Customer Safeguarding Policy

1.Purpose

This Customer Safeguarding Policy establishes the framework through which Evea seeks to protect customers, their accounts, funds, personal information, and access to Evea's products and services.

The purpose of this Policy is to ensure that Evea maintains appropriate controls to:

• Protect customer funds and financial interests.
• Protect customer accounts from unauthorized access or misuse.
• Detect and respond to fraud and suspicious activity.
• Protect customer information and maintain confidentiality.
• Provide customers with clear channels for reporting concerns.
• Respond appropriately to service disruptions, security incidents, disputes, and customer complaints.
• Manage customer risks in accordance with applicable legal, regulatory, contractual, and partner requirements.

Evea is committed to treating customer protection as a core part of its operational, risk, and compliance framework.

2.Scope

This Policy applies to all Evea customers and users of Evea's products and services, including, where applicable:

• Business account holders.
• Account owners and administrators.
• Authorized users and employees.
• Cardholders.
• Beneficiaries and payment counterparties where relevant.

This Policy also applies to Evea employees, contractors, service providers, and third parties involved in delivering, supporting, or managing Evea's services.

3.Customer Safeguarding Principles

Evea will seek to safeguard customers through the following principles:

3.1Security

Evea will implement reasonable administrative, technical, and operational controls designed to protect customer accounts, information, and transactions.

3.2Transparency

Evea will provide customers with clear information about relevant products, transactions, fees, restrictions, and available support channels.

3.3Prevention

Evea will maintain controls designed to prevent fraud, unauthorized access, financial crime, operational errors, and misuse of its services.

3.4Detection and Response

Evea will maintain processes to identify, investigate, and respond to suspected fraud, security incidents, suspicious activity, and customer concerns.

3.5Fair Treatment

Evea will seek to handle customer complaints, disputes, and safeguarding concerns fairly, consistently, and within applicable timeframes.

3.6Risk-Based Controls

The level of monitoring, verification, restrictions, and other safeguards may vary based on the nature and level of risk associated with a customer, account, transaction, or product.

4.Safeguarding of Customer Funds

Where Evea holds, receives, processes, or facilitates the movement of customer funds, Evea will implement controls appropriate to its role, regulatory status, and underlying financial infrastructure.

Depending on the applicable product and partner arrangement, customer funds may be held, received, or safeguarded by licensed banking, payment, or other regulated financial institution partners.

Evea will:

• Maintain clear records relating to customer balances and transactions.
• Reconcile relevant transaction and balance records as appropriate.
• Maintain controls designed to prevent unauthorized movement of customer funds.
• Restrict access to systems and processes involved in the management of customer funds.
• Investigate material discrepancies or errors.
• Escalate material issues to the appropriate management, partner, or regulatory function where required.

Evea will not represent customer funds as being directly held, insured, or guaranteed by Evea where such representations are inaccurate.

5.Customer Account Security

Evea will maintain reasonable security controls designed to protect customer accounts from unauthorized access.

These controls may include:

• Secure authentication mechanisms.
• Password and credential protection requirements.
• Multi-factor authentication, where available or required.
• Device and session monitoring.
• Access controls based on user roles and permissions.
• Account activity monitoring.
• Security notifications and alerts.
• Temporary restrictions or account suspension where suspicious activity is identified.

Customers are responsible for maintaining the confidentiality of their login credentials and taking reasonable steps to prevent unauthorized access to their accounts.

6.User Roles and Access Controls

Evea may provide different levels of access and permissions based on a customer's organisational structure and the user's role.

Access controls may include:

• Account Owner permissions.
• Administrator permissions.
• Employee or spender permissions.
• Approval permissions.
• Budget management permissions.
• Payment initiation and approval permissions.

Evea will seek to apply appropriate controls to ensure that users can only perform actions authorized for their assigned roles.

Customers may be responsible for managing and periodically reviewing the users and permissions associated with their Evea account.

7.Transaction Security and Fraud Monitoring

Evea will maintain controls designed to identify and respond to potentially fraudulent, unauthorized, or unusual activity.

Depending on the product and available infrastructure, these controls may include:

• Transaction monitoring.
• Velocity and frequency checks.
• Transaction limits.
• Device or access monitoring.
• Unusual activity detection.
• Card security controls.
• Customer or transaction verification.
• Manual review and investigation.
• Temporary transaction or account restrictions.

Transactions or account activity that generate a fraud or security concern may be delayed, declined, restricted, or subjected to further review.

