> For the complete documentation index, see [llms.txt](https://docs.spendl.money/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.spendl.money/spendl-compliance-pack/spendl-terms-and-conditions.md). # Spendl Terms and Conditions Effective Date: 1 July 2026 Light Fusion (Pty) Ltd t/a Spendl Technologies Registration Number 2023/154151/07 FSP Licence 53757 - FIC Org ID 74993 ## Risk Notice and Crypto Asset Risk Disclosures This Risk Notice forms part of these Terms and is incorporated by reference. By accessing or using the Services, you confirm that you have read, understood, and accepted the risks set out below. ### A. General volatility and capital risk Crypto assets are highly volatile and speculative. Their value can rise or fall sharply over very short periods, including to zero. You may lose some or all of the capital you commit to crypto-related activity. Past performance is not indicative of future results. SPENDL does not promise returns, yields, capital protection, or any specific outcome from the Services. You should only commit funds you can afford to lose entirely. ### B. Market and liquidity risk Crypto asset markets can experience extreme volatility, illiquidity, flash crashes, market manipulation, and disorderly trading. Bid-ask spreads can widen materially, and large orders may move the market. There may be times when SPENDL or its liquidity partners are unable to execute a conversion at, or close to, a quoted or expected price. ### C. Conversion, slippage and best execution Conversion to ZAR is performed at a rate that includes an FX margin over the wholesale rate quoted to SPENDL by its liquidity partners. The final ZAR amount you receive may differ materially from the rate displayed at the time of instruction due to slippage, partial fills, market movement, and settlement timing. SPENDL applies a best-execution policy but does not guarantee any particular price, fill, or speed of execution. ### D. Settlement, blockchain and on-chain risk Crypto asset transactions are confirmed by independent blockchain networks that SPENDL does not control. Settlement may be delayed or fail due to network congestion, gas/fee underpayment, chain reorganisations, soft or hard forks, downtime, consensus failures, or validator misbehaviour. Transactions sent to incorrect addresses, on the wrong chain, or with incompatible token standards may be unrecoverable. You bear sole responsibility for the addresses, networks, memos and amounts you instruct. ### E. Smart contract and technology risk Crypto assets, bridges, wallets, and DeFi protocols can contain bugs, vulnerabilities, oracle failures, or design flaws that may result in loss of value. Software upgrades, migrations, and forks may also introduce risk. SPENDL relies on third-party software and infrastructure that may, despite reasonable diligence, fail. ### F. Custody, segregation and counterparty risk Crypto assets transit the conversion infrastructure on a transient basis. SPENDL is not a custodian of standalone crypto holdings. ZAR balances are held in a pooled client account maintained by SPENDL’s licensed Third Party Payment Provider (the Programme Partner) to your order. Pooled balances are not bank deposits in SPENDL’s name and are not protected by any statutory deposit-insurance scheme. You are exposed to the credit, operational, and legal risk of the Programme Partner, the card scheme, banking partners, liquidity providers, blockchain infrastructure providers, and other counterparties used by SPENDL. In an insolvency of any of those parties, recovery is not guaranteed. ### G. Stablecoin and depeg risk Stablecoins may lose their peg, be frozen by their issuer, be delisted, or become illiquid. SPENDL is not the issuer or guarantor of any stablecoin and does not warrant its peg, redemption mechanism, reserve quality, audit status, or regulatory treatment. Where a depeg or issuer event occurs, SPENDL may suspend deposits, hold settlement, or convert at the prevailing market rate, which may differ materially from par. ### H. Cyber, phishing and fraud risk Crypto users are common targets for phishing, social engineering, SIM-swap attacks, malware, fake support staff, and impersonation. SPENDL will never request your seed phrase, recovery phrase, full password, backup phrase, or remote-control access to your device. Treat any such request as fraudulent and report it to . ### I. Regulatory and tax risk The regulatory treatment of crypto assets is evolving in South Africa and globally. New laws, conduct standards, or determinations may restrict or prohibit certain assets, products, transfers or jurisdictions, may impose new fees or reporting obligations, and may impact your ability to access or use the Services. Tax treatment is fact-specific. You are solely responsible for your tax position, including income tax, capital gains, VAT, withholding and exchange-control compliance, and for any reporting to SARS. ### J. No advice; no guaranteed returns SPENDL provides intermediary financial services in relation to crypto assets under FAIS Category I and does not provide investment, legal, tax, accounting or financial advice. Nothing on the Platform, in marketing material, or in any conversation with SPENDL personnel constitutes a recommendation to buy, sell, hold, or convert any crypto asset. You should obtain independent professional advice before transacting. ### K. Alpha and Beta features Parts of the Services are in alpha or beta. Beta features may change, break, be withdrawn, or behave inconsistently without notice and are provided on an “as is” basis without service-level commitments. Use of beta features is at your own risk. ### L. Use of credentials and unauthorised transactions You are responsible for safeguarding your devices, credentials, PINs, multi-factor authentication factors, API keys, signing keys and webhook secrets. SPENDL’s liability for unauthorised transactions is allocated as set out in Schedule A and the applicable scheme/Programme Partner rules. Grossly negligent handling of your credentials shifts more risk to you. You acknowledge that the risks above are not exhaustive. If you do not understand any aspect of the Services or the underlying technology, do not transact until you have obtained appropriate independent advice. ## Part 1 - Definitions and Interpretation **1.1** Defined terms. In these Terms, unless the context indicates otherwise: > **“Acceptable Use Policy”** means the policy set out in Schedule H, as amended from time to time. > > **“Account”** means a SPENDL account opened by a Customer and used to access one or more Services. > > **“API”** means the application programming interfaces, software development kits, documentation, and tenant infrastructure made available by SPENDL under Schedule B. > > **“Authorised Dealer”** means a bank authorised by the South African Reserve Bank (SARB) to deal in foreign exchange. SPENDL does not route crypto-asset cross-border flows through an Authorised Dealer; crypto-asset cross-border flows are conducted under SPENDL’s CASP and FIC Act obligations as described in Schedule D. > > **“B2B Customer”** means a juristic person (whether RSA-incorporated or non-RSA-incorporated) that uses the B2B Services under Schedule B, C, D or E. A B2B Customer is sometimes referred to as a Tenant where it consumes the Platform on a multi-tenant basis. > > **“B2C Customer”** means a natural person who uses the SPENDL Card under Schedule A. > > **“Beneficial Owner”** means a natural person who, directly or indirectly, ultimately owns or exercises effective control over a Customer or transaction, as contemplated in the FIC Act. > > **“Business Day”** means any day other than a Saturday, Sunday or South African public holiday. > > **“Card”** means the SPENDL prepaid reloadable debit card on a major payment Network, managed by SPENDL as a CASP and issued and processed by the Programme Partner under Network Rules, as described in Schedule A. > > **“CASP”** means a crypto asset service provider as defined in Schedule 1, Item 22 of the FIC Act. > > **“Commercial Agreement”** means a document signed by a B2B Customer and SPENDL setting out the specific Services, commercial terms, and any bespoke variations to these Terms. > > **“Confidential Information”** means all non-public information disclosed by one party to the other in connection with the Services, whether or not marked confidential, including pricing, technology, business plans, customer lists, and Personal Information. > > **“Crypto Asset”** means a digital representation of value that can be transferred, stored or traded electronically and is supported by SPENDL from time to time. The list of supported Crypto Assets is published on the Website and may be updated from time to time without amendment to these Terms. > > **“Customer”** means any person (B2C or B2B) who has agreed to these Terms and uses any Service. > > **“Customer Data”** means data submitted by a Customer to the Platform, including data relating to End Users where applicable. > > **“Effective Date”** means the date these Terms become effective for a Customer, being the earliest of: account opening; acceptance of these Terms; first use of any Service; or the date specified in a Commercial Agreement. > > **“End User”** means a natural person who uses a B2B Customer’s services and whose data or transactions flow through the Platform. > > **“FAIS Act”** means the Financial Advisory and Intermediary Services Act 37 of 2002 and its subordinate legislation, including the FAIS General Code of Conduct (Board Notice 80 of 2003), FAIS Notice 25 of 2023, FSCA FAIS Notice 90 of 2023, and any successor or amending instruments. > > **“FAIS Disclosure Notice”** means the standalone disclosure document published by SPENDL pursuant to sections 4 and 5 of the FAIS General Code of Conduct, as amended from time to time. > > **“FIC Act”** means the Financial Intelligence Centre Act 38 of 2001 and its directives, including Directives 7 (Targeted Financial Sanctions) and 9 (Travel Rule). > > **“Fee Schedule”** means the fees and charges schedule set out at Schedule F and published on the Website. > > **“Force Majeure Event”** means any event described in clause 12.6. > > **“ITT”** means the Internal Treasury Token, a closed-loop tokenised payment instrument operated by SPENDL and described in Schedule C. > > **“Joint Standards”** means collectively, Joint Standard 1 of 2023 (IT Governance and Risk Management for Financial Institutions), Joint Standard 1 of 2024 (Outsourcing by Financial Institutions), Joint Standard 2 of 2024 (Cybersecurity and Cyber Resilience for Financial Institutions), and any further joint standards issued by the FSCA and Prudential Authority that apply to SPENDL. > > **“Material Change”** means any change to the Services or these Terms that adversely affects Customer rights, materially increases fees, materially reduces functionality, materially expands liability, or changes the scope of data processing. > > **“MSA”** means the SPENDL Master Services Agreement (and any associated Transaction Documents, schedules, and annexures) entered into separately between SPENDL and a B2B Customer / Tenant. The MSA governs the B2B / Tenant deployment of the Platform and Services and is a precondition to any production B2B / Tenant deployment. > > **“Network”** means the international payment card network on which the Card is issued, the rules of which (the Network Rules) apply to the Card and are incorporated by reference. The identity