Legal document

AML/KYC Policy

Operator: FIRSTSTONE TRADING sp. z o.o.
Version: 2.0
Effective date: 2026-06-06
Last updated: 2026-08-09
Language: Polish
Legal contact: compliance@purepoint.pl

Shop Operator: FIRSTSTONE TRADING spółka z ograniczoną odpowiedzialnością (abbreviation: FIRSTSTONE TRADING sp. z o.o.) KRS: 0001254766 | NIP: 7831958614 Registry court: District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register (KRS) Date of registration: 17 February 2026 Registered office (KRS): ul. Wierzbięcice 44A/40A, 61-568 Poznań, województwo wielkopolskie Voivodeship Correspondence / Shop service address: ul. Wierzbięcice 44A/40A, 61-568 Poznań (100 shares of PLN 50 each) Representation: Krystian Dawidowski — Member of the Management Board (sole management board, individual representation) ADE (e-Delivery): AE:PL-21312-60691-FGBFV-19 Compliance Officer: compliance@purepoint.pl

Document version: 2.0 Effective date: 6 June 2026 Review frequency: quarterly

Purpose of the policy and the basis for its proactive application
Justification for the absence of obligated-institution status
Definitions
Three-tier KYC policy (Tier 1 / Tier 2 / Tier 3)
Required documents by tier
Sanctions lists and their real-time updating
Ultimate beneficial owner — definition and determination procedure
Procedure for refusing to process an order
Procedure for reporting suspicious transactions to GIIF
KYC data retention and archiving obligations
Cooperation with State authorities
Audit trail — verification record in the order metadata
Compliance Officer and accountability structure
Bibliography and legal basis
Change history
Final clause

1. Purpose of the policy and the basis for its proactive application

§ 1 para. 1. This AML/KYC Policy (hereinafter the “Policy“) sets out the rules under which the Operator of the purepoint.pl Shop — FIRSTSTONE TRADING sp. z o.o. (hereinafter the “Operator“) — voluntarily and proactively applies selected elements of the anti-money laundering and counter-terrorist financing regime (Anti-Money Laundering, AML) and customer identification procedures (Know Your Customer, KYC), despite the fact that the Operator is not an obligated institution within the meaning of Art. 2 para. 1 of the Act of 1 March 2018 on counteracting money laundering and terrorist financing (consolidated text: Journal of Laws 2023 item 1124, as amended; hereinafter: the AML Act).

§ 1 para. 2. Objectives of the Policy: 1. preventing the use of the purepoint.pl Shop for money laundering or terrorist financing; 2. preventing the misuse of Research Materials by entities subject to international sanctions (EU, USA, UN); 3. verifying the status of the Qualified Buyer and the consistency of their declarations with their actual business profile; 4. protecting the Operator against civil and criminal liability arising from unwitting participation in criminal activity; 5. building institutional trust — with banks, payment service providers (Stripe), State authorities and academic partners.

§ 1 para. 3. The proactive application of the Policy stems from three strategic motivations: 1. Compliance-by-design — the research materials sector is regarded as a high-risk merchant category by financial institutions; the independent implementation of AML/KYC procedures reduces the risk of a bank account being frozen, of the agreement with Stripe being terminated, or of being cut off from payment gateways. 2. Reputation within the research community — laboratories, universities and pharmaceutical companies vetting a supplier expect transparent procedures for identifying the end recipient of substances. 3. Protection against potential interpretation by the authorities — notwithstanding the current absence of obligated-institution status, holding an AML/KYC Policy constitutes evidence of due diligence in the event of hypothetical enquiries from the General Inspector of Financial Information (GIIF — Polish Financial Intelligence Unit), the National Revenue Administration (KAS) or the public prosecutor’s office.

§ 1 para. 4. The Policy is effective from 6 June 2026 and is subject to quarterly review by the Operator’s Compliance Officer.

2. Justification for the absence of obligated-institution status

§ 2 para. 1. Pursuant to Art. 2 para. 1 of the AML Act, obligated institutions include, among others: domestic banks, branches of foreign banks, cooperative savings and credit unions, domestic payment institutions, domestic electronic money institutions, investment firms, investment fund management companies, insurance undertakings, currency exchange offices, entities conducting business activity consisting in the provision of services for exchange between virtual currencies and means of payment, tax advisory service offices, statutory auditors, advocates and legal advisers within a defined scope, notaries, real estate intermediaries, entities conducting business activity in the provision of bookkeeping services, and entrepreneurs accepting or making cash payments of a value equal to or exceeding EUR 10,000.

