FinCEN Compliance Statement

Milli takes its obligations under federal financial crimes law seriously. This statement describes how Milli approaches compliance with the Bank Secrecy Act ("BSA") and the regulations of the Financial Crimes Enforcement Network ("FinCEN"), a bureau of the U.S. Department of the Treasury. It is intended for customers, regulators, and financial institution partners.

1. Regulatory Status and MSB Registration

Milli provides financial management software and, through partners, access to card and money movement features. Milli does not hold customer funds or transmit money in its own name. Card issuing, deposit, and money movement services are provided by a licensed partner bank, which is subject to direct federal supervision and maintains its own BSA/AML program. Based on this structure, Milli is not currently registered with FinCEN as a Money Services Business ("MSB") under 31 C.F.R. section 1022.380.

Milli continually evaluates its activities against FinCEN's MSB definitions. If any Milli activity requires MSB registration, Milli will register with FinCEN (FinCEN Form 107) before engaging in that activity, renew the registration every two years, maintain an agent list where required, and publish its registration information on this page and on our FinCEN/MSB Disclosure.

2. BSA Compliance Program

Milli's written BSA/AML program, approved by senior management and coordinated with its partner bank, includes: - Internal controls: risk-based policies and procedures for onboarding, monitoring, investigations, reporting, and record-keeping; - BSA/AML Compliance Officer: a designated officer with the authority, independence, and resources to manage the program; - Training: role-based training at onboarding and at least annually, covering red flags, escalation, sanctions, and confidentiality of SARs; - Independent testing: annual review of program effectiveness by qualified independent parties, with findings tracked to remediation; and - Risk assessment: an enterprise BSA/AML and sanctions risk assessment updated at least annually and whenever products, customers, or geographies change.

3. Customer Due Diligence (CDD)

For Milli Elite Card features, Milli performs customer identification and verification under the partner bank's Customer Identification Program (see our Patriot Act CIP Notice), develops a customer risk profile based on expected activity, and conducts ongoing monitoring to maintain and update customer information on a risk basis.

4. Enhanced Due Diligence (EDD)

Customers presenting higher risk, such as those with unusual transaction patterns, adverse media, connections to higher-risk jurisdictions, or politically exposed person status, are subject to enhanced due diligence, which may include additional documentation, source-of-funds review, senior compliance approval, and more frequent monitoring.

5. Transaction Monitoring

Milli uses automated monitoring rules and analytics, supplemented by human review, to identify unusual or potentially suspicious activity, including rapid movement of funds, structuring, activity inconsistent with a customer's profile, and known fraud typologies. Alerts are documented, investigated, and resolved within defined timeframes.

6. Suspicious Activity Reports (SARs)

When activity is identified that may involve money laundering, terrorist financing, fraud, or other illicit activity, Milli escalates it for investigation. SARs are filed with FinCEN by Milli or its partner bank, as applicable, generally within 30 calendar days of initial detection of facts that may constitute a basis for filing (up to 60 days when no suspect is identified), with continuing activity reviews as required. Milli does not disclose the existence of a SAR, as prohibited by 31 U.S.C. section 5318(g)(2).

7. Currency Transaction Reports (CTRs)

Milli does not accept cash. Where cash transactions in excess of $10,000 in a single business day occur through partner channels (for example, cash deposits at participating retail locations), CTRs are filed by the responsible financial institution within 15 calendar days. Milli monitors for structuring designed to evade CTR thresholds and escalates such activity for SAR consideration.

8. OFAC Sanctions Screening

Milli screens all Elite Card applicants and relevant counterparties against the OFAC Specially Designated Nationals and Blocked Persons ("SDN") List and other applicable U.S. sanctions lists at onboarding, upon list updates, and on an ongoing basis. Potential matches are reviewed and, where confirmed, accounts are blocked or transactions rejected and reported to OFAC as required. Milli does not provide services to persons located in comprehensively sanctioned jurisdictions.

9. Record Retention

Milli retains BSA records, including customer identification records, transaction records, SARs and supporting documentation, CTRs, and training and testing records, for five years from the date of the record (or from account closure for CIP records), as required by 31 C.F.R. Chapter X. Records are stored securely and are retrievable for examination by regulators and law enforcement.

Milli supports its partner bank in responding to FinCEN Section 314(a) requests, which require financial institutions to search their records for accounts or transactions of persons that may be involved in terrorism or money laundering, and responds within the required timeframe (generally 14 days). Where eligible, Milli intends to participate in the Section 314(b) voluntary information-sharing program with other registered financial institutions, under the safe harbor provided by law.

11. Cooperation and Governance

Milli cooperates fully with lawful requests from FinCEN, law enforcement, and regulators. Program performance is reported to senior management at least quarterly.

12. Contact

BSA/AML and FinCEN compliance inquiries, including from regulators and financial institution partners: compliance@drivemilli.com.