Know Your Customer (KYC) Policy

1. Introduction

At Privy Consul, we recognise the importance of adhering to robust compliance standards, particularly in today's global environment where risks of money laundering, terrorism financing, and other illicit activities are prevalent. Our Know Your Customer (KYC) policy is integral to maintaining the integrity of our services, ensuring that we operate within the legal framework established by the United Kingdom, the United States, and international regulatory bodies.

KYC is not merely a procedural requirement but a fundamental responsibility. It allows us to protect our clients, principals, and the broader financial ecosystem by verifying identities, assessing risks, and implementing safeguards to prevent financial crime. This policy outlines the steps and measures we take to ensure compliance with relevant regulations, as well as the responsibilities of our people, clients, and partners in upholding these standards.

The policy serves as a cornerstone of our broader compliance framework, working in tandem with our Anti-Money Laundering (AML) protocols and data protection measures. It applies to all aspects of our services, from initial engagement and onboarding through to advisory, investigative, and crisis-response work. By ensuring rigorous compliance, Privy Consul reinforces its commitment to transparency, accountability, and ethical practice in every client relationship.

2. Purpose of the Policy

The primary purpose of this KYC Policy is to ensure that Privy Consul complies with applicable laws and regulations, particularly those designed to combat financial crime. It provides a clear framework for identifying and verifying clients, monitoring their activity, and mitigating risks associated with illegal conduct.

This policy is designed to achieve several key objectives:

• Regulatory compliance. To meet the requirements of the UK Money Laundering Regulations 2017, the U.S. Bank Secrecy Act and USA PATRIOT Act, FATF Recommendations, and other applicable standards.
• Risk mitigation. To identify and address risks related to money laundering, terrorism financing, fraud, and other illicit activities.
• Client trust. To build and maintain trust with our clients by demonstrating our commitment to transparency and due diligence.
• Reputation management. To safeguard Privy Consul's reputation by ensuring that our services are not misused for illegal purposes.
• Business integrity. To ensure that all business relationships are conducted ethically and in compliance with the law.

This policy also provides a reference point for our people and partners, outlining their responsibilities in implementing KYC measures effectively. By doing so, Privy Consul not only meets its legal obligations but sets a benchmark for excellence in compliance practice.

3. Scope

The scope of this policy extends to all individuals and entities that engage with Privy Consul, as well as to our internal teams and third-party partners. Specifically, it applies to:

• Clients. Any individual, corporate entity, or organisation that engages Privy Consul's services, including advisory, intelligence, and crisis-response engagements. This includes both new and existing clients, as well as those who engage us for a specific matter.
• Employees. All members of Privy Consul, including permanent staff, contractors, and consultants, who are involved in client onboarding, due diligence, or compliance-related tasks. Employees are required to follow the procedures outlined in this policy to ensure consistency and accuracy in KYC implementation.
• Third-party partners. Service providers, intermediaries, and other external entities that work with Privy Consul to deliver client services. These partners must also adhere to our KYC standards and demonstrate a commitment to compliance.

The policy is applicable across all jurisdictions in which Privy Consul operates, taking into account local regulatory requirements. Our primary framework is grounded in UK regulation — including the Proceeds of Crime Act 2002 and the Sanctions and Anti-Money Laundering Act 2018 — and, for clients and engagements connected to the United States, the U.S. Bank Secrecy Act, the USA PATRIOT Act, and applicable OFAC sanctions regimes, while aligning throughout with international standards to ensure seamless compliance across borders.

By defining a broad scope, this policy ensures that no aspect of our operations is left unaddressed, enabling Privy Consul to maintain a comprehensive approach to compliance.

4. Regulatory Framework

Privy Consul operates within a highly regulated environment, where compliance with legal and regulatory requirements is paramount. This policy is grounded in a dual UK/US legal framework, incorporating both national and international standards to address the complexities of cross-border risk and advisory work.

Key regulations and standards:

