Corporate Governance Process

Orion Transact Inc.

CORPORATE GOVERNANCE PROCESS

1. INTRODUCTION

In compliance with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and associated regulations, this document serves as an overview of the Corporate Governance Framework of Orion Transact Inc. (henceforth referred to as "the Company"), a federally registered Money Services Business (MSB) that operates under the regulatory supervision of the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC).
In this context, "corporate governance" refers to the internal structures, guiding principles, and procedures that specify how power is used and managed within the organization. This covers the duties of executive management and the Board of Directors in maintaining ethical behavior, legal and efficient corporate operations, and regulatory compliance, especially with regard to anti-money laundering and anti-terrorist financing regulations. It also covers the company's responsibilities to its customers, staff, counterparties, financial partners, regulators, and the larger community in which it conducts business.
Transparency, consistency in decision-making, and accountability at all organizational levels are intended to be supported by this governance framework. It guarantees that the Company's risk profile and service offerings in the areas of currency exchange, cross-border payments, and associated MSB activities are in line with the management and oversight functions.

2. BOARD OF DIRECTORS

The main corporate body charged by the shareholders with overseeing the general management and strategic orientation of Orion Transact Inc. is the Board of Directors, or "the Board." In accordance with Canadian regulatory requirements, such as those imposed under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and the MSB Registration Regulations, the Board oversees the Company's operations in its entirety, approves important policies, and keeps an eye on senior management.

The Board may be composed of up to three members, with a preference for including at least one independent non-executive director not involved in the Company’s day-to-day operations. All Directors must possess the professional qualifications, business judgment, and integrity necessary to fulfill their fiduciary responsibilities and to actively participate in the Board’s deliberations. Consideration is given to candidates with knowledge of financial operations, compliance oversight, risk management, or the Canadian payments and money services sector.

As an MSB providing foreign exchange and payment settlement services, the company's business model, internal control framework, and risk profile must all be thoroughly explained to newly appointed directors. In accordance with Canadian corporate and regulatory law, they must also be aware of their own responsibilities and liabilities, including the need to act honestly and in the company's best interests. Any newly appointed director with little prior experience in regulated financial entities is expected to complete training provided by the company in compliance with governance best practices.

The Chief Compliance Officer reviews the company's internal Board Induction Program every year, and it is carried out in collaboration with human resources and senior management. Through this program, new directors are guaranteed to be promptly and pertinently introduced to the company's AML/ATF Compliance Program, internal policies, FINTRAC reporting requirements, operational procedures, and key personnel. The HR Department and the leaders of the pertinent business and compliance units are in charge of the content and delivery of the induction process, but the Board is still accountable for its efficacy.

2.1. ROLE OF BOARD OF DIRECTORS

The Board of Directors is the highest authority in Orion Transact Inc.'s governance structure and is ultimately in charge of the organization's overall performance, legal compliance, and strategic leadership. The Board is tasked with making sure that all operations are carried out in a way that complies with Canadian federal laws and regulatory guidelines, and it is directly answerable to the company's shareholders.

Regarding compliance, the Board is responsible for making sure the Company complies fully with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), its related regulations, and the guidelines provided by FINTRAC, Canada's designated anti-money laundering and anti-terrorist financing supervisory authority for MSBs. When handling customer and transactional data, the Board must also consider applicable principles under the recommendations of the Financial Action Task Force (FATF) and any applicable requirements imposed under privacy and data protection frameworks, such as the Personal Information Protection and Electronic Documents Act (PIPEDA).

It is the Board's responsibility to make well-informed decisions about the Company's operational and financial risks, including those related to payment services, international transactions, and possible exposure to fraudulent schemes or money laundering. The Board is responsible for making sure that the company's customer relationships and service models stay within the specified risk tolerance and are regularly reviewed using the internal risk assessment methodology of the company.

The Board is in charge of managing business strategies that are intended to create long-term value and ensure operational sustainability in terms of commercial performance. Although results cannot be guaranteed, shareholders and other stakeholders have a right to expect that risks associated with enterprise activity will be appropriately evaluated and managed under the direction of the Board. A balance between prudent control and entrepreneurial initiative should be reflected in board decisions.

