Acceptable Use Policy

1. Scope

This Acceptable Use Policy (the “AUP”) supplements the Koraly Terms of Service and applies to every Customer, end-user and integrator accessing the Koraly services. The AUP reflects the operating rules of the card networks (Visa, Mastercard, American Express, Discover), US anti-money laundering and counter-terrorist financing laws, US economic sanctions enforced by OFAC, the Bank Secrecy Act, the FTC Act, state consumer protection statutes and other applicable laws. Any violation of this AUP constitutes a material breach of the Terms and may trigger immediate suspension, fund holds, reserve increases, account closure and reports to competent authorities.

2. Prohibited Activities

Customers must not use the Koraly services to facilitate or engage in any activity that violates applicable law or that exposes Koraly, its partners or its end-customers to undue risk. Prohibited activities include, without limitation:

• money laundering, structuring, layering or any scheme intended to disguise the origin or destination of funds;
• terrorism financing, proliferation financing or transactions involving designated terrorist organizations;
• tax evasion or tax fraud, including misclassification of taxable activities and false invoicing;
• trafficking in controlled substances, narcotics, illegal drugs, weapons, ammunition, explosives or human beings;
• intellectual property infringement (counterfeit goods, unlicensed digital content, trademark violations);
• violations of US economic sanctions and trade controls, including transactions with persons listed on OFAC's Specially Designated Nationals list or located in comprehensively sanctioned jurisdictions;
• consumer fraud, deceptive advertising, false claims and unfair business practices under the FTC Act or state law equivalents.

3. Prohibited Business Categories

The following business categories are not permitted on the Koraly platform. Existing accounts engaged in such activities will be terminated and pending funds may be held pending investigation and reporting:

• adult content, pornography, escort services and sexually explicit material;
• unlicensed gambling, sweepstakes, lotteries and games of chance conducted without the required state license;
• unregistered financial services — banking, lending, securities brokerage, investment advice, payday loans, debt-collection and equivalent regulated activities without proper licensing;
• unlicensed crypto exchanges, OTC desks and money services businesses; crypto-related products are allowed only with prior written approval and enhanced KYB;
• regulated substances sold without proper compliance: alcoholic beverages without age verification, cannabis and CBD products without a valid state license and lab testing, prescription pharmaceuticals, tobacco and nicotine products sold to minors;
• weapons, ammunition, explosives, kits to manufacture firearms, three-dimensional printing of firearms components and related accessories;
• DRM circumvention devices, password-cracking software, mod-chips and other tools designed to bypass technical protection measures;
• trade in endangered species, protected wildlife products and environmental violations under the Endangered Species Act and CITES;
• pyramid schemes, multi-level marketing programs with guaranteed returns, chain letters and Ponzi-style operations;
• miracle medicine, unverified medical claims, fake COVID-19 treatments and dietary supplements with deceptive health claims;
• hate speech, doxxing, content inciting violence and platforms promoting discrimination on protected characteristics;
• spyware, stalkerware, surveillance products marketed for covert use and other tools designed to violate the privacy of unsuspecting individuals.

4. High-Risk Categories Requiring Enhanced Due Diligence

The following verticals are not prohibited but require enhanced KYB, elevated reserves, custom pricing and continuous monitoring. Approval is at Koraly's sole discretion and may be revoked at any time:

• long-haul travel, ticketing and hospitality with significant fulfilment delay;
• subscription continuity, free-trial conversions and negative-option billing models;
• online coaching, training, infoproducts and continuing education;
• crowdfunding platforms, donations and pass-through fundraising;
• multi-vendor marketplaces with split payments, especially those accepting independent sellers;
• verticals with historically elevated chargeback rates exceeding the Visa Dispute Monitoring Program thresholds.

5. Platform Behavior

Customers must not engage in any of the following behaviors when using the Koraly services:

• opening multiple accounts to evade detection or to circumvent risk limits or restrictions;
• abusing the API, scraping content, evading rate limits or otherwise interfering with the operation of the services;
• uploading, distributing or facilitating the distribution of malware, ransomware or any malicious code;
• conducting card testing, brute-force attempts or any activity that tests stolen or unauthorized payment credentials;
• attempting to manipulate fraud signals, risk scores or other machine-learning outputs to gain an unfair advantage;
• using the services to encash transactions on behalf of third parties without the express prior written consent of Koraly;
• impersonating another business or individual, falsifying contact information or misrepresenting beneficial ownership.

6. Reporting Abuse

Suspected violations of this AUP may be reported confidentially to abuse@koraly.io. Reports should include sufficient detail to identify the activity, evidence where available and the reporter's contact information for follow-up. We do not retaliate against good-faith reporters.

7. Enforcement

Koraly reserves the right to investigate suspected violations and to take any of the following actions, alone or in combination, without prior notice and without liability:

• suspending the Customer's account, halting transaction processing and disabling API access;
• placing reserves or holds on funds, including amounts already collected, to cover potential chargebacks, refunds, fines or losses;
• permanently closing the account and terminating the commercial relationship;
• declaring disputed amounts forfeited to cover damages, fines or related expenses, to the extent permitted by law;
• reporting the activity and disclosing relevant information to law enforcement (FinCEN, OFAC, FBI, state attorneys general), card networks and other competent authorities;
• pursuing civil or criminal proceedings to recover damages and seek appropriate remedies.

These remedies are cumulative and in addition to any other rights and remedies available to Koraly under the Terms of Service or applicable law.

8. Contact

Questions about this Acceptable Use Policy can be addressed to:

Koraly LLC — Compliance
4900 240TH ST 5478, Ashton, IA 51232, USA
Email: abuse@koraly.io
Phone: +1 (319) 323-7362