• UK Money Laundering Regulations 2017. This regulation forms the backbone of AML and KYC compliance in the UK. It mandates stringent requirements for client identification, risk assessment, and reporting of suspicious activities. Privy Consul strictly adheres to these provisions for clients and matters connected to the United Kingdom.
• U.S. Bank Secrecy Act (BSA) & USA PATRIOT Act. These statutes form the equivalent backbone of AML and customer identification obligations in the United States, requiring identity verification, recordkeeping, and reporting of suspicious activity for clients and matters connected to the United States.
• Proceeds of Crime Act 2002. This act criminalises money laundering and establishes the legal basis for confiscating proceeds of criminal activity in the UK. Our KYC measures are designed to detect and prevent such activity from occurring through our services.
• Sanctions and Anti-Money Laundering Act 2018. This legislation empowers UK authorities to impose sanctions and enforce AML measures. Privy Consul conducts regular checks against international sanctions lists to ensure compliance, in parallel with the sanctions regimes administered by the U.S. Treasury's Office of Foreign Assets Control (OFAC).
• Financial Action Task Force (FATF) Recommendations. As a global standard-setting body, FATF provides guidelines for combating money laundering and terrorism financing. Our policy incorporates these recommendations to align with international best practice.
• UK GDPR & U.S. state privacy law. While implementing KYC measures, we ensure that personal data is handled in compliance with applicable data protection laws — including UK GDPR and, where relevant, U.S. state privacy statutes such as the CCPA — to safeguard client privacy.

This regulatory framework provides a solid foundation for our KYC policy, ensuring that Privy Consul meets its legal obligations on both sides of the Atlantic while maintaining the highest standards of ethical conduct.

5. Key Definitions

Understanding key terms is essential for implementing the KYC Policy effectively. Below are the definitions of critical concepts that guide our approach:

• KYC (Know Your Customer). A process of identifying and verifying the identity of clients to ensure their legitimacy and to assess potential risks related to money laundering or financial crime.
• AML (Anti-Money Laundering). A set of procedures, laws, and regulations designed to detect, prevent, and report money laundering activity.
• CDD (Client Due Diligence). The standard process of collecting and verifying client information to evaluate potential risks.
• EDD (Enhanced Due Diligence). Additional checks conducted on high-risk clients or matters to gain a deeper understanding of their activities and sources of funds.
• PEP (Politically Exposed Person). An individual who holds a prominent public position, or is closely associated with such a person, making them more susceptible to bribery and corruption risk.
• Sanctioned Entity. An individual, organisation, or country subject to economic or financial restrictions imposed by bodies such as the United Nations, the U.S. Treasury's Office of Foreign Assets Control (OFAC), or the European Union.
• Source of Funds. Documentation or information that demonstrates the origin of the financial resources being used in a matter.
• Beneficial Owner. The individual who ultimately owns or controls a legal entity or asset, even if it is held in another name.

These definitions provide clarity and consistency in the implementation of KYC measures, ensuring a shared understanding among all stakeholders.

6. Client Due Diligence (CDD)

Client Due Diligence (CDD) is the cornerstone of our KYC Policy. It involves identifying and verifying the identity of clients to ensure that they are legitimate and to assess any associated risks.

6.1 Steps in the CDD process

1. Client identification.
   • Obtain personal information, such as full name, date of birth, and nationality.
   • For entities, collect legal name, registration details, and ownership structure.
2. Verification.
   • Verify the authenticity of identification documents provided by the client.
   • Use third-party databases and tools to confirm details against international sanctions lists, PEP lists, and adverse media reports.
3. Risk assessment.
   • Assign a risk profile to each client based on factors such as geography, nature of engagement, and activity patterns.
   • High-risk clients are subject to additional scrutiny through Enhanced Due Diligence (EDD).

6.2 Required documentation

• For individuals. A valid passport or national ID, proof of address (utility bill or bank statement), and evidence of source of funds.
• For entities. Incorporation documents, constitutional documents, ownership registry, and proof of registered address.

CDD ensures that Privy Consul engages only with legitimate clients while maintaining compliance with regulatory requirements.

7. Enhanced Due Diligence (EDD)

Enhanced Due Diligence (EDD) is applied to clients or matters identified as high-risk. These additional checks provide a deeper understanding of the client's background, activities, and financial dealings.

7.1 When EDD is required

• Clients from jurisdictions identified as high-risk by FATF or other regulatory bodies.
• Matters involving large sums or complex ownership structures.
• Politically Exposed Persons (PEPs) or their associates.
• Situations where the source of funds is unclear or unverifiable.

7.2 EDD procedures

• Collect detailed information about the client's activities, including financial statements and contracts where relevant.
• Verify the source of funds and wealth through supporting documentation.
• Conduct additional background checks using specialised tools and databases.
• Monitor the client relationship more frequently to detect unusual patterns or behaviour.

EDD is a critical component of our risk-based approach, ensuring that potential risks are thoroughly investigated and mitigated.

8. Ongoing Monitoring

At Privy Consul, ongoing monitoring is a critical aspect of our KYC procedures. It ensures that client activity remains consistent with declared profiles and that any potential risks are identified and addressed in real time. This process is not limited to the initial onboarding phase but continues throughout the client relationship.