of the Network is disclosed on the Website and may change with notice. > > **“PEP (Politically Exposed Person)”** means collectively, a domestic politically exposed person as referred to in Schedule 3A of the FIC Act and a foreign politically exposed person as referred to in Schedule 3B of the FIC Act. > > **“PIP (Prominent Influential Person)”** means a person referred to in Schedule 3C of the FIC Act. > > **“Platform”** means the SPENDL websites, applications, dashboards, APIs, tenant infrastructure and Services. > > **“POPIA”** means the Protection of Personal Information Act 4 of 2013 and its regulations. > > **“Personal Information”** means personal information as defined in POPIA. > > **“Programme Partner”** means a duly licensed Third Party Payment Provider (TPPP) and/or payment institution appointed by SPENDL to issue and process the Card, operate the pooled client ZAR account, and perform related card-programme functions. The identity of the Programme Partner is disclosed on the Website and may be changed by SPENDL on reasonable notice, subject to Network Rules and applicable law. > > **“Reserve”** means a reserve, holdback, or security deposit that SPENDL may require or maintain to manage settlement, chargeback, refund, fraud or scheme-rule exposures, as described in clause 5.11 and Schedule A. > > **“Restricted Jurisdictions”** means the list of countries and territories from which SPENDL does not accept Customers, published on the Website and updated from time to time. > > **“Sanctions Lists”** means sanctions lists maintained or implemented in South Africa, the Targeted Financial Sanctions list issued by the Financial Intelligence Centre in South Africa, by the United Nations Security Council, the United States Office of Foreign Assets Control, the European Union, the United Kingdom, the Financial Action Task Force, and any other list reasonably applied by SPENDL. > > **“Services”** means all services made available by SPENDL under these Terms, including the Card, B2B Platform, ITT, Cross-Border Crypto Compliance, and Treasury and Off-Ramp, as further described in Part 3 and the Schedules. > > **“SLA”** means the service level commitments at Schedule B, Part B-3. > > **“SPENDL”** means Light Fusion (Pty) Ltd (Reg 2023/154151/07) trading as Spendl Technologies, with FSP Licence Number 53757 and an Accountable Institution with FIC Org ID 74993, and its successors and permitted assigns. > > **“Terms”** means these Master Terms together with the Schedules, any Commercial Agreement, the Fee Schedule, the Privacy Policy and the Acceptable Use Policy. > > **“Travel Rule”** means the originator and beneficiary information exchange obligations applicable to crypto-asset transfers, as set out in FIC Directive 9 and aligned international standards (including FATF Recommendation 16). > > **“TPPP”** means a Third Party Payment Provider registered with the Payments Association of South Africa (PASA) or otherwise authorised to provide third-party payment services in South Africa. > > **“VASP”** means a virtual asset service provider as defined under FATF Recommendations. > > **“Website”** means spendl.money, app.spendl.money, docs.spendl.money, and any successor or sub-domain operated by SPENDL. > > **“ZAR Balance”** means the South African Rand balance held to the Customer’s order in a pooled client account at the Programme Partner, used to fund Card transactions and other ZAR-denominated Services. **1.2** Interpretation. Headings are for convenience only and do not affect interpretation. References to legislation include amendments and subordinate legislation. References to a person include any natural or juristic person. The singular includes the plural and vice versa. The word “including” is not limiting. Where a word or phrase is given a defined meaning, any other grammatical form has a corresponding meaning. The contra proferentem rule shall not apply. **1.3** Order of precedence. In the event of conflict, the order of precedence is: (a) the MSA together with any executed Transaction Document (for B2B / Tenant deployments only); (b) the applicable Schedule (only to the extent of an express override stated in that Schedule); (c) any standalone Commercial Agreement signed between SPENDL and a B2B Customer where an MSA is not in place; (d) the Master Terms; (e) the Fee Schedule; (f) the Acceptable Use Policy; (g) the FAIS Disclosure Notice; (h) the Privacy Policy; and (i) policies referenced in the Master Terms or Schedules. ## Part 2 - Acceptance, Eligibility and Account Opening **2.1** Acceptance. You accept these Terms and become bound by them when you do any of the following: open an Account; access or use any part of the Platform or Services; load or use the Card; or sign a Commercial Agreement. If you do not agree to these Terms, you must not use the Services. You will not open, or attempt to open, an Account under any name except your own, or use your Account to carry out transactions on behalf of a third party. **2.2** Authority for juristic persons. If you accept these Terms on behalf of a juristic person, you warrant that: (a) the entity is duly incorporated and in good standing; (b) you are duly authorised to bind the entity; (c) the entity has the legal capacity to contract; and (d) the entity will procure that its directors, officers, employees and authorised users comply with these Terms. **2.3** Eligibility - natural persons (B2C Card). To open and use the Card you must: (a) be a natural person aged 18 or older; (b) be lawfully resident in the Republic of South Africa; (c) hold a valid South African identity document or, where SPENDL permits, an acceptable equivalent; (d) not be on any Sanctions List; (e) not be located in or a resident of a Restricted Jurisdiction; and (f) accurately complete KYC and any enhanced due diligence (EDD) requested. SPENDL does not knowingly collect or process Personal Information of children under the age of 18 (as contemplated in section 35 of POPIA). If SPENDL becomes aware that it has inadvertently collected such information, it will delete it without undue delay. **2.4** Eligibility - RSA juristic persons (B2B). To use the B2B Services as an RSA-incorporated juristic person you must: (a) be duly registered with the Companies and Intellectual Property Commission (or its equivalent for trusts and partnerships); (b) provide registration documents, mandate, beneficial-owner identification (≥ 5%), director and authorised-signatory identification, source-of-funds documentation, and proof of regulatory status where applicable; (c) not be on any Sanctions List; and (d) accept the applicable Schedule and any Commercial Agreement. **2.5** Eligibility - non-RSA juristic persons (B2B). Non-RSA juristic persons may use the B2B Services subject to: (a) enhanced due diligence; (b) sanctions and adverse-media screening; (c) home-jurisdiction regulatory clearance where required; (d) compliance with applicable SARB rules for crypto-asset cross-border flows under the CASP framework (and not via the Authorised Dealer fiat route, which SPENDL does not use for crypto); (e) tax-residency self-certification consistent with the OECD Common Reporting Standard (CRS) and, where applicable, FATCA; and (f) any additional risk-based controls SPENDL applies. SPENDL may decline to onboard a non-RSA Customer in its discretion. **2.6** Customer representations. You represent and warrant on a continuing basis that: (a) all information you provide is true, accurate, and complete; (b) funds and Crypto Assets used in connection with the Services originate from lawful sources; (c) you are acting on your own behalf and not for an undisclosed third party (any third-party use requires SPENDL’s prior written consent and KYC of that third party); (d) you have read and understood the Risk Disclosures at the front of these Terms and in Part 7; (e) you are not on any Sanctions List and are not located in a Restricted Jurisdiction; (f) you are not a PEP or PIP, or if you are, you have disclosed that status; (g) you have determined your tax obligations independently; and (h) you have authority to enter into these Terms (where you are a juristic person). **2.7** Right to refuse. SPENDL may refuse to onboard, suspend, or close an Account at any time without liability where required by law, regulator order, sanctions, Network Rules, risk policy, Programme Partner instruction, or where the Customer has breached these Terms or the Acceptable Use Policy. **2.8** Reverse solicitation. Where SPENDL accepts a Customer who approaches SPENDL on its own initiative from a jurisdiction in which SPENDL is not authorised, that acceptance is at the Customer’s own initiative and SPENDL makes no representation that the Services are authorised or appropriate in that jurisdiction. **2.9** Cooling-off and ECTA. To the extent that a B2C Customer is entitled to a cooling-off period under section 44 of the Electronic Communications and Transactions Act 25 of 2002 (ECTA) in respect of any electronic transaction with SPENDL that is not excluded under section 42 of ECTA (financial services being a recognised exclusion), the B2C Customer may exercise that right by written notice to within seven (7) days of conclusion of the relevant transaction. SPENDL records that the bulk of the Services are financial services excluded from the statutory cooling-off right under section 42(2)(c) of ECTA. **2.10** MSA precondition for B2B / Tenant deployments. Any B2B / Tenant deployment of the Platform or Services (including any pilot or production use of the API, multi-tenant infrastructure, ITT participation, Treasury or Off-Ramp, or any white-label or embedded use) is conditional on the B2B Customer entering into, and remaining in good standing under, the SPENDL Master Services Agreement (MSA) signed separately between the parties. The MSA governs the commercial, operational, compliance, data-protection, IP, indemnity and SLA terms of the deployment in detail. In the event of any conflict between these Terms and the MSA in respect of a B2B / Tenant deployment, the MSA (read with any executed Transaction Document) prevails to the extent of the conflict in line with the order of precedence at clause 1.3. A B2B Customer that has not signed an MSA is restricted to sandbox / evaluation use only and may not place live or production traffic on the Platform. ## Part 3 - Services Overview and Regulatory Status **3.1** Services menu. SPENDL provides the following Services, each governed by the Master Terms together with the relevant Schedule: * SPENDL Card, a prepaid reloadable debit card on a major payment Network for B2C Customers, issued and processed by the Programme Partner, funded only by converting supported Crypto Assets to ZAR (Schedule A). * B2B Platform and Public API, multi-tenant infrastructure for fintechs, payment companies, payroll providers, asset managers, merchant networks, and similar regulated or compliance-conscious customers (Schedule B). * ITT, a closed-loop tokenised payment instrument used by enrolled programme participants (Schedule C). * Cross-Border Crypto Compliance, inbound and outbound cross-border crypto-asset flow handling conducted under SPENDL’s CASP authorisation and FIC Act obligations (Schedule D). SPENDL does not route crypto-asset cross-border flows through an Authorised Dealer. * Treasury and Off-Ramp, crypto-to-ZAR conversion, settlement windows, and business treasury accounts (Schedule E). * Ancillary services, payroll disbursement, merchant