In order to guarantee that organizational policies and conduct are in line with stakeholder interests and regulatory requirements, the Board must play a key role in forming the Company's culture of integrity and accountability. In addition to actively supporting a governance environment where diverse viewpoints are accepted and taken into consideration, the Board should promote truthful and productive discussion during meetings.

Establishing and preserving open lines of communication with shareholders, authorities, and important external stakeholders is another duty of the Board. Such communication needs to be precise, timely, and represent the content of material developments rather than just their appearance. While always keeping the Company's responsibilities to the public interest in mind, the Board will identify key risk areas and monitor key performance indicators (KPIs) to gauge operational effectiveness and financial results.

The Board will meet as often as needed to carry out its responsibilities. Every meeting's minutes must be precisely documented, kept up to date, and, if necessary, made available for regulators to review. The content of discussions, including any opposing viewpoints expressed during the decision-making process, must be reflected in the record.

2.2. ROLE OF UBO

The Ultimate Beneficial Owner (UBO) of Orion Transact Inc. does not hold a formal corporate office unless they are appointed as a director or officer. But in cases where the UBO continues to play a significant role in strategic decision-making or corporate oversight, its influence must be in line with the requirements of the regulations for accountability, independence, and transparency.

When the UBO interacts with the Board of Directors and senior management, it is expected that they will use good judgment and uphold ethical standards. The UBO may offer strategic insight and high-level direction, but it is not always involved in day-to-day management. In doing so, the UBO should respect the Canadian legal and regulatory standards, particularly those outlined in the Canada Business Corporations Act and the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), as well as the principles of good governance, such as intellectual independence and transparency.

Board resolutions and shareholder records must explicitly state the UBO's involvement in any meetings of directors or shareholders that it chairs or presides over. The UBO should make sure that meetings are fair and well-organized in these situations, promoting involvement and candid dialogue among directors or shareholders and assisting in the facilitation of decisions that promote the expansion of the company while adhering to MSB rules.

Through the recommendation of candidates with a range of professional skills, regulatory knowledge pertinent to the MSB industry, and diverse experience, the UBO may help shape the makeup of the Board. This entails aiding in succession planning and making certain that the competencies of the Board as a whole complement the operational and regulatory requirements of the business.

The UBO may offer informal feedback or assistance to preserve leadership stability and corporate direction, even though the Board and senior management are ultimately in charge of overseeing performance reviews. Additionally, the UBO may hold recurring meetings with board members to discuss strategic matters or issues that affect the company's long-term survival.

The UBO's participation in Board or management affairs must be open, documented, and compliant with legal corporate governance standards. Under Canadian AML regulations, the UBO must avoid unduly influencing regulatory, compliance, or internal control functions. If it does, its beneficial ownership obligations may be reviewed.

2.3. ROLE OF THE EXECUTIVE & NON-EXECUTIVE DIRECTOR

The governance structure of Orion Transact Inc. makes a distinction between executive and non-executive directors based on their respective functions within the company.

An executive director is a director who works full-time for Orion Transact Inc. and actively participates in the day-to-day operations of the company. Executive directors usually oversee regulatory compliance procedures, manage personnel and operations, and carry out strategic initiatives as mandated by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and MSB-related frameworks.

A member of the Board who does not work full-time for Orion Transact Inc. or any of its affiliated companies and does not take part in day-to-day company management is known as a non-executive director. Independent judgment, strategic oversight, and accountability in financial, risk, and compliance matters are all provided by non-executive directors. Additionally, they help to maintain the integrity of the company's corporate governance procedures and, if appropriate, may be members of specialized Board committees.

To avoid any one person or group of people having an excessive amount of influence over decision-making, the Board of Directors must maintain a balance between independence and authority. Maintaining the values of independence, transparency, and sound governance in line with industry best practices for financial services in Canada requires striking this balance.

The Canada Business Corporations Act and other Canadian corporate laws impose the same fiduciary duties on all directors, regardless of their title. These obligations include the duty to act honestly and in good faith with the Company's best interests in mind, as well as the duty to use the care, diligence, and skill that a person of reasonable caution would use in the same situation.