§ 2 para. 2. The Operator does not provide any of the services listed in Art. 2 para. 1 of the AML Act, and in particular: 1. does not provide payment services within the meaning of the Act of 19 August 2011 on payment services (Journal of Laws 2024 item 30, as amended); 2. does not provide financial or investment advisory services; 3. does not conduct currency exchange activity or currency exchange (including virtual currencies); 4. does not trade in securities or provide brokerage services; 5. does not conduct banking activity within the meaning of the Act of 29 August 1997 — Banking Law (Journal of Laws 2024 item 1646, as amended); 6. does not provide trust services or third-party asset management; 7. does not accept cash payments of a value equal to or exceeding EUR 10,000 — all Shop payments are made by non-cash means (Stripe Payments Europe Limited and BACS transfer to the Operator’s bank account).

§ 2 para. 3. The Operator is a seller of Research Materials — substances offered exclusively for research, laboratory, scientific and educational purposes. This activity is classified under the Polish Classification of Business Activities (PKD) under codes appropriate for the retail sale and distribution of chemical reagents, and not for financial services.

§ 2 para. 4. Consequently, the Operator is not subject to the obligations under Art. 33–86 of the AML Act (among others, it is not obliged to apply financial security measures, to carry out a risk assessment, or to submit SAR/CTR reports under a mandatory regime). Nevertheless — for the motivations set out in § 1 para. 3 — the Operator voluntarily applies selected elements of the AML/KYC regime described in the further part of the Policy.

§ 2 para. 5. The Operator reserves that, in the event of a change in its business profile that would result in the Operator being covered by the catalogue in Art. 2 para. 1 of the AML Act, the Policy will be promptly updated to meet the statutory requirements, and the Compliance Officer will apply for entry into the register of obligated institutions maintained by the competent authority.

3. Definitions

§ 3. For the purposes of this Policy, the following definitions are adopted:

Operator — FIRSTSTONE TRADING sp. z o.o.;
Shop — the online service for the sale of Research Materials operated under the purepoint.pl domain;
Qualified Buyer — a natural person conducting business activity, a legal person or an organisational unit without legal personality (Art. 43(1) of the Civil Code, hereinafter the “CC“), purchasing Research Materials exclusively for a purpose connected with business, professional, research or academic activity, excluding a consumer (Art. 22(1) CC);
KOP — Qualified Profile Declaration (Kwalifikowane Oświadczenie Profilu) — a set of 5 compliance declarations + indication of the Qualified Buyer category + supplementary data;
Tier — the KYC level applied depending on the value of the order or the aggregate value of the Qualified Buyer’s orders over 12 months;
Research Materials or Products — substances offered exclusively for laboratory research purposes, not intended for consumption or for administration to humans or animals;
Ultimate beneficial owner — a natural person within the meaning of Art. 2 point 1 of the AML Act, exercising direct or indirect control over a legal person that is a Qualified Buyer;
GIIF — the General Inspector of Financial Information (Polish Financial Intelligence Unit), the authority competent in matters of counteracting money laundering and terrorist financing, acting on the basis of Art. 12 of the AML Act;
Compliance Officer — an employee designated by the Operator responsible for implementing the Policy; contact address: compliance@purepoint.pl;
Sanctions lists — lists of persons, entities and organisations subject to international sanctions: European Union (EU Consolidated Financial Sanctions List), United States (OFAC SDN List), United Nations (UN Security Council Consolidated List).

4. Three-tier KYC policy

§ 4 para. 1. The Operator applies three levels of Qualified Buyer verification, assigned to the value of a single order or the aggregate value of orders over the preceding 12 calendar months (whichever value is higher).

§ 4 para. 2. Tier 1 — Standard (up to 5 000 EUR / order)

Scope: single orders with a gross value of up to 5 000 EUR and an aggregate value of the Qualified Buyer’s orders over the preceding 12 months not exceeding 15 000 EUR.

Procedure: 1. Completion of the standard KOP in accordance with the Shop Terms and Conditions (5 declarations + selection of the Qualified Buyer category: STUDENT, LAB, SCIENTIST, BIZ_RD, OTHER_PRO); 2. basic verification of identification data (first name, surname, address, NIP in the case of a legal person); 3. automated screening of the list of email addresses and surnames for basic consistency with the sanctions lists; 4. no manual review — the order is processed automatically following acceptance of the KOP and payment; 5. handling time: up to 24 business hours.

