3. Account eligibility and single-account policy: TUMA permits one account per individual natural person. Duplicate or multiple accounts are prohibited. Accounts that are duplicates may be suspended or permanently closed.

4. Prohibited document types: TUMA will not accept expired documents, screenshots, photocopies, forged or altered documents, images with signs of tampering, unclear or invalid documents. Documents presented must be original, valid and clearly attributable to the user.

5. Biometric consent and use: By registering for an account and using TUMA, you consent to the capture, processing and temporary storage of biometric data solely for the purposes of identity verification, fraud prevention and regulatory compliance for this service. Biometric data obtained at onboarding (such as a live selfie or motion check) will be processed in accordance with applicable data protection law and will be used only for verifying identity and preventing fraud in connection with the TUMA service. Biometric information will not be used for unrelated profiling, marketing, or any purposes beyond compliance and authentication without separate explicit consent. You may be asked to re-provide biometric verification during enhanced due diligence (EDD) or on periodic re-verification.

6. EDD documentation: For enhanced due diligence and risk elevated cases, TUMA may request additional documents including but not limited to recent bank statements, utility bills, payslips, employment letters, and additional identity documentation. Failure to provide requested documentation may lead to transaction refusal, account suspension, or account closure.

7. Re-verification and review frequency: TUMA conducts a review of customer information on a weekly basis to ensure ongoing compliance with regulatory obligations. Customers may be required to re-verify documents upon expiry, change of name/address/nationality, or where regulatory changes or risk indicators necessitate re-verification.

8. Device, IP and behavioural checks; VPN restrictions: TUMA collects device and transaction-related signals during onboarding and transactions. This includes IP address, device identifiers and transaction patterns for fraud prevention and compliance. Use of VPNs, proxies or non-UK IP addresses may prevent access to the platform or the ability to transact and may lead to suspension.

9. KYC coverage limitation: Collected biometric and KYC data are used for compliance of this product only; such data are not repurposed beyond the compliance and security needs of TUMA without separate consent.

10. Fees policy: At present TUMA does not charge a separate transfer fee. TUMA reserves the right to introduce fees in the future and will provide at least 14 days’ notice to customers before new fees are applied.

11. Exchange rates: Exchange rates are provided by market-sourced liquidity through TUMA’s banking and vendor partners. Rates displayed in the app are indicative at the time of instruction and are valued at execution. Forex markets are volatile and rates may change between time of instruction and execution. TUMA will display the exact rate and recipient amount at the point of confirmation.

12. Best Rate Commitment: TUMA maintains a Best Rate Commitment for marketing fairness. We monitor market rates and endeavour to offer competitive rates. This is a non-contractual commitment and rates are only guaranteed at execution as displayed at confirmation.

13. Rate lock and cutoff: Quotes are held and actionable for short periods by design. Typical operational target for rate lock is 30 seconds from quote issuance; however, market conditions can shorten or lengthen this window and TUMA will always indicate the expiry/validity on the quote where possible.

14. Rounding rules: Amounts are rounded according to destination currency conventions and payout channel rules. Where rounding applies, the displayed recipient amount is final.

15. Payment methods and Token (Open Banking): TUMA supports payment via Open Banking using Token as our Open Banking partner, and via card payment methods where supported by payment providers. Open Banking consent is granted during the payment flow and may be revoked by the user via their bank or the Token consent interface.

16. Card storage and security: TUMA does not store card details. Card storage (tokenisation) is managed by PCI-DSS compliant card service providers.

17. Authorisation and when an order is received: A transfer instruction is considered received once cleared authorisation and funds confirmation are received from the payment provider. For card payments this is when the payment provider confirms successful capture or settlement.

18. Immediate pass-through and settlement: TUMA operates on a pass-through settlement model and does not retain customer funds beyond the time required to execute the transfer. Transfers are executed immediately upon receipt of cleared funds and successful AML/compliance checks.

19. No scheduled or recurring transfers: TUMA does not support scheduled or recurring transfers at this time.

20. Right to delay for AML review: TUMA may delay execution of an otherwise valid transaction for up to 24 hours while conducting AML or compliance reviews without incurring liability for such delay.

