TSMX LLC

Anti-Money Laundering ("AML") Compliance Plan

Compliance and Supervisory Procedures

www.tsmx.io

UPDATED AS OF: March 18, 2026

The FINRA AML web page (https://www.finra.org/rules-guidance/key-topics/aml) includes important information and links to other websites with useful information. You should also consult the websites maintained by the Financial Crimes Enforcement Network (FinCEN) at https://www.fincen.gov and the Securities and Exchange Commission (SEC) at https://www.sec.gov.

For historical guidance and background, consult NASD Notices to Members (NTM) 02-21, 02-50, 02-78, 02-80, 03-34, 06-07, 06-41, and 07-17, and Regulatory Notices 07-42, 08-66, 09-05, 12-08, 17-40, 18-19, and 19-18.

1. TSMX LLC AML Policy

It is the policy of TSMX LLC (the "Company") to prohibit and actively prevent money laundering and any activity that facilitates money laundering or the funding of terrorist or criminal activities by complying with all applicable requirements under the Bank Secrecy Act ("BSA") and its regulations.

"Money laundering" is generally defined as engaging in acts designed to conceal or disguise the true origins of criminally derived proceeds so that the proceeds appear to have derived from legitimate origins or constitute legitimate assets. Generally, money laundering occurs in three stages: placement, layering, and integration.

"Terrorist financing" may not involve the proceeds of criminal conduct, but rather an attempt to conceal either the origin of the funds or their intended use, which could be for criminal purposes. TSMX LLC operates a sweepstakes-based sports prediction exchange at www.tsmx.io and does not accept real-money wagers. However, the Company remains subject to applicable BSA, FinCEN, and financial services compliance obligations.

TSMX LLC's AML policies, procedures, and internal controls are designed to ensure compliance with all applicable BSA regulations and FINRA rules and will be reviewed and updated on a regular basis.

Rules: 31 C.F.R. § 1023.210; FINRA Rule 3310.

2. AML Compliance Person Designation and Duties

The Company has designated Dan Nedelko, Chief Operating Officer (compliance@tsmx.io), as the Anti-Money Laundering Program Compliance Person (“AML Compliance Person”), with full responsibility for the Company’s AML program. Dan Nedelko has a working knowledge of the BSA and its implementing regulations and is qualified by experience, knowledge, and training.

The duties of the AML Compliance Person will include monitoring the Company's compliance with AML obligations, overseeing communication and training for employees, and any other duties assigned by the Company.

The AML Compliance Person will also ensure that the Company keeps and maintains all required AML records and will ensure that Suspicious Activity Reports ("SARs") are filed with FinCEN when appropriate. The AML Compliance Person is vested with full responsibility and authority to enforce the Company's AML program.

The Company will provide FinCEN with contact information for the AML Compliance Person through the FINRA Contact System (FCS), including: (1) name: Dan Nedelko; (2) title: Chief Operating Officer; (3) mailing address: 5118 Park Ave., Ste. 249, Memphis, TN 38117; (4) email address: compliance@tsmx.io; (5) telephone number: 1-901-205-9469; and (6) fax (if any). The annual review of FCS information will be conducted by the AML Compliance Person and will be completed no later than seventeen (17) business days following the end of each calendar year.

Rules: 31 C.F.R. § 1023.210; FINRA Rule 3310; FINRA Rule 4517.

3. Providing AML Information to Federal Law Enforcement and Other Financial Institutions

a. FinCEN Requests Under USA PATRIOT Act Section 314(a)

Pursuant to the BSA and its implementing regulations, financial institutions are required to make certain searches of their records upon receiving an information request from FinCEN. TSMX LLC will respond to a FinCEN 314(a) Request by immediately searching its records to determine whether the Company maintains or has maintained any account for, or has engaged in any transaction with, each person, entity, or organization named in the 314(a) Request.

The Company will designate through the FINRA Contact System (FCS) one or more persons to be the point of contact for 314(a) Requests and will promptly update the point of contact information following any change.

Rule: 31 C.F.R. § 1010.520.

b. National Security Letters

National Security Letters (NSLs) are written investigative demands that may be issued by the FBI and other federal government authorities. NSLs are highly confidential. No officer, employee, or agent of TSMX LLC can disclose to any person that a government authority or the FBI has sought or obtained access to records.

The Company understands that the receipt of any NSL is highly confidential. If the Company files a SAR after receiving an NSL, the SAR will not contain any reference to the receipt or existence of the NSL. The SAR will only contain detailed information about the facts and circumstances of the detected suspicious activity.

c. Grand Jury Subpoenas

Grand juries may issue subpoenas as part of their investigative proceedings. The receipt of a grand jury subpoena does not in itself require the filing of a SAR. However, the Company will conduct a risk assessment of the customer who is the subject of the grand jury subpoena and review the customer's account activity. If suspicious activity is uncovered, the Company will elevate the customer's risk profile and file a SAR in accordance with SAR filing requirements.

