AML & KYC Policy

1. Purpose

This policy sets out the procedures KrosWeb Enterprise Inc., doing business as KrosAI ("the Company," "we," "us"), applies to verify the identity and legitimacy of business customers before and during their use of the KrosAI platform. It is designed to prevent the use of KrosAI's infrastructure for money laundering, fraud, sanctions evasion, or other illicit activity, and to ensure compliance with applicable regulatory requirements in each jurisdiction in which KrosAI operates, including Nigeria, Kenya, Ghana, the United States, and the United Kingdom.

This policy applies to KrosAI's onboarding of its own business customers (the companies and developers who use KrosAI's infrastructure). It is distinct from, and complements, KrosAI's product-level KYC features, which verify individual end users during phone number activation.

2. Scope

This policy applies to every prospective and existing business customer seeking to use KrosAI's platform to provision phone numbers, route calls, or otherwise access KrosAI's telephony infrastructure.

3. Business Verification

Before a business customer is granted access to the platform, KrosAI verifies:

• Business registration — confirmation that the applicant is a legally registered business entity, using officially issued registration documents.
• Beneficial ownership — identification of the individual(s) who ultimately own or control the applicant business.

No customer is onboarded until business verification is satisfactorily completed.

4. Sanctions and Watchlist Screening

All prospective customers, and their identified beneficial owners, are screened against relevant sanctions and watchlists, including but not limited to the U.S. Office of Foreign Assets Control (OFAC) list, prior to onboarding. A positive match against a sanctions or watchlist entry results in the application being held and escalated for manual review; onboarding does not proceed until the match is cleared or the application is declined.

5. Risk-Based Onboarding

KrosAI applies a risk-based approach to onboarding, calibrating the depth of due diligence to the customer's profile and intended use case:

• Standard due diligence applies to typical use cases (e.g., standard AI voice agent deployment for customer support).
• Enhanced due diligence applies to higher-risk use cases (e.g., use cases involving financial transactions, high call/SMS volume, or markets with elevated regulatory sensitivity), and may include additional documentation requests, extended verification steps, or senior review before approval.

6. Third-Party Verification Tooling

KrosAI uses Didit (didit.me), a third-party identity and business verification provider, to support business verification and sanctions screening as part of the onboarding process described above.

7. Ongoing Monitoring

Customer verification is not a one-time event. Following onboarding, KrosAI monitors customer activity on an ongoing basis for patterns consistent with suspicious or anomalous use, including unexpected volume spikes, unusual call/SMS patterns, or activity inconsistent with the customer's stated use case. Flagged activity is escalated for internal review and may result in additional verification requests, account restrictions, or suspension.

8. Regulatory Alignment

This policy and the underlying process are designed to satisfy applicable AML/KYC regulatory requirements in each jurisdiction where KrosAI operates. As KrosAI expands into new markets, this policy is reviewed and, where necessary, updated to reflect local regulatory requirements in each new jurisdiction.

9. Recordkeeping

Records of business verification, screening results, and monitoring escalations are retained for as long as required under applicable regulations in the relevant jurisdiction.

10. Policy Review

This policy is reviewed periodically and updated as KrosAI's operations, customer base, or applicable regulatory requirements evolve.

11. Contact

Questions regarding this policy may be directed to team@krosai.com.