AML & Sanctions Policy

This policy establishes the controls through which AI Agents Lawyer, Inc. (C Corporation, Filing ID: 2026-001936499, Wyoming, USA) seeks to prevent our services from being used to launder the proceeds of crime, to finance terrorism, or to evade, circumvent or breach economic and trade sanctions.

It applies to all directors, officers, employees, contractors, secondees and appointed agents of the firm, and to every client engagement, counterparty relationship, referral and payment we handle, irrespective of size, jurisdiction or the use of technology in delivering the service.

Our controls are designed to satisfy applicable obligations under United States law, including the Bank Secrecy Act, the USA PATRIOT Act and regulations administered by the Office of Foreign Assets Control (OFAC), together with the sanctions regimes of the United Nations, the European Union, the United Kingdom (OFSI) and the Hong Kong Monetary Authority where our offices or counterparties are located. Where regimes conflict, we apply the most restrictive applicable measure permitted by law.

The Board retains ultimate responsibility for this policy. Day-to-day ownership sits with the firm's designated Compliance Officer, who is responsible for client due diligence decisions, sanctions escalation, suspicious activity reporting, training and periodic review of this policy.

• The Compliance Officer reviews every new client engagement before work begins.
• Any partner may escalate a concern directly to the Compliance Officer, bypassing the engagement team.
• No fee, disbursement or referral payment is released without compliance clearance.
• This policy and its risk assessment are reviewed at least annually, and after any material change in law, business model or client base.

We classify every relationship as low, medium or high risk using a documented methodology that weighs the client's sector, ownership structure, jurisdictions of operation and beneficial ownership, the nature of the engagement, the source of funds for any payment, and the delivery channel.

Higher risk factors attract enhanced measures. These include clients incorporated in or operating from jurisdictions identified by the FATF as subject to increased monitoring or a call for action, complex or opaque corporate structures, nominee arrangements, politically exposed persons, and engagements involving prepaid or anonymous value transfer. We decline relationships where residual risk cannot be mitigated.

Before accepting an engagement we identify and verify:

• The legal identity of the client entity, through registry extract, constitutional documents and proof of registered address.
• The identity of each individual who ultimately owns or controls the client, directly or indirectly, at a threshold of 25% or more, and of any person exercising effective control by other means.
• The identity of the individual instructing us, together with evidence of their authority to bind the client.
• The purpose and intended nature of the engagement, and the source of funds where fees are paid by a third party.

We re-verify identity on a risk-triggered basis, on any change of control, and at least every three years for high-risk relationships. Where a client is itself a regulated financial institution or law firm, we may rely on its own due diligence only after confirming the adequacy of its regime and obtaining written assurances; reliance does not transfer responsibility for the decision.

Every client, beneficial owner, instructing individual, counterparty and payee is screened against consolidated sanctions and watchlists, including OFAC's SDN and Consolidated Sanctions Lists, the UN Consolidated List, the EU Consolidated List and the UK OFSI Consolidated List, before onboarding and on an ongoing basis as lists are updated.

We do not provide services to, receive value from, or otherwise deal with any designated person or entity, any entity owned 50% or more in the aggregate by one or more designated persons, or any person acting on behalf of a designated person. We do not provide services that would facilitate trade with comprehensively sanctioned jurisdictions, the export of controlled technology contrary to export control law, or the structuring of arrangements intended to obscure a sanctioned interest.

Potential matches are not resolved by automated clearance alone. Each alert is reviewed by a human analyst, documented, and where unresolved, escalated to the Compliance Officer and, where required, to the relevant authority. Matches are dispositioned as true or false positive with written reasons retained.

Fees are accepted only by electronic transfer through regulated banking channels or by card payment through a licensed processor. We do not accept cash, bearer instruments, money orders, stored-value cards or transfers from unverified third parties.

We do not accept payment in cryptoassets, and we do not accept payment routed through intermediaries whose identity we have not verified. Any request to pay fees on behalf of a client is treated as a risk trigger requiring source-of-funds evidence and Compliance Officer approval. Overpayments and unexplained credits are returned to the originating account.

Our practice concerns autonomous and agentic systems, which introduce money-laundering and sanctions risks that predate neither the technology nor the policy response. We specifically assess:

• Opaque principals. Engagements where the instructing party is an autonomous agent, an unincorporated collective or an anonymous development group, with no identified human controller.
• Synthetic identity. Identity documents, corporate records or video verification that may themselves be generated or altered by AI. We use independent registry checks and liveness verification rather than documents alone.
• Agent-mediated value transfer. Products that let an AI agent initiate, route or approve payments on a user's behalf, where the human principal may be neither identified nor visible to the counterparty.
• Evasion tooling. Services whose stated design would help a customer restructure ownership, disguise control or fragment transactions in order to avoid screening.
• Jurisdictional arbitrage. Deployment architectures deliberately placed to place the operator beyond the reach of any single supervisor.

An engagement presenting any of these features is treated as high risk at minimum, and is declined where the controller, the economic beneficiary or the lawful basis for the arrangement cannot be established.

Engagement teams are required to know their client's business well enough to recognise a departure from expected activity. Unexplained changes in ownership, jurisdiction, payment route or instructions, requests to alter invoices or redirect funds, and any suggestion of concealment are escalated in writing to the Compliance Officer on the day they are identified.

Where we know, suspect or have reasonable grounds to suspect that funds are the proceeds of crime, are linked to terrorist financing, or involve a sanctions breach, we submit a report to the appropriate authority, including a Suspicious Activity Report to FinCEN or a Suspicious Transaction Report to the relevant financial intelligence unit, and we do not proceed with the transaction. Reporting decisions are made by the Compliance Officer and documented.

Where a mandatory disclosure duty applies, we make the disclosure notwithstanding any duty of confidentiality owed to the client. We do not disclose to the client, or to any third party, that a report has been made where tipping-off is prohibited.

We retain identification evidence, screening results, risk assessments, escalation records and reporting decisions for a minimum of five years after the end of the relationship, or longer where a specific legal requirement, investigation or legal hold applies. Records are held on access-controlled systems, available to regulators and law enforcement on lawful request.

Compliance records are processed consistent with our Privacy Policy and Data Protection Policy. Personal data collected for screening is used only for that purpose and is not sold, licensed or used to train third-party models.

All personnel complete AML and sanctions training on joining and annually thereafter, with additional training covering the typologies relevant to AI businesses and agentic payment flows. Attendance and assessment results are recorded.

The programme is subject to an independent review at least every two years by a reviewer with no operational responsibility for its execution. Findings, and the remediation actions taken, are reported to the Board.

Failure to comply with this policy is a disciplinary matter and may result in termination of employment or engagement, recovery of losses, and notification to the relevant authority where the conduct may constitute an offence. Deliberate circumvention of screening, or the knowing concealment of a suspicious circumstance, is treated as gross misconduct.

This policy does not create rights for any third party, does not constitute legal or compliance advice, and is not a substitute for the AML obligations of any client, which remain theirs alone.

To report a concern, or for questions about this policy or our screening decisions: legal@aiagentslawyer.com

AI Agents Lawyer, Inc. · C Corporation · Wyoming, USA · Filing ID: 2026-001936499
Principal Office: Suite No #25421, 30 North Gould Street, Sheridan, Wyoming 82801, USA
Back Office: Unit 1603, 16th Floor, The L Plaza, 367-375 Queen's Road Central, Sheung Wan, Hong Kong SAR