ALPHAPAY TECHNOLOGY LIMITED

Complaints Handling and Management Policy

1. Purpose and policy commitment

1.1 This Policy establishes the process by which ALPHAPAY TECHNOLOGY LIMITED (“Alphapay”) receives, records, investigates, resolves, escalates, reports and learns from complaints. It supports clause 11 (Complaints and notices) of Alphapay’s Business Money Services Terms and Conditions (the “Terms and Conditions”). Capitalized terms not defined in this Policy have the meanings given in the Terms and Conditions.

1.2 Alphapay will operate a complaint process that is free of charge, clear, accessible, impartial, timely and proportionate. A complainant will not receive adverse treatment merely for raising a complaint in good faith.

1.3 This Policy is designed for Alphapay’s Canadian business money-services activities. Where a complaint concerns payment-card services governed by the Code of Conduct for the Payment Card Industry in Canada (the “Payment Card Code”), the mandatory Code requirements prevail over any less protective internal standard.

2. Scope and eligibility

2.1 This Policy applies to complaints from current, former and prospective Clients; Authorized Persons; beneficiaries; merchants; payers; and other persons materially affected by Alphapay’s Services. Eligibility does not depend on a turnover, income, asset or residency threshold, although the availability of an external forum may depend on that forum’s jurisdiction and eligibility rules.

2.2 A representative may complain for another person if Alphapay receives evidence of authority appropriate to the circumstances. Alphapay may accept an anonymous complaint, but the ability to investigate or provide personal information may be limited.

2.3 This Policy applies regardless of whether a complaint is made orally or in writing and regardless of whether the complainant uses the word “complaint”. It does not replace procedures for whistleblowing, employment grievances, law-enforcement requests, litigation, privacy breaches, security incidents or suspicious transaction reporting, although the Complaint Officer must refer such matters promptly to the responsible function.

3. Definitions

3.1 “Complaint” means an expression of dissatisfaction about Alphapay, the Services, an Order, an employee, an agent or a service provider, where a response or resolution is expressly or reasonably expected. A routine question or service request is not a Complaint unless the person expresses dissatisfaction with the response, delay, conduct or outcome.

3.2 “Code Complaint” means a Complaint alleging non-compliance with the Payment Card Code in relation to a payment-card product or service provided to a merchant by an acquirer or downstream participant.

3.3 “Complaint Officer” means the Chief Compliance Officer or a qualified delegate who has sufficient authority, resources and independence to administer this Policy.

3.4 “Business Day” and “Client” have the meanings given in the Terms and Conditions. “Complainant” means a person who makes a Complaint or on whose behalf a Complaint is made.

4. Governance and responsibilities

4.1 The governing body or senior management of Alphapay approves this Policy and is accountable for ensuring that complaint handling is adequately resourced and subject to effective oversight.

4.2 The Complaint Officer owns the complaint-management framework, maintains the complaint register, assigns impartial investigators, approves final responses within delegated authority, monitors deadlines, oversees remediation, identifies reportable matters and provides management reporting.

4.3 Every employee, contractor and agent who receives a Complaint must treat the complainant respectfully, preserve relevant records and send the Complaint to [COMPLAINTS EMAIL] no later than the end of the next Business Day. A Complaint is considered received by Alphapay when it reaches any employee, contractor, agent or approved complaint channel.

4.4 A person must not investigate or approve the outcome of a Complaint concerning their own conduct or where another actual or perceived conflict exists. The Complaint Officer must assign an independent reviewer. A Complaint about the Complaint Officer must be escalated to [INDEPENDENT ESCALATION TITLE].

4.5 Legal, privacy, information-security, operations, finance, fraud and other functions must support investigations and remediation when requested. Seeking legal advice does not suspend an applicable complaint deadline unless Applicable Law permits an extension.

5. Complaint channels and accessibility

5.1 Complaints may be submitted without charge through the following channels: email at [COMPLAINTS EMAIL]; telephone at [COMPLAINTS TELEPHONE]; mail or courier to [COMPLAINTS ADDRESS]; or the web form at [COMPLAINTS WEBPAGE URL]. These details must match clause 11.1 of the Terms and Conditions and Alphapay’s public website.

5.2 Alphapay will accept a Complaint in English or French and will provide reasonable disability-related or communication accommodations on request. Staff must assist a person who has difficulty putting a Complaint in writing and must confirm the resulting record with the complainant where practicable.

5.3 Alphapay should request the complainant’s legal name and contact details; account, merchant or Order reference; relevant dates and amounts; a description of the issue; desired outcome; and supporting documents. A Complaint must not be rejected merely because information is incomplete. The investigator must make reasonable efforts to obtain what is needed.

6. Service standards and mandatory timelines

6.1 The Complaint Officer must prioritize urgent Complaints, including alleged unauthorized transactions, missing funds, active fraud, discrimination, threats, material privacy or security incidents, significant client harm, regulatory breaches and recurring or systemic problems. Immediate containment or escalation must not wait for the ordinary timetable.

