1. Executive Summary and Policy Statement

This Know Your Customer (KYC) Policy establishes the comprehensive framework through which HL Hunt identifies, verifies, and monitors its customers, business partners, and associated parties. This policy is designed to protect HL Hunt from financial crime, ensure regulatory compliance, and maintain the integrity of our business operations.

HL Hunt is committed to implementing robust customer due diligence measures that align with international best practices and comply with all applicable laws and regulations, including but not limited to the Bank Secrecy Act (BSA), USA PATRIOT Act, Financial Action Task Force (FATF) recommendations, and relevant state and federal anti-money laundering (AML) requirements.

1.1 Policy Objectives

• Prevent the use of HL Hunt's products and services for money laundering, terrorist financing, or other illicit purposes
• Ensure compliance with all applicable federal, state, and international regulations
• Protect HL Hunt's reputation and financial integrity
• Establish clear procedures for customer identification and verification
• Implement risk-based enhanced due diligence for higher-risk relationships
• Maintain comprehensive records supporting all KYC activities
• Foster a culture of compliance throughout the organization

1.2 Scope and Applicability

This policy applies to all business units, subsidiaries, branches, and affiliates of HL Hunt. It covers all customers, including individual customers, business entities, corporate clients, trusts, foundations, partnerships, government entities, and any other legal arrangements seeking to establish or maintain a business relationship with HL Hunt.

2. Regulatory Framework and Legal Basis

HL Hunt's KYC program is designed to comply with multiple regulatory frameworks and legal requirements:

2.1 Primary Regulatory Requirements

2.2 International Standards

HL Hunt adheres to internationally recognized standards including FATF's 40 Recommendations, the Wolfsberg Group Principles, and Basel Committee guidance on customer due diligence for banks where applicable.

3. Governance Structure and Responsibilities

3.1 Board of Directors

The Board of Directors bears ultimate responsibility for HL Hunt's KYC and AML compliance program. The Board shall:

• Approve this KYC Policy and any material amendments
• Ensure adequate resources are allocated to the compliance function
• Receive and review quarterly compliance reports
• Oversee the appointment and performance of the Chief Compliance Officer

3.2 Chief Compliance Officer (CCO)

The CCO has day-to-day responsibility for implementing and maintaining the KYC program, including:

• Developing and updating KYC policies and procedures
• Ensuring staff training and awareness programs are effective
• Monitoring compliance with KYC requirements
• Reporting to the Board on compliance matters
• Serving as the primary liaison with regulatory authorities
• Overseeing suspicious activity investigations and SAR filings

3.3 Compliance Department

The Compliance Department is responsible for:

• Conducting enhanced due diligence reviews
• Performing ongoing monitoring and periodic reviews
• Investigating alerts and escalations from business units
• Maintaining the customer risk rating methodology
• Coordinating with external auditors and examiners

3.4 Business Unit Responsibilities

All business units and customer-facing personnel are responsible for:

• Collecting required customer information and documentation
• Performing initial customer identification and verification
• Escalating unusual or suspicious activities to Compliance
• Maintaining accurate and complete customer records
• Completing required KYC training programs

3.5 Three Lines of Defense Model

4. Customer Categories and Risk Classification

4.1 Customer Categories

HL Hunt classifies customers into the following categories, each subject to specific due diligence requirements:

4.1.1 Individual Customers (Natural Persons)

Individual customers include retail clients, high-net-worth individuals, and private banking clients who engage with HL Hunt in their personal capacity.

4.1.2 Business Entities

Business entities encompass corporations, limited liability companies, partnerships, sole proprietorships, and other legal business structures.

4.1.3 Institutional Clients

Institutional clients include financial institutions, investment funds, pension funds, insurance companies, and other regulated entities.

4.1.4 Government and Public Sector

This category includes federal, state, and local government agencies, quasi-governmental organizations, and sovereign entities.

4.1.5 Non-Profit Organizations

Non-profit organizations, charities, foundations, religious organizations, and other tax-exempt entities require specialized due diligence.

4.1.6 Trusts and Legal Arrangements

Trusts, estates, foundations, and similar legal arrangements require identification of trustees, settlors, beneficiaries, and protectors.

