Customer Agreement

This Customer Agreement ("Agreement") governs your use of the currency conversion and remittance services ("Services") provided by Koya Labs Ltd ("Koya", "we", "us"), a private company limited by shares incorporated in Kenya, Registration No. PVT-MA15BD72.

By creating an account, clicking "I Agree", or otherwise using the Services, you accept this Agreement and agree to be bound by it, together with the documents listed below, which are incorporated by reference.

• The Privacy Notice.
• The Cookie Notice.
• The Terms of Use, which govern the website itself.
• The Risk Disclosure.

This Agreement is formed electronically and is valid and enforceable under Section 83J of the Kenya Information and Communications Act. Nothing in this clause limits your statutory rights under the Consumer Protection Act, 2012.

If you do not agree to this Agreement, you must not use the Services.

How this Agreement relates to the Terms of Use

The Terms of Use govern reading koyabank.com. This Agreement governs transacting. They are separate documents with separate scopes, and accepting one is not accepting the other.

You must be at least 18 years old and have full legal capacity to enter into this Agreement.

You must successfully complete Koya's identity verification process before using the Services, including providing accurate identity documents, proof of address, and any other information we reasonably request. What we collect and why is set out in the Privacy Notice.

Koya reserves the right to decline, suspend, or restrict service to any person for legal, regulatory, risk, or compliance reasons, including where a person:

• Appears on a sanctions list.
• Is a Politically Exposed Person subject to enhanced review.
• Resides in a jurisdiction where Koya's Services are not available.
• Cannot or will not complete identity verification.

A decision to decline service is not a statement that you have done anything wrong, and where the law permits us to explain it, we will.

Koya provides conversion between Kenya Shillings (KES) and Bitcoin (BTC), and facilitates related remittance transactions, subject to the limits, fees and processes described on the platform at the time of your transaction.

Services are currently provided on a limited pilot basis. Transaction limits, available payment channels, and service availability may change without prior notice during this phase.

Koya acts as a service provider facilitating conversion and transfer of value between payment channels, including M-Pesa and other integrated payment rails, and blockchain based settlement.

Koya does not operate as a licensed bank and does not accept customer deposits in the banking sense. Money reaching Koya in connection with a conversion is held only for the purpose of completing that conversion, and is not a deposit, not a balance you can draw on, and not covered by any guarantee scheme.

You are responsible for maintaining the confidentiality of your account credentials and for all activity conducted through your account.

You must notify Koya immediately at hello@koyabank.com if you suspect unauthorised access to your account. The sooner you tell us, the more we can do.

Koya will apply reasonable technical and organisational security measures but cannot guarantee that the Services will be free from interruption, error, or unauthorised access by third parties acting outside Koya's control.

What we will never ask you for

Koya will never ask you for your PIN, a one time code, or a sign-in link, by email, telephone, WhatsApp, Telegram or any other channel. Anyone who does is not us. If you receive such a request, do not act on it and report it to security@koyabank.com.

You can sign out of every device from your account settings. If you believe your account has been accessed by someone else, do that first, then contact us.

Applicable fees for conversion and remittance transactions are disclosed to you before you confirm a transaction. All fees are stated prior to confirmation, and Koya does not charge hidden fees.

Separately from the rate lock above, and consistent with the Consumer Protection Act, 2012, where an estimate is provided before execution Koya will not charge more than 10% above the disclosed estimate without your consent.

Given how the rate lock works, this ceiling should never be reached in practice. It is stated because it is your statutory protection and it applies whether or not our systems behave as described.

Quotes expire

A quote is valid for a limited period shown to you at the time. If you do not confirm within that period the quote lapses and you will be given a fresh one at the prevailing rate. A lapsed quote costs you nothing.

Once you confirm a transaction, Koya will process it in accordance with the timelines disclosed on the platform. Processing times may vary depending on payment channel congestion, blockchain network conditions, and compliance review.

Transactions may be delayed, held, or declined where required for compliance review, including sanctions screening, source of funds verification, or suspected fraudulent activity. Koya will make reasonable efforts to notify you of any such hold, subject to legal restrictions on disclosure. In some circumstances the law prohibits us from telling you that a report has been made, which is described in section 9.

You acknowledge and accept the following risks, which are inherent to digital asset transactions and are not within Koya's power to remove. The Risk Disclosure covers them in more detail.

Digital assets processed through the Services are held via Koya's third party institutional custody arrangements pending settlement.

Koya does not custody customer funds indefinitely as a deposit taking institution. Assets are held only for as long as completing your transaction requires.

The lifecycle of a conversion

For transparency, these are the stages a conversion actually passes through in Koya's systems. They are listed because the point at which value moves between parties is the thing this section exists to describe.

1. Intent and quote. Your instruction is captured and a rate is quoted and locked.
2. Identity and compliance. Verification and screening run where required.
3. Payout details. The destination for the converted value is captured from you.
4. Payment. Your payment is collected and confirmed through the payment channel.
5. Execution. The conversion is executed against the locked rate.
6. Delivery. The converted value is sent to the destination you provided.
7. Completion. The transaction settles and is recorded.

