AML, KYC, CTF & DAC7 Compliance Policy

Operator: GQ VENTURES SAS · Trade name: FARENIO · Country of establishment: France

Effective date: September 2026 · Compliance contact: contact@farenio.com · Legal contact: legal@farenio.com

ARTICLE 1 – PURPOSE

This Policy establishes the compliance framework applied by GQ VENTURES SAS, operating under the trade name FARENIO (“FARENIO”), for the identification and verification of professional service providers and other relevant marketplace users, trader traceability, fraud prevention, tax reporting and associated compliance controls.

FARENIO operates a digital marketplace and software ecosystem connecting customers, hosts, property managers, businesses and other users with independent cleaners, cleaning companies and other professional service providers.

This Policy is intended to ensure that information required for marketplace participation is collected, verified, maintained and used in accordance with applicable French and European Union law without unnecessary duplication.

ARTICLE 2 – LEGAL FRAMEWORK

This Policy shall be applied, as relevant, in accordance with:

• Regulation (EU) 2022/2065 on a Single Market for Digital Services (“Digital Services Act” or “DSA”);
• Directive 2011/16/EU on administrative cooperation in taxation, as amended by Directive (EU) 2021/514 (“DAC7”);
• Articles 1649 ter A to 1649 ter E of the French General Tax Code and applicable implementing provisions;
• Regulation (EU) 2016/679 (“GDPR”);
• French Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties, as amended;
• Applicable French consumer, commercial, tax and marketplace legislation;
• Applicable European Union and French sanctions legislation; and
• Other mandatory laws applicable to FARENIO's marketplace activities.

Anti-money laundering and counter-terrorist financing requirements apply to FARENIO only to the extent that GQ VENTURES SAS or a relevant activity is legally within the scope of the applicable AML/CFT legislation.

Provider identity verification performed for marketplace integrity, payment, fraud-prevention, DSA, DAC7 or contractual purposes shall not by itself be characterised as a statutory AML/KYC obligation.

ARTICLE 3 – SCOPE

This Policy applies, where relevant, to:

• Individual professional service providers;
• Cleaning companies;
• Vendors;
• Marketplace sellers;
• Hosts and property managers acting professionally;
• Business and enterprise users;
• Marketplace partners; and
• Other persons or entities whose verification is required by applicable law or reasonably necessary for operation of the marketplace.

The nature and extent of verification depends on the person's role, legal status, services, applicable statutory requirements and identified compliance risks.

ARTICLE 4 – UNIFIED PROVIDER COMPLIANCE RECORD

FARENIO shall, where legally permissible, maintain a unified compliance record for each relevant provider or trader. The record may contain:

Identity → Business Registration → DSA Trader Information → Tax/DAC7 Information → Payment Verification → Insurance → Verification Status → Review History.

Information already lawfully obtained for one compliance purpose should not be requested again where it remains accurate, adequate and lawfully reusable for the additional purpose.

Access to compliance information is restricted according to authorised roles and legitimate operational requirements.

ARTICLE 5 – IDENTITY AND BUSINESS VERIFICATION

Before activating a provider where verification is required, FARENIO may obtain information necessary to establish the provider's identity and professional or business status.

Individual Providers

Relevant information may include:

• Full legal name;
• Postal or residential address;
• Email address;
• Telephone number;
• Date of birth where legally required;
• Government-issued identity documentation;
• Tax identification information where applicable;
• Professional or business registration information;
• Payment-account information; and
• Other information required by applicable law.

Legal Entities and Businesses

Relevant information may include:

• Legal entity name;
• Trading name;
• Registered office;
• Business registration number;
• SIREN/SIRET or equivalent foreign identifier;
• Relevant commercial-register information;
• VAT identification number where applicable;
• Tax identification information;
• Authorised representative information;
• Payment-account information; and
• Other documentation necessary to establish the entity's existence and authority to operate.

FARENIO shall collect only information that is necessary for an identified legal, contractual, security or legitimate compliance purpose.

ARTICLE 6 – DSA TRADER TRACEABILITY

Where FARENIO operates an online platform allowing consumers to conclude distance contracts with traders and the applicable trader-traceability provisions of the DSA apply, FARENIO shall obtain the legally required trader information before allowing the trader to offer services to consumers through the relevant marketplace functionality.

Required information may include:

• Trader's name or legal name;
• Postal address;
• Telephone number;
• Email address;
• Identity document or legally recognised electronic identification;
• Payment-account details;
• Trade-register information and registration number, where applicable; and
• The trader's self-certification committing to offer only services that comply with applicable Union law.

FARENIO shall make reasonable efforts to assess whether required information is reliable and complete using appropriate official databases, electronic interfaces, supporting documents or other legally appropriate verification methods.