§ 4 para. 3. Tier 2 — Manual Review (5 000 – 15 000 EUR)

Scope: single orders with a gross value of between 5 000 EUR and 15 000 EUR, or an aggregate value of the Qualified Buyer’s orders over 12 months exceeding 15 000 EUR (and not exceeding 50 000 EUR).

Procedure: 1. Completion of the extended KOP; 2. verification of the Qualified Buyer category: – for LAB and BIZ_RD: verification of the NIP in the KRS register (National Court Register) or CEIDG (Central Register and Information on Business Activity) — checking the consistency of the PKD with the declared profile (PKD 74.10.Z / 72.11.Z / 72.19.Z / 72.20.Z / 21.20.Z); – for SCIENTIST: verification of the ORCID number (Open Researcher and Contributor ID) and institutional affiliation in a public database (orcid.org); – for STUDENT: request for a copy of a valid student or doctoral ID card with a visible field of study (biomed/chemistry/biotechnology/pharmacy); – for OTHER_PRO: detailed manual review of the 100+ character declaration and additional documents confirming research activity; 3. request for additional documents in case of doubt — a certificate from a laboratory, a university affiliation document, a description of the research project, an invoice issued to a scientific institution; 4. extended sanctions screening — verification of both the names of natural persons and the names of entities and delivery addresses against the EU, OFAC SDN and UN lists; 5. approval of the order by the Compliance Officer; 6. handling time: up to 5 business days.

§ 4 para. 4. Tier 3 — Full KYC (> 15 000 EUR)

Scope: single orders with a gross value exceeding 15 000 EUR, or an aggregate value of the Qualified Buyer’s orders over 12 months exceeding 50 000 EUR.

Procedure: 1. Completion of the extended KOP and a dedicated Tier 3 KYC form (template available on request at compliance@purepoint.pl); 2. identification of the ultimate beneficial owner of the legal person in accordance with the procedure set out in § 7 of this Policy; 3. verification of the source of funds (Source of Funds) and the source of wealth (Source of Wealth) of the Qualified Buyer: – a declaration on the source of funds (research grant, own funds, corporate financing, EU subsidy, commercial contract); – supporting documentation (grant agreement, 3-month bank statement, subsidy award decision, copy of the contract); 4. full extended sanctions screening: – the natural person placing the order; – the legal person (Qualified Buyer); – ultimate beneficial owners (UBOs); – members of the management board and supervisory board (PEP — Politically Exposed Persons); – delivery addresses and logistics intermediaries; – bank accounts of the payment sender; 5. legal consultation with an external law firm in the case of orders > 50 000 EUR gross; 6. approval of the order by the Compliance Officer and a Member of the Management Board (Krystian Dawidowski) — a requirement for two independent signatures; 7. handling time: up to 14 business days.

§ 4 para. 4a. Currency conversion. The Tier thresholds expressed in EUR are converted into PLN at the average exchange rate of the National Bank of Poland (NBP) as of the date the order is placed, published in NBP’s Table of average exchange rates of foreign currencies No. A. In the case of orders settled in a foreign currency other than EUR, a cross-conversion is applied via the NBP average exchange rate as of the date the order is placed. This mechanism is consistent with the currency conversion method applied in the Operator’s International Sanctions and Export Control Policy.

§ 4 para. 5. The Operator reserves the right to raise the Tier level for a given Qualified Buyer irrespective of the order value if circumstances arise indicating an elevated risk (e.g. an order from a country with elevated AML risk under the FATF list, inconsistency of data, suspicion of so-called structuring — splitting a transaction into smaller portions in order to circumvent the thresholds).

§ 4 para. 6. Geographic exclusion of deliveries: the Operator does not carry out shipments to the following countries subject to restrictions: Russian Federation, Belarus, Iran, North Korea, Syria, Cuba, Venezuela, Myanmar. The geo-block is applied at the basket level — a Buyer with a delivery address in the aforementioned jurisdictions is unable to place an order.

