Anti-Money Laundering & Sanctions Policy

1. Our commitment

Brighter S.R.O. operates a zero-tolerance approach to money laundering, terrorist financing, sanctions evasion and financial crime. While we are not a financial institution and provide only non-financial services (advertising, marketing, photography, market research, computer services, data processing and information services), we voluntarily apply core anti-money-laundering (“AML”) and counter-terrorist-financing (“CTF”) principles to every engagement.

This policy applies to all directors, employees, contractors and partners of Brighter S.R.O. and is reviewed at least annually.

2. Regulatory framework

While Brighter is not an obliged entity within the meaning of §5 of Slovak Act No. 297/2008 Coll. on the Prevention of Legalisation of Proceeds of Criminal Activity and Terrorist Financing, we align our internal procedures with:

• Slovak Act No. 297/2008 Coll. — the national AML/CTF law transposing EU directives.
• EU Directive (EU) 2015/849 (AMLD4), as amended by Directive (EU) 2018/843 (AMLD5) and Directive (EU) 2018/1673 (AMLD6).
• EU Council Regulations on restrictive measures (sanctions) against specific countries, entities and individuals.
• OFAC, UK HM Treasury and UN Security Council consolidated sanctions lists, applied through our payment processors.
• GDPR (Regulation (EU) 2016/679) for the lawful processing of personal data collected as part of due diligence.

3. Beneficial ownership

Brighter S.R.O. is owned and controlled by a single Ultimate Beneficial Owner (UBO):

• UBO & Director: Alek Kovachev Aleksandrov
• Role: Konateľ (director and sole signatory)
• Ownership: 100%
• Public registration: Slovak Register of Public Sector Partners (RPVS) and Commercial Register (IČO 55 929 532), Municipal Court Bratislava III.

Any change in beneficial ownership above 25% is registered with the Commercial Register within 60 days, in line with §10a of Act No. 530/2003 Coll.

4. Sanctions & restricted jurisdictions

Brighter screens every customer transaction through its licensed EU payment institution’s real-time fraud and sanctions screening, which checks counterparties against the consolidated EU, UN, US (OFAC) and UK sanctions lists in real time. We do not accept orders from, or provide services to, any person or entity that is:

• Listed on any applicable sanctions list (EU, UN, OFAC, HM Treasury);
• Acting on behalf of a sanctioned person or entity;
• Resident in, or operating from, a comprehensively-sanctioned jurisdiction (currently including Iran, North Korea, Syria, Cuba, the so-called territories of Crimea, Donetsk and Luhansk; this list may be updated to reflect changes in international sanctions regimes);
• Subject to an active EU asset-freezing measure.

Card transactions originating from these jurisdictions are automatically declined by our payment processor. If a manual order requires sanction screening, Brighter will perform an additional check before commencing work.

5. Customer due diligence

For our typical engagements (B2C services with an average order value below €1,000), the customer due-diligence baseline is performed by our payment provider at the payment step: identity verification, address-verification (AVS), 3D Secure 2 authentication, device fingerprinting, velocity checks and PEP/sanctions screening.

For business clients or orders above €5,000 we additionally collect, where applicable:

• Legal name and registration number of the contracting entity;
• VAT identification number (validated via VIES);
• Beneficial ownership declaration (for orders above €10,000);
• Registered office address;
• Identification of the natural person acting on behalf of the client.

Enhanced due diligence (EDD) is applied where there is heightened risk — for example, clients connected to politically exposed persons (PEPs), high-risk third countries (per Commission Delegated Regulation (EU) 2016/1675), or unusually complex transaction structures.

6. Payment processing controls

All card payments are processed through a licensed EU payment institution authorised under PSD2 and regulated by a national competent authority within the European Economic Area. Brighter never stores card numbers, CVV or any other sensitive payment data. The payment provider applies:

• Strong Customer Authentication (SCA) under PSD2 with 3D Secure 2.
• PCI-DSS Level 1 compliance.
• Real-time fraud and money-laundering monitoring.
• Sanctions and PEP screening on every transaction.
• Transaction-pattern analysis across the provider’s acquiring network.

Cash payments are not accepted. SEPA bank transfers (only on request for orders over €500) come exclusively from accounts held with regulated EU credit institutions.

7. Suspicious activity reporting

While Brighter is not formally required to file suspicious activity reports under §17 of Act No. 297/2008 Coll., we will report any reasonable suspicion of money laundering, terrorist financing or sanctions evasion to the appropriate authority:

• Financial Intelligence Unit (FIU) of the National Crime Agency of the Slovak Republic: minv.sk
• Our payment provider, simultaneously, for the affected transaction(s).

Engagements presenting clear money-laundering or terrorism-financing indicators will be declined or terminated without notice. We do not tip off the customer concerned, in line with §18 of Act No. 297/2008 Coll.

8. Record-keeping

Brighter retains records of customer identification, transaction history, due-diligence documentation and communications for a minimum of 5 years after the business relationship ends or the transaction is executed, in line with §19 of Act No. 297/2008 Coll. and Slovak Accounting Act §35.

9. Internal controls & training

All Brighter personnel involved in client onboarding, invoicing and project delivery receive AML/CTF awareness training at the start of their engagement and at least annually thereafter. The training covers:

• Recognising red flags of money laundering, terrorist financing and sanctions evasion;
• Customer identification and verification procedures;
• Escalation and reporting workflows;
• Sanctions and PEP screening protocols;
• Record-keeping and data-protection obligations under GDPR.

The Director (Alek Kovachev Aleksandrov) acts as the designated Compliance Officer and is responsible for the implementation of this policy.

10. Contact

For AML/sanctions/compliance enquiries:
BRIGHTER S.R.O.
Račianska 88 B, Nové Mesto, 831 02 Bratislava, Slovakia
Compliance Officer: Alek Kovachev Aleksandrov
Email: brighter@brighter-studio.com
Phone: +421 919 034 092