---

KYB/KYC Consent

1. Information Collected

By applying to become a Supplier, the Supplier authorizes XenoStep to collect information needed for KYB, KYC, tax, sanctions, fraud, payment, and contract review. This information may include business registration records, formation documents, registered address, tax identification details, representative identity documents, UBO information, bank account details, product information, support contacts, and related documentation.

The Supplier confirms that all submitted information is accurate, complete, and current.

2. Screening Consent

The Supplier consents to screening of the Supplier, its representatives, directors, officers, and UBOs against sanctions, watchlist, and risk databases. Screening may include OFAC, United Nations, European Union, and United Kingdom sanctions lists, as well as politically exposed person screening and adverse media checks.

The Supplier understands that a match, potential match, or incomplete information may delay onboarding, trigger enhanced review, or result in rejection.

3. Third-Party Verification

The Supplier authorizes XenoStep to use third-party verification providers to validate business existence, identity, ownership, sanctions status, tax information, bank account information, and risk signals. XenoStep may share submitted information with those providers solely for verification, compliance, security, tax, payment, fraud prevention, and related business purposes.

4. Ongoing Screening

The Supplier consents to periodic re-screening during the Supplier relationship. XenoStep may also re-screen when there is a change in ownership, control, representative, product category, bank account, country, sanctions law, payment processor requirement, or risk profile.

The Supplier must promptly notify XenoStep of any material change that may affect KYB, KYC, sanctions, tax, or payment review.

5. Data Retention

XenoStep may retain KYB and KYC data for seven (7) years after the end of the Supplier relationship, or longer if required by AML, sanctions, tax, accounting, litigation hold, payment network, or other legal obligations.

The Supplier understands that XenoStep may be unable to delete certain compliance records before the end of the required retention period.

6. Controlling Language

This Consent is prepared in English. A Korean translation may be provided for reference convenience only. If there is any conflict or inconsistency between the English version and any translation, the English version controls in all respects.