Anti-Money Laundering (AML) Policy

1. Purpose & Regulatory Basis

RZK is committed to preventing the use of its Platform for money laundering, terrorist financing, or other illicit financial activity. This Anti-Money Laundering Policy (“AML Policy”) establishes RZK's written AML program as required for dealers in precious metals, stones, or jewels under the Bank Secrecy Act (31 U.S.C. § 5311 et seq.) and its implementing regulations at 31 C.F.R. Part 1027, and reflects the four required pillars of a BSA/AML program: (1) internal policies, procedures, and controls; (2) a designated compliance officer; (3) ongoing employee training; and (4) independent testing.

2. Scope

This policy applies to all RZK employees, contractors, and any personnel involved in customer onboarding, sales, purchasing, shipping, or payment processing, and to every transaction conducted through the Platform, including live-auction purchases, exchange purchases, and any buy-back or consignment transactions RZK may offer.

3. Designated Compliance Officer

RZK designates a BSA/AML Compliance Officer responsible for day-to-day administration of this program, including implementation, monitoring, recordkeeping, training, and liaison with regulators and law enforcement.

4. Customer Identification Program (CIP / KYC)

Before a customer may bid in a live auction or complete a purchase on the exchange, RZK verifies the customer's identity through the account-creation flow. At minimum, RZK collects and verifies:

• Full legal name and date of birth (customers must be 18 or older).
• Residential/shipping address.
• Email address and phone number.
• A government-issued photo ID (and optional selfie), uploaded for RZK staff review on the Verify ID page.

RZK will not permit a customer to place a bid, complete a purchase, or receive payment for a sale until identity verification has been completed successfully. RZK reserves the right to request additional documentation (e.g., proof of address, source-of-funds documentation) for higher-value or higher-risk transactions or customers.

5. Risk-Based Customer Due Diligence

RZK applies a risk-based approach to customer due diligence, considering factors such as:

• Transaction size and frequency, and whether activity is consistent with the customer's stated profile.
• Use of cash, money orders, or third-party payment instruments not linked to the verified account holder.
• Requests for unusual shipping arrangements (e.g., shipping to addresses unrelated to the billing/verified address, freight forwarders, or high-risk jurisdictions).
• Structuring behavior — breaking a transaction into multiple smaller transactions to avoid recordkeeping or reporting thresholds.
• Customers or counterparties appearing on government sanctions or watchlists.

Enhanced due diligence, including manual review by the Compliance Officer, is applied to any transaction or customer relationship presenting elevated risk.

6. Sanctions & Watchlist Screening

RZK screens customers against the U.S. Treasury Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list and other applicable government sanctions and watchlists at account creation and on an ongoing basis. RZK will not open an account for, transact with, or ship goods to any individual or entity that is a sanctioned party, is located in a comprehensively sanctioned jurisdiction, or is otherwise prohibited under applicable U.S. law.

7. Recordkeeping

RZK maintains the following records for at least five (5) years, as required under 31 C.F.R. Part 1027:

• Identity-verification records and supporting documentation for each customer.
• Records of each purchase and sale transaction, including date, parties, item description, and amount.
• Records related to any suspicious activity review, escalation, or report.
• IRS/FinCEN Form 8300: RZK will file Form 8300 for any transaction (or related series of transactions) in which it receives more than $10,000 in cash, as required under 31 U.S.C. § 5331 and 26 U.S.C. § 6050I, and will provide the required annual written statement to the customer named on the form.

8. Monitoring & Reporting Suspicious Activity

All personnel must promptly escalate any transaction or customer behavior that appears suspicious to the Compliance Officer. Examples of “red flags” include, without limitation:

• A customer who is reluctant or unable to provide identifying information, or provides information that appears false or inconsistent.
• Payment from a source unrelated to the account holder, or from multiple unrelated third parties.
• Structuring cash or payments into amounts just under $10,000 or other reporting/recordkeeping thresholds.
• Requests to reverse, cancel, or “undo” a transaction shortly after completion for reasons unrelated to a genuine dispute (a possible layering technique).
• Unusual urgency, indifference to price/premium, or lack of interest in the value or authenticity of the metal or coins purchased.
• Shipping requests to freight forwarders, high-risk jurisdictions, or addresses with no apparent connection to the customer.

The Compliance Officer will review escalations, document findings, and determine whether to file a voluntary Suspicious Activity Report (SAR) with FinCEN, restrict or terminate the account, and/or notify law enforcement, as appropriate. RZK personnel must never disclose to a customer that a suspicious activity review or report has been made (“tipping off”).

9. Prohibited Activity

RZK will not knowingly:

• Transact with any customer who fails identity verification or sanctions screening.
• Accept payment intended to disguise the true source, ownership, or beneficiary of funds.
• Facilitate transactions structured to evade recordkeeping, reporting, or identification requirements.
• Transact with anonymous, numbered, or unverifiable accounts.

10. Employee Training

All employees and contractors involved in onboarding, sales, payments, or shipping receive AML training at hire and at least annually thereafter, covering this policy, applicable law, red flags, and escalation procedures. Training completion is documented and retained by the Compliance Officer.

11. Independent Testing

RZK will arrange for periodic independent testing of this AML program — by an internal function independent of the compliance role, an outside consultant, or auditor — at least every 12 months, to assess the program's effectiveness and compliance with applicable law. Findings and remediation steps are documented and reported to RZK's owners/officers.

12. Policy Review & Amendments

This AML Policy is reviewed at least annually, and promptly upon any material change in RZK's business, products, or applicable law, and updated as necessary with approval from RZK's owners/officers and, as appropriate, outside legal counsel.

13. Contact