settlement, tokenisation and integration services (papered through Commercial Agreements under Schedule B or via project addenda). **3.2** Regulatory status. SPENDL is an Exempt Crypto Asset FSP (Cat I) under the FAIS Act (FSP No 53757) and is registered as an Accountable Institution with the Financial Intelligence Centre (Org ID 74993). SPENDL is a Responsible Party under POPIA. SPENDL is not a bank, deposit-taker, registered credit provider under the National Credit Act, or insurer. SPENDL does not provide financial, legal, tax, accounting or investment advice. SPENDL is currently exempt from the requirement to maintain professional indemnity insurance and fidelity guarantee cover under Part VI of the Determination of Fit and Proper Requirements for Financial Services Providers, 2017 (Board Notice 194 of 2017), pursuant to FSCA FAIS Notice 25 of 2023 (published on 11 May 2023). The exemption may be amended or withdrawn by the FSCA, in which event SPENDL will comply with any new requirements within the prescribed period. SPENDL will comply with any FSCA conduct standards, joint standards, or determinations applicable to CASPs as and when they take effect. **3.3** Service status and beta features. Some Services or features may be made available in alpha or beta. Beta features are provided on an “as is” basis without service-level commitments and may change, be withdrawn, or break without notice. Production Services are provided in accordance with the SLA in Schedule B for B2B Customers and on a commercially reasonable basis for B2C Customers. **3.4** Reliance on third parties. SPENDL relies on third-party providers including the Programme Partner (card issuance, processing, pooled-account operation), the card scheme, banking partners, blockchain infrastructure providers, custody and conversion partners, identity-verification vendors, and cloud and security service providers. The identities of material third parties are published on the Website and may be updated from time to time. SPENDL takes commercially reasonable care in selecting and managing third parties consistent with Joint Standard 1 of 2024 (Outsourcing by Financial Institutions), but is not liable for their independent acts or omissions except as expressly stated. **3.5** Geographic scope and Restricted Jurisdictions. The Services are primarily offered in and from South Africa. SPENDL maintains a Restricted Jurisdictions list on the Website and may decline or suspend Services to any Customer connected with a Restricted Jurisdiction. **3.6** FAIS Disclosure. In accordance with sections 4 and 5 of the FAIS General Code of Conduct (Board Notice 80 of 2003, as amended), SPENDL maintains a standalone FAIS Disclosure Notice setting out, amongst other things, SPENDL’s full FSP details (including FSP licence number, category and authorised product sub-categories), its Key Individual and Compliance Officer particulars, its Conflicts of Interest Management Policy summary, the nature and scope of the financial services rendered, applicable fees, complaints procedures, the FAIS Ombud and National Financial Ombud Scheme particulars, and the relevant Risk Disclosures and warnings applicable to crypto asset financial services. The FAIS Disclosure Notice is published on the Website and is available on request from . The FAIS Disclosure Notice forms part of the pre-contractual disclosures provided to each Customer and is incorporated into these Terms by reference. **3.7** Conflicts of Interest summary. SPENDL maintains and publishes a Conflicts of Interest Management Policy in accordance with the FAIS General Code of Conduct. In summary: (a) SPENDL identifies and avoids actual, potential and perceived conflicts where reasonably practicable; (b) where a conflict cannot be avoided, it is managed and disclosed to the affected Customer; (c) SPENDL does not pay or accept inducements that could compromise the duty owed to a Customer; (d) employee personal-account dealing is restricted; and (e) the policy is reviewed annually and on any material change. The full policy is published on the Website. **3.8** Treating Customers Fairly. SPENDL operates a Treating Customers Fairly (TCF) framework consistent with FSCA TCF outcomes, which in summary requires: (i) customers feel confident they are dealing with a culture of fair treatment; (ii) products and services are designed for identified customer groups; (iii) customers receive clear information before, during and after point of sale; (iv) advice (where given) is suitable; (v) products perform as customers have been led to expect; and (vi) customers do not face unreasonable post-sale barriers to change product, switch provider, submit claims, or complain. ## Part 4 - KYC, AML, Sanctions and Travel Rule **4.1** RMCP, KYC and CDD. SPENDL maintains a Risk Management and Compliance Programme (RMCP) adopted under section 42 of the FIC Act. The RMCP enforces KYC, CDD, ongoing monitoring, sanctions screening, Travel Rule, suspicious-transaction reporting, record-keeping, and Customer-risk rating. You must complete CDD before using the Services. Required information may include: government-issued identity, proof of residential or registered address (≤ 3 months old), selfie or liveness verification, source of funds and source of wealth attestation, beneficial-owner identification, mandate documents and proof of authority, regulatory licences, and tax-residency self-certification (including CRS / FATCA where applicable). **4.2** Enhanced due diligence. SPENDL may apply EDD where risk indicators are present, including PEP/PIP status, high-risk jurisdictions, complex beneficial-ownership structures, large or unusual transactions, exposure to high-risk industries, or adverse media. EDD may also be a precondition for limit-increase requests. **4.3** Ongoing monitoring and refresh. SPENDL monitors transactions on a risk-sensitive basis and refreshes CDD periodically (and immediately on a material change in risk profile). You must notify SPENDL within 14 days of any material change to information previously provided (residence, mandate, ownership, sanctions status, regulatory status). **4.4** Beneficial ownership and third-party use. You warrant that any funds or Crypto Assets you deposit are your own and not for an undisclosed third party. Third-party deposits are prohibited unless SPENDL has provided prior written consent and completed KYC for that third party. You further warrant that any wallet used to fund the Services is owned and controlled by you. **4.5** PEP and PIP self-declaration. You must disclose if you, your close associates, or family members are PEPs or PIPs. SPENDL may apply additional approval, monitoring, and source-of-funds verification. **4.6** Sanctions screening (TFS). SPENDL screens Customers, Beneficial Owners, related parties, counterparties, and transactions against Sanctions Lists and adverse-media sources. SPENDL may decline, hold, freeze, reverse, or report transactions, and terminate the relationship, where required by law or risk policy. SPENDL maintains a Targeted Financial Sanctions programme aligned with the FIC Act, FIC Directive 7, and UN Security Council Resolutions 1267, 1373 and 1718, including automated screening and immediate freezing where a match is confirmed. **4.7** Travel Rule (FIC Directive 9). Crypto-asset transfers are subject to FIC Directive 9. For inbound transfers, SPENDL acts as the Beneficiary CASP and complies with its Beneficiary-side obligations, including requesting and validating originator information from the originating CASP/VASP. For outbound transfers (where supported via infrastructure partners), SPENDL or its infrastructure partner acts as the Originator CASP and provides the required originator information to the Beneficiary CASP/VASP. You must provide accurate, complete, and timely information for Travel Rule purposes when requested. SPENDL applies thresholds and information requirements as set out in FIC Directive 9, applying a precautionary lower threshold where its RMCP requires. **4.8** Suspicious, unusual and cash-threshold reports. SPENDL is required to file regulatory reports with the Financial Intelligence Centre and other authorities, including Suspicious and Unusual Transaction Reports (STR/SUTR), Terrorist Property Reports (TPR), and Cash Threshold Reports (CTR) where applicable. SPENDL is not liable for any delay, refusal, or freeze caused by these obligations. **4.9** Anti-tipping-off. Section 29(3) of the FIC Act prohibits SPENDL, its directors, officers, employees and agents from disclosing to a Customer or any other person the fact that an STR, SUTR, TPR or related enquiry has been made or is contemplated, otherwise than as permitted by the FIC Act. You acknowledge that SPENDL may be required to act, withhold information, or take or refrain from action in compliance with this prohibition. **4.10** Record keeping. SPENDL retains CDD and transaction records for at least five years from the end of the Customer relationship or last transaction (per section 23 of the FIC Act), and longer where required by other laws. **4.11** Cooperation with the Programme Partner. The Programme Partner is itself a regulated TPPP subject to AML/CTF obligations. You authorise SPENDL and the Programme Partner to share KYC, transaction, sanctions, and fraud data with each other, with relevant banking partners and with the card scheme, to the extent reasonably necessary to operate the Card programme, comply with applicable law, and prevent fraud and abuse. ## Part 5 - Fees, Limits, FX and Funding **5.1** Fee Schedule. Fees are set out in the Fee Schedule (Schedule F) published on the Website and, for B2B Customers, in the Commercial Agreement. Unless stated otherwise, fees exclude VAT, which is charged at the prevailing rate where applicable. Fees may include issuance, replacement, ATM, POS, conversion, FX margin, processing, monthly platform, integration, transaction, dispute / chargeback handling, and inactivity / dormancy fees. **5.2** Right to amend fees. SPENDL may amend the Fee Schedule on at least 30 days’ notice (60 days for material changes), except where a shorter period is required by law, regulator, or Network Rules. If you do not accept an amended fee, you may terminate the relevant Service before the new fee takes effect; continued use after the effective date constitutes acceptance. **5.3** Funding the Card. You may fund the Card only by converting supported Crypto Assets to ZAR via the Platform. The ZAR amount becomes available on the Card once the underlying blockchain confirmations have been received and the conversion has settled. Conversion rates and settlement times depend on blockchain confirmations, liquidity provider availability, and banking-hours constraints. **5.4** FX margin and best execution. Conversion is executed at a rate that includes a margin over the wholesale rate quoted to SPENDL by its liquidity partners. The applicable margin is disclosed in the Fee Schedule. SPENDL applies a best-execution policy taking account of price, certainty of execution, speed, size, and counterparty risk. **5.5** Network, gas and third-party fees. Network fees (gas, miner, scheme, processor, and banking-partner fees) are passed through at cost and are deducted from the amount converted or settled. All on-chain fees associated with funding the Account are for the Customer’s account. Customers must ensure any Crypto Asset funding includes the appropriate gas/on-chain fee to ensure timely confirmation; SPENDL