AML, Counter-Terrorist Financing, PEP and Sanctions Statement

Effective date: 26 August 2026

---

Why this page exists

Payments products get used by people trying to move money that isn't theirs. This page sets out who we will and will not open an account for, and what the law obliges us to do. It is a summary, written for customers and for anyone doing due diligence on us.

It is not our compliance programme. We do not publish the detail of how we detect, investigate or escalate financial crime, and clause 12 explains why.

---

1. Our status

We registered in the crypto asset service provider category rather than arguing that a non-custodial service sits outside it. The obligations that follow are applied in full.

We maintain a Risk Management and Compliance Programme as required by section 42 of the Financial Intelligence Centre Act 38 of 2001. It is approved by our board, reviewed at least annually, and a Money Laundering Reporting Officer is appointed and accountable for it.

Registration is not a licence. It is how the Centre knows who we are so that we can report to it, and it is the reason we verify your identity and keep records of what you do. It is not an approval or an endorsement of Zap by the Centre or by any other regulator. We do not hold a Financial Advisory and Intermediary Services licence, and we are not an authorised financial services provider. See clause 3 of our Terms of Service.

---

2. What we will not do

• We will not knowingly deal with a person or entity designated under any sanctions list we screen against.
• We will not process a transaction we believe involves the proceeds of unlawful activity, the financing of terrorism, or the financing of weapons proliferation.
• We will not open an anonymous account, or an account in a false or fictitious name.
• We will not accept an account opened by one person for the benefit of another.
• We will not accept physical cash, in any amount, through any channel.
• We will not weaken a control to win business, to hit a growth target, or to accommodate a partner.

---

3. Who cannot open a Zap account

We will refuse the following, and a refusal on any of these grounds cannot be overturned by anyone at Zap:

• Anyone appearing on a sanctions list we screen against, or acting for or on behalf of such a person.
• Anyone resident in, or a national of, a country subject to comprehensive sanctions.
• Anyone under 18.
• Anyone opening an account anonymously, under a false or fictitious name, or on behalf of someone they will not disclose.
• Anyone presenting an identity document that is forged, altered, expired, or belongs to somebody else.
• Anyone who will not or cannot give us the information we ask for, or whose information we cannot verify.
• Anyone we have previously removed on financial crime grounds.
• Anyone who already holds a Zap account. One account per person.

We also do not serve, and will not knowingly process payments for: unlicensed money transfer, remittance or exchange businesses; unlicensed crypto exchanges and over-the-counter desks; mixing, tumbling and other services designed to obscure where funds came from; darknet markets; unlicensed gambling; adult services; arms dealing; and shell companies with no demonstrable operating business.

---

4. Who we do accept

Zap is built for South African residents who are paid from outside the country for freelance, contract or remote work. To open an account you must:

• be 18 or older;
• be resident in South Africa, and hold a valid South African identity document, or a passport together with evidence of lawful South African residence;
• be acting for yourself alone; and
• complete identity verification.

We currently accept natural persons only. We do not open accounts for companies, close corporations, trusts or partnerships.

---

5. Identity verification

Verification is a gate, not a formality. Until it is complete you cannot send, convert or withdraw anything.

We establish who you are from your document, not from what you type into the app. We check that the document is genuine, that a live person is presenting it, and that the person presenting it is the person in the document. We check the signals around your device and your connection against what you have told us.

We do not offer a reduced or simplified verification path to anyone, and a verification that fails is never waved through as a commercial decision.

We may ask you at any time to verify again, to provide further documents, or to evidence where your money comes from. If you decline, we may restrict or close your account.

---

6. Sanctions screening

We screen every applicant before we open an account, and we re-screen our customers for as long as their account is open, against:

• the United Nations Security Council Consolidated List;
• the South African targeted financial sanctions list published by the Financial Intelligence Centre;
• the United States OFAC Specially Designated Nationals and Sectoral Sanctions lists;
• the European Union Consolidated Financial Sanctions List;
• the United Kingdom OFSI Consolidated List;
• designated blockchain addresses; and
• politically exposed person and adverse media data.