5. Required documents by tier

§ 5 para. 1. Catalogue of documents required from the Qualified Buyer depending on the Tier level:

Document	Tier 1	Tier 2	Tier 3
Standard KOP (5 declarations + category)	YES	YES	YES
Identification data (first name, surname, address)	YES	YES	YES
NIP (for legal persons and sole proprietorships)	YES	YES	YES
Extract from KRS / CEIDG (no older than 30 days)	—	YES	YES
Copy of student ID card (STUDENT category)	—	YES	YES
ORCID verification (SCIENTIST category)	—	YES	YES
Certificate from a laboratory (LAB category)	—	YES	YES
Description of the research project (OTHER_PRO)	—	YES	YES
Identity document of the ultimate beneficial owner	—	—	YES
List of UBOs from CRBR (Central Register of Beneficial Owners)	—	—	YES
Declaration on the source of funds (SoF)	—	—	YES
Declaration on the source of wealth (SoW)	—	—	YES
Documentation supporting SoF/SoW	—	—	YES
Power of attorney from the management board (if the order is placed by a third party on behalf of the company)	—	YES	YES
End-Use Statement	—	YES	YES

§ 5 para. 2. All documents are submitted in electronic form to compliance@purepoint.pl or via secure upload in the Buyer’s panel. Documents are verified for authenticity (dating, stamps, consistency with public registers); they are not, however, a basis for assessing creditworthiness or legal status — they serve compliance verification purposes only.

§ 5 para. 3. The Operator does not require from the Buyer any documents going beyond the scope necessary to verify the Qualified Buyer’s status and to fulfil the obligations set out in this Policy, in accordance with the data minimisation principle (Art. 5 para. 1 point c GDPR).

§ 5 para. 4. Basis for processing KYC data. Since the Operator is not an obligated institution and applies KYC procedures voluntarily, the basis for processing the personal data collected under this Policy is: 1. Art. 6 para. 1 point b GDPR — necessity for the performance of the contract with the Qualified Buyer (processing of the order) — in respect of identification data and verification of the Buyer’s status; 2. Art. 6 para. 1 point f GDPR — the Operator’s legitimate interest in preventing abuse, protecting against legal liability and maintaining relationships with payment service providers and banks — in respect of sanctions screening, determination of the UBO and the audit trail; 3. Art. 6 para. 1 point c GDPR — to the extent that a specific obligation (e.g. responding to a request from an authority) arises from mandatory provisions of law. The details of processing (controller, purposes, retention periods, data subjects’ rights) are set out in the Shop’s Privacy Policy, with which this Policy remains consistent.

6. Sanctions lists and their real-time updating

§ 6 para. 1. The Operator uses three primary sources of sanctions lists updated in close-to-real-time (real-time / near real-time):

European Union — EU Consolidated Financial Sanctions List – source: EU Sanctions Map (sanctionsmap.eu) and publications in the Official Journal of the EU; – legal basis: Council (EU) regulations issued on the basis of Art. 215 TFEU and common positions under the Common Foreign and Security Policy (CFSP); – update frequency: at the moment a new regulation is published in the Official Journal of the EU;
United States — OFAC Specially Designated Nationals and Blocked Persons List (SDN List) – source: Office of Foreign Assets Control, U.S. Department of the Treasury (treasury.gov/ofac); – significance: notwithstanding that the Operator is a Polish entity, OFAC sanctions have an actual impact on the ability to carry out payments within the SWIFT system and on exposure to U.S. service providers (Stripe, Plausible); – frequency: verification at least once every 24 hours on a daily cycle;
United Nations — UN Security Council Consolidated List – source: scsanctions.un.org; – significance: covers UN Security Council resolutions implemented at the level of the EU and the Member States; – frequency: verification on request and on a weekly cycle.

§ 6 para. 2. The Operator deploys a sanctions-screening tool which: 1. validates the Qualified Buyer’s data at the moment the order is placed (Tier 1 — basic screening, Tier 2 and 3 — extended screening); 2. carries out a daily re-screening of the active Qualified Buyers database against the updated sanctions lists; 3. generates an alert (red flag) in the event of a hit and blocks the processing of further orders until resolved by the Compliance Officer; 4. retains screening logs for a period of at least 5 years (Section 10 of this Policy).

§ 6 para. 3. In the event of a hit against the sanctions lists (a so-called true match), the Operator: 1. promptly suspends processing of the order; 2. does not refund the amount paid without prior consultation with the Compliance Officer and, if necessary, with Stripe Payments Europe Limited and the bank maintaining the Operator’s account; 3. considers filing a notification with GIIF under Art. 89 para. 1 of the AML Act (Section 9 of this Policy); 4. archives the full incident documentation for a period of 10 years.

§ 6 para. 4. Low-confidence hits (a so-called fuzzy match — similarity of a surname/name without full data consistency) are subject to manual review by the Compliance Officer within 48 hours of detection.