cannot control or alter blockchain confirmation times. **5.6** Limits and tiers. Default Customer tiers and limits are set out in Schedule F. Limit increases are subject to EDD and SARB Exchange Control thresholds where applicable. SPENDL may adjust limits in its discretion based on risk, regulatory, or operational factors. **5.7** Cross-border and crypto compliance. SPENDL does not route crypto-asset cross-border flows through an Authorised Dealer. Crypto-asset cross-border flows are conducted under SPENDL’s CASP authorisation and FIC Act obligations, including FIC Directive 9 (Travel Rule), SARB Exchange Control and BoP reporting requirements applicable to crypto assets, and the SARB Financial Surveillance Department (FinSurv) crypto-asset reporting framework, in each case as updated from time to time. Customers remain responsible for complying with their personal or corporate exchange-control position, tax-residency obligations, and obtaining tax clearances where required. Where any ZAR fiat cross-border activity is offered, that activity (if any) will be conducted through a duly licensed banking partner and only where lawful. **5.8** B2B pricing. B2B pricing is set in the Commercial Agreement and may include a monthly platform fee, transaction or processing fees, integration or onboarding fees, FX margin, yield share, and margin share. Invoices are payable within 14 days of issue unless the Commercial Agreement states otherwise. Late payments accrue interest at the prime rate plus 2% per annum, or the maximum rate permitted by law if lower. **5.9** Non-refundability and no set-off. Except as expressly stated in these Terms or required by law, fees paid to SPENDL are non-refundable. Card-programme fees (including issuance, replacement, scheme assessments and Network pass-through fees) are non-refundable consistent with Network Rules. You may not set off, withhold, or deduct any amount from sums owed to SPENDL on account of disputed amounts, counterclaims, taxes, or any other reason; disputes must be raised through the complaints process and any refund or credit will be processed on its own terms. **5.10** Tax. You are solely responsible for determining and paying any taxes (including income, capital gains, VAT, and withholding taxes) arising in connection with the Services. SPENDL will issue tax statements and certificates as required, will share data with SARS in respect of crypto-asset transactions where lawfully required (including under any third-party reporting obligation introduced by SARS for CASPs), and will respond to lawful requests from SARS or other authorities. **5.11** Security deposit, Reserve and settlement holdback. SPENDL may, in its discretion or as required by the Programme Partner, card scheme, banking partner or regulator: (a) require a Customer (in particular a B2B Customer) to lodge a security deposit; (b) maintain a rolling Reserve calculated against settlement, chargeback, refund, fraud, sanctions or scheme-rule exposures; and (c) apply a settlement and revenue-share holdback. The size, calculation method and release schedule of any Reserve or holdback are notified to the Customer and are subject to adjustment based on risk. SPENDL may offset amounts owed to it (including chargebacks, fines, penalties, scheme assessments, and unpaid fees) against any Reserve, holdback or balance held to the Customer’s order. **5.12** Chargeback abuse and excessive disputes. Customers must not engage in chargeback abuse, including raising disputes without a good-faith basis, raising disputes after merchant credit has been received, or filing disputes to defraud merchants or the scheme. Excessive chargeback ratios (above scheme-defined thresholds) or evidence of abuse may result in higher dispute-handling fees, increased Reserve requirements, restriction or termination of the Card, and reporting to scheme monitoring programmes. **5.13** Inactivity and dormancy. An Account is dormant if there has been no transaction or login for the period stated in the Fee Schedule (default: 12 months for B2C; 24 months for B2B). SPENDL will give at least 30 days’ notice before charging a dormancy fee or closing a dormant Account, and will refund any residual ZAR Balance to a verified bank account in your name (less fees and amounts owed) where legally and operationally feasible. ## Part 6 - Customer Obligations and Acceptable Use **6.1** Lawful use. You will use the Services only for lawful purposes, in accordance with these Terms and the Acceptable Use Policy (Schedule H). You must not use the Services to launder proceeds of crime, finance terrorism, evade sanctions, fund prohibited goods or services, or facilitate any other unlawful activity. **6.2** Account security. You are responsible for the security of your credentials, devices, PINs, multi-factor authentication factors, API keys, signing keys, and webhook secrets. You must enable multi-factor authentication where SPENDL makes it available and notify SPENDL immediately of any suspected compromise. SPENDL will never request your seed phrase, recovery phrase, full password, or backup phrase. You are responsible for transactions effected with your credentials, except to the extent set out in Schedule A or in a Commercial Agreement. **6.3** Accurate information. You will keep your information current, including name, residential or registered address, contact details, beneficial owners, authorised signatories, regulatory status, and Sanctions-status changes. SPENDL may suspend the Services where information is inaccurate or out of date. **6.4** Cooperation. You will cooperate with SPENDL on KYC, EDD, source-of-funds enquiries, sanctions enquiries, regulator enquiries, audits, fraud investigations, and dispute investigations. SPENDL may suspend or restrict Services until cooperation is provided. **6.5** No market abuse. You will not engage in market abuse, manipulation, spoofing, layering, wash trading, front-running, or any conduct that distorts price discovery or settlement. **6.6** No reverse engineering. You will not copy, modify, decompile, reverse-engineer, scrape, or create derivative works of the Platform or its software, except to the extent expressly permitted by law. **6.7** Anti-obstruction. You will not obstruct, frustrate, delay or otherwise interfere with SPENDL’s compliance, regulatory, scheme, audit, fraud-prevention or risk-management activities, including by withholding information, withdrawing consents required for KYC or sanctions screening, or using technical means to bypass controls. **6.8** Non-circumvention. You will not, during the term and for 12 months after termination, directly or indirectly solicit, engage with, or contract with any of SPENDL’s named Programme Partner, banking partners, custody, liquidity or infrastructure partners with a view to replicating the Services or circumventing SPENDL, where the relationship was introduced or facilitated by SPENDL. This clause does not restrict ordinary commercial dealings independent of SPENDL. **6.9** Reputational protection. The Customer will not make any public statement, post or communication that disparages or brings into disrepute SPENDL, the Programme Partner, the card scheme, banking partners or any other named partner of SPENDL, except to the extent the statement is true, made in good faith, and protected by law. Lawful complaints, ombud submissions, regulator engagements and whistleblower disclosures are not restricted by this clause. **6.10** Acceptable Use Policy. The Acceptable Use Policy at Schedule H is incorporated by reference. A breach of the AUP is a breach of these Terms. ## Part 7 - Risk Disclosures, Limitation of Liability and Indemnity **7.1** Risk Disclosures incorporated. The Risk Notice and Crypto Asset Risk Disclosures at the front of these Terms are incorporated into this Part 7. By using the Services you confirm that you have read and understood them. **7.2** No advice. The Services do not include investment, legal, tax, or financial advice. You must take independent advice as needed. Where SPENDL provides intermediary services for crypto assets under FAIS Cat I, those services are intermediary in nature and not advisory. **7.3** Stablecoin and depeg events. Where a stablecoin used in the conversion pipeline depegs, is frozen by its issuer, is delisted, or otherwise becomes subject to a material credit or liquidity event, SPENDL may, without liability: (a) suspend deposits or conversions in that asset; (b) hold or delay settlement; (c) convert at the prevailing market rate (which may differ materially from par); or (d) require the Customer to provide instructions for an alternative supported asset. **7.4** Custody, segregation and SPENDL insolvency. ZAR Balances are held in a pooled client account at the Programme Partner to your order. ZAR Balances are not deposits at a registered bank in SPENDL’s name and are not protected by any statutory deposit-insurance scheme. Crypto Assets transit through the conversion infrastructure on a transient basis and are not held by SPENDL as a stand-alone custodial service. Customer entitlements are tracked on an internal sub-ledger reconciled daily to the Programme Partner’s statement, and reconciliations are reviewed by SPENDL’s finance and compliance functions. In the event of SPENDL’s insolvency, business rescue, or liquidation, SPENDL has structured the pooled-account arrangement with the Programme Partner to support the segregation of Customer funds from SPENDL’s own estate, so far as legally permissible; however, insolvency outcomes are determined by South African insolvency law and SPENDL cannot guarantee insolvency-remoteness from any third party. **7.5** Counterparty risk. Customers are exposed to the credit, operational, and legal risk of SPENDL’s counterparties, including the Programme Partner, the card scheme, banking partners, blockchain infrastructure providers, liquidity providers, and custody partners. SPENDL discloses these classes here and identifies specific counterparties on the Website or on request, subject to confidentiality. **7.6** “As is” and disclaimer of warranties. Except as expressly stated, the Services are provided on an “as is” and “as available” basis. SPENDL disclaims all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement, to the maximum extent permitted by law. This clause does not limit non-excludable rights under the Consumer Protection Act for B2C Customers. ### 7.7 Limitation of Liability **7.7.1** General exclusions. To the maximum extent permitted by law, and subject always to clauses 7.7.4 and 7.7.5, neither SPENDL nor its affiliates, officers, directors, employees, agents or licensors shall be liable to any Customer for any indirect, incidental, special, consequential, punitive or exemplary damages, or for any loss of profit, revenue, business, opportunity, goodwill, reputation, data or anticipated savings, whether such liability arises in contract, delict (including negligence), under statute, or on any other basis, and whether or not SPENDL was advised of the possibility of such loss. **7.7.2** B2B aggregate cap. Subject to clauses 7.7.4 and 7.7.5, SPENDL’s aggregate liability to a B2B Customer for all claims (whether arising from one event or a series of related events) in any rolling 12-month period shall not exceed the greater of (i) the fees actually paid by that B2B Customer to SPENDL in the 12 months preceding the first event giving rise to the claim, or (ii) ZAR 500,000. The parties may agree a different