8.Customer Verification and KYC

Evea will apply customer identification and verification procedures in accordance with its Customer Onboarding and Know Your Customer (KYC) Policy.

Customer safeguarding controls may include verification of:

• The business or legal entity.
• Directors and authorized representatives.
• Ultimate Beneficial Owners.
• Other relevant persons with ownership or control over the customer.

Evea may request additional information or documentation where necessary to protect customers, manage risk, or meet applicable compliance requirements.

9.Sanctions and Financial Crime Controls

Evea will maintain controls designed to prevent its products and services from being used for prohibited or unlawful activity.

Relevant controls may include:

• Customer and counterparty screening.
• Sanctions screening.
• Risk-based monitoring.
• Review of suspicious or unusual activity.
• Enhanced due diligence for higher-risk relationships.
• Escalation of potential financial crime concerns.

Sanctions screening will be conducted in accordance with Evea's Sanctions Screening Policy and other applicable financial crime policies and procedures.

10.Protection of Customer Information

Evea will take reasonable steps to protect customer and user information from unauthorized access, disclosure, alteration, loss, or misuse.

Controls may include:

• Role-based access controls.
• Restricted access to sensitive information.
• Secure storage and transmission of data.
• Authentication and access management controls.
• Logging and monitoring of relevant systems.
• Appropriate vendor and third-party controls.
• Incident response procedures.

Customer information will be collected, used, retained, and disclosed in accordance with applicable data protection requirements and Evea's privacy and data management policies.

11.Customer Communication and Transparency

Evea will seek to provide customers with clear and accessible information regarding:

• Available products and services.
• Applicable fees and charges.
• Material terms and conditions.
• Transaction status.
• Account restrictions, where appropriate.
• Relevant security responsibilities.
• Support and complaint channels.

Evea will not knowingly provide misleading information regarding its products, regulatory status, safeguarding arrangements, or the protection of customer funds.

12.Customer Notifications and Alerts

Where operationally available and appropriate, Evea may notify customers about significant account or transaction activity.

Notifications may include:

• Successful transactions.
• Declined or failed transactions.
• Account access events.
• Changes to account settings or permissions.
• Card activity.
• Security-related events.
• Other material activity requiring customer awareness.

The availability and delivery of notifications may depend on the customer's device settings, communication channels, and third-party service availability.

13.Reporting Fraud, Security Concerns and Unauthorized Activity

Customers should promptly notify Evea through an authorized support channel if they become aware of:

• A suspected unauthorized transaction.
• Suspected fraud.
• Compromised login credentials.
• Lost or compromised payment cards.
• Unauthorized access to their account.
• A suspected security incident.

Upon receiving a report, Evea may take appropriate action, including:

• Restricting account access.
• Blocking or replacing an affected card.
• Suspending relevant transactions.
• Investigating the activity.
• Requesting additional verification.
• Coordinating with relevant banking, card, or payment partners.

Evea will assess reported incidents based on the available information and applicable partner, legal, and operational requirements.

14.Account Restrictions and Protective Actions

Evea may temporarily restrict, suspend, or limit an account, card, transaction, or service where reasonably necessary to:

• Prevent suspected fraud.
• Protect customer funds.
• Investigate unauthorized activity.
• Address a security concern.
• Comply with legal, regulatory, or partner requirements.
• Prevent financial crime.
• Investigate a material breach of Evea's terms or policies.

Where appropriate and permitted, Evea will provide the customer with information regarding the restriction and any steps required to restore access.

15.Customer Disputes and Chargebacks

Customers may report eligible transaction disputes in accordance with Evea's Chargeback and Dispute Management Policy.

Evea will maintain processes for:

• Receiving customer dispute reports.
• Reviewing relevant transaction information.
• Collecting supporting evidence.
• Investigating suspected unauthorized or fraudulent transactions.
• Escalating eligible disputes to relevant banking, card, or payment partners.
• Communicating material outcomes to customers.

The availability and outcome of a chargeback or dispute will depend on the nature of the transaction and applicable payment network, card scheme, banking, or partner rules.

16.Customer Complaints

Evea will provide customers with appropriate channels for submitting complaints.

Complaints may relate to:

• Account access.
• Transactions.
• Cards.
• Fees.
• Service quality.
• Fraud or unauthorized activity.
• Delays or operational errors.
• Customer support.
• Other concerns relating to Evea's services.

Evea will seek to:

• Acknowledge complaints where appropriate.
• Investigate the issue.
• Communicate with the customer.
• Take reasonable corrective action where necessary.
• Maintain records of material complaints and outcomes.