7. Ultimate beneficial owner — definition and determination procedure

§ 7 para. 1. The Operator applies the definition of ultimate beneficial owner from Art. 2 point 1 of the AML Act:

“Ultimate beneficial owner — any natural person exercising direct or indirect control over a client through the powers held, arising from legal or factual circumstances, enabling a decisive influence to be exerted over the acts or activities undertaken by the client, or any natural person on whose behalf business relations are established or an occasional transaction is carried out.”

§ 7 para. 2. In relation to legal persons other than companies whose securities are admitted to trading on a regulated market, the ultimate beneficial owner is deemed to be: 1. a natural person who is a shareholder holding ownership rights to more than 25% of the total number of shares in that legal person; 2. a natural person holding more than 25% of the total number of votes in the decision-making body of that legal person, also as a pledgee or usufructuary, or on the basis of agreements with other persons entitled to vote; 3. a natural person exercising control over a legal person or legal persons that jointly hold ownership rights to more than 25% of the total number of shares; 4. a natural person exercising control over a legal person by holding, in relation to it, the powers referred to in Art. 3 para. 1 point 37 of the Act of 29 September 1994 on accounting (Journal of Laws 2023 item 120, as amended).

§ 7 para. 3. Procedure for determining the ultimate beneficial owner (Tier 3): 1. request for an extract from CRBR (Central Register of Beneficial Owners maintained by the Minister of Finance on the basis of Art. 55 of the AML Act); 2. request for a declaration from the person representing the Qualified Buyer as to the identity of the UBO — template available on request at compliance@purepoint.pl; 3. verification of a copy of the UBO’s identity document (identity card / passport — with numbers irrelevant to the verification redacted, in accordance with Art. 5 GDPR); 4. screening of the UBO against the sanctions lists and PEP lists (Politically Exposed Persons); 5. archiving of the results in the order metadata (Section 12 of this Policy).

§ 7 para. 4. In the event that it is impossible to unambiguously determine the ultimate beneficial owner despite exhausting the measures indicated in § 7 para. 3, the Operator deems the ultimate beneficial owner to be a member of the managing body of the legal person — by analogy to Art. 2 point 1 letter b in fine of the AML Act.

§ 7 para. 5. In relation to sole proprietorships, the ultimate beneficial owner is the natural person conducting that business activity, and the determination procedure is limited to verification of the entry in CEIDG.

8. Procedure for refusing to process an order

§ 8 para. 1. The Operator reserves the right to refuse to process an order in each of the following cases: 1. a hit of the Qualified Buyer or UBO against the sanctions lists (true match or confirmed fuzzy match); 2. refusal or evasion by the Qualified Buyer in providing the documents required for the given Tier; 3. demonstration that the KOP declarations are untrue (e.g. a non-existent NIP, inconsistency of the PKD, a forged ID card); 4. suspicion of so-called structuring (splitting orders into portions below 5 000 EUR in order to circumvent Tier 2); 5. an order with a delivery address in a country subject to the geo-block (§ 4 para. 6); 6. a payment order from a bank account maintained by an institution subject to sanctions; 7. the impossibility of unambiguously determining the UBO despite applying the procedure under § 7 para. 3; 8. a justified suspicion that the Research Materials may be used contrary to the Buyer’s declaration (e.g. consumer resale, illegal manufacture); 9. other circumstances indicating an elevated AML/CFT risk (Counter-Financing of Terrorism).

§ 8 para. 2. Communication of the refusal: the Qualified Buyer receives an email at the address provided when placing the order, containing: 1. information about the refusal to process the order; 2. an indication that a detailed justification of the refusal is not provided where this could disclose the irregularity-detection procedures applied or breach the Operator’s obligations; 3. information about a full refund of the amount paid within 14 days of the date of refusal; 4. an indication of the appeal channels: compliance@purepoint.pl and the complaints form; 5. a notice of the right to lodge a complaint with the President of the Personal Data Protection Office, where the refusal involves the processing of personal data.

§ 8 para. 3. The refund of funds is made exclusively to the bank account from which the payment was made, in order to avoid the risk of money laundering through the transfer of funds to third-party accounts.

§ 8 para. 4. In cases where the Operator suspects an offence, the decision on the refund of funds is taken following consultation with the Compliance Officer and, if necessary, with the bank maintaining the Operator’s account and Stripe Payments Europe Limited. In extreme cases the Operator may withhold the refund until an instruction is issued by the public prosecutor’s office or GIIF.

