CFR 1010.311, aggregating multiple transactions by or on behalf of the same person on the same business day as required.

10.4 Funds transfer recordkeeping and the Travel Rule

For transmittals of funds of US$3,000 or more, the funds transfer recordkeeping and Travel Rule requirements at 31 CFR 1010.410(e) and (f) apply. For such transmittals we collect and retain, and pass to the receiving institution as required, the originator's name, address, and account or identification number, the amount and execution date, the identity of the recipient's financial institution, and the recipient's name, address, and account number, together with any other specific identifier of the recipient. This is why we ask for complete recipient details rather than a nickname or a partial account number, and why an incomplete instruction cannot be released. Where the originator is not an established customer we verify identity and record the identifying document details.

10.5 Structuring is prohibited

It is a federal crime to structure transactions — that is, to break a larger amount into smaller ones, to use multiple accounts, senders, recipients, or providers, or to time transactions — for the purpose of evading a reporting or recordkeeping requirement. Structuring is prohibited on SonghaiPay whether or not the underlying funds are lawful. Suspected structuring is investigated, reported where required, and results in restriction or closure. We will also refuse to advise you on how to keep a transaction below any reporting point, and a request to do so is itself a red flag we record.

11. Prohibited Customers, Jurisdictions, and Activities

We will not open or maintain a relationship with, or process a transaction for:

• any person appearing on the OFAC SDN or Consolidated lists, or on a UN, EU, or UK sanctions list, or owned or controlled by such a person;
• any person located, resident, or organised in a jurisdiction subject to comprehensive U.S. sanctions or embargo, or a jurisdiction we or a partner have designated as unsupported;
• any person under 18 years of age, or lacking legal capacity to contract;
• any person who refuses to complete identity verification, refuses a reasonable information request, or supplies false, altered, or fabricated information or documents;
• any person using another person's identity, payment instrument, or account, or permitting their own account to be used by another (including money-mule arrangements and credential sharing, which Yellow Card also prohibits — Yellow Card Master Service Agreement);
• shell entities with no discernible lawful business purpose, unlicensed money services businesses, unlicensed payment aggregators, informal value-transfer operators, and unregistered virtual-asset service providers;
• unlicensed gambling, unlicensed pharmaceuticals, narcotics and controlled substances, weapons, munitions and explosives, and unlicensed dual-use or export-controlled goods;
• human trafficking, forced labour, child exploitation, and any content or conduct that sexually exploits any person;
• terrorist financing, proliferation financing, sanctions evasion, bribery, and corruption;
• fraud of any kind, including romance, advance-fee, business-email-compromise, investment, and impersonation fraud;
• ransomware or extortion payments, sale of stolen data or credentials, and distribution of malware;
• Ponzi, pyramid, and multi-level schemes, and unregistered securities or investment offerings;
• purchase or shipment of counterfeit, stolen, or illegally trafficked goods, including wildlife, antiquities, and precious minerals of undocumented origin;
• any activity prohibited by our licensed partners' restricted and prohibited business lists (Stripe Services Agreement) or by applicable law in the sending or receiving jurisdiction.

This list is illustrative and not exhaustive. We reserve the right to decline any customer or transaction that presents unacceptable financial-crime risk, and, consistent with our partners' rights, to suspend or decline activity we believe is unlawful, fraudulent, harmful, or presents an unacceptable level of risk.

12. Transaction Limits and Controls

We apply transaction limits as a financial-crime and fraud control as well as a partner requirement. Limits are risk-based and vary by:

• verification tier — a partially verified customer has materially lower limits than a fully verified one, and completing additional verification steps generally raises them;
• corridor — sending and receiving country, including local regulatory caps and payout-network rules in the destination market;
• payment method — card, ACH or bank transfer, and wallet balance carry different fraud and chargeback profiles;
• payout method — mobile money, bank deposit, and cash pickup are controlled differently;
• product — money transfer, donation, Shop & Send, and airtime top-up each have their own limits, with airtime and donation limits set tightly relative to their typical use;
• customer history and risk rating — established, well-understood behaviour supports higher limits; unresolved risk indicators reduce them.