cap in a Commercial Agreement. **7.7.3** B2C aggregate cap. Subject to clauses 7.7.4 and 7.7.5, and subject in all respects to the non-excludable rights of a Consumer under South African law (in particular the Consumer Protection Act 68 of 2008, the FAIS Act and the FAIS General Code of Conduct, POPIA, ECTA and the National Credit Act 34 of 2005), SPENDL’s aggregate liability to a B2C Customer for all claims (whether arising from one event or a series of related events) in any rolling 12-month period shall be limited to the fees actually paid by that B2C Customer to SPENDL in the 12 months preceding the first event giving rise to the claim. Where the loss complained of arises from a Card transaction, liability shall be determined in accordance with Schedule A, the applicable Network Rules and Programme Partner operating rules, and SPENDL’s complaints and disputes processes under Part 11 and Schedule A.5 to A.7, and the cap in this clause 7.7.3 applies only to the extent there is residual liability not otherwise allocated by those rules. **7.7.4** Carve-outs that always apply. Nothing in these Terms shall be read as excluding, limiting or modifying: (a) any liability of SPENDL for fraud, fraudulent misrepresentation, wilful misconduct, or gross negligence; (b) any liability for death or personal injury caused by negligence; (c) any liability or remedy that cannot lawfully be excluded, limited or modified by agreement, including non-excludable rights under the Consumer Protection Act, the FAIS Act and the FAIS General Code of Conduct, POPIA, ECTA, the National Credit Act, the FIC Act, the Financial Sector Regulation Act, and any subordinate legislation, conduct standards or joint standards thereunder; (d) any award, determination, recommendation or order made by the FAIS Ombud, the National Financial Ombud Scheme, the Information Regulator, the FSCA, the Prudential Authority, the Financial Intelligence Centre, a court of competent jurisdiction, or any other statutory body or regulator with jurisdiction over SPENDL or the Services; or (e) any liability of SPENDL that, by reason of its nature or by operation of law, cannot be capped or excluded. **7.7.5** Status of the caps. The caps in clauses 7.7.2 and 7.7.3 operate as a fallback only. They do not apply to, and shall not be construed as limiting or reducing, any amount payable under clause 7.7.4 or otherwise payable in terms of any statute, conduct standard, joint standard, ombud determination, court order or Network Rule. Where any provision of this clause 7.7 is found to be inconsistent with a non-excludable statutory right or with an ombud or regulator determination, that provision shall, to the extent of the inconsistency, be read down or severed so as to give effect to the statutory right or determination without invalidating the remainder of this clause. **7.7.6** Customer acknowledgement. The Customer acknowledges that the allocation of risk in this clause 7.7, including the exclusion of indirect and consequential losses in clause 7.7.1 and the aggregate caps in clauses 7.7.2 and 7.7.3, is a material basis on which SPENDL has agreed to provide the Services and has determined its pricing, and that this allocation is fair and reasonable in light of the nature of the Services, the fees payable, the carve-outs in clause 7.7.4, and the availability of independent recourse to the FAIS Ombud, the National Financial Ombud Scheme, the Information Regulator and the courts. ### 7.8 Indemnity **7.8.1** B2B Customer indemnity. The B2B Customer indemnifies and holds harmless SPENDL, the Programme Partner, the card scheme, banking partners, and SPENDL’s affiliates, officers, directors, employees, agents and licensors against all losses, claims, liabilities, damages, fines, penalties, costs and expenses (including reasonable legal fees on the attorney-and-own-client scale) arising out of or in connection with: (a) the B2B Customer’s breach of these Terms, any Commercial Agreement, the Acceptable Use Policy or applicable law (including the FIC Act, FAIS Act, POPIA, sanctions, exchange-control and tax laws); (b) any act, omission, claim or demand by an End User of the B2B Customer; (c) any third-party claim relating to data or content the B2B Customer or its End Users submit to the Platform; and (d) any unauthorised use of the B2B Customer’s credentials or API keys caused by its failure to safeguard them. **7.8.2** B2C Customer indemnity. The B2C Customer indemnifies SPENDL, its affiliates, officers, directors, employees and agents against direct losses, claims, liabilities, fines, penalties and reasonable legal costs arising solely from: (a) the B2C Customer’s fraud or wilful misconduct; (b) the B2C Customer’s material breach of the Acceptable Use Policy (Schedule H); or (c) any unauthorised use of the B2C Customer’s credentials, PIN or Card caused by the B2C Customer’s fraud, wilful misconduct or gross negligence. No other indemnity is owed by a B2C Customer under these Terms. **7.8.3** Exclusions. No indemnity is owed under this clause 7.8 to the extent the loss is caused by SPENDL’s own fraud, wilful misconduct or gross negligence, or by any matter for which liability cannot lawfully be shifted to the Customer. **7.8.4** Conduct of claims. SPENDL will promptly notify the Customer of any indemnified claim, allow the Customer to assume the defence (subject to SPENDL’s right to participate at its own cost), and not settle the claim in a manner that imposes a non-indemnified obligation on the Customer without the Customer’s consent (not to be unreasonably withheld). ## Part 8 - Intellectual Property and Licence **8.1** Ownership. SPENDL (and its licensors) own all intellectual property rights in the Platform, the Services, the API, and all related software, documentation, marks, and content. No rights are transferred except as expressly stated. **8.2** Licence to Customer. SPENDL grants you a limited, revocable, non-exclusive, non-transferable, non-sublicensable licence to access and use the Platform and Services solely as permitted by these Terms and any Commercial Agreement. The licence terminates on termination of the Services. **8.3** Customer Data and licence-back. As between SPENDL and the Customer, the Customer owns its Customer Data. You grant SPENDL a non-exclusive, royalty-free licence to process Customer Data to provide the Services, comply with law, operate the RMCP and Joint Standards controls, and to produce aggregated, anonymised insights to maintain and improve the Services. SPENDL does not acquire ownership of Customer Data. **8.4** Feedback. If you provide feedback or suggestions about the Services, you grant SPENDL a perpetual, irrevocable, royalty-free licence to use that feedback without restriction. **8.5** Trademarks. SPENDL, the Spendl logo, ITT and related marks are trademarks of SPENDL or its affiliates. You may not use them without prior written consent, except for permitted referential or factual use. **8.6** Open source. The Platform may include open-source components subject to third-party licences. Notices are available on request and via the developer documentation. ## Part 9 - Privacy, Data Protection and Cybersecurity **9.1** Privacy Policy. SPENDL processes Personal Information in accordance with POPIA and (where applicable to End Users in the European Economic Area or the United Kingdom) the EU GDPR and UK GDPR. The Privacy Policy published on the Website describes the categories of Personal Information collected, purposes, lawful bases, recipients (including KYC/AML vendors, regulators, the Programme Partner, and infrastructure partners), retention periods, security measures, cross-border transfer mechanisms, and your rights. **9.2** Information Officer. SPENDL has appointed an Information Officer registered with the Information Regulator. Contact details are published in the Privacy Policy and at clause 12.7. **9.3** Data subject rights. You may exercise rights of access, correction, deletion, restriction, and objection under POPIA (and equivalent rights under GDPR where applicable), subject to lawful retention requirements (including the FIC Act 5-year retention period). Requests should be sent to the Information Officer. **9.4** Cross-border transfers. Where Personal Information is transferred outside South Africa, SPENDL relies on a lawful basis under section 72 of POPIA (including adequacy or binding contractual commitments equivalent to POPIA standards). **9.5** Breach notification. SPENDL will notify the Information Regulator and affected data subjects as soon as reasonably possible after confirmation of a Personal Information breach that poses a real risk of harm, in accordance with section 22 of POPIA, and will report material cyber incidents to the FSCA in line with Joint Standard 2 of 2024. **9.6** B2B Data Processing Addendum. For B2B Customers where SPENDL processes Personal Information of the Customer’s End Users on the Customer’s behalf, the Data Processing Addendum at Schedule G applies and is incorporated by reference. **9.7** IT governance and cybersecurity. SPENDL maintains an IT governance and cybersecurity framework aligned with Joint Standard 1 of 2023 (IT Governance and Risk Management for Financial Institutions) and Joint Standard 2 of 2024 (Cybersecurity and Cyber Resilience for Financial Institutions), including Board-approved strategies, risk management, identity and access controls, encryption, vulnerability management, incident response, business continuity, and third-party risk management. **9.8** Outsourcing. SPENDL’s outsourcing arrangements (including with the Programme Partner, liquidity providers and cloud providers) are governed by an outsourcing policy aligned with Joint Standard 1 of 2024, including risk assessment, due diligence, written agreements, monitoring and exit planning. **9.9** Cookies and analytics. The Website uses cookies and similar technologies for functionality, analytics, and fraud prevention as described in the standalone Cookie Policy published on the Website. **9.10** Marketing communications. SPENDL will only send direct marketing communications where lawfully permitted under POPIA (section 69) and the Consumer Protection Act. You may opt out at any time via the unsubscribe mechanism in the relevant communication or by emailing . Service messages (transactional, security, regulatory) are not marketing and cannot be opted out of while you remain a Customer. **9.11** Business and tenant data continuity. SPENDL maintains business continuity and disaster-recovery arrangements aligned with applicable Joint Standards. For B2B Customers, SPENDL maintains tenant-data continuity capabilities (including export and reasonable transition assistance on termination) as set out in Schedule B. ## Part 10 - Suspension, Termination and Wind-Down **10.1** Suspension. SPENDL may suspend the Services (including freezing funds) where: (a) required by law, regulator, court, Network Rule, or Programme Partner instruction; (b) there is a reasonable suspicion of fraud, sanctions issue, or unlawful activity; (c) information you provided is inaccurate or out of date; (d) you breach these Terms or the AUP; or (e) operational continuity, security, or risk management requires it. Suspension is not a termination. **10.2** Termination by you. You may terminate any Service at any time by closing your Account and giving notice to SPENDL. Termination does not relieve you of accrued obligations. **10.3** Termination by SPENDL. SPENDL may terminate