Under sections 26A and 26B of the Financial Intelligence Centre Act, a United Nations designation takes effect in South Africa the moment the Security Council adopts it, and it is an offence for any person to make property or services available to someone designated. Where we identify a designated person we act immediately. We do not need a court order or anyone's consent to do so, and we cannot hold off while we hear your side.

What we can and cannot stop. Zap is non-custodial: your assets sit in a wallet you control, and we hold no key that lets us move them. We therefore cannot immobilise, seize or confiscate anything on-chain, and we will not claim otherwise. What we can withdraw is service — access to the app, and every ability to send, convert or cash out — and that is what we do.

---

7. Politically exposed persons

Being a politically exposed person is not a reason to be refused. It is a reason to be looked at more closely. There is no minimum amount below which we skip this, because the law sets none and neither do we.

If you hold, or have held, a prominent public position outside South Africa — or you are an immediate family member or a known close associate of someone who does — we apply enhanced due diligence before we accept you. Approval is not automatic, we will ask you to evidence not only where your funds come from but where your wealth comes from, and we keep looking at the account more closely for as long as it is open.

If you hold a prominent public position inside South Africa, or are the family member or close associate of someone who does, the same applies where we assess the relationship as higher risk.

We ask you to tell us about this yourself when you sign up, and we screen for it independently. Declaring it costs you nothing. Denying it and being found out is grounds for us to close your account.

---

8. Others we look at more closely

Acceptance is not automatic, and takes longer, for:

• anyone with a meaningful connection to a country the Financial Action Task Force has placed under a call for action or increased monitoring;
• anyone whose device or network signals do not match where they say they live, including anyone reaching us through anonymising infrastructure;
• anyone with credible adverse media relating to fraud, corruption or financial crime; and
• anyone whose account activity stops matching what they told us it would be.

---

9. Reporting, and why we may go quiet

The law requires us to report certain matters to the Financial Intelligence Centre, and it prohibits us from telling you when we have. This is called tipping off, and it is a criminal offence.

So if we decline something, restrict your account, or ask a question that seems to come from nowhere, we may be unable to explain it. We will tell you that a restriction exists. Nobody here is permitted to invent a reason instead, and no amount of pressing our support team will produce one. Please do not read our silence as indifference.

We comply with any lawful direction not to proceed with a transaction, and with any lawful request from the Centre, a supervisory body, a court, or law enforcement. We satisfy ourselves that such a request is authentic and lawful before we disclose anything, and we record what was disclosed and to whom.

---

10. Records

We keep customer due diligence and transaction records for at least five years after your relationship with us ends, after the transaction concludes, or after any report we file — whichever runs longest. Sections 22 to 24 of the Financial Intelligence Centre Act require this.

Records are not deleted when you close your account, and we cannot delete them on request. Our Privacy Policy sets out what we hold, how it is protected, and which rights you do have.

---

11. Our people

Everyone who works at Zap is screened before appointment and periodically afterwards, and is trained on these obligations before being given access to any system. Every employee is required to escalate anything that looks wrong, and is protected when they do — including when they turn out to be mistaken.

---

12. What this page does not contain

We do not publish our thresholds, our detection rules, our screening configuration, or the mechanics of how we investigate. Publishing them would tell anyone intending to misuse Zap exactly where to sit.

Supervisors, auditors and counterparties conducting due diligence may request the underlying programme at ari@zapzar.co.za.

---

Review. This statement is reviewed at least annually, and sooner if our business or the law changes. Version 1.0, 26 August 2026.

ZA Payments (Pty) Ltd, registration number 2025/911807/07. 194 Bancor Avenue, Park Lane West Building, Waterkloof Glen, Pretoria, 0181, South Africa.