Limits apply per transaction and on rolling daily, weekly, monthly, and annual bases, and to aggregate activity across linked accounts, devices, and payment instruments. Your current limits are shown in the app. We do not publish our limit matrix in this Policy because limits are dynamic and because publishing them assists evasion. We may raise, lower, or suspend limits at any time for risk reasons, including without prior notice, and we do not grant limit increases where the purpose appears to be to circumvent monitoring. Attempting to defeat a limit by splitting activity across accounts, people, or providers is structuring and is prohibited under Section 10.5.

13. Charitable and Donation-Specific Controls

Charitable and humanitarian giving is a high-trust, high-risk activity. Donors deserve to know their money reached the cause, and regulators expect providers to guard against diversion of humanitarian funds to terrorist or criminal actors.

13.1 Vetting of causes and local distribution partners

Every cause listed on SonghaiPay Donate is reviewed before it goes live. Diligence includes verifying the legal existence and registration of the implementing organisation, identifying its directors, trustees, and beneficial owners, confirming the plausibility of the stated programme and budget, reviewing governance and financial controls, obtaining references or prior funder confirmations where available, and confirming the organisation's authority to operate in the area of intended delivery. Local distribution partners who physically deliver aid, cash, goods, or services are diligenced on the same basis, with additional attention to their controls over beneficiary selection and distribution records.

13.2 Screening of partner organisations

Causes, implementing organisations, local distribution partners, and their principals and beneficial owners are screened against the sanctions, PEP, and adverse media sources in Sections 8 and 9, at onboarding and on an ongoing basis, with rescreening on list updates. A confirmed sanctions match ends the relationship immediately and triggers the blocking and reporting steps in Section 8.4.

13.3 Terrorist-financing risk in humanitarian corridors

We recognise that emergency-relief corridors may run through areas where armed groups or designated organisations operate and may attempt to tax, divert, or capture aid. In these corridors we apply heightened controls: closer scrutiny of the delivery route and of who controls access to the delivery area, restrictions or prohibitions on disbursement in specified areas, limits on cash-based delivery in favour of traceable in-kind or account-based delivery where practicable, beneficiary-level distribution records held by the partner, spot verification and third-party monitoring where available, and immediate suspension of disbursement where diversion is suspected pending investigation and, where required, reporting.

13.4 Disbursement reconciliation and impact reporting

Donations are pooled by cause and released to vetted partners against a documented plan. Each release is reconciled: funds sent are matched to partner receipts, expenditure records, procurement and delivery documentation, and beneficiary counts. Discrepancies are investigated before any further release, and unresolved discrepancies stop funding. Campaign updates and impact reporting are published to donors, and we retain the underlying reconciliation records under Section 18. Donations are not refundable once disbursed to a cause; the applicable rules are in our Refund Policy.

14. Shop & Send and Airtime-Specific Controls

14.1 Shop & Send and trade-based money laundering

Because Shop & Send converts funds into goods that then cross borders, it carries trade-based money laundering risk: over- or under-invoicing, phantom shipments, mismatches between the goods purchased and the recipient's plausible needs, repeated high-value purchases of easily resold items, and use of the service as a channel to settle unrelated obligations. Controls include screening of merchants, recipients, and delivery counterparties; product-category restrictions barring prohibited, export-controlled, dual-use, and high-resale-risk goods; checks that order value and frequency are consistent with the customer profile; verification of the delivery address and of the recipient's identity at delivery; retention of order, invoice, and delivery records; and escalation where the commercial rationale is not credible. Purchases intended for resale, for a business the customer has not disclosed, or for a third party the customer will not identify may be refused.