any Service: (a) for material breach by you that is not cured within 14 days of notice (or that is incapable of cure); (b) where required by law, regulator, court, Network Rule or Programme Partner; (c) on a sanctions match; (d) if you become insolvent, are wound up, or commit an act of insolvency; (e) for prolonged inactivity (≥ 12 months for B2C, ≥ 24 months for B2B); or (f) for B2B Customers, on 90 days’ written notice for convenience. **10.4** Restricted Access State. SPENDL may, instead of full suspension or termination, place an Account into a Restricted Access State (e.g., view-only, withdraw-only, or block-new-deposits) where required by law, scheme rule, Programme Partner, sanctions or risk policy. A Restricted Access State is not a termination. **10.5** Effect of termination. On termination: (a) the licence to use the Platform terminates; (b) outstanding fees become payable; (c) transactions in flight will be completed or unwound as applicable; (d) any residual ZAR Balance will be returned to a verified bank account in your name within 30 days where legally and operationally feasible, less fees, holdbacks, Reserves and amounts owed; (e) records will be retained as required by law; and (f) clauses by their nature surviving termination (Parts 1, 6.8, 6.9, 7, 8, 9, 11, 12, the AUP, the DPA, and any indemnities) will survive. **10.6** Wind-down (B2B). For B2B Customers, SPENDL will provide reasonable transition assistance for a period (typically 30 days, extendable by mutual agreement) on then-prevailing rates, subject to outstanding fees being paid and KYC/AML cooperation continuing. Tenant Data export will be provided in a commonly used format on request. **10.7** Sanctions and AML holds. SPENDL may withhold residual balances or pause unwind activity pending the resolution of sanctions, AML, fraud, or regulator investigations. ## Part 11 - Complaints, Disputes and Governing Law **11.1** Complaints process. If you have a complaint, please contact . SPENDL will acknowledge a complaint within 3 Business Days and aim to resolve it within 30 days, in line with SPENDL’s Complaints Management Policy and the TCF framework summarised at clause 3.8. **11.2** External escalation. If your complaint relates to a financial service, you may escalate to the FAIS Ombud (; Menlyn Central Office Building, 125 Dallas Avenue, Pretoria 0010; [www.faisombud.co.za](http://www.faisombud.co.za)), the National Financial Ombud Scheme where applicable, or the FSCA. Data complaints may be escalated to the Information Regulator. Reports of suspected financial-sector misconduct may also be made to the FSCA via its whistleblower channels. **11.3** Governing law and jurisdiction. These Terms shall be governed by and construed in accordance with South African law. You and SPENDL agree to submit all disputes, claims or controversies (including non-contractual disputes, claims or controversies) arising out of or in connection with these Terms, or the breach, termination, enforcement or interpretation thereof (together, Disputes), to the High Court of South Africa, Western Cape Division, Cape Town, with non-exclusive jurisdiction. ### 11.4 Time-bar **(a)** B2B Customers. To the maximum extent permitted by law, any claim by a B2B Customer arising out of or in connection with these Terms must be commenced within 12 months of the date on which the B2B Customer first became aware (or ought reasonably to have become aware) of the event giving rise to the claim, failing which the claim is barred. **(b)** B2C Customers. Nothing in these Terms shortens or limits the statutory prescription period applicable to a B2C Customer’s claim, nor the B2C Customer’s right to refer a complaint or claim to the FAIS Ombud, the National Financial Ombud Scheme, the Information Regulator, the FSCA or a court of competent jurisdiction, within the time periods prescribed by the relevant body or statute. **11.5** Whistleblowing and PRECCA. SPENDL operates an internal whistleblower channel for reports of fraud, corruption, bribery, money-laundering, sanctions breaches, market abuse or other unlawful conduct (). Reports may be made anonymously. SPENDL prohibits retaliation against any person making a report in good faith, consistent with the Protected Disclosures Act 26 of 2000 and the Prevention and Combating of Corrupt Activities Act 12 of 2004 (PRECCA). ## Part 12 - Changes, Communications and General **12.1** Changes to Services and Terms. SPENDL may modify the Services or these Terms. For Material Changes, SPENDL will give at least 30 days’ notice (60 days where required), except where a shorter period is required by law, regulator, Network Rule, Programme Partner instruction, or for urgent security reasons. You may terminate without penalty during the notice period; continued use after the effective date constitutes acceptance. **12.2** Versioning. A version log of these Terms is published on the Website. Prior versions are archived and available on request. Current version: 1.2, effective 1 July 2026. **12.3** Communications and electronic signature. You consent to receive communications electronically (including legal notices) and to sign electronically, as contemplated by ECTA. Notices are deemed delivered when sent to the address on file (without bounce, for email) or delivered to your account (for in-app messages). SPENDL may record calls and chats for compliance and quality purposes. **12.4** Assignment and change of control. SPENDL may assign or novate these Terms to an affiliate or successor on notice. You may not assign without SPENDL’s prior written consent. SPENDL may make reasonable requests for information following a change of control of a B2B Customer. **12.5** Severability and waiver. If any provision is invalid, the remainder remains in force. Failure to enforce a provision is not a waiver. **12.6** Force Majeure. Neither party is liable for delay or failure caused by an event beyond its reasonable control, including power or grid failure, telecoms or ISP disruption, cloud outage, DDoS or cyber incidents, pandemic, war, civil unrest, strike, regulatory action, exchange or banking disruption, Network outage, Programme Partner outage, blockchain disruption (including hash-rate or consensus failures), stablecoin issuer suspension or depeg, or banking partner disruption. The affected party will notify the other within 5 Business Days of the event and take reasonable steps to mitigate. For B2B Customers, either party may terminate the affected Service if the event continues for more than 30 days. For B2C Customers, either party may terminate the affected Service if the event continues for more than 60 days. **12.7** Notices and contacts. Unless a Commercial Agreement provides otherwise: * General support: * Complaints Officer: * Compliance Officer (CCO): Carl Muller, * Information Officer (POPIA): Carl Muller, * Whistleblower channel: * Abuse / AUP reports: * Lost or stolen card / fraud hotline:011 207 1600 * Registered office and service of legal process (domicilium citandi et executandi): 14 Central Square, Cape Town * FAIS Disclosure Notice, Conflicts of Interest Management Policy, Privacy Policy, Cookie Policy and Complaints Management Policy: published on the Website (or on request from ). **12.8** Third-party rights. The card scheme, the Programme Partner, banking partners, and infrastructure partners are intended third-party beneficiaries of clauses that confer rights or protections on them. **12.9** Entire agreement. These Terms (with the Schedules, the MSA and any Transaction Document (for B2B / Tenant deployments), any standalone Commercial Agreement (where there is no MSA), the Fee Schedule, the Privacy Policy, and the AUP) form the entire agreement between you and SPENDL with respect to the Services and supersede prior representations, except for fraud. **12.10** Counterparts and execution. Where these Terms are signed (for example through a Commercial Agreement), they may be signed in counterparts and electronically. ## Part 13 - Version Control | **Version** | **Effective Date** | **Summary of Changes** | **Reason for Changes** | **Approved By** | | ----------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | | 1.1 | 1 September 2025 | Founding version — initial Terms and Conditions issued. | Initial Terms and Conditions compliance requirement upon platform launch | Board of Directors | | 1.2 | 1 July 2026 | Restructure of the Terms and Conditions from a single 20-clause document into Master Terms with eight incorporated Schedules adding definitions, interpretation and an order of precedence, and removing duplicated sections. Perimeter extended from B2C-only to B2C, B2B/Tenant and End User. Compliance content expanded across FIC Directives 7 and 9 and the CASP cross-border and FinSurv position. Risk Notice replaced with a twelve-part crypto risk disclosure; liability and indemnity rewritten with split B2B/B2C caps. | Compliance pack refresh: alignment with the updated RMCP, FAIS Disclosure Notice, Conflicts of Interest, Complaints, Cookie and Privacy Policies. | Board of Directors | ## Schedule A - SPENDL Card (B2C) **A.1** Issuance and processing. The SPENDL Card is a prepaid reloadable debit card on a major payment Network, issued and processed by the Programme Partner under SPENDL’s programme. The Card is not a credit facility, bank account, deposit, or investment product; it does not earn interest and does not provide overdraft. The Card is non-transferable. Card artwork and finishes may vary; any substitutions keep features, security, and performance the same. **A.2** Funding. You may fund the Card only by converting supported Crypto Assets to ZAR via the Platform. Funds become available once the underlying blockchain confirmations and ZAR settlement are complete. Cut-off times are published on the Website. SPENDL does not facilitate outbound transfers of Crypto Assets from the Card or Account, nor reconversion of ZAR back into Crypto Assets, except as expressly described in these Terms. **A.3** Acceptance. The Card may be used to pay merchants or withdraw cash wherever the Network is accepted, subject to KYC/FICA verification, Network Rules, regulatory restrictions, applicable limits, and the Fee Schedule. Certain merchant category codes (MCCs) are restricted by SPENDL or the Network; the restricted list is in the AUP. **A.4** Pre-authorisations and holds. Some merchants (for example, fuel, hospitality, car rental) may place pre-authorisation holds that reduce available balance until the final transaction posts. Pre-authorisations typically expire within 7 to 30 days depending on the merchant type and Network Rules. **A.5** Refunds and disputes. Merchant refunds post when received from the merchant or processor; timing is merchant-dependent. To dispute a transaction, notify SPENDL promptly with supporting evidence (typically within 30 to 60 days of posting). SPENDL processes disputes via the Programme Partner under Network Rules. SPENDL will investigate in good faith and, where appropriate, correct, reverse, or re-credit as required by law and Network Rules. **A.6** Lost, stolen or compromised cards. Notify SPENDL immediately and report the card as lost/stolen to the Bank on 011 207 1600 if the Card is lost, stolen, or compromised. SPENDL will block the Card on request as soon as reasonably practicable. Replacement cards are issued in accordance with the Fee Schedule and typically within 5 to 10 Business Days. **A.7** Unauthorised transaction liability (B2C). You will not be liable for unauthorised Card transactions where you (a) report the loss, theft, or compromise promptly; (b) follow SPENDL’s security guidance; and (c) have not acted fraudulently or with gross negligence. You will be liable for transactions effected with your PIN or credentials where you have shared them, written them down insecurely, or otherwise been grossly negligent. Specific allocation of pre- and post-notification liability is set out in the Fee Schedule and applicable Network Rules. **A.8** Chargeback abuse. Repeated, unfounded, or fraudulent disputes may result in higher dispute-handling fees, a Reserve, restriction of the Card, scheme reporting, and termination, in line with clause 5.12. **A.9** ATM and POS. ATM withdrawals are subject to the Fee Schedule and partner ATM rules. Dynamic Currency Conversion (DCC) at foreign POS or ATM may result in a less favourable rate; you can decline DCC and have the transaction processed in the local currency where the option is offered. **A.10** Card expiry, renewal, and cancellation. The Card has an expiry date printed on the Card. SPENDL may renew or replace the Card before expiry on substantially the same terms. You may cancel the Card at any time; any residual ZAR Balance will be returned in accordance with clause 10.5. **A.11** Network Rules. The Network Rules (and Programme Partner operating rules) apply to all Card transactions and are incorporated by reference to the extent they govern Cardholder rights or obligations. The Network Rules are scheme-mandatory and override inconsistent Card-specific provisions in these Terms to the extent of any conflict. **A.12** Death and estate. On the death of a Cardholder, the executor of the estate must notify SPENDL with certified documentation. SPENDL will block the Card and process residual balances in accordance with the executor’s lawful authority. ## Schedule B - B2B Platform and Public API ### Part B-1 - Platform terms **B.1.1** Tenants. SPENDL provisions a logical tenant for each B2B Customer. The tenant is the unit of configuration, isolation, billing, and access control. Tenant lifecycle (sandbox provisioning, production go-live, decommissioning) is managed jointly with the Customer. **B.1.2** API access and credentials. API access is via authenticated keys with scoped permissions. Customers must rotate keys at least every 12 months (or sooner on suspected compromise), revoke keys for departing personnel promptly, and follow SPENDL’s integration guidance. **B.1.3** Sandbox vs production. The sandbox is provided for testing and integration. Sandbox Services may not be used for live or production traffic and may be reset, modified, or withdrawn without notice. Production Services are governed by the SLA at Part B-3. **B.1.4** End User pass-through. Where the B2B Customer provides services to End Users using the Platform, the Customer must impose minimum terms on those End Users including: KYC/AML cooperation; sanctions and AUP compliance; lawful-use undertakings; consent to data processing; and acknowledgement of risk disclosures equivalent in substance to those in Part 7 and the Risk Notice. **B.1.5** Webhooks and callbacks. Webhook endpoints must be HTTPS-only, validated by signature, and tolerant of replay. Customers are responsible for endpoint availability and security. **B.1.6** Rate limits and fair use. API rate limits, quotas and fair-use thresholds are published in the developer documentation and may be updated from time to time on reasonable notice. SPENDL may throttle requests that exceed published limits without liability. **B.1.7** Audit log and records of instructions. SPENDL maintains immutable logs of API calls, instructions and configuration changes initiated by a B2B Customer. Logs are made available to the Customer via the dashboard or on reasonable request, subject to confidentiality and retention rules. **B.1.8** Audit and inspection. Customers that are themselves regulated may exercise audit rights once per year on at least 30 days’ written notice, during business hours, subject to confidentiality and reasonable cost-allocation, and limited to information necessary for the Customer’s regulatory obligations. Pooled audit reports (such as SOC 2 or equivalent), where available, will be made available in lieu of on-site audit. **B.1.9** Subprocessors and infrastructure partners. A current list of material subprocessors and infrastructure partners is maintained on the Website. SPENDL will give the Customer at least 30 days’ notice of changes to that list. The Customer may object on reasonable grounds; if SPENDL cannot accommodate the objection, the Customer may terminate the affected Service. **B.1.10** Reporting. SPENDL will provide monthly tenant reports covering, where applicable, ITT volumes, wallet balances, active users, transaction volumes, and revenue, consistent with the agreed scope. **B.1.11** Insurance. SPENDL maintains insurance arrangements appropriate to the Services, subject always to any exemption applicable to it under FAIS Notice 25 of 2023. Evidence of cover (or confirmation of exemption) can be provided to B2B Customers on reasonable request. **B.1.12** Business continuity and tenant data continuity. SPENDL maintains business continuity, disaster recovery, and tenant data continuity arrangements consistent with applicable Joint Standards. On request or on termination, SPENDL will provide a Tenant Data export in a commonly used format. ### Part B-2 - Master Services Agreement and Commercial Terms **B.2.1** MSA precondition. As stated in clause 2.10, every B2B / Tenant deployment is conditional on the parties signing the SPENDL Master Services Agreement (MSA). The MSA, together with its Transaction Documents and annexures, governs the deployment and prevails over these Terms in the event of any conflict in respect of the B2B / Tenant relationship. **B.2.2** Transaction Documents. Specific B2B Services, fees, Reserves, term, renewal, named users, integration scope, SLAs, support tier, reporting cadence, and bespoke variations are agreed in a Transaction Document (or Commercial Agreement) under the MSA. The Transaction Document, together with the MSA, the Master Terms and this Schedule, governs the engagement. **B.2.3** Term and renewal. Unless a Transaction Document states otherwise, B2B engagements run for an initial term of 12 months, with auto-renewal for successive 12-month periods unless either party gives 60 days’ notice of non-renewal. **B.2.4** Compliance with the MSA. The B2B Customer / Tenant must remain in compliance with the MSA at all times, including (without limitation) its obligations relating to AML/CTF, sanctions, KYC and CDD, the Risk Management and Compliance Programme, data protection, audit cooperation, business continuity, intellectual property, reputational protection, non-circumvention, anti-obstruction, insurance, fees, Reserves and holdbacks, and chargeback abuse. A breach of the MSA is a breach of these Terms. ### Part B-3 - Service Level Agreement **B.3.1** Uptime target. SPENDL targets monthly uptime of 99.5% for Production Services, measured on a rolling 30-day basis and excluding scheduled maintenance, beta features, and Force Majeure Events. **B.3.2** Maintenance windows. Planned maintenance is typically conducted in low-traffic windows on at least 7 days’ notice. Emergency maintenance may be performed on best-effort notice. **B.3.3** Support tiers and hours. Standard business hours support: 08:00 to 17:00 South African time, Monday to Friday, excluding public holidays. Standard support: response within 1 Business Day. Priority support: response within 4 business hours. Enterprise support: response within 1 hour for Severity 1 incidents and 4 hours for Severity 2. Severity classification is described in the Commercial Agreement. **B.3.4** Service credits. If monthly uptime falls below 99.5%, the Customer may claim service credits as set out in the Commercial Agreement. Service credits are the sole and exclusive remedy for SLA breach and are capped at 25% of the monthly platform fee for the affected month. **B.3.5** Status page. SPENDL maintains a public status page on which incidents and maintenance are communicated. ## Schedule C - ITT Programme Rules **C.1** Definition. ITT (Internal Treasury Token) is a closed-loop tokenised payment instrument issued by SPENDL or a SPENDL-affiliated programme operator and used by enrolled programme participants for treasury, settlement, and payment purposes within the programme. ITT is not offered to the public. **C.2** Not a security or financial product. ITT is not offered or marketed as a security, share, debenture, collective investment scheme, derivative, deposit, or any other regulated financial product. ITT does not confer ownership of, or rights to dividends or profits from, SPENDL or any affiliate. Where ITT is later determined by a regulator to fall within a regulated product class, SPENDL will adapt the programme to comply. **C.3** Eligibility. Only enrolled programme participants who have completed CDD/EDD, executed a programme participation agreement, and been admitted by SPENDL may hold or transact in ITT. **C.4** Issuance and redemption. ITT is issued against a corresponding ZAR (or other supported asset) deposit on a 1:1 basis (or as set out in the programme rules). ITT is redeemable into the underlying asset by an enrolled participant on the terms set out in the programme rules, subject to KYC/AML, sanctions, and operational windows. Redemption is processed within 2 Business Days of a valid redemption instruction in ordinary course, subject to extension where AML, sanctions or operational issues arise. **C.5** Custody and backing. The ZAR (or other) backing for ITT is held in segregated or pooled accounts at the Programme Partner or another regulated counterparty as set out in the programme rules. The backing is reconciled daily and reviewed regularly by SPENDL’s finance and compliance functions. Backing is not insured by any deposit-insurance scheme. **C.6** Closed-loop use. ITT is transferable only between enrolled programme participants and only via the SPENDL Platform. ITT is not transferable to external wallets or CASPs and cannot be sold, assigned, or used as collateral outside the programme without SPENDL’s consent. **C.7** Smart-contract upgrades and incidents. SPENDL may upgrade, pause, or migrate the ITT smart contracts to address bugs, security incidents, regulatory requirements, or programme changes. Upgrades are communicated to participants in advance where reasonably practicable. In a security incident, SPENDL may pause the programme to protect participants. **C.8** Wind-down. On termination of the ITT programme, SPENDL will redeem outstanding ITT to the underlying asset within a reasonable wind-down window and notify participants of the timeline. SPENDL may withhold redemption pending sanctions, AML, or regulator clearance. **C.9** AML, sanctions, and Travel Rule. Programme participants are subject to ongoing CDD/EDD, sanctions screening, and Travel Rule compliance. Closed-loop transfers within the programme are tracked, monitored, and reportable to authorities as required. ## Schedule D - Cross-Border Crypto Compliance **D.1** Scope and CASP basis. This Schedule applies to cross-border crypto-asset flows that SPENDL or its infrastructure partners facilitate. SPENDL does not route crypto-asset cross-border flows through an Authorised Dealer. Crypto-asset cross-border flows are conducted under