8.1 Activity monitoring

• Pattern analysis. Comparing current activity against historical data to identify deviations or unusual behaviour.
• Threshold alerts. Setting thresholds for transaction values, volumes, or types, triggering alerts for any activity that exceeds these limits.
• Geographical analysis. Monitoring activity involving high-risk jurisdictions or countries subject to international sanctions.

If activity raises concerns, it is flagged for further investigation. Our compliance team reviews flagged matters to determine whether they align with the client's risk profile or warrant additional scrutiny.

8.2 Periodic reviews

• Annual reviews. Standard clients undergo a full review of their records at least once a year.
• High-risk reviews. Clients classified as high-risk are reviewed more frequently, with quarterly updates to their risk profiles.
• Event-driven reviews. Reviews triggered by significant changes, such as new ownership structures, large transactions, or negative media coverage.

8.3 Real-time monitoring tools

We leverage third-party technology to facilitate real-time monitoring, including sanctions screening, PEP checks, and adverse media searches. These tools enable us to identify and address risks proactively.

Ongoing monitoring is not just a compliance requirement but a proactive measure to protect our clients and stakeholders from financial crime. It ensures that Privy Consul maintains the highest standards of operational integrity.

9. Reporting Obligations

Reporting obligations are a cornerstone of Privy Consul's compliance framework. These obligations ensure that any suspicious activity is promptly escalated and reported to the relevant authorities, minimising risk to the financial system.

9.1 Suspicious Activity Reports (SARs)

A Suspicious Activity Report (SAR) is submitted to the UK Financial Intelligence Unit (UKFIU) for matters connected to the United Kingdom, or to the Financial Crimes Enforcement Network (FinCEN) for matters connected to the United States, when activity raises concerns about potential money laundering, terrorism financing, or other illicit activity. Examples of scenarios requiring a SAR include:

• Large cash transactions. Significant cash deposits or withdrawals that appear unusual for the client's profile.
• Threshold alerts. Discrepancies between the client's submitted documents and their declared activities.
• Refusal to provide information. Clients unwilling to comply with reasonable requests for KYC or transaction detail.

Our compliance team ensures that SARs are detailed and include all relevant information to assist authorities in their investigations. Once a SAR is filed, we refrain from notifying the client, in compliance with tipping-off regulations.

9.2 Internal reporting and escalation

1. Reporting the activity to the Compliance Officer.
2. The Compliance Officer conducting a thorough review of the case.
3. Determining whether external reporting (e.g., filing a SAR) is required.

This structured approach ensures that all suspicious activity is addressed promptly and appropriately.

9.3 Reporting timeframes

All suspicious activity must be reported internally within 24 hours of detection. External reporting, where required, is completed within the legal timeframes specified by the relevant regulator.

Reporting obligations reinforce Privy Consul's commitment to transparency and its role in safeguarding the financial ecosystem.

10. Record Retention

The retention of KYC and AML records is essential for compliance, accountability, and operational efficiency. At Privy Consul, we maintain meticulous records to ensure that we can meet regulatory requirements and respond effectively to audits or inquiries.

10.1 Types of records retained

• Identification documents. Copies of passports, national IDs, and proof of address.
• Transaction records. Details of all transactions processed on behalf of the client, including dates, amounts, and counterparties.
• Risk assessments. Documentation of client risk profiles, including any changes made during periodic reviews.
• Communication records. Correspondence with clients related to KYC, AML, or compliance matters.

10.2 Retention period

Records are retained for a minimum of five years after the termination of the client relationship or the completion of the last matter, aligning with the requirements of the UK Money Laundering Regulations 2017 and the recordkeeping provisions of the U.S. Bank Secrecy Act.

10.3 Secure storage and access

• Digital records. Stored in encrypted databases with multi-factor authentication for access.
• Physical records. Kept in locked, fireproof storage units with restricted access.
• Access controls. Only authorised personnel, such as compliance officers and auditors, can access these records.

By maintaining comprehensive and secure records, Privy Consul demonstrates its commitment to compliance and operational excellence.

11. Roles and Responsibilities

Privy Consul's compliance framework is supported by clearly defined roles and responsibilities, ensuring that all employees and stakeholders contribute to the effective implementation of the KYC Policy.

11.1 Compliance Officer

The Compliance Officer plays a central role in overseeing all aspects of KYC and AML compliance. Key responsibilities include:

• Developing and updating KYC and AML policies.
• Conducting regular audits to ensure adherence to internal procedures.
• Reviewing and approving risk assessments for high-risk clients.
• Filing Suspicious Activity Reports (SARs) with the relevant authorities.