The Company will not directly or indirectly disclose to the person who is the subject of the subpoena its existence, its contents, or the information used to respond to it.

d. Voluntary Information Sharing Under USA PATRIOT Act Section 314(b)

BSA regulations permit financial institutions to share information with other financial institutions under the protection of a safe harbor if certain procedures are followed. TSMX LLC will share information with other financial institutions regarding individuals, entities, organizations, and countries for purposes of identifying and, where appropriate, reporting activities that may involve possible terrorist activity or money laundering.

The Company will ensure that FinCEN files an initial notice before any sharing occurs and annual notices thereafter. Before sharing information with another financial institution, TSMX LLC will take reasonable steps to verify that the other financial institution has submitted the requisite notice to FinCEN.

Rules: 31 C.F.R. § 1010.540.

4. Checking the Office of Foreign Assets Control (OFAC) Listings

Although not part of the BSA and its implementing regulations, OFAC compliance is often performed in conjunction with AML compliance. OFAC is an office of the U.S. Treasury that administers and enforces economic sanctions and embargoes based on U.S. foreign policy and national security goals.

Before opening an account, and on an ongoing basis, TSMX LLC will check to ensure that a customer does not appear on the Specially Designated Nationals and Blocked Person ("SDN") list or is not engaging in transactions that are prohibited by the economic sanctions and embargoes administered and enforced by OFAC at http://www.treas.gov/offices/enforcement/ofac/.

If the Company determines that a customer is on the SDN list or is engaging in prohibited transactions, TSMX LLC will reject the transaction and/or block the customer's assets and file a blocked assets and/or rejected transaction form with OFAC within ten (10) days. The Company will also call the OFAC Hotline at (800) 540-6322 immediately.

Rules: 31 C.F.R. § 501.603; 31 C.F.R. § 501.604.

5. Customer Identification Program (CIP)

TSMX LLC is required to have and follow reasonable procedures to document and verify the identity of customers who open new accounts on www.tsmx.io. These procedures must enable the Company to form a reasonable belief that it knows the true identity of its customers.

The Company's CIP must be in writing and be part of the Company's AML compliance program. TSMX LLC will collect minimum customer identification information from each customer who opens an account; utilize risk-based measures to verify the identity of each customer; record customer identification information and the verification methods and results; provide the required adequate CIP notice to customers; and compare customer identification information with government-provided lists of suspected terrorists.

Rule: 31 C.F.R. § 1023.220.

a. Required Customer Information

Before opening an account, TSMX LLC will collect the following information for all accounts, for any person that is opening a new account and whose name is on the account:

• (1) the name;

• (2) date of birth (for an individual);

• (3) an address, which will be a residential or business street address (for an individual); and

• (4) an identification number, which may be one or more of the following: a taxpayer identification number, passport number and country of issuance, alien identification card number, or number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or other similar safeguard (for non-U.S. persons).

Rule: 31 C.F.R. § 1023.220(a)(2)(i).

b. Customers Who Refuse to Provide Information

If a potential or existing customer either refuses to provide the information described above when requested, or appears to have intentionally provided misleading information, TSMX LLC will not open a new account and, after considering the risks involved, consider closing any existing account. In either case, the AML Compliance Person will be notified to determine whether the Company should report the situation to FinCEN on a SAR.

c. Verifying Information

TSMX LLC will verify customer identity through documentary and non-documentary means on a risk-based basis. The Company will use the following documentary and non-documentary methods as appropriate:

• An unexpired government-issued identification evidencing nationality or residence and bearing a photograph or similar safeguard, such as a driver's license or passport;

• Independently verifying the customer's identity through the comparison of information provided by the customer with information obtained from a consumer reporting agency, public database, or other source;

• Checking references with other financial institutions; or

• Obtaining a financial statement.

Given that TSMX LLC operates primarily as a digital platform at www.tsmx.io, the Company will primarily rely on non-documentary verification methods, including identity verification through third-party KYC service providers.

Rule: 31 C.F.R. § 1023.220(a)(2)(ii).

d. Lack of Verification

When the Company cannot form a reasonable belief that it knows the true identity of a customer, TSMX LLC will do the following: (1) not open an account; (2) impose terms under which a customer may conduct transactions while the Company attempts to verify the customer's identity; (3) close an account after attempts to verify a customer's identity fail; and (4) determine whether it is necessary to file a SAR in accordance with applicable laws and regulations.

Rule: 31 C.F.R. § 1023.220(a)(2)(iii).

e. Recordkeeping

TSMX LLC will document its verification, including all identifying information provided by a customer, the methods used and results of verification, and the resolution of any discrepancies identified in the verification process. The Company will retain records of all identification information for five (5) years after the account has been closed, and will retain records made about verification of the customer's identity for five years after the record is made.