Where required information is inaccurate, incomplete or materially unreliable, FARENIO may request correction and, where required by law, prevent or suspend the trader from offering services until the deficiency has been remedied.

ARTICLE 7 – DAC7 DUE DILIGENCE

Where FARENIO qualifies as a reporting platform operator and a provider carries out a reportable activity within the scope of DAC7, FARENIO shall perform the applicable seller due-diligence procedures.

Information collected for an individual reportable seller may include, where legally required:

• First and last name;
• Primary address;
• Tax identification number;
• Jurisdiction issuing the tax identification number;
• VAT identification number, where available and applicable;
• Date of birth; and
• Other information prescribed by applicable DAC7 legislation.

For an entity, required information may include:

• Legal name;
• Primary address;
• Tax identification number;
• Jurisdiction issuing that number;
• VAT identification number, where applicable;
• Business registration number; and
• Other information required under the applicable reporting framework.

FARENIO shall determine whether a provider constitutes a reportable seller, excluded seller or other category recognised by applicable DAC7 legislation.

ARTICLE 8 – DAC7 VERIFICATION

FARENIO shall apply the verification procedures required under applicable DAC7 legislation to determine the reliability of information collected from sellers. Verification may use:

• Information and documentation already held by FARENIO;
• Official company registers;
• Tax identification validation facilities;
• VAT validation facilities;
• Government databases or public interfaces;
• Legally recognised electronic identification;
• Internal consistency checks; and
• Other legally permissible verification methods.

Providers shall cooperate with reasonable requests necessary for FARENIO to satisfy its statutory DAC7 due-diligence obligations.

ARTICLE 9 – DAC7 REPORTING

Where legally required, FARENIO shall report prescribed information concerning reportable sellers and relevant activities to the competent tax authority within the statutory reporting period.

Reportable information may include:

• Seller identification information;
• Tax identification information;
• Consideration paid or credited through the platform;
• Number of relevant activities;
• Fees, commissions or taxes withheld or charged by FARENIO where reportable; and
• Other information prescribed by applicable DAC7 legislation.

FARENIO shall inform affected providers about the processing and transmission of their information as required by applicable tax and data-protection legislation.

ARTICLE 10 – PAYMENT AND ACCOUNT VERIFICATION

Where necessary for marketplace payments, payouts, fraud prevention or legal compliance, FARENIO may verify payment information associated with a provider.

Payment verification may be performed directly or through an authorised payment-service provider.

Where a payment-service provider performs legally required identity, business or account verification, FARENIO may rely on relevant verification outcomes where legally permissible while maintaining any independent information that FARENIO itself is required to obtain.

ARTICLE 11 – FRAUD AND MARKETPLACE INTEGRITY

FARENIO may implement proportionate measures designed to prevent fraud, impersonation, false provider identities, account misuse and other abusive marketplace activity. Measures may include:

• Identity verification;
• Business verification;
• Document validation;
• Duplicate-account detection;
• Payment verification;
• Transaction monitoring;
• Device and account-security signals;
• Unusual activity detection; and
• Manual compliance review.

Automated indicators shall not automatically establish unlawful or fraudulent conduct. Where appropriate, material adverse action is subject to appropriate review before implementation.

ARTICLE 12 – SANCTIONS COMPLIANCE

Where legally necessary or proportionate to an identified compliance risk, FARENIO may screen relevant persons or entities against applicable European Union, United Nations or other legally applicable sanctions lists.

Potential matches are appropriately reviewed before adverse action is taken.

Where FARENIO is legally prohibited from providing services or processing a transaction involving a sanctioned person or entity, FARENIO shall take the measures required by applicable law.

ARTICLE 13 – ENHANCED VERIFICATION

Where information supplied by a provider is inconsistent, incomplete, potentially fraudulent or otherwise presents an elevated compliance risk, FARENIO may conduct enhanced verification, which may include:

• Requesting additional identification;
• Requesting additional business documentation;
• Verifying registration information;
• Requesting clarification concerning inconsistencies;
• Verifying authority to represent a business;
• Manual compliance review; or
• Temporary restriction pending completion of verification.

Enhanced verification is proportionate to the identified risk and applicable legal requirement.

ARTICLE 14 – PROVIDER STATUS AND ACTIVATION

Where verification is required, FARENIO may maintain the following compliance statuses:

Pending → Verification Required → Under Review → Verified → Restricted → Suspended → Terminated.

Submission of documents or information does not by itself constitute verification. A provider may be prevented from activation or restricted where:

• Mandatory information has not been provided;
• Required information cannot reasonably be verified;
• Material inconsistencies remain unresolved;
• Information appears false or misleading;
• A statutory requirement prevents activation;
• The provider no longer satisfies applicable marketplace requirements; or
• Another lawful contractual ground for restriction applies.