11.2 Employees

All employees involved in client onboarding, activity monitoring, or compliance work are required to:

• Conduct thorough due diligence during client onboarding.
• Escalate suspicious activity to the Compliance Officer promptly.
• Participate in regular training to stay current on KYC and AML regulation.

11.3 Third-party partners

Service providers and intermediaries must adhere to Privy Consul's KYC standards. Contracts with third parties include clauses requiring compliance with our policies and the relevant regulations.

Clearly defining roles and responsibilities ensures accountability and fosters a culture of compliance across the organisation.

12. Training and Awareness

At Privy Consul, we believe that effective training is critical to ensuring that employees and partners are equipped to implement KYC measures consistently and accurately.

12.1 Training programme

• Induction training. New employees receive comprehensive training on KYC and AML requirements during onboarding.
• Ongoing education. Regular workshops and e-learning modules to update staff on changes in regulation and industry best practice.
• Scenario-based learning. Real-life case studies and exercises to help employees identify and address potential risks.

12.2 Certification and assessment

Employees are required to complete annual assessments to demonstrate their understanding of KYC and AML principles. Certificates of completion are issued for compliance purposes.

12.3 Partner training

Third-party partners are provided with training materials to ensure alignment with Privy Consul's compliance framework.

Continuous training ensures that Privy Consul remains at the forefront of compliance excellence.

13. Non-Compliance Consequences

Privy Consul takes compliance with KYC and AML regulation very seriously. Non-compliance, whether intentional or unintentional, can have severe legal, financial, and reputational consequences for both the company and the individuals involved.

13.1 Consequences for Privy Consul

1. Legal penalties. Fines and sanctions imposed by regulatory authorities; legal action under the UK Money Laundering Regulations 2017, the U.S. Bank Secrecy Act, and other applicable law in the jurisdictions in which we operate.
2. Operational risk. Restrictions on operations, such as limitations on providing services in certain jurisdictions; suspension or revocation of licences to operate.
3. Reputational damage. Loss of trust among clients, partners, and stakeholders; negative media coverage affecting the firm's standing.

13.2 Consequences for employees

1. Disciplinary action. Formal warnings, retraining, or reassignment of duties; termination of employment for serious or repeated violations.
2. Personal liability. Legal penalties, including fines or imprisonment, where non-compliance is proven to be deliberate or negligent.

13.3 Addressing non-compliance

Privy Consul has a zero-tolerance policy for non-compliance. Steps taken to address violations include:

1. Internal investigation. Identifying the root cause of the issue and assessing its impact; reviewing processes to determine whether lapses were systemic or individual.
2. Corrective action. Implementing additional training for employees; enhancing monitoring systems or updating policies and procedures.
3. Regulatory reporting. Notifying relevant authorities of significant breaches and cooperating fully with investigations.

By enforcing strict consequences for non-compliance, Privy Consul reinforces its commitment to upholding the highest standards of integrity and accountability.

14. Review and Updates

The dynamic nature of KYC and AML regulation necessitates regular review and updates to Privy Consul's policies and procedures, ensuring the firm remains compliant with evolving legal requirements and industry best practice.

14.1 Annual reviews

• Regulatory updates. Identifying changes to law and guidance, such as updates to the UK Money Laundering Regulations, the U.S. Bank Secrecy Act, or FATF Recommendations.
• Internal assessments. Evaluating the effectiveness of current policies based on audit findings and employee feedback.
• Industry trends. Monitoring emerging risk and technological developments to enhance compliance measures.

14.2 Interim updates

• New risks. Responding to emerging threats, such as new types of fraud or changes in global risk profile.
• Operational changes. Adjustments to Privy Consul's services, client base, or geographical focus.
• Regulatory changes. Immediate updates to comply with new law or directives from regulatory authorities.

14.3 Communication of changes

• Employee notification. All staff are informed of changes and provided with updated training materials.
• Client communication. Existing clients are notified of any changes that may affect their relationship with Privy Consul.
• Public disclosure. Updates are reflected in the publicly available version of this policy at privyconsul.com.

Regular review and updates ensure that Privy Consul remains proactive and adaptive in its approach to KYC and AML compliance, reinforcing trust and confidence among clients and stakeholders.

15. Governing Law and Jurisdiction

1. If you are a resident of, or located within, the United Kingdom, this Policy and any disputes arising out of it shall be governed by and construed in accordance with the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the English courts.
2. For all other clients, this Policy and any disputes arising out of it shall be governed by and construed in accordance with the laws of the State of New York and the federal laws of the United States, without regard to conflict of law principles, and the parties submit to the exclusive jurisdiction of the courts located in New York.