6.2 If Applicable Law, a payment-network rule or a written contract imposes a shorter or more protective deadline, that requirement prevails. A delay notice does not convert a missed mandatory deadline into compliance.

7. Intake, triage and acknowledgement

7.1 Upon receipt, the Complaint Officer must assign a unique reference, record the receipt date and channel, identify the complainant and affected account or transaction, capture the issues and requested remedy, and preserve all relevant communications and system records.

7.2 The Complaint must be classified by product or service, issue type, severity, legal or regulatory category, financial impact, vulnerability, potential recurrence and whether it is a Code Complaint, privacy matter, security incident, suspicious activity concern or possible breach of the Terms and Conditions.

7.3 The written acknowledgement must: (a) confirm receipt and the reference number; (b) summarize the Complaint; (c) identify the Complaint Officer or contact point; (d) explain the investigation process and expected timeline; (e) request any necessary information; (f) explain how personal information will be handled; and (g) describe any immediate protective action already taken.

7.4 A Complaint that is misdirected internally remains received on the original receipt date. If another organization appears solely or jointly responsible, Alphapay must explain that conclusion and, with consent where required, provide appropriate referral information or coordinate with that organization without abandoning Alphapay’s own responsibilities.

8. Investigation and fair assessment

8.1 The investigator must act competently, diligently, impartially and in good faith. The investigation must be proportionate to the nature, complexity, urgency and potential impact of the Complaint.

8.2 The investigator must identify the issues, gather and preserve relevant evidence, review the Agreement and Applicable Law, interview relevant persons where appropriate, test transaction and system records, consider comparable Complaints, and give the complainant a fair opportunity to provide material information.

8.3 The investigator must assess: (a) what occurred; (b) whether Alphapay, the Client or a third party failed to meet an obligation; (c) whether the Complaint should be upheld in whole or in part; (d) the direct impact; (e) the appropriate remedy; (f) whether other clients or processes may be affected; and (g) whether regulatory, contractual or law-enforcement notification is required.

8.4 An investigation must not disclose that Alphapay has made, may make or is considering a suspicious transaction report or other confidential regulatory filing where disclosure is prohibited. The Complaint Officer must coordinate such matters with the anti-money-laundering compliance function.

9. Remedies and final response

9.1 A remedy must be fair, proportionate, lawful and capable of implementation. Depending on the circumstances, it may include an explanation, apology, correction of records, transaction trace, reprocessing, refund, fee reversal, payment of substantiated direct loss, contract correction, service restoration, process change, staff training or another appropriate measure.

9.2 A proposed payment or settlement must be approved under Alphapay’s financial authority matrix. A release, confidentiality term or admission of liability may be used only with Legal approval and must not prevent a person from reporting a matter to a regulator or law-enforcement body where such a restriction would be unlawful.

9.3 The final written response must include: (a) a summary of the Complaint; (b) the investigation steps and material information considered; (c) the findings; (d) the decision and reasons; (e) any remedy, implementation date and person responsible; (f) any outstanding limitation; and (g) the available internal and external escalation routes. For a Code Complaint, it must also include the relevant acquirer or payment card network operator escalation information and complaint form.

9.4 The response must use plain language, distinguish findings of fact from assumptions, avoid unnecessary personal information, and be delivered through a durable medium. Where the Complaint was made orally, Alphapay may explain the outcome orally but must retain a written record and provide a written final response for a Code Complaint or on request.

10. Internal review and external escalation

10.1 A complainant who is dissatisfied may request an internal review at [INTERNAL REVIEW EMAIL] within [INTERNAL REVIEW REQUEST PERIOD] after the final response. The review must be conducted by a person who was not materially involved in the original decision and who has authority to affirm, vary or return the matter for further investigation.

10.2 For a Code Complaint, Alphapay must identify the relevant acquirer or payment card network operator and provide the applicable complaint form and contact details. The complainant may contact the Financial Consumer Agency of Canada (“FCAC”) at any stage about possible non-compliance with the Payment Card Code. FCAC monitors compliance but does not resolve individual disputes or award compensation.

10.3 A privacy complainant who remains dissatisfied may contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator. The response should identify the regulator that applies to the circumstances and direct the complainant to current official contact information.

10.4 For other unresolved matters, Alphapay may identify an applicable provincial or territorial consumer-protection body, court, contractual dispute process or other competent forum. Staff must not direct a complainant to the Ombudsman for Banking Services and Investments unless Compliance has verified that Alphapay is a participating firm and that the Complaint falls within its mandate.

10.5 Staff must not state that FINTRAC registration is a licence or endorsement, or present FINTRAC, the Bank of Canada or the British Columbia Ombudsperson as an individual dispute-resolution service for Alphapay. The Bank of Canada supervises payment service providers under the Retail Payment Activities Act but does not resolve disputes between a payment service provider and its end users.