Compared to executive directors, non-executive directors usually carry out their duties occasionally and might not have as much constant access to internal reports or operational systems. They must, however, independently supervise issues of strategic and regulatory significance and contribute intelligently to Board discussions.

2.4. APPROVAL OF NEW SERVICES & PRODUCTS

Any new service or product offering at Orion Transact Inc. must be approved by the Board of Directors and subject to a methodical, risk-based decision-making process that guarantees complete alignment with the company's operational capabilities, strategic goals, and legal requirements in Canada.

A thorough risk assessment must be carried out prior to the launch of any new goods or services. Risks pertaining to finances, operations, reputation, law, and compliance must all be taken into account in this assessment. Products that may involve complex transaction layering, third-party payment flows, high-risk jurisdictions, or customer categories that increase the company's exposure under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) are given special consideration. Similar prudential standards are used when evaluating services with high transaction volumes or elevated fraud exposure, even though Orion Transact Inc. is not a Virtual Asset Service Provider (VASP).

Every new product or service is examined to make sure it can be provided in a way that conforms with the company's AML/ATF Program, as filed with FINTRAC, and that none of its features conflict with the company's current registration and purview as a money services business. Legal advice may be sought when necessary to verify whether regulatory notifications or changes to the company's MSB registration are required prior to launch.

An evaluation of data security procedures, cybersecurity threats, and the reliability of the information systems used to provide the new service are also included in the compliance review. The internal IT department of the company, working with outside consultants if needed, must confirm that adequate controls are in place to safeguard client data in compliance with PIPEDA and to stop transactional manipulation or unauthorized access.

The Compliance Officer formally reviews all proposals for new services or products and sends internal memos to the Board detailing any compliance concerns or risk conditions that need to be addressed. Before requesting the Board's final approval, these reviews must be finished. The final proposal may occasionally include suggestions for pilot programs, phased rollouts, or post-implementation review schedules.

All new goods and services are monitored continuously and performance is reported on a regular basis after launch. This entails monitoring transactional activity, client uptake, indications of suspicious behavior, and departures from anticipated use cases. Corrective measures are suggested when problems occur, and internal auditing techniques can be used to confirm that controls continue to be effective over time.

Based on documented reviews, operational readiness, and regulatory compatibility, the Board of Directors alone has the final say over whether to approve the introduction of new services and products.

2.5. COMPLIANCE & AML MEASURES FOR OPERATIONS

In order to ensure complete compliance with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), its related Regulations, and FINTRAC guidance, Orion Transact Inc. upholds a thorough Anti-Money Laundering (AML) and Countering the Financing of Terrorism (CFT) framework. In order to prevent the misuse of its services for illegal purposes, the company, which is a registered Money Services Business (MSB) in Canada, is committed to the highest standards of compliance and ethical conduct.

A Compliance Officer has been appointed by the company to supervise and manage all regulatory responsibilities pertaining to AML/CFT compliance. In compliance with Canadian laws, industry best practices, and FINTRAC regulatory updates, this officer makes sure that all company operations, including payment services and foreign exchange operations, are carried out strictly. In order to make sure that the company's leadership is completely aware of its compliance posture and potential risks, the Compliance Officer reports directly to the Board of Directors.

By evaluating each client's risk profile and modifying the scope of due diligence appropriately, Orion Transact Inc. employs a risk-based approach to customer due diligence, or CDD. Enhanced Due Diligence (EDD) is applied to clients who are considered high-risk because of their profile, location, or type of transactions. To identify and reduce the risks of money laundering and terrorist financing, this entails thorough background checks, frequent transaction monitoring, and continuous evaluations.

The business also uses a strong transaction monitoring system to keep an eye on every transaction that goes through its platform. High-volume or high-risk transactions—such as cross-border payments, odd transaction patterns, and actions that could raise suspicions of money laundering or other illegal activity—are given particular attention. Suspicious transactions are identified by automated systems and subsequently examined by the compliance team to guarantee careful monitoring and adherence to legal requirements.