§ 8 para. 5. The decision to refuse is recorded in the internal refusal register (Refusal Register) maintained by the Compliance Officer, containing at least: the order identifier, the date of refusal, the basis for the refusal, the outcome of the consultation, the date of the refund, and any notification to GIIF.

9. Procedure for reporting suspicious transactions to GIIF

§ 9 para. 1. Although the Operator is not an obligated institution, Art. 89 para. 1 of the AML Act provides:

“Anyone who, in connection with the professional activity carried out, has formed a suspicion that specified assets originate from a crime or are connected with a crime, or may serve to finance terrorism, is obliged to notify the General Inspector thereof without delay.”

§ 9 para. 2. The Operator interprets the above provision as a legal basis for the voluntary reporting of suspicious transactions even in situations where it does not have obligated-institution status.

§ 9 para. 3. Procedure for reporting to GIIF: 1. the Compliance Officer draws up a description of the circumstances indicating a suspicion of money laundering or terrorist financing; 2. gathering of the full transaction documentation (KOP, Tier documents, screening logs, email correspondence, payment documentation); 3. transmission of the notification to GIIF via the GIIF IT system (eGIIF) or in written form to the address: Financial Information Department, Ministry of Finance, ul. Świętokrzyska 12, 00-916 Warsaw; 4. simultaneous notification of the Member of the Management Board (Krystian Dawidowski); 5. maintaining confidentiality as to the fact of the report — the Qualified Buyer is not informed of the fact of the report (Art. 90 of the AML Act).

§ 9 para. 4. Tipping-off prohibition: the prohibition on disclosing the fact of the report to the person to whom the report relates, or to third parties — by analogy to Art. 54 of the AML Act applied by obligated institutions.

§ 9 para. 5. In the event that there is a suspicion of an offence other than money laundering or terrorist financing (e.g. trafficking in psychoactive substances, document forgery), the Operator notifies the relevant law enforcement authorities: the district prosecutor’s office competent for the Operator’s registered office (District Prosecutor’s Office in Gdańsk-Wrzeszcz) or the Police, irrespective of the report to GIIF.

10. KYC data retention and archiving obligations

§ 10 para. 1. The Operator retains KYC documentation in accordance with the following rules:

Data category	Retention period	Basis
KOP, identification data, Tier 2 and Tier 3 documents	5 years from the end of the year in which the business relationship expired	Art. 49 para. 1 of the AML Act (per analogiam)
Sanctions screening logs	5 years from the screening date	Art. 49 para. 1 of the AML Act (per analogiam)
Tier 3 documents (UBO, SoF, SoW)	5 years from the end of the year in which the relationship expired	Art. 49 para. 1 of the AML Act (per analogiam)
Refusal Register	5 years from the date of refusal	Art. 49 para. 1 of the AML Act (per analogiam)
Documentation of the report to GIIF	5 years + an additional 5 years at GIIF’s request, up to a total of 10 years	Art. 49 para. 2 of the AML Act (per analogiam)
Documentation of suspicions of an offence other than AML	10 years	prosecutorial practice

§ 10 para. 2. Upon expiry of the retention period, documents are destroyed in a manner that prevents their reconstruction (physical shredding for paper documents, secure deletion for digital files — Gutmann pattern or equivalent).

§ 10 para. 3. KYC data is stored in a secure IT system hosted by cyber_Folks S.A., with access restricted to the Compliance Officer and the Member of the Management Board. Data is encrypted at-rest (AES-256) and in-transit (TLS 1.3).

§ 10 para. 4. The retention of KYC data remains consistent with the Privacy Policy and the Data Retention Policy — in the event of a discrepancy, the longer retention periods arising from this Policy take precedence.

11. Cooperation with State authorities

§ 11 para. 1. The Operator undertakes to cooperate fully and promptly with the following authorities:

General Inspector of Financial Information (GIIF — Polish Financial Intelligence Unit) — in respect of reporting suspicious transactions and responding to requests to provide documentation under Art. 84–85 of the AML Act;
Tax Office (US) and the National Revenue Administration (KAS) — in respect of: – tax and customs-fiscal audits; – requests to provide information under Art. 45 of the Act of 16 November 2016 on the National Revenue Administration (Journal of Laws 2023 item 615, as amended); – proceedings concerning VAT and CIT;
The public prosecutor’s office and the Police — in respect of: – criminal proceedings conducted against Qualified Buyers or third parties; – providing secured documentation on the basis of a court or prosecutorial order; – giving testimony in preparatory and judicial proceedings (Art. 177 et seq. of the Code of Criminal Procedure);
Chief Pharmaceutical Inspectorate (GIF) — in respect of suspicions of trading in medicinal products without the required authorisation;
President of the Personal Data Protection Office (UODO) — in respect of proceedings concerning the processing of Qualified Buyers’ personal data in KYC procedures.