17.Incident Management

Evea will maintain processes for managing significant operational, security, fraud, or customer-impacting incidents.

Depending on the nature of an incident, Evea may:

• Assess the scope and potential impact.
• Contain and investigate the issue.
• Restrict affected accounts or services where necessary.
• Engage relevant internal teams and service providers.
• Coordinate with banking, payment, card, or infrastructure partners.
• Notify affected customers where appropriate or required.
• Implement corrective actions to reduce the likelihood of recurrence.

Material incidents will be escalated to management.

18.Third-Party and Partner Safeguards

Evea may rely on banks, payment institutions, card issuers, processors, infrastructure providers, and other third parties in delivering its services.

Evea will seek to assess relevant third parties based on the nature of the relationship and associated risk.

Where appropriate, Evea may consider:

• Regulatory status.
• Security and operational controls.
• Financial crime and compliance controls.
• Data protection practices.
• Business continuity arrangements.
• Incident management capabilities.
• Contractual obligations.

Evea will maintain appropriate oversight of material third-party relationships.

19.Business Continuity and Service Resilience

Evea will seek to maintain appropriate operational resilience and continuity arrangements to reduce disruption to customers.

These may include:

• System monitoring.
• Incident response processes.
• Data backup and recovery arrangements.
• Third-party dependency management.
• Escalation procedures.
• Business continuity planning.

Where a significant service disruption occurs, Evea will take reasonable steps to restore affected services and communicate material information to customers where appropriate.

20.Customer Responsibilities

Customer safeguarding is a shared responsibility.

Customers and authorized users are expected to:

• Keep login credentials secure.
• Use strong and unique authentication credentials.
• Not share passwords or authentication codes.
• Maintain accurate account and business information.
• Promptly remove users who no longer require access.
• Regularly review account users and permissions.
• Monitor account and transaction activity.
• Promptly report suspected fraud or unauthorized activity.
• Cooperate with reasonable verification and investigation requests.

Failure to take reasonable security precautions may affect Evea's ability to protect the account or investigate certain incidents.

21.Training and Employee Awareness

Relevant Evea employees and contractors will receive training appropriate to their responsibilities.

Training may include:

• Customer protection principles.
• Account and information security.
• Fraud and suspicious activity indicators.
• Customer verification requirements.
• Incident escalation.
• Complaint handling.
• Data protection and confidentiality.
• Applicable safeguarding procedures.

Training will be reviewed and updated periodically.

22.Monitoring and Effectiveness

Evea will periodically assess the effectiveness of its customer safeguarding controls.

This may include monitoring:

• Fraud and security incidents.
• Customer complaints.
• Unauthorized transaction reports.
• Dispute and chargeback trends.
• Account compromise incidents.
• Service disruptions.
• Operational errors.
• Control failures.
• Third-party incidents.

Where material weaknesses are identified, Evea will take appropriate steps to investigate and remediate them.

23.Roles and Responsibilities

23.1Management

Management is responsible for:

• Approving this Policy.
• Providing oversight of material customer protection risks.
• Supporting appropriate safeguarding resources and controls.
• Reviewing significant incidents and remediation actions.

23.2Risk and Compliance

The Risk and Compliance function is responsible for:

• Supporting the development and maintenance of safeguarding controls.
• Reviewing material customer protection risks.
• Monitoring relevant incidents and trends.
• Supporting escalation and investigation processes.
• Recommending improvements to controls.

23.3Operations and Customer Support

Relevant teams are responsible for:

• Supporting customers.
• Receiving and escalating customer concerns.
• Following applicable safeguarding procedures.
• Identifying potential fraud, security, or operational risks.
• Maintaining appropriate records.

23.4All Employees and Contractors

All personnel are responsible for:

• Following applicable safeguarding and security policies.
• Protecting customer information.
• Escalating suspected fraud, security incidents, or control weaknesses.
• Not knowingly bypassing customer protection controls.

24.Policy Breaches

Any employee or contractor who knowingly bypasses, weakens, or fails to comply with applicable customer safeguarding controls may be subject to appropriate disciplinary or contractual action.

Material breaches may also result in escalation to management, relevant partners, or authorities where required.

25.Policy Review

This Policy will be reviewed at least annually and earlier where necessary due to:

• Changes in Evea's products or services.
• Expansion into new markets or jurisdictions.
• Changes in applicable laws, regulations, or partner requirements.
• Material fraud, security, or operational incidents.
• Changes to Evea's technology or infrastructure.
• Material changes in Evea's risk profile.

Any material amendments to this Policy must be approved by management.