14.2 Airtime and data top-ups and value-transfer abuse

Airtime and data have real monetary value and can be resold or converted, which makes top-ups attractive for laundering small amounts at high volume, for testing stolen payment credentials, and for informal value transfer outside licensed channels. Controls include tight per-transaction and rolling limits, restrictions on the number of distinct destination numbers a customer may fund and the frequency of funding for any one number, detection of card-testing and enumeration behaviour, velocity controls on wallet-funded top-ups, screening of the customer and, where identifiable, the destination subscriber, and review of patterns consistent with commercial airtime resale. Using SonghaiPay top-ups for commercial airtime resale, for bulk redistribution, or as a substitute for licensed money transmission is prohibited and will result in restriction or closure.

15. Agent and Third-Party Partner Oversight

We apply risk-based due diligence to every third party that touches a customer, a transaction, or customer data: licensed money transmission and payout partners, payout networks and mobile money operators, charitable implementing and distribution partners, Shop & Send merchants and logistics providers, airtime aggregators, identity verification and screening vendors, and any agent, introducer, or referral partner acting for SonghaiPay.

Before onboarding, we assess legal existence, ownership and control, licensing or registration where required, AML/CFT program adequacy, sanctions screening capability, data protection posture, information security, financial standing, litigation and regulatory history, and adverse media, and we screen the entity and its principals against the lists in Section 8. Contracts require compliance with applicable AML, sanctions, and data protection law, cooperation with monitoring and investigations, prompt notification of incidents and regulatory actions, audit and information rights, restrictions on subcontracting without consent, and termination rights for compliance failure. After onboarding, partners are subject to periodic re-diligence at a frequency set by risk, ongoing screening, performance and exception monitoring, reconciliation, and, where warranted, on-site or documentary review. Where a partner is required to maintain and monitor an agent list under FinCEN's MSB rules, we support that partner's oversight of activity conducted through our platform. Partners who cannot or will not meet these standards are not used.

16. Information Sharing under USA PATRIOT Act Sections 314(a) and 314(b)

Section 314(a). Where FinCEN transmits an information request on behalf of a federal law enforcement agency concerning a person suspected of terrorist financing or money laundering, we and our licensed partners search available records for accounts and transactions involving the named subject during the specified period and report matches to FinCEN through the prescribed channel within the required time. The existence and contents of a 314(a) request are confidential; we do not disclose to any customer that they are or may be the subject of one, and we do not use the request as a basis for any action other than reporting unless independently justified.

Section 314(b). Where permitted, we and our partners may participate in voluntary information sharing with other financial institutions that have filed the required notice with FinCEN, for the purpose of identifying and reporting activities that may involve money laundering or terrorist financing. Information shared under 314(b) is used only for that purpose, is kept confidential, and is protected by the statutory safe harbour.

Lawful requests, subpoenas, and legal process. We respond to valid subpoenas, court orders, search warrants, regulatory examination requests, and other lawful demands from competent authorities. Requests are reviewed for validity, scope, and jurisdiction, and we disclose only what is legally required. Where we are permitted to notify you of a request for your information, and are not prohibited from doing so by law or by court order, we will use reasonable efforts to do so, as described in our Privacy Policy. We do not require a subpoena to act on a sanctions obligation, and no legal process is needed for us to file a report the law requires.

17. Training Program

Section 5.3 describes the pillar; in practice our training program consists of a mandatory core curriculum for all personnel at onboarding and annually, role-specific deep dives (front-line red flags and escalation for support; screening and investigation technique for compliance operations; secure design, logging, and data minimisation for engineering; accuracy and prohibited-claim rules for marketing; diligence and monitoring for partner managers), targeted briefings on new typologies and sanctions developments, testing with a required pass mark and remedial retraining, and record retention of curricula, attendance, and results. Everyone at SonghaiPay is trained on one non-negotiable duty: if something looks wrong, escalate it to compliance, immediately, and do not warn the customer.

18. Recordkeeping and Retention

We retain records for the minimum periods required by the Bank Secrecy Act and its implementing regulations, and longer where another law, a partner requirement, or a legal hold applies.