To ensure that staff members are fully informed about current regulations, emerging threats, and internal procedures designed to maintain compliance, Orion Transact Inc. also regularly offers AML/CFT training to all of its employees. All new hires must complete the required training, which is updated frequently to take into account modifications to the law and new or updated FINTRAC guidelines, among other regulatory changes. This training strengthens the company's commitment to preventing financial crimes by ensuring that staff members have the skills and information needed to identify and address suspicious activity.

2.6. TECHNOLOGY RISK & CYBERSECURITY GOVERNANCE

To protect the availability, confidentiality, and integrity of its information systems—all of which are essential to its operations as a Money Services Business (MSB)—Orion Transact Inc. uses a strong framework for technology risk and cybersecurity governance. With regard to cybersecurity threats, data protection, and the avoidance of any unauthorized access or data breaches, the company is dedicated to making sure that its IT infrastructure is secure.

Because financial institutions are increasingly facing threats, the company's IT governance framework incorporates continuous risk assessments to find and fix any vulnerabilities pertaining to its digital services. The company is especially aware of the risks related to payment services, cross-border transactions, and vulnerabilities related to MSBs that could expose the company to fraud or illegal activity.

The company places a high priority on adhering to cybersecurity regulations, making sure it satisfies applicable standards, such as those established by FINTRAC and PIPEDA (Personal Information Protection and Electronic Documents Act), as well as international cybersecurity standards like GDPR where appropriate. By ensuring that its operations adhere to these data protection frameworks, the company's cybersecurity measures aim to protect client information and uphold confidence in the services offered.

A thorough incident response plan has been put in place by the company to handle cybersecurity breaches and other risks associated with IT. Clear protocols for detecting, containing, and lessening the impact of any cybersecurity incidents are outlined in this plan, along with guidelines for interacting with stakeholders, regulators, and impacted parties. To keep it up to date with new threats and regulatory requirements, the response plan is reviewed on a regular basis.

Orion Transact Inc. periodically performs security audits and monitors its IT systems to guarantee continuous oversight and risk mitigation. These audits are intended to assess how well security measures are working, spot possible threats, and make sure that internal and external regulations are being followed. Depending on the risk, any vulnerabilities found during these audits are quickly fixed with system upgrades, enhanced security measures, or more employee training.

6. CONFLICT OF INTEREST

When a person's direct or indirect personal interests obstruct or seem to obstruct their capacity to act impartially and in the Company's best interests, a conflict of interest occurs. To preserve the confidence of all parties involved, including shareholders, clients, and regulators, Orion Transact Inc. must continue to make decisions in an atmosphere of honesty and openness.

Transactions between the company and its directors, managers, or major shareholders are just a few of the circumstances that can give rise to conflicts of interest. Decision-making processes may appear or actually be biased as a result of these transactions. The interests of the company and its shareholders must always come before the personal interests of any director or a person closely related to a director.

The Board of Directors expects all members to act in the best interests of the company and to steer clear of any circumstance in which their personal interests could conflict with the company's in order to minimize potential conflicts. Directors should do everything in their power to steer clear of situations or actions that might give the impression of a conflict, even if they are not immediately apparent.

Any current or potential conflicts of interest must be promptly and completely disclosed to the Board by directors, ideally in writing. As soon as the conflict is discovered, the disclosure needs to be made and added to the company's Register of Interests. The involved director may still take part in the debate and cast a vote, but they must carefully weigh the possible repercussions of their involvement in decision-making in such a situation against their own integrity.

To preserve the integrity of the governance process, the director must consider resigning from the Board in cases of a persistent material conflict of interest. The Board may also consider whether it is in the best interests of the Company for the director to continue to participate and whether corrective action is necessary.

4. BOARD MEETINGS

In accordance with relevant laws and internal guidelines, members of Orion Transact Inc.'s Board of Directors are expected to attend all regular and special Board meetings, either in person or via teleconferencing or video conferencing platforms.

Since their involvement is essential to preserving the independence and integrity of the governance process, independent directors are expected to attend all board meetings. The quorum needed for decision-making will not be impacted by the absence of an independent director, unless the company's bylaws specify otherwise. To ensure impartial input and oversight, the Board may, nevertheless, require the attendance of at least one independent director at each meeting in order to foster accountability and transparency.