21. No interest for delays: TUMA does not pay interest or other compensation for delays arising from compliance reviews, partner outages, network issues or other force majeure events.

28. Monitoring overview: TUMA operates a transaction monitoring programme which combines automated monitoring and manual review. Transaction behaviour is scored against internal risk models and thresholds.

29. Risk categories: Customers and transactions are categorised as Low, Medium, High or Prohibited for risk-based monitoring and controls.

30. Automated and manual review: Automated systems detect anomalies which are triaged to human analysts for manual review where necessary. The escalation path is: Compliance Analyst > MLRO > Senior Management > FCA (if required).

31. Partial freezes: TUMA may impose partial holds on transaction amounts pending review. Partial freezes do not constitute acceptance or completion of a refund and will be lifted or escalated when the review concludes.

32. Scam assistance: TUMA will provide reasonable assistance to customers who fall victim to scams, including attempting reversals and providing evidence for law enforcement. Such assistance is not a guarantee of recovery.

33. No liability for recipient fraud: TUMA is not liable for funds misappropriated by a recipient or their agents where the recipient has received and used funds, or where local payout rules render payouts irrevocable.

34. Legal framework: TUMA complies with the Money Laundering Regulations 2017, the Proceeds of Crime Act 2002, and related statutory instruments and guidance. TUMA will file Suspicious Activity Reports (SARs) with the NCA or relevant authority where required.

35. PEPs and sanctions: TUMA does not onboard true Politically Exposed Persons (PEPs) as part of its standard risk appetite and will decline onboarding where a PEP or sanctioned individual cannot be accepted. All customers are screened against sanctions lists and watchlists.

36. EDD triggers and documentation: EDD may be required where a customer’s behaviour or profile indicates elevated risk. EDD documentation may include bank statements, payslips, utility bills, proof of employment, and additional ID.

37. Record retention: TUMA retains transactional and KYC records for at least seven (7) years from the date of last activity, in line with regulatory obligations.

38. Privacy and processing: TUMA processes personal data in accordance with UK GDPR and the Data Protection Act 2018. The Privacy Policy sets out detailed categories of processed personal data, purposes, legal bases, rights and retention schedules.

39. Data subject rights: Customers have the right to access, rectify, restrict, object, request portability and request erasure of personal data subject to legal retention obligations. Users may request deletion immediately, but TUMA will retain or anonymise data securely after 7 years to satisfy regulatory retention obligations.

40. DPO contact: For data protection queries or rights requests contact disputes@tuma.com.

41. Breach notification: TUMA will notify relevant supervisory authorities and affected individuals of a personal data breach within 72 hours where required by law, and will cooperate with authorities on remediation.

42. Security controls: TUMA enforces employee 2-factor authentication (2FA) and role-based access controls. Customers are required to keep account credentials confidential and to notify TUMA immediately of any suspected compromise.

43. Liability cap: Except where liability cannot be lawfully limited (e.g., death, personal injury, fraud where applicable laws exclude limits), TUMA’s aggregate liability for direct loss is limited to £1,000 per account and is dependent on the transaction and demonstrated direct loss.

44. User negligence and fraud: Users are liable for losses resulting from negligent behaviour such as sharing credentials, failing to secure devices, or failing to report compromises promptly.

45. Force Majeure: TUMA is not liable for delays or failures caused by events outside its reasonable control including, but not limited to, strikes, pandemics, government action, FX market suspension, power outages, telecommunication failures, cyber-attacks, or third-party vendor outages.

46. Regulatory intervention: If a regulator or foreign authority imposes restrictions (including currency controls or freezes), TUMA is not liable for the consequences of such intervention.

47. Indemnity: Customers will indemnify TUMA against claims, losses and liabilities arising from misuse of the service, intentional or negligent breaches of these Terms, or provision of false information.

48. Complaints handling: Initial contact should be to support@tuma.com for operational issues and disputes@tuma.com for formal disputes. The internal escalation is Support > Compliance Analyst > MLRO > Senior Management.

49. Formal complaints timing: Formal complaints must be raised within 5 days of the incident where practicable.

50. Response times: TUMA aims to acknowledge complaints within 5 business days, to resolve straightforward matters within 48 hours where feasible, and complex matters within 8 weeks in line with FCA DISP expectations.