Records are held securely, in a form that permits timely retrieval and reconstruction of a transaction, and are produced to authorities and partners when lawfully required. Where a legal hold, investigation, or litigation applies, retention is extended until the hold is lifted. A request to delete personal data will not override a statutory retention obligation; see our Privacy Policy.

19. Data Protection and Confidentiality of KYC Information

KYC information — identity documents, biometric templates derived from an identity document and selfie, source-of-funds evidence, screening results, and investigation files — is among the most sensitive data we hold, and we treat it accordingly. Access is restricted to personnel with a documented need to know, under role-based access controls, with authentication and full audit logging. Data is encrypted in transit and at rest. We practise data minimisation, collecting only what verification and legal compliance require, and we apply the retention limits in Section 18.

We share KYC information with our licensed partners and identity, screening, and fraud vendors only as needed to verify you, to screen, to complete your transaction, and to meet legal obligations, under contracts that restrict use and require confidentiality and security. We disclose it to regulators, financial intelligence units, and law enforcement where legally required. We do not sell KYC or biometric data and we do not use it for advertising. Cross-border transfers to partners in Africa and elsewhere are made under appropriate safeguards, and our partners maintain jurisdiction-specific privacy policies, including for Nigeria under the NDPA, South Africa under POPIA, the EU under the GDPR, and the United States (Yellow Card legal centre, Stripe Privacy Policy).

Full detail on categories of data, legal bases, recipients, international transfers, security measures, and your privacy rights is in our Privacy Policy. Security concerns may be reported to security@songhaipay.com and privacy questions to privacy@songhaipay.com.

20. Your Cooperation Obligations and the Consequences of Non-Cooperation

20.1 What we ask of you

By using SonghaiPay you agree to:

• provide true, current, and complete information about yourself, your recipient, and the purpose of your activity, and to correct it promptly when it changes;
• submit genuine, unaltered identity documents and supporting evidence;
• complete verification, including the selfie liveness and biometric matching step, when asked;
• respond to information requests within the time we specify;
• use the service only for your own transactions, and ensure receiving accounts are in the recipient's name and under the recipient's sole control, consistent with our payout partner's requirement that receiving accounts be in the customer's own name and under sole control (Yellow Card Master Service Agreement);
• refrain from structuring, from using another person's identity or payment instrument, and from allowing anyone else to use your account;
• report suspected fraud or misuse of your account promptly.

20.2 What happens if you do not

Where you do not cooperate, or where cooperation raises further concerns, we may take any of the following steps, individually or together, and with or without prior notice where notice is not legally required or would prejudice an investigation:

Where a transaction is not completed and funds are not subject to a blocking obligation, we return them to the originating payment method under our Refund Policy and applicable law. You may not close your account in order to avoid an investigation, and closure does not extinguish our recordkeeping and reporting obligations (Yellow Card Master Service Agreement). Nothing in this section limits rights you have that cannot be waived under Regulation E, Subpart B (CFPB) or under applicable state money transmitter law.

21. Your Rights and How to Correct Your Verification Data

Verification decisions rest on data, and data can be wrong. You have the right to:

• know what we hold about you for verification purposes, subject to legal limits;
• correct inaccurate information, including a misspelled name, an incorrect date of birth, an out-of-date address, or a mismatched identification number;
• resubmit documents where an image was unclear, cropped, or expired;
• contest a screening match you believe is a false positive, by writing to compliance@songhaipay.com with your name, a description of the issue, and any evidence that distinguishes you from the listed person;
• ask for human review of an automated verification outcome, where applicable law provides that right;
• exercise privacy rights — access, correction, deletion, portability, and objection — to the extent available under laws such as the CCPA and CPRA in California, the comprehensive privacy laws of Colorado, Connecticut, Utah, Virginia, and other states, and the NDPA, POPIA, the Ghana Data Protection Act, the Kenya Data Protection Act, and the EU and UK GDPR where they apply. Requests are handled as described in our Privacy Policy.

