Anti-financial crime & anti-money laundering policy.

1. Purpose & scope.

Avona Ltd ("the Company") is committed to preventing our software and services from being used to facilitate money laundering, terrorist financing, or deliberate tax evasion. This Anti-Financial Crime and Anti-Money Laundering (AML) Policy outlines the procedures we use to detect, prevent, and report suspicious activity.

This policy applies to all directors, employees, contractors, and offshore development teams.

2. Our operational context & risk profile.

As an FCA-regulated agent providing Account Information Services (AIS) and HMRC-recognised Making Tax Digital (MTD) software, Avona does not hold, transfer, or manage client funds.

• Our AML risk is considered low compared to transactional banks.
• However, because we aggregate financial data and calculate tax liabilities, our primary risk exposure is users attempting to use our software to facilitate or legitimise Tax Evasion or commit Fraud.

3. The money laundering reporting officer (MLRO).

Avona has appointed Stephen Burnside as the designated Money Laundering Reporting Officer (MLRO) / Nominated Officer.

• The MLRO is responsible for receiving internal reports of suspicious activity from staff or automated system flags.
• The MLRO is solely responsible for deciding whether to file a formal Suspicious Activity Report (SAR) with the National Crime Agency (NCA) and notifying our Principal firm (Finexer).

4. Customer due diligence (CDD) & KYC.

While the underlying banks are responsible for the primary Know Your Customer (KYC) checks on the bank accounts themselves, Avona enforces its own verification at onboarding:

• Identity Verification: Users must register with valid contact details and verify their identity before submitting data to HMRC.
• Open Banking Authentication: We rely on the Strong Customer Authentication (SCA) provided by the user's bank (via Finexer) to verify that the user legally controls the connected bank accounts.
• Sanctions Screening: Avona reserves the right to screen user details against the HM Treasury Consolidated List of Financial Sanctions Targets if deemed necessary by the MLRO.

5. Identifying "red flags" (suspicious activity).

Staff members and development teams must remain vigilant for anomalous user behavior that could indicate tax evasion or money laundering. Red flags specific to Avona's platform include:

• Deliberate Obfuscation: A user repeatedly connecting and disconnecting bank feeds to intentionally hide specific transaction periods from their tax calculation.
• Massive Discrepancies: A user manually overriding tax calculations or deleting significant volumes of income data so that their HMRC submission drastically differs from their Open Banking feed.
• Suspicious Accounts: Connecting offshore bank accounts from high-risk jurisdictions that do not align with a standard UK sole trader or landlord profile.
• Identity Mismatches: The name on the connected bank account consistently failing to match the user's registered Avona or HMRC profile.

6. Internal reporting & "tipping off".

If any staff member or contractor spots a red flag, they must follow this procedure:

1. Report Immediately: Email the MLRO (Stephen Burnside) via a secure internal channel detailing the user ID and the suspicious behaviour.
2. No Investigation: Staff must not attempt to investigate the user themselves or contact the user regarding the suspicion.
3. Strictly No "Tipping Off": Under the Proceeds of Crime Act 2002 (POCA), it is a criminal offence to inform a customer that they are under investigation for money laundering. Staff must never tell a user that an internal AML report or a SAR has been filed. Continue to provide standard software support unless instructed otherwise by the MLRO.

7. External reporting (SARs).

If the MLRO determines that the internal report has merit, they will:

1. File a Suspicious Activity Report (SAR) with the UK National Crime Agency (NCA) via their secure online portal.
2. Notify Finexer’s compliance team, in accordance with our Principal/Agent agreement.
3. Determine whether to freeze or suspend the user's Avona account pending regulatory guidance.

8. Record keeping & training.

• Records: Avona will retain all records of CDD checks, internal AML reports, and SARs for a minimum of 5 years from the date the business relationship ends.
• Training: All staff handling customer data or support tickets will receive basic AML awareness training during onboarding to ensure they can identify the "red flags" listed in Section 5.