10.6 Nothing in this Policy limits a complainant’s right to seek independent legal advice, report suspected criminal conduct, apply to a court, or contact a regulator or law-enforcement body. Alphapay may be unable to discuss confidential reporting or investigative activity.

11. Complaint records and privacy

11.1 The complaint register must record, at minimum: the unique reference; receipt and acknowledgement dates; complainant and account details; channel; product or service; issue and requested remedy; Code Complaint status; severity and risk classification; assigned investigator; key evidence; communications; findings; decision; redress; escalation; regulatory reporting; root cause; corrective action; closure date; and management-review history.

11.2 Complaint records must be accurate, access-controlled and retained for at least seven years after closure, or longer where required by Applicable Law, litigation hold or Alphapay’s approved retention schedule. Records must then be securely destroyed or anonymized.

11.3 Personal information must be collected, used, disclosed and retained only as reasonably necessary to handle the Complaint, manage risk and satisfy legal obligations. Privacy Complaints must also be referred to the Privacy Officer at [PRIVACY OFFICER EMAIL]. Alphapay’s privacy notice is available at [PRIVACY NOTICE URL].

12. Root-cause analysis and corrective action

12.1 The Complaint Officer must determine whether a Complaint indicates a recurring or systemic issue. The analysis must consider similar Complaints, near misses, operational incidents, chargebacks, transaction errors, service-provider failures, employee conduct, product design, disclosures, contract terms and control weaknesses.

12.2 Where a root cause may affect other clients, products or processes, Alphapay must define corrective action, assign an accountable owner and deadline, assess whether affected persons require notice or remediation, and test whether the corrective action was effective.

12.3 Material legal, regulatory, financial, conduct, privacy, security or reputational issues must be escalated promptly to senior management and, where appropriate, the governing body, Legal, the Privacy Officer, the anti-money-laundering compliance officer, insurers, service providers or regulators.

13. Management information and regulatory reporting

13.1 The Complaint Officer must provide senior management with regular reports showing complaint volumes, categories, ageing, timeliness, outcomes, redress, recurring issues, root causes, corrective actions, overdue items, external escalations and material risks. Significant matters must be reported without waiting for the next scheduled report.

13.2 Where Alphapay is a downstream participant for payment-card services, it must provide its current Payment Card Code complaint policies and procedures to the relevant acquirer annually and provide Code Complaint information to that acquirer on the frequency and in the format required for semi-annual reporting to the relevant payment card network operator and FCAC.

13.3 Regulatory reports must be complete, accurate, timely and approved by the appropriate control function. Complaint data must be reconciled to operational, fraud, privacy, incident and legal records where relevant.

14. Training, monitoring and review

14.1 Relevant employees, contractors and agents must receive complaint-handling training at onboarding and at least annually. Training must cover recognition and routing of Complaints, accessibility, impartiality, timelines, recordkeeping, privacy, Payment Card Code requirements, escalation, vulnerable complainants, anti-retaliation and prohibited disclosures.

14.2 The Complaint Officer must conduct periodic quality assurance over complaint files, including testing timeliness, evidence, reasoning, remedies, communications, coding, escalation and closure. Deficiencies must be documented and remediated.

14.3 This Policy must be reviewed at least annually and promptly after a material legal or regulatory change, audit finding, control failure, new product, significant Complaint trend, merger or acquisition, or material change to the Terms and Conditions. Amendments require approval under Alphapay’s policy-governance framework.

Appendix A — Complaint acknowledgement checklist

Complaint reference number and date received.

Accurate summary of the issue and the outcome sought.

Name or contact point of the person handling the Complaint.

Explanation of the investigation process and expected final-response date.

Request for any necessary supporting information, without making acceptance conditional on perfect documentation.

Description of urgent protective measures, if any.

Accessibility, language and communication options.

Privacy notice or explanation of how information will be handled.

Appendix B — Final response checklist

Summary of the Complaint and material issues investigated.

Material evidence and contractual or regulatory criteria considered.

Findings, decision and clear reasons.

Remedy, implementation date and accountable owner, or reasons no remedy is offered.

Internal review route and deadline.

Applicable external escalation route; for a Code Complaint, the relevant acquirer or payment card network operator details and complaint form.

Statement that FCAC may consider possible Payment Card Code non-compliance but does not resolve individual disputes or award compensation.

Contact information for follow-up and date the file will be closed unless new material information is received.

References

[1] Financial Consumer Agency of Canada, “Code of Conduct for the Payment Card Industry in Canada.”

[2] Financial Consumer Agency of Canada, “Complaint-handling under the Code of Conduct for the Payment Card Industry in Canada.”

[3] Bank of Canada, “Retail payments.”

[4] Office of the Privacy Commissioner of Canada, “Report a concern.”

[5] Ombudsman for Banking Services and Investments, “How the Complaint Process Works.”

[6] Alphapay Technology Limited, “Business Money Services Terms and Conditions,” clause 11.