Two limits apply. We cannot delete records the Bank Secrecy Act and other laws require us to retain, and we cannot disclose information about sanctions or suspicious activity reporting where the law prohibits disclosure, including under the no-tip-off rule in Section 10.2.

22. Reporting Suspected Fraud or Financial Crime

If you suspect fraud, a scam, identity theft, unauthorised use of your account, or any attempt to use SonghaiPay for money laundering, terrorist financing, sanctions evasion, or other financial crime, tell us immediately at compliance@songhaipay.com. For account access and transaction help, contact support@songhaipay.com; for suspected security vulnerabilities or data incidents, security@songhaipay.com.

Please include your name and the email or phone number on your account, the date and amount of any relevant transaction, the recipient's details, what happened, and any screenshots or messages you have. Do not send full payment card numbers by email. Reports are triaged by compliance, investigated, and, where required, reported to authorities. We investigate reports from customers, employees, contractors, agents, and third parties alike, and we do not retaliate against anyone who reports a concern in good faith. Reports may be made anonymously, though anonymity may limit our ability to follow up.

If you believe you are the victim of a crime, also contact your local law enforcement. Payment-related error and cancellation rights, including the Regulation E right to cancel within 30 minutes and to report an error within 180 days, are explained in our Refund Policy and in the receipt you receive for each transfer (CFPB Remittance Transfer Rule). Complaints may also be filed with the Consumer Financial Protection Bureau at consumerfinance.gov/complaint or by telephone at (855) 411-2372, and with the state regulator of the licensed money transmitter (Stripe licensing disclosures).

23. Governing Law and Dispute Resolution

This Policy and any dispute arising out of it or out of your use of SonghaiPay are governed by the laws of the State of Georgia and applicable United States federal law, without regard to conflict-of-laws principles. Venue for any action not subject to arbitration lies in the state or federal courts located in Fulton County, Georgia.

As set out more fully in our Terms of Service, disputes are resolved by binding individual arbitration administered by the American Arbitration Association under its Consumer Arbitration Rules. You may opt out of arbitration by written notice to us within 30 days of the date you first accept the Terms. Claims that qualify may instead be brought in small-claims court. Class, collective, and representative actions are waived to the fullest extent permitted by law.

Nothing in this section, and nothing elsewhere in this Policy, limits or waives any right you have that cannot be waived under Regulation E, Subpart B (CFPB), under applicable state money transmitter law, or under any other law that prohibits its waiver. Nothing in this Policy limits our obligations, or our partners' obligations, under the Bank Secrecy Act, OFAC sanctions programmes, or any other applicable legal requirement.

24. Changes to this Policy

We review this Policy at least annually and update it when the law, our products, our partners, or our risk profile change. When we make a material change we will update the "Last Updated" date above, publish the revised Policy at https://songhaipay.com/kyc-aml, and, where required or appropriate, notify you by email or in-app notice before the change takes effect. Changes required by law, by a regulator, or by a sanctions obligation may take effect immediately. Your continued use of SonghaiPay after a change takes effect constitutes acceptance of the revised Policy. We encourage you to review this Policy periodically, together with our Terms of Service, Privacy Policy, and Refund Policy.

25. Contact Us

Songhai LLC (d/b/a SonghaiPay) 650 Ponce De Leon Ave Ste. 300 #1380 Atlanta, GA 30308 United States https://songhaipay.com

Related documents: Terms of Service · Privacy Policy · Refund Policy · KYC / AML Policy · Donations

Partner disclosures: Stripe licensing disclosures · Stripe Services Agreement · Stripe Consumer Terms · Stripe Privacy Policy · Bridge U.S. licences and registrations · Yellow Card legal centre · Yellow Card Master Service Agreement · Yellow Card widget terms

This document is provided for informational purposes and should be reviewed by qualified legal counsel licensed in your jurisdiction before publication.