Any restriction is implemented consistently with applicable contractual, DSA and other statutory requirements.

ARTICLE 15 – PROVIDER RESPONSIBILITIES

Providers subject to this Policy shall:

• Provide accurate and complete information;
• Provide information within applicable statutory deadlines;
• Keep information current;
• Notify FARENIO of material changes;
• Provide reasonable supporting documentation where required;
• Refrain from providing false, misleading or fraudulent information; and
• Cooperate with legally required verification procedures.

Where a provider fails to supply information required by law, FARENIO may take the measures required or permitted by the applicable legal framework.

ARTICLE 16 – DATA PROTECTION

Personal data processed under this Policy is processed in accordance with the GDPR, French data-protection legislation and the FARENIO Privacy Policy. FARENIO applies the principles of:

• Lawfulness, fairness and transparency;
• Purpose limitation;
• Data minimisation;
• Accuracy;
• Storage limitation;
• Integrity and confidentiality; and
• Accountability.

Information is not collected merely because it may potentially be useful in the future.

Personal data originally collected for one compliance process may be reused for another compliance purpose only where the reuse has an appropriate legal basis and complies with applicable purpose-limitation and transparency requirements.

ARTICLE 17 – SECURITY AND ACCESS CONTROL

FARENIO shall implement appropriate technical and organisational measures to protect compliance information against unauthorised access, disclosure, alteration, destruction or loss.

Access is limited according to role, responsibility and legitimate operational need.

Sensitive verification documentation receives safeguards proportionate to the nature of the information and associated risks.

ARTICLE 18 – RECORD RETENTION

FARENIO shall maintain compliance records for the periods required by applicable law and for no longer than necessary for the relevant purposes, subject to legitimate legal preservation requirements. Relevant records may include:

• Provider identification records;
• Business verification records;
• DSA trader-verification records;
• DAC7 due-diligence records;
• DAC7 reporting records;
• Payment-verification records;
• Fraud-review records;
• Sanctions-screening records where applicable;
• Provider compliance decisions; and
• Audit logs.

At the end of the applicable retention period, records are securely deleted or anonymised unless continued retention is required by law or necessary for the establishment, exercise or defence of legal claims.

ARTICLE 19 – AUDIT TRAIL

FARENIO shall maintain an appropriate audit trail for material provider-verification and compliance decisions. The audit trail may record:

Provider → Information Submitted → Verification Source → Verification Result → Reviewer/System → Decision → Date → Subsequent Review.

Audit records are protected against unauthorised modification and made available only to appropriately authorised personnel.

ARTICLE 20 – REGULATORY COOPERATION

FARENIO shall cooperate with competent French and European authorities where required by applicable law.

Information is disclosed to public authorities only where there is an appropriate legal basis or other legally binding requirement.

Requests and disclosures are appropriately documented.

ARTICLE 21 – GOVERNANCE

Responsibility for implementation of this Policy rests with the authorised compliance and management functions of GQ VENTURES SAS. FARENIO shall periodically review:

• Provider-verification requirements;
• DSA trader-traceability controls;
• DAC7 due-diligence procedures;
• Fraud-prevention controls;
• Sanctions controls where applicable;
• Data-retention requirements;
• Access permissions; and
• Changes in applicable French or European Union law.

Material compliance requirements are reflected in the relevant platform workflows and provider onboarding processes.

ARTICLE 22 – RELATIONSHIP WITH OTHER FARENIO POLICIES

This Policy shall be read together with, where applicable:

• FARENIO Terms and Conditions;
• Client Terms;
• Service Provider Terms;
• Digital Services Act & Platform Transparency Notice;
• Privacy Policy;
• Cookie Policy;
• Marketplace Trust, Safety & Integrity Policy;
• Data Retention Policy;
• Information Security policies; and
• Other applicable FARENIO legal and compliance documentation.

Where the same provider information is required under multiple compliance frameworks, FARENIO should maintain a single authoritative record rather than unnecessary duplicate datasets, subject to applicable access, purpose and retention controls.

In the event of conflict between this Policy and mandatory applicable law, mandatory law shall prevail.

ARTICLE 23 – REVIEW

This Policy shall be reviewed periodically and whenever there is a material change affecting:

• French implementation of DAC7;
• The Digital Services Act;
• Applicable tax-reporting requirements;
• FARENIO's marketplace business model;
• Provider onboarding or verification;
• Payment or payout architecture;
• Applicable sanctions requirements;
• Data-protection requirements; or
• Another material legal or regulatory obligation.

ARTICLE 24 – CONTACT

GQ VENTURES SAS, trading as FARENIO, France.

Compliance: contact@farenio.com · Legal: legal@farenio.com

Applicable framework: French law and applicable European Union law.