The minutes of the meeting, which must be prepared as soon as each Board session concludes, will formally record attendance at each meeting. The names of the directors in attendance as well as any absences, along with any relevant justifications, must be included in these minutes. At the following meeting, the Board reviews and approves the minutes, guaranteeing that all decisions and discussions are accurately documented and adhere to corporate governance guidelines.

5. DELEGATION TO MANAGEMENT

5.1. THE ROLE OF THE CHIEF EXECUTIVE OFFICER

The CEO's appointment is the responsibility of the governing body. The CEO is the executive's top leader and most senior member. In order for management's authority and accountability to be regarded as the CEO's authority and accountability insofar as the governing body is concerned, the CEO uses a delegation of authority to transfer all of the governing body's authority to management.

Together with other executives, the CEO is in charge of carrying out the strategy and managing the company going forward.

5.2. THE ROLE OF THE HEAD OF OPERATIONS

The Head of Operations frequently reports to the CEO and is in charge of Orion Transact Inc.'s day-to-day operations. The head of operations is in charge of making sure that resources are managed properly and that business operations run smoothly. Her duties also include planning and overseeing the daily operations of the company to guarantee smooth progress, managing employees from various departments, giving constructive criticism, and communicating with the CEO and board of directors to decide on operational activities and establish strategic goals.

5.3. THE ROLE OF THE HEAD OF RISK

The Chief Risk Officer will identify and manage general risks in collaboration with management and employees. Making sure an organization has internal controls that effectively measure and manage the risks it faces is his goal.

5.4. THE ROLE OF THE HEAD OF INFORMATION TECHNOLOGY

The IT Head is in charge of the strategic planning, execution, and upkeep of Orion Transact Inc.'s IT infrastructure in order to guarantee regulatory compliance. In matters pertaining to IT infrastructure, the head of IT regularly works with the management team.

5.5. THE ROLE OF THE MANAGING DIRECTOR

As the company's principal representative in Canada, the managing director oversees the operations of the Canadian office and makes sure that the government and the regulatory body FINTRAC are in good communication.

The key responsibilities of the Managing Director include, but are not limited to, the following:

- Overseeing Compliance with Local Regulations: The Managing Director ensures that the Company complies with all applicable regulatory requirements in Canada, including those outlined by FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), and any other relevant provincial or federal laws. This includes managing compliance programs and ensuring timely reporting to regulators.

- Liaising with Canadian Regulators: The Managing Director serves as the primary point of contact between the Company and Canadian regulators, including FINTRAC and other authorities that govern the Company's operations. This role involves maintaining open and transparent communication with regulators, addressing compliance concerns, and ensuring that all regulatory expectations are met.

- Supervising the Local Team: The Managing Director is responsible for overseeing the day-to-day operations of the Company’s Canadian office and managing relationships with internal teams, including compliance, finance, operations, and customer service. The Managing Director ensures that the team operates efficiently, meets performance standards, and aligns with the Company’s strategic goals.

- Aligning Strategic Goals with Global Objectives: The Managing Director ensures that the activities of the Canadian operations align with the global objectives of Orion Transact Inc.. This includes implementing global strategies at the local level, monitoring performance against goals, and making necessary adjustments to improve operational outcomes and customer service.

5.6. THE ROLE OF THE HEAD OF RISK

This role focuses on identifying, assessing, and mitigating risks associated with the operation activity of the Company.

The key responsibilities of the Head of Risk include, but are not limited to, the following:

- Developing and Implementing a Risk Management Framework: The Head of Risk is responsible for establishing and maintaining a comprehensive risk management framework that complies with all regulatory requirements under Canadian law and FINTRAC’s guidelines, particularly in the context of anti-money laundering (AML) and countering the financing of terrorism (CFT). This framework must address a wide range of risks, including operational, financial, compliance, and reputational risks, with a focus on safeguarding the Company’s assets and reputation.

- Monitoring Market, Operational, and Compliance Risks: The Head of Risk is tasked with monitoring various risk factors that could impact the Company’s operations, particularly market risks and operational risks that arise from the trading of over-the-counter (OTC) derivatives and other financial products. The Head of Risk is expected to analyze market trends, regulatory changes, and other relevant factors that may influence the Company’s risk exposure.