§ 11 para. 2. Requests from authorities are processed by the Compliance Officer within: 1. 24 hours — requests marked as urgent (e.g. an interim court order, securing of assets); 2. 7 business days — standard requests; 3. 30 days — requests requiring the preparation of historical compilations (e.g. all of a given Buyer’s transactions over 5 years).

§ 11 para. 3. Before disclosing information, the Operator verifies the lawfulness of the request — it checks the legal basis, the requesting entity and the scope of the demand. In case of doubt, it consults an external law firm.

§ 11 para. 4. The Operator does not disclose the fact of cooperation with the authorities to outsiders or to the Qualified Buyers concerned by the cooperation, where this arises from provisions of law or the content of the request (e.g. the obligation of confidentiality in preparatory proceedings).

12. Audit trail — verification record in the order metadata

§ 12 para. 1. Every order placed in the purepoint.pl Shop has, in the Operator’s database, extended KYC metadata covering at least:

Order identifier (UUID + external number);
KYC Tier applied (1, 2, 3) together with the justification for the choice of level (order value, aggregate value over 12 months);
Content of the KOP in the form in which the Buyer accepted the declarations (a snapshot at the moment the order was placed, with a SHA-256 hash to preserve non-falsifiability);
Qualified Buyer category (STUDENT / LAB / SCIENTIST / BIZ_RD / OTHER_PRO) + supplementary data declared by the Buyer;
Results of register verification (timestamp, source — KRS, CEIDG, ORCID — result: match / mismatch / no data);
Results of sanctions screening (timestamp, source list, result: clean / fuzzy match / true match);
List of documents provided by the Buyer (file name, upload date, SHA-256 hash);
Compliance Officer’s decision (approval / refusal / request for additional documents) together with a timestamp and the identifier of the decision-maker;
Member of the Management Board’s decision (Tier 3 only) together with a timestamp and electronic signature;
GIIF report identifier (where applicable);
Final status of the order (processed / refused / refunded / suspended / reported to the authorities);
Communication logs with the Qualified Buyer (email thread, ticket system).

§ 12 para. 2. The KYC metadata is non-modifiable after the order is finalised — any changes are made on an append-only basis (adding a new record instead of overwriting the previous one), preserving the full change history.

§ 12 para. 3. The audit trail is made available: 1. to the Compliance Officer — full access; 2. to the Member of the Management Board — full access; 3. to State authorities — on the basis of a valid request (§ 11 para. 1); 4. to the Qualified Buyer — the scope relating to their own orders, under Art. 15 GDPR (right of access).

§ 12 para. 4. The Operator carries out a quarterly review of the audit trail in order to identify risk patterns (e.g. repeated orders from particular IP addresses, inconsistencies in declarations) — the results of the review are passed to the Compliance Officer and serve to update the Policy under the quarterly cycle.

13. Compliance Officer and accountability structure

§ 13 para. 1. The Operator’s Compliance Officer is responsible for: 1. implementing and ongoing application of this Policy; 2. performing KYC procedures for Tier 2 and Tier 3; 3. managing sanctions screening and responding to alerts; 4. communication with GIIF, law enforcement authorities and supervisory authorities; 5. maintaining the Refusal Register and the audit trail; 6. quarterly review of the Policy and proposals for updates; 7. internal training for the Operator’s employees and associates.

§ 13 para. 2. Accountability structure: 1. Compliance Officer: Kacper Gan (Project & Strategy Coordinator / Compliance Lead) — operational implementation of the Policy, day-to-day compliance decisions, Tier 3 escalation; 2. Member of the Management Board / Managing Person: Krystian Dawidowski — Member of the Management Board — formal responsibility for the policy, Tier 3 approval (second signature), representation of the Operator before State authorities, taking strategic decisions.

§ 13 para. 3. The Compliance Officer has the right to independently escalate risk matters directly to the Member of the Management Board, bypassing the operational hierarchy, where there is a justified suspicion of a conflict of interest or a serious breach.