SPENDL’s CASP authorisation and FIC Act obligations, and under the applicable SARB Exchange Control and BoP reporting framework for crypto assets, in each case as updated from time to time. **D.2** Travel Rule (FIC Directive 9). For inbound transfers, SPENDL acts as the Beneficiary CASP and complies with its Beneficiary-side obligations, including requesting and validating originator information from the originating CASP/VASP. For outbound transfers (where supported via infrastructure partners), SPENDL or its infrastructure partner acts as the Originator CASP and provides the required originator information to the Beneficiary CASP/VASP. Customers must provide accurate, complete and timely Travel Rule information on demand. **D.3** FinSurv and Exchange Control reporting. SPENDL reports cross-border crypto-asset flows to the SARB Financial Surveillance Department (FinSurv) under the crypto-asset reporting framework and complies with SARB Exchange Control rules applicable to CASPs as those rules are issued and amended. Customers remain responsible for complying with their personal or corporate exchange-control position and obtaining any tax clearances required. **D.4** Beneficiary screening. SPENDL screens originators, beneficiaries and counterparties against Sanctions Lists and adverse-media sources. Transfers to or from high-risk jurisdictions or counterparties may be declined or held pending EDD. **D.5** FX, fees and pass-through. Where conversion occurs, FX rates include the margin disclosed in the Fee Schedule. On-chain (gas, miner) and infrastructure-partner fees are passed through at cost. **D.6** Cut-off times and corridors. Each crypto corridor has a cut-off time and an expected settlement window published on the Website. Flows received after cut-off are processed on the next Business Day, subject to blockchain confirmation timing. **D.7** Refunds and recalls. Recalled or failed transfers are returned to the source of funds, net of irrecoverable Network and infrastructure-partner fees. **D.8** Restricted corridors. SPENDL may restrict or suspend any corridor at any time on regulatory, sanctions, partner, or operational grounds. **D.9** No Authorised Dealer fiat route for crypto. For the avoidance of doubt, SPENDL does not use the Authorised Dealer (fiat banking) framework for the crypto-asset cross-border leg. Any related ZAR fiat banking activity that may be conducted with the Programme Partner or another banking partner is separate from, and not a substitute for, the crypto-asset compliance regime described in this Schedule. ## Schedule E - Treasury and Off-Ramp **E.1** Conversion service. SPENDL provides a Crypto Asset to ZAR conversion service (off-ramp) at market rates plus the disclosed FX margin. The conversion is executed via SPENDL’s liquidity partners under a best-execution policy. **E.2** Order types. Conversions are typically executed at market on a best-execution basis. Slippage tolerances and partial-fill handling are configurable for B2B Customers in the Commercial Agreement. **E.3** Cut-off times. Conversion cut-off times are published on the Website. Conversions placed after cut-off settle on the next Business Day. **E.4** Treasury accounts (B2B). B2B Customers may hold operating ZAR balances in a SPENDL-managed treasury account configured to their policy, with reconciliation reports on the cadence set in the Commercial Agreement. **E.5** Reconciliation. SPENDL provides transaction-level reconciliation files via the API and the Customer dashboard. Customers must review and notify SPENDL of any discrepancy within 30 days. **E.6** No advice. The conversion and treasury services are intermediary services under FAIS and do not constitute advice. Customers are responsible for their own treasury, hedging, and tax decisions. ## Schedule F - Fee Schedule (Framework and Default Tiers) This Schedule sets out the categories of fees and default tier limits applicable to the Services. Specific Rand amounts are published on the Website and, for B2B Customers, in the Commercial Agreement. Fees are exclusive of VAT unless stated. SPENDL may amend the Fee Schedule on notice in accordance with clause 5.2. ### F.1 Fee categories * Card issuance and replacement fees * ATM withdrawal and balance enquiry fees (domestic and international) * POS transaction fees (domestic and international) * Crypto-to-ZAR conversion fee and FX margin * Network, scheme, gas and pass-through fees * Monthly platform fees (B2B) * Integration and onboarding fees (B2B) * Processing, settlement and disbursement fees * Dispute, chargeback and abuse handling fees * Reserve, security deposit and holdback amounts as required by risk policy * Inactivity / dormancy fees * Bespoke fees as set out in a Commercial Agreement ### F.2 Default B2C tiers (Card) **Smart** Monthly load limit ZAR 25,000. Compliance requirements: South African ID and South African address. Subject to KYC and ongoing monitoring. **Savvy** Monthly load limit ZAR 100,000. Compliance requirements: South African ID, basic proof of residence, and South African address. Subject to KYC and ongoing monitoring. **Guru** Monthly load limit ZAR 500,000. Compliance requirements: South African ID, full proof of residence, source-of-funds documentation, and South African address. Subject to KYC, EDD where applicable, and ongoing monitoring. Limit increases beyond the Guru tier are subject to EDD, source-of-funds verification, and applicable SARB rules for crypto-asset flows under the CASP framework. ### F.3 Default B2B tiers B2B limits, processing rates, FX margins, Reserves and bespoke fees are set in the Commercial Agreement. Default baseline floors apply for Sandbox and pilot tenants; production limits are calibrated to the Customer’s risk profile, regulatory status, and volume forecast. ### F.4 Dormancy Default dormancy period: 12 months (B2C) and 24 months (B2B), as set out in clause 5.13. ## Schedule G - Data Processing Addendum **G.1** Application. This Schedule applies where SPENDL processes Personal Information of a B2B Customer’s End Users in the course of providing the Services. The B2B Customer is the Responsible Party and SPENDL is the Operator under POPIA (controller and processor in equivalent terminology under GDPR). **G.2** Subject matter and duration. The processing is carried out for the duration of the Services. The categories of data subjects, types of Personal Information, processing purposes, and technical and organisational measures are set out in the Annex to the Commercial Agreement (or, if none, in the dashboard). **G.3** SPENDL obligations. SPENDL will: (a) process Personal Information only on documented instructions from the Customer (and in accordance with these Terms); (b) ensure persons with access are bound by confidentiality; (c) implement appropriate technical and organisational security measures aligned with Joint Standard 2 of 2024; (d) assist the Customer with data-subject requests, breach notifications, and Information Regulator engagements (subject to reasonable cost-allocation); (e) make available information necessary to demonstrate compliance; and (f) on termination, return or delete Personal Information in accordance with these Terms and applicable law. **G.4** Subprocessors. SPENDL may engage subprocessors. The current list is published on the Website. SPENDL will give 30 days’ notice of changes; the Customer may object on reasonable grounds. **G.5** Cross-border transfers. Where Personal Information is transferred outside South Africa, SPENDL will rely on a lawful basis under section 72 of POPIA and impose binding obligations on recipients equivalent in substance to POPIA standards. Where GDPR applies, SPENDL will rely on a lawful transfer mechanism under Chapter V of the GDPR. **G.6** Breach notification. SPENDL will notify the Information Regulator and affected data subjects as soon as reasonably possible after confirmation of a Personal Information breach that poses a real risk of harm, in accordance with POPIA, and will coordinate with the Customer on Customer-facing notifications. **G.7** Audit. The Customer may audit SPENDL’s POPIA/GDPR compliance once per year on 30 days’ notice, subject to confidentiality and reasonable cost-allocation. Pooled audit reports (such as SOC 2) will be made available in lieu of on-site audits where appropriate. **G.8** Liability. Liability under this Schedule is subject to the limitation of liability in clause 7.7, except to the extent such limitation would be unenforceable under POPIA or GDPR. ## Schedule H - Acceptable Use Policy **H.1** Prohibited activities. You must not use the Services to facilitate, promote, or attempt to engage in: * Money laundering, terrorism financing, sanctions evasion, or tax evasion. * Trade in illegal goods or services, including narcotics, weapons, child sexual abuse material, human trafficking, or counterfeit goods. * Unlicensed gambling or iGaming, unlicensed financial services, or pyramid / Ponzi schemes. * Adult content involving minors, non-consensual content, or content prohibited by law. * Pass-through money-service-business activity, layered structuring to evade limits, or otherwise frustrating SPENDL’s AML controls. * Cyber-attack tooling, ransomware, malware distribution, or any activity that compromises the Platform or third-party systems. * Market abuse, manipulation, spoofing, layering, wash trading, and front-running. **H.2** Restricted MCCs. SPENDL or the card scheme may restrict transactions in specific merchant category codes, including unlicensed gambling, certain digital wallets and crypto on-ramps, certain forex / CFD platforms, adult content, and others. The current restricted list is maintained on the Website. **H.3** Restricted Jurisdictions. SPENDL maintains a Restricted Jurisdictions list, including jurisdictions subject to comprehensive sanctions, FATF call-for-action jurisdictions, and others identified by SPENDL’s risk policy. The list is published on the Website and updated from time to time. **H.4** Security obligations. You will: enable multi-factor authentication where available; protect credentials, PINs, devices, API keys, and signing keys; promptly report suspected compromise; and keep contact details current so that fraud and security alerts reach you. SPENDL will never request your seed phrase, recovery phrase, full password, or backup phrase. **H.5** Fair use. You will not abuse rate limits, sandbox quotas, or support channels. SPENDL may throttle or suspend access for abusive use after notice (or without notice for clear abuse). **H.6** No reverse engineering or scraping. You will not scrape the Platform, attempt to reverse-engineer the API or software, probe for vulnerabilities outside an authorised programme, or circumvent technical protections. **H.7** Anti-bribery and corruption. Each party will comply with applicable anti-bribery and anti-corruption laws (including PRECCA). Neither party will offer or accept improper inducements in connection with the Services. **H.8** Modern slavery and trafficking. Each party will not knowingly engage in or facilitate slavery, servitude, forced or compulsory labour, or human trafficking, and will take reasonable steps to avoid such conduct in its supply chain and comply with the Prevention and Combating of Trafficking in Persons Act 7 of 2013. **H.9** Reporting. Suspected breaches of this AUP can be reported to . Confidential reports of unlawful conduct may also be made to . SPENDL may suspend Services pending investigation.