Compliance & Regulatory Disclosures

Payhubz, operated by Proximo Consultancy Ltd (ACN 639 933 494), is subject to obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) ("AML/CTF Act") and the AML/CTF Rules. As a reporting entity providing designated services, we maintain a compliant AML/CTF Program that includes:

• Customer identification and verification (KYC/KYB) procedures for all merchants and beneficial owners • Ongoing customer due diligence and transaction monitoring • Enhanced due diligence for higher-risk merchants, jurisdictions, and transaction types • Suspicious matter reporting (SMR) to AUSTRAC where required • Threshold transaction reporting (TTR) for cash transactions of AUD 10,000 or more • Record-keeping for a minimum of seven (7) years as required by the AML/CTF Act • Regular staff training on AML/CTF obligations and red-flag indicators • Independent review and audit of our AML/CTF Program

By applying for or using Payhubz merchant services, you consent to us collecting, verifying, and retaining information about your business, its beneficial owners, and its transactions for the purpose of fulfilling these obligations. We are required by law to report certain information to AUSTRAC and other regulatory authorities without notifying you.

Payhubz and its acquiring bank partners maintain compliance with the Payment Card Industry Data Security Standard (PCI DSS). Our obligations and expectations include:

• Payhubz's payment processing infrastructure is operated in partnership with PCI DSS-certified acquiring banks and payment processors • Merchants are required to maintain their own PCI DSS compliance appropriate to their transaction environment and volume • Merchants must complete an annual Self-Assessment Questionnaire (SAQ) or undergo a Qualified Security Assessor (QSA) audit as required by their card scheme obligations • Payhubz does not store, process, or transmit cardholder data on behalf of merchants except through PCI DSS-compliant systems • Any suspected cardholder data breach must be reported to Payhubz immediately at [email protected]

Merchants are solely responsible for the security of their own systems, point-of-sale environments, and any cardholder data they handle. Failure to maintain PCI DSS compliance may result in fines imposed by card schemes, which will be passed on to the merchant.

Payhubz operates as an Independent Sales Organisation (ISO) in partnership with licensed acquiring banks. All merchant services are subject to the operating regulations and rules of the relevant card schemes, including:

• Visa International Operating Regulations • Mastercard Rules • eftpos Australia Scheme Rules

Merchants must comply with all applicable card scheme rules at all times. Key obligations include:

• Displaying accepted card scheme marks at point of sale and online checkout • Not imposing surcharges that exceed the reasonable cost of acceptance (in accordance with RBA surcharging standards) • Not discriminating against cardholders based on card type • Maintaining chargeback ratios below card scheme thresholds (typically 1% by volume) • Complying with 3D Secure 2.0 requirements for card-not-present transactions where mandated • Retaining transaction records for a minimum of 18 months

Payhubz reserves the right to pass on any fines, penalties, or costs imposed by card schemes as a result of a merchant's non-compliance.

Payhubz operates within the following Australian regulatory framework:

Payhubz maintains a sanctions compliance program consistent with Australian law and international best practice. We screen merchants, beneficial owners, and transactions against:

• The Australian Sanctions Office (ASO) consolidated list • United Nations Security Council sanctions lists • OFAC (Office of Foreign Assets Control) Specially Designated Nationals list • Other applicable international sanctions regimes

Payhubz will not onboard or continue to service merchants, individuals, or entities that are subject to applicable sanctions. We reserve the right to freeze, block, or terminate accounts and report to relevant authorities where sanctions obligations require.

Merchants must not use Payhubz services to process transactions that would violate applicable sanctions laws, including transactions involving sanctioned countries, entities, or individuals. Breach of this obligation may result in immediate account termination and reporting to relevant authorities.

Payhubz is committed to resolving complaints fairly and promptly. If you have a complaint about our services:

We will acknowledge your complaint within 2 business days and aim to resolve it within 21 days. Complex matters may take longer; we will keep you informed of progress.

• Australian Financial Complaints Authority (AFCA): www.afca.org.au | 1800 931 678 (where applicable) • Office of the Australian Information Commissioner (OAIC) for privacy complaints: www.oaic.gov.au • AUSTRAC for AML/CTF concerns: www.austrac.gov.au

We do not charge fees for lodging a complaint.