Rule: 31 C.F.R. § 1023.220(a)(3).

f. Notice to Customers

TSMX LLC will provide notice to customers that the Company is requesting information from them to verify their identities, as required by federal law. The Company will use the following language to provide notice to customers via its website at www.tsmx.io:

Important Information About Procedures for Opening a New Account: To help the government fight the funding of terrorism and money laundering activities, federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. What this means for you: When you open an account, we will ask for your name, address, date of birth, and other information that will allow us to identify you. We may also ask to see your driver's license or other identifying documents.

Rule: 31 C.F.R. § 1023.220(a)(5).

6. Customer Due Diligence (CDD) Rule

On May 11, 2016, FinCEN adopted a final rule on Customer Due Diligence Requirements for Financial Institutions (CDD Rule). FinCEN identifies four components of customer due diligence: (1) customer identification and verification; (2) beneficial ownership identification and verification; (3) understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and (4) conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.

TSMX LLC will not open or maintain accounts for legal entity customers within the meaning of 31 CFR 1010.230. If in the future the Company elects to open accounts for legal entity customers, the Company will implement a formal beneficial ownership program consistent with the CDD Rule requirements.

Rules: 31 C.F.R. § 1010.230; 31 C.F.R. § 1023.210(b)(5); FINRA Rule 3310.

7. Suspicious Activity Reporting (SAR)

TSMX LLC will file a SAR with FinCEN for any transaction (including a deposit, withdrawal, transfer, or exchange of currency or other payment) conducted or attempted by, at, or through the Company involving $5,000 or more in funds or other assets where the Company knows, suspects, or has reason to suspect that the transaction:

• involves funds derived from illegal activities or is intended or conducted to evade any federal transaction reporting requirement or to avoid any transaction reporting requirement under federal law;

• is designed to evade any requirements of the BSA;

• has no lawful purpose or is not the sort of transaction in which the particular customer would normally be expected to engage, and the Company knows of no reasonable explanation for the transaction after examining the available facts; or

• involves the use of the Company to facilitate criminal activity.

TSMX LLC will report the suspicious transaction by completing a SAR and filing it with FinCEN. The Company will retain a copy of any SAR filed and the original or business record equivalent of any supporting documentation for a period of five (5) years from the date of filing.

The Company will not notify any person involved in the suspicious transaction that the transaction has been reported to FinCEN.

Rules: 31 C.F.R. § 1023.320; FINRA Rule 3310.

8. Sweepstakes Platform-Specific AML Considerations

TSMX LLC operates as a sweepstakes-based sports prediction exchange under applicable U.S. sweepstakes promotional law. The platform uses a dual-currency model: Coins (free-to-play virtual currency) and Cash (redeemable virtual currency). Users may voluntarily purchase virtual Cash via ACH bank transfer; no purchase is required to participate.

Notwithstanding the sweepstakes model, the Company recognizes that virtual currency transactions and prize redemptions may carry money laundering risk. The following additional controls apply to platform operations:

• All ACH deposits and Cash redemptions are processed through vetted payment processors that maintain their own BSA/AML compliance programs.

• Geo-compliance technology (including Xpoint integration) is employed to block access from prohibited jurisdictions and to verify user location at login and during transactions.

• Users must complete identity verification (KYC) before any Cash redemption is processed.

• Transaction monitoring is applied to identify unusual patterns, including rapid depositing and redemption, structuring of deposits below reporting thresholds, or redemption requests inconsistent with user gameplay history.

• The Company maintains records of all deposit and redemption transactions for a minimum of five (5) years.

9. AML Recordkeeping

TSMX LLC will create and retain all records required by the BSA and its implementing regulations, including but not limited to records of:

• All verified customer identification information collected at account opening;

• All SAR filings and supporting documentation;

• All OFAC SDN screening records;

• All deposit, withdrawal, and redemption transactions;

• All FinCEN 314(a) search requests and results;

• All AML training records for employees and contractors.

Records will be retained for a minimum of five (5) years as required by applicable law, except where a longer retention period is required.

Rules: 31 C.F.R. § 1023.410; FINRA Rule 4511.

10. AML Training Program

TSMX LLC will develop ongoing employee training under the Company's AML program. The Company's training will include, at a minimum:

• How to identify red flags and signs of money laundering that arise during the course of employees' duties;

• What to do once a red flag is identified, including how, when, and to whom to escalate concerns;

• What employees are not permitted to do once a suspicious transaction or activity has been identified;

• The Company's AML policies, procedures, and controls;

• The consequences of failing to comply with the Company's AML program.

TSMX LLC will review its training program periodically to ensure it remains current and accurate. The AML Compliance Person will document all training sessions, including the date, topics covered, and participants.

Rule: FINRA Rule 3310(e).

11. Independent Testing

TSMX LLC will provide for independent testing of the AML program to be conducted by qualified Company personnel or by a qualified outside party. Testing will be conducted on a periodic basis to verify that the AML program is functioning as required. Results of testing will be documented and provided to senior management. Any deficiencies identified during testing will be addressed promptly.

Rule: FINRA Rule 3310(c).

TSMX LLC — Anti-Money Laundering Policy — Updated June 10, 2026 — www.tsmx.io