§ 13 para. 4. Channels for contacting the Compliance Officer: – Email: compliance@purepoint.pl – Correspondence address: FIRSTSTONE TRADING sp. z o.o., ul. Wierzbięcice 44A/40A, 61-568 Poznań – ADE (e-Delivery): AE:PL-21312-60691-FGBFV-19 – Telephone contact: available to customers holding an account in the order service panel and on request at compliance@purepoint.pl.

§ 13 para. 5. The Compliance Officer undergoes quarterly training on changes in AML/CFT law, international sanctions and FATF good practices.

14. Bibliography and legal basis

§ 14 para. 1. National legal acts:

Act of 1 March 2018 on counteracting money laundering and terrorist financing (consolidated text: Journal of Laws 2023 item 1124, as amended);
Act of 23 April 1964 — Civil Code (consolidated text: Journal of Laws 2024 item 1061, as amended);
Act of 6 June 1997 — Penal Code (consolidated text: Journal of Laws 2024 item 17, as amended), in particular Art. 233 of the Penal Code (false testimony) and Art. 299 of the Penal Code (money laundering);
Act of 6 September 2001 — Pharmaceutical Law (consolidated text: Journal of Laws 2025 item 750), in particular Art. 124 para. 1: “whoever places a medicinal product on the market without the required authorisation shall be subject to a fine, the penalty of restriction of liberty or deprivation of liberty for up to 2 years”;
Act of 19 August 2011 on payment services (Journal of Laws 2024 item 30, as amended);
Act of 29 August 1997 — Banking Law (Journal of Laws 2024 item 1646, as amended);
Act of 16 November 2016 on the National Revenue Administration (Journal of Laws 2023 item 615, as amended);
Act of 29 September 1994 on accounting (Journal of Laws 2023 item 120, as amended);
Act of 30 May 2014 on consumer rights (Journal of Laws 2023 item 2759, as amended; hereinafter the “UPK“);
Act of 6 June 1997 — Code of Criminal Procedure (Journal of Laws 2024 item 37).

§ 14 para. 2. European Union legal acts:

Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (4AMLD), as amended by Directive (EU) 2018/843 (5AMLD);
Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLR);
Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 establishing the Anti-Money Laundering Authority (AMLA);
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR);
Council (EU) regulations implementing international sanctions — a compendium is available at sanctionsmap.eu.

§ 14 para. 3. International standards and guidelines:

FATF Recommendations (International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation) — Financial Action Task Force, edition as updated;
UN Security Council Consolidated List — scsanctions.un.org;
OFAC Specially Designated Nationals (SDN) List — U.S. Department of the Treasury;
Wolfsberg Group Guidance on AML/CFT — best practices for financial institutions.

15. Change history

Version	Date	Scope of changes	Author
1.0	2026-05-22 / 2026-05-24	Original drafting of the AML/KYC Policy — Tiers of 5k / 50k EUR, general structure. Erratum: the quotation of Art. 124 of the Pharmaceutical Law required correction.	Compliance Officer
2.0	2026-06-06	Rebuild: three Tiers (5k / 15k / 50k EUR), full UBO procedure, integration with the definition of the Qualified Buyer, EU/OFAC/UN sanctions, geo-block (RU/BY/IR/KP/SY/CU/VE/MM), order metadata audit trail, correction of the quotation of Art. 124 of the Pharmaceutical Law (penalty of up to 2 years’ deprivation of liberty + fine), cooperation with GIIF despite the absence of obligated-institution status.	Compliance Officer

16. Final clause

§ 16 para. 1. In matters not regulated by this document, the mandatory provisions of Polish and European Union law shall apply.

§ 16 para. 2. In case of doubts as to interpretation, please contact compliance@purepoint.pl.

§ 16 para. 3. This Policy constitutes a document of an internal nature to the Operator as well as a publicly available declaration of compliance standards. It does not create subjective rights of Qualified Buyers to demand a particular assessment of their application — the Operator retains full discretion to decide on the processing of an order within the limits of the law.

§ 16 para. 4. Any provisions of acts, regulations and directives cited in the text are to be understood in the wording in force as of the effective date of this Policy (6 June 2026), taking into account their subsequent amendments — upon the entry into force of the next version of the Policy, the references will be updated accordingly.

AML/KYC Policy v2.0 — purepoint.pl Shop — FIRSTSTONE TRADING sp. z o.o. Effective date: 6 June 2026 | Next review: 6 September 2026