4.2 Risk Classification Framework

HL Hunt employs a risk-based approach to customer due diligence, categorizing customers into three risk tiers:

4.3 Risk Factors

The following factors are considered when assessing customer risk:

4.3.1 Customer Risk Factors

• Customer type and legal structure
• Industry or business sector
• Ownership structure complexity
• Source of wealth and funds
• PEP status or association with PEPs
• Adverse media or negative news
• Prior suspicious activity or regulatory actions

4.3.2 Geographic Risk Factors

• Country of residence, incorporation, or operation
• Countries subject to sanctions or embargoes
• FATF-identified high-risk jurisdictions
• Countries with inadequate AML/CFT frameworks
• Known tax havens or secrecy jurisdictions

4.3.3 Product and Service Risk Factors

• Anonymous or bearer instruments
• Cross-border transactions
• High-value transactions
• Wire transfers to/from high-risk jurisdictions
• Private banking or wealth management services

4.3.4 Channel Risk Factors

• Non-face-to-face customer acquisition
• Third-party introducers
• Remote or online onboarding
• Intermediary relationships

5. Customer Identification Program (CIP)

HL Hunt's Customer Identification Program establishes the minimum standards for identifying and verifying customer identity before establishing a business relationship.

5.1 Individual Customer Requirements

5.1.1 Required Information

The following information must be collected for all individual customers:

5.1.2 Acceptable Identification Documents

Primary identification documents (at least one required):

• Valid, unexpired passport (domestic or foreign)
• Government-issued driver's license with photo
• State-issued identification card with photo
• Military identification card
• Permanent Resident Card (Green Card)
• Employment Authorization Document (EAD)

Secondary documentation for address verification:

• Utility bill dated within 90 days (electric, gas, water, internet)
• Bank or financial institution statement dated within 90 days
• Mortgage statement or property tax bill
• Lease agreement or rental contract
• Government correspondence (tax notice, voter registration)

5.2 Business Entity Requirements

5.2.1 Entity Information

The following information must be collected for all business entities:

5.2.2 Governance Documentation

• Articles of Incorporation or Organization
• Bylaws or Operating Agreement
• Partnership Agreement (for partnerships)
• Trust Agreement (for trusts)
• Board resolution authorizing the business relationship
• List of authorized signatories with specimen signatures
• Organizational chart showing management structure

5.3 Beneficial Ownership Requirements

In compliance with FinCEN's Customer Due Diligence Rule, HL Hunt must identify and verify beneficial owners of all legal entity customers.

5.3.1 Definition of Beneficial Owner

A beneficial owner is defined as:

• Ownership Prong: Each individual who directly or indirectly owns 25% or more of the equity interests of the legal entity customer.
• Control Prong: A single individual with significant responsibility to control, manage, or direct the legal entity, such as a CEO, CFO, COO, Managing Member, General Partner, or similar position.

5.3.2 Required Beneficial Owner Information

For each beneficial owner, collect:

• Full legal name
• Date of birth
• Current residential address (physical, not P.O. Box)
• Social Security Number or passport number and country of issuance
• Percentage of ownership interest (for owners)
• Title or role (for control persons)

5.3.3 Beneficial Ownership Certification

All legal entity customers must complete a Beneficial Ownership Certification Form at account opening and update it whenever there are changes to beneficial ownership exceeding the 25% threshold or changes to the control person.

5.4 Guarantor Requirements

When a guarantor is required for a transaction, the following information and documentation must be obtained:

5.4.1 Individual Guarantors

• Full legal name and all aliases
• Government-issued photo identification
• Social Security Number
• Current residential address with proof
• Financial statements (personal balance sheet)
• Tax returns for the most recent two years
• Credit report authorization
• Source of wealth documentation

5.4.2 Corporate Guarantors

• All business entity documentation as specified in Section 5.2
• Board resolution authorizing the guarantee
• Audited financial statements for two years
• Beneficial ownership certification
• Legal opinion on enforceability (if required)

6. Verification Procedures and Methodology

6.1 Document Verification

All identity documents undergo rigorous verification:

6.1.1 Manual Verification Procedures

• Examine document for signs of tampering, alteration, or forgery
• Verify security features (holograms, watermarks, microprinting)
• Confirm document is unexpired
• Cross-reference photo with customer (for in-person verification)
• Verify consistency across multiple documents
• Document all verification steps in the customer file

6.1.2 Electronic Document Verification

• Automated document authenticity scanning
• Optical character recognition (OCR) extraction
• Machine learning fraud detection algorithms
• Cross-database validation
• Biometric facial comparison (for remote onboarding)

6.2 Database and Third-Party Verification

HL Hunt utilizes multiple verification sources:

6.3 Non-Documentary Verification Methods

When documentary verification is insufficient or unavailable:

• Contact customer directly at independently obtained contact information
• Cross-reference information with public records databases
• Verify information through independent reference sources
• Request additional documentation or alternative forms of identification
• Conduct site visits for business customers (where appropriate)

6.4 Verification Timing Requirements

7. Enhanced Due Diligence (EDD)

Enhanced Due Diligence is required for customers presenting elevated risk profiles. EDD involves more intensive verification, documentation, and ongoing monitoring.

7.1 EDD Triggers

EDD must be performed when any of the following conditions are present:

• Customer or beneficial owner is a Politically Exposed Person (PEP)
• Customer is domiciled in or conducts significant business in high-risk jurisdictions
• Complex or opaque ownership structures
• Cash-intensive businesses (MSBs, casinos, convenience stores, car dealers)
• Unusually large or complex transactions
• Adverse media or negative news identified during screening
• Prior suspicious activity reports involving the customer
• High-risk industries (arms/defense, gambling, cryptocurrency, precious metals)
• Private banking or high-net-worth relationships
• Correspondent banking relationships

7.2 Politically Exposed Persons (PEPs)

7.2.1 PEP Definition

A Politically Exposed Person includes:

• Current or former senior government officials (executive, legislative, judicial, military)
• Senior officials of major political parties
• Senior executives of state-owned enterprises
• Immediate family members of the above (spouse, children, parents, siblings)
• Close associates (business partners, advisors, agents)

7.2.2 PEP Due Diligence Requirements

• Senior management approval required to establish or maintain relationship
• Establish source of wealth and source of funds
• Enhanced ongoing monitoring with lower thresholds
• Annual relationship review by senior management
• Document rationale for maintaining the relationship

7.3 High-Risk Jurisdiction Due Diligence

For customers with nexus to high-risk jurisdictions (as identified by FATF, OFAC, or HL Hunt's internal risk assessment):

• Obtain and verify additional documentation on source of funds
• Conduct enhanced background checks
• Require senior management approval
• Implement enhanced transaction monitoring
• Consider restrictions on certain transaction types or corridors

7.4 EDD Documentation Requirements

In addition to standard KYC documentation, EDD files must include:

• Detailed narrative explaining the nature of the business relationship
• Source of wealth analysis with supporting documentation
• Source of funds documentation for significant transactions
• Explanation of ownership structure with organizational chart
• Enhanced background check results
• Senior management approval documentation
• Ongoing monitoring plan
• Periodic review notes and findings

8. Ongoing Monitoring and Periodic Review

KYC is not a one-time event. HL Hunt maintains continuous vigilance through ongoing monitoring and periodic reviews.

8.1 Transaction Monitoring

8.1.1 Automated Monitoring Systems

HL Hunt's transaction monitoring system generates alerts based on:

• Transactions exceeding established thresholds
• Unusual patterns compared to customer profile
• Transactions involving high-risk jurisdictions
• Structuring patterns suggesting currency transaction report avoidance
• Rapid movement of funds
• Round-dollar transactions or other anomalies

8.1.2 Alert Disposition

All system-generated alerts are reviewed by trained compliance personnel:

• Level 1 Review: Initial alert review and disposition
• Level 2 Review: Complex alerts requiring senior analyst review
• Escalation: Alerts warranting SAR consideration or senior management attention

8.2 Periodic KYC Reviews

Customer information is reviewed on a schedule based on risk rating:

8.3 Trigger Events

In addition to scheduled reviews, KYC must be refreshed upon occurrence of:

• Material change in customer's business or ownership
• Significant change in transaction patterns
• Adverse media or negative news
• Regulatory inquiry or law enforcement request
• Customer-initiated changes to account or authorized signers
• Document expiration
• SAR filing involving the customer

8.4 Sanctions and PEP Rescreening

All customers are rescreened against sanctions and PEP databases:

• Daily: Batch screening against OFAC SDN list updates
• Weekly: Full customer base screening against consolidated sanctions lists
• Quarterly: PEP and adverse media screening
• Real-time: Transaction-level screening for wire transfers

9. Special Customer Categories and Situations

9.1 Correspondent Banking

HL Hunt applies enhanced due diligence to all correspondent banking relationships:

• Obtain correspondent's AML/KYC policies and procedures
• Assess correspondent's regulatory status and supervision
• Review correspondent's customer base and geographic footprint
• Obtain representation regarding shell bank prohibition
• Establish payable-through account restrictions where applicable
• Conduct annual reviews of all correspondent relationships

9.2 Private Banking and High-Net-Worth Individuals

Private banking relationships require:

• Senior management approval for relationship initiation
• Detailed source of wealth documentation
• Enhanced transaction monitoring
• Annual relationship review
• PEP screening of all family members and close associates

9.3 Non-Profit Organizations

Due to elevated money laundering and terrorist financing risks, NPOs require:

• Verification of tax-exempt status (IRS determination letter)
• Review of mission, activities, and geographic operations
• Identification of key officers, directors, and major donors
• Review of sources of funding
• Assessment of controls over disbursements

9.4 Third-Party Introducers and Agents

When relying on third parties for customer introduction:

• Conduct due diligence on the third party itself
• Establish written agreement specifying responsibilities
• Ensure third party applies equivalent KYC standards
• Obtain immediate access to customer identification information
• Retain ultimate responsibility for KYC compliance
• Conduct periodic audits of third-party performance

9.5 Remote and Digital Onboarding

For customers onboarded through non-face-to-face channels:

• Implement enhanced identity verification measures
• Use biometric verification (facial recognition, liveness detection)
• Require multiple forms of identity verification
• Implement device fingerprinting and IP geolocation
• Apply lower initial transaction limits pending full verification
• Conduct post-onboarding verification calls

10. Suspicious Activity Detection and Reporting

10.1 Red Flags

Employees must be alert to indicators of potential suspicious activity:

10.1.1 Customer Behavior Red Flags

• Reluctance to provide required identification or documentation
• Providing false, inconsistent, or suspicious information
• Unusual concern about reporting requirements
• Attempts to avoid recordkeeping or threshold requirements
• Multiple accounts with no apparent business purpose

10.1.2 Transaction Red Flags

• Transactions inconsistent with customer's stated business or profile
• Unusually large cash transactions or cash deposits
• Structuring to avoid reporting thresholds
• Rapid movement of funds with no apparent business purpose
• Wire transfers to/from high-risk jurisdictions
• Transactions involving shell companies or nominees

10.1.3 Documentation Red Flags

• Altered or potentially fraudulent documents
• Documents that cannot be verified
• Inconsistencies between documents
• Use of fictitious names or addresses

10.2 Suspicious Activity Reporting (SAR)

HL Hunt files Suspicious Activity Reports as required by law:

• SAR filing decision made within 30 days of initial detection
• SAR filed within 30 days of decision (or 60 days if ongoing investigation)
• All SARs reviewed and approved by CCO or designee
• SAR filing does not automatically result in account closure
• SAR existence and contents are strictly confidential

10.3 Internal Escalation Procedures

Employees suspecting potential suspicious activity must:

1. Not alert the customer to the suspicion or potential reporting
2. Document observations in writing immediately
3. Escalate to direct supervisor and Compliance Department
4. Preserve all relevant documentation
5. Cooperate with any subsequent investigation

11. Recordkeeping and Documentation

11.1 Retention Requirements

HL Hunt maintains KYC records for the following periods:

11.2 Documentation Standards

All KYC files must include:

• Clear audit trail of all verification steps
• Copies of all identification documents
• Records of all database searches and results
• Risk assessment and rating documentation
• Approval documentation for high-risk relationships
• Notes from periodic reviews
• Correspondence with customers regarding KYC matters

11.3 Data Integrity

HL Hunt ensures data integrity through:

• Access controls limiting KYC data access to authorized personnel
• Audit logging of all access and modifications
• Regular data quality reviews
• Secure backup and disaster recovery procedures
• Encryption of sensitive data at rest and in transit

12. Training and Awareness

12.1 Training Requirements

All HL Hunt personnel receive KYC/AML training appropriate to their role:

12.2 Training Content

Training programs cover:

• HL Hunt's KYC policy and procedures
• Regulatory requirements and updates
• Red flag indicators for money laundering and terrorist financing
• Customer identification and verification procedures
• Enhanced due diligence requirements
• Suspicious activity escalation and reporting
• Sanctions compliance
• Consequences of non-compliance

12.3 Training Records

The Compliance Department maintains records of all training, including:

• Training completion dates and attendance
• Assessment scores (where applicable)
• Training materials and curricula
• Remedial training for failed assessments

13. Quality Assurance and Testing

13.1 Quality Assurance Program

HL Hunt maintains a quality assurance program to ensure KYC effectiveness:

• Sample-based review of KYC files quarterly
• Assessment of documentation completeness and accuracy
• Verification of risk rating accuracy
• Review of periodic review timeliness
• Feedback to business units on identified deficiencies

13.2 Independent Testing

Internal Audit conducts independent testing of the KYC program:

• Annual risk-based audit of KYC processes
• Testing of automated monitoring systems
• Assessment of governance and oversight
• Evaluation of training effectiveness
• Follow-up on prior audit findings

13.3 Regulatory Examinations

HL Hunt cooperates fully with regulatory examinations:

• Designated examination coordinator assigned
• Timely response to all examiner requests
• Tracking and remediation of examination findings
• Board reporting on examination results

14. Privacy and Data Protection

14.1 Data Protection Principles

HL Hunt handles KYC data in accordance with the following principles:

• Collection limited to information necessary for KYC purposes
• Use restricted to authorized compliance purposes
• Access limited to personnel with legitimate business need
• Security measures commensurate with data sensitivity
• Retention only for required periods
• Secure destruction at end of retention period

14.2 Customer Privacy Rights

HL Hunt respects customer privacy rights while fulfilling regulatory obligations:

• Customers informed of KYC data collection requirements
• Privacy notices provided at account opening
• Customer access to their own KYC data upon request
• Correction of inaccurate information
• Note: Regulatory obligations may override certain privacy requests

14.3 Cross-Border Data Transfers

When KYC data is transferred across borders:

• Compliance with applicable data protection laws (GDPR, etc.)
• Appropriate safeguards for international transfers
• Data transfer agreements with recipient entities
• Assessment of recipient country's data protection adequacy

14.4 Data Security

KYC data is protected through:

• Encryption at rest and in transit
• Multi-factor authentication for system access
• Role-based access controls
• Regular security assessments and penetration testing
• Incident response procedures for data breaches

15. Policy Administration

15.1 Policy Review and Updates

This policy is reviewed and updated as follows:

• Annual comprehensive review by Compliance Department
• Ad hoc updates upon regulatory changes
• Board approval for material amendments
• Version control and change documentation
• Communication of updates to all affected personnel

15.2 Exception Process

Exceptions to this policy require:

• Written request documenting business rationale
• Risk assessment of the proposed exception
• Approval by CCO (or Board for material exceptions)
• Documentation in customer file
• Periodic review of exception status

15.3 Non-Compliance Consequences

Failure to comply with this policy may result in:

• Disciplinary action up to and including termination
• Regulatory penalties and enforcement actions
• Civil and criminal liability
• Reputational damage to HL Hunt

15.4 Contact Information

Questions regarding this policy should be directed to:

Chief Compliance Officer: compliance@hlhunt.com

BSA Officer: bsa@hlhunt.com

Compliance Hotline: 1-800-XXX-XXXX

Appendix A: Definitions

Appendix B: Document Version History