51. Financial Ombudsman Service (FOS): If a complaint remains unresolved, eligible UK customers may refer the matter to the Financial Ombudsman Service.

52. Compensation: TUMA may offer compensation up to £1,000 or the value of direct loss as part of a valid complaint resolution, subject to investigation and evidence.

53. Official notices: Notices and legal communications shall be delivered by email to the customer’s registered email address or via in-app notification. An email is deemed received 48 hours after sending if no delivery failure notice is received.

54. Marketing consent: Marketing communications will be sent only with the user’s consent. TUMA uses a single opt-in method at registration for marketing communications by email, WhatsApp and SMS, and users may opt out at any time via settings or by contacting support.

55. Language: These Terms and all communications are in English. If a translated version exists, the English version governs in case of conflict.

56. Voluntary closure: Customers may request account closure; TUMA will process voluntary closure requests within 24 hours subject to verification and outstanding transaction resolution.

57. Dormant accounts: Accounts with no transaction activity for six (6) months will be rendered dormant. Dormant accounts will remain in a suspended state until the user contacts support and re-verifies identity.

58. Funds on closure: On closure or dormancy, available funds will be refunded to the sender less any recoverable costs or charges incurred in attempting refunds or reversals.

59. Suspension pending investigation: Accounts under investigation for suspicious activity or regulatory reasons may remain suspended until cleared by TUMA or regulators.

60. Recipient-country regulations: Transfers are subject to the laws and regulations of the recipient country including local exchange control, taxation or mobile-money levy rules (for example, Central Bank of Kenya (CBK) and Bank of Tanzania (BoT) requirements).

61. Taxes and levies: Any local taxes, fees or levies imposed by the recipient country or payout partner will be reflected in the final amount shown to the sender where practicable.

62. Recipient-side restrictions: TUMA is not liable for delays, deductions or seizure of funds caused by recipient-country authorities, payout partner rules or local law.

63. Policies: TUMA maintains documented policies including an AML policy, Business-wide Risk Assessment, Data Protection policy, Cyber Security policy and a Whistleblower policy. These policies are available on request by legitimate regulatory or audit request.

64. Business continuity and disaster recovery: TUMA maintains a business continuity plan. In the event of severe system outages, TUMA aims to resume core services within 72 hours or sooner depending on the nature of the incident.

65. Cybersecurity and testing: TUMA conducts periodic penetration tests and vulnerability assessments and follows industry best practices to protect customer data and systems.

66. Audit frequency and oversight: Internal audits are carried out quarterly and external audits annually. The MLRO and senior management have oversight responsibility for compliance and audit remediation.

67. Virtual accounts and new products: TUMA may introduce new products including virtual GBP accounts, referral programs and loyalty schemes. Specific terms will be provided at product launch.

68. Amendments: TUMA reserves the right to amend these Terms. Material changes to fees or fundamental service changes will be notified in advance. Introduction of new products may be governed by separate terms which users must accept.

69. Governing law: These Terms are governed by the laws of England and Wales and operate within the regulatory framework of the FCA.

70. Mediation and arbitration: Parties shall attempt to resolve disputes by mediation before commencing arbitration or court proceedings. Arbitration proceedings, if required, will be conducted under the rules of the London Court of International Arbitration (LCIA) with seat in London and the English language to govern proceedings.

71. Small claims: Nothing in these Terms precludes a customer from pursuing a small claims court action in England and Wales where applicable.

72. Definitions: "Account" means a TUMA user account; "Sender" means the person sending funds; "Recipient" means the person receiving funds; "Transaction" or "Order" means an instruction to transfer funds; "PSRs" means Payment Services Regulations 2017; "MLR" means Money Laundering Regulations 2017; "FCA" means Financial Conduct Authority.

73. Interpretation: Headings are for convenience only. References to statutes include amendments and delegated legislation.

Annex A — Refund Policy: The Refund Policy is attached. It sets out the operational steps, notification requirements and timelines for refunds, reversals and chargebacks.

Annex B — Privacy Policy: The Privacy Policy is attached and governs data processing, retention, transfers, data subject rights and breach notification procedures.