A conversion can also end in review, refund, expiry, or failure, in which case value collected from you is returned to you.

You agree to cooperate with Koya's identity verification, source of funds, and transaction monitoring requirements as necessary for compliance with Kenyan anti money laundering and counter terrorism financing law.

Koya may report suspicious transactions to the Financial Reporting Centre or other competent authorities as required by law, without prior notice to you where such notice would be unlawful.

Koya may freeze, suspend, or decline to process a transaction where required by law, by sanctions obligations, or by a court order.

Why we sometimes cannot explain

Where the law prohibits it, we cannot tell you that a report has been made about a transaction, or explain the detail behind a compliance decision. This restriction comes from the anti money laundering framework and applies to every regulated institution in Kenya. Where we can lawfully explain a decision, we will.

Records collected for these purposes are retained under the schedule in the Privacy Notice, which in most cases is at least seven years.

You agree not to use the Services:

• For any unlawful purpose, including money laundering, terrorist financing, fraud, or evasion of sanctions.
• To provide false or misleading information during onboarding or in connection with any transaction.
• On behalf of a third party without Koya's prior written consent.

The third item matters more than it may appear. Converting on behalf of someone else defeats the identity checks the law requires us to perform, and it is how people are used, sometimes without understanding it, to move money for others. If someone has asked you to convert on their behalf, do not, and tell us.

Breach of this section may result in suspension or termination under section 13, and where conduct appears unlawful we may report it.

To the fullest extent permitted under Kenyan law, Koya's liability for any loss arising from your use of the Services is limited to direct, proven losses arising from Koya's own negligence or breach of this Agreement.

Koya is not liable for losses arising from:

• Blockchain network failure or congestion.
• Third party payment rail outages.
• Incorrect destination addresses provided by you.
• Events beyond Koya's reasonable control, as described in section 15.

You agree to indemnify Koya against claims, losses, or expenses arising from your breach of this Agreement or your unlawful use of the Services, to the extent permitted by Kenyan law.

This does not extend to anything arising from Koya's own negligence or breach, and it does not apply to loss you did not cause.

Koya may suspend or terminate your account for:

• Breach of this Agreement.
• Suspected fraud or illegal activity.
• Compliance requirements.
• Regulatory direction.

You may close your account at any time, subject to completion of any pending transactions and to applicable regulatory record keeping requirements. Closing your account does not delete records we are legally required to keep, and the Privacy Notice explains why.

Termination does not affect any rights or obligations that accrued before termination. Where value is held in connection with a pending transaction at the point of suspension or termination, it is returned to you unless the law requires otherwise.

If you have a complaint, please contact us first at hello@koyabank.com so that we can attempt to resolve it directly. Most things are fixed fastest this way.

If a dispute is not resolved within 30 days, either party may refer it to arbitration in Nairobi under the Arbitration Act, 1995 (Kenya).

This clause does not restrict your right to bring a claim before a Kenyan court, which cannot be excluded under the Consumer Protection Act, 2012. Arbitration is an option available to you, not a condition imposed on you.

Regulators

You may also lodge a complaint with the relevant regulator at any time, without coming to us first:

• The Central Bank of Kenya or the Capital Markets Authority, as applicable to the subject of your complaint.
• The Office of the Data Protection Commissioner at www.odpc.go.ke, for anything concerning your personal data.

Koya is not liable for delay or failure to perform caused by events beyond its reasonable control, including blockchain network failure, third party service outages, government action, or natural disaster.

Where such an event prevents a transaction from completing, we will return value collected from you as soon as we reasonably can. Force majeure excuses delay; it does not entitle Koya to keep your money.

Koya may update this Agreement from time to time. Material changes will be notified to you before they take effect. Continued use of the Services after changes take effect constitutes acceptance.

Unlike the website notices, this Agreement governs a relationship we have with you, so we will tell you directly rather than relying on you to notice a changed date on a page.

A material change you do not accept entitles you to close your account under section 13 without penalty.

Governing law

This Agreement is governed by the laws of the Republic of Kenya.

Severability

If any provision of this Agreement is found unenforceable, that provision is severed to the minimum extent necessary and the remaining provisions continue in effect.

Entire agreement

This Agreement, together with the documents incorporated by reference in section 1, constitutes the entire agreement between you and Koya regarding the Services.

No waiver

If we do not enforce a right under this Agreement, that is not a waiver of it.

Assignment

We may assign our rights and obligations under this Agreement to another entity, for example on a reorganisation, provided this does not reduce your rights. You may not assign yours.

Language

This Agreement is published in English. Where a translation is provided for convenience and the versions differ, the English version governs.

For anything concerning your account or a transaction, contact support. For questions about this Agreement itself, contact legal. For a suspected security issue, contact security.