- Preparing Risk Reports and Escalating to Senior Management: Regular risk reports must be prepared, documenting identified risks, their potential impact, and the mitigation strategies in place. These reports must be presented to senior management to ensure that all stakeholders are fully informed of the Company’s risk landscape. The Head of Risk is also responsible for ensuring that any significant or emerging risks are escalated promptly to senior management for further evaluation and action.

- Collaborating with IT and Compliance Teams: The Head of Risk must work closely with the IT and Compliance teams to ensure that risk management practices are seamlessly integrated into the Company’s day-to-day operations. This collaboration ensures that risks related to information technology, data protection, and regulatory compliance are adequately addressed, and that appropriate safeguards are in place to protect the Company’s operations and customer information.

6. UBO RIGHTS

The Ultimate Beneficial Owner (UBO) has rights, and the Board of Directors of Orion Transact Inc. is dedicated to protecting those rights and making sure that any obstacles to exercising those rights are promptly gone. Recognizing the importance of the UBO's interests to the Company's overall governance, the Board offers suitable avenues for pursuing remedies in the event that those rights are violated.

The Board encourages the UBO to attend and participate in shareholder meetings, whether they are special or annual, and recognizes the value of UBO participation in these gatherings. The Board should make sure that the UBO is actively encouraged to participate and that they are fully informed about any matters that call for their consent and involvement.

The Board must make sure that a thorough explanation of the possible consequences of any proposed resolutions is included with every item of special business mentioned in the Notice of Meeting of Shareholders. This guarantees that UBOs can decide on issues impacting the company with knowledge.

The rights of the UBO shall be respected and safeguarded by the Board. These rights include, but are not limited to, the following:

- Right to Vote: The UBO has the right to vote on all matters that require their consent or approval, including any resolutions affecting the Company’s governance, financial matters, or corporate structure.

- Pre-emptive Right: The UBO holds a pre-emptive right to all new share issuances by the Company, allowing them to maintain their proportionate ownership in the event of new equity offerings.

- Right to Inspect Corporate Books and Records: The UBO has the right to inspect the Company’s corporate books and records, subject to reasonable limitations in accordance with Canadian corporate law.

- Right to Information: The UBO is entitled to receive timely, accurate, and comprehensive information on the Company’s financial condition, strategic plans, and operational performance, enabling informed decision-making.

- Right to Dividends: The UBO has the right to receive dividends in proportion to their shareholding, subject to the Company’s dividend policy and available profits.

- Appraisal Right: In the event of certain corporate actions, the UBO has the right to seek an independent valuation of their shares, as set forth by applicable Canadian corporate laws.

7. AUDIT

As an impartial and independent assurance activity, Orion Transact Inc.'s internal audit function enhances business operations and aids in the accomplishment of strategic goals. An organized method for assessing and enhancing the efficiency of the organization's governance, internal control, and risk management procedures is offered by the internal audit process.

The Internal Auditor is in charge of managing the company's internal audit operations and occupies the highest position within the organization. When internal audit services are rendered by an outside service provider, the internal auditor is in charge of overseeing the engagement's follow-up activities, managing the service contract, and guaranteeing the caliber of the audit work.

It is the duty of the Board of Directors to recommend the appointment of external auditors and, if required, to remove them. At the annual or special meetings, the Board's recommendation should be put forward for shareholder approval. For efficient oversight, management should support coordination between internal and external auditors.

Regular coordination meetings between internal and external auditors are necessary to guarantee smooth audit procedures. These gatherings make it easier to share information, including audit reports, management letters, and a shared vocabulary, approach, and technique for audits. This partnership promotes openness in the business's operations and increases the audit process's overall efficacy.

A successful external audit on behalf of the shareholders should be made possible by the way audit fees are set up. Cost-cutting strategies shouldn't sacrifice the integrity or quality of the auditing process. Cost considerations should not affect the objectivity of external auditors, nor should they lower audit standards in order to achieve financial goals.

Even though auditors may work in corporate finance or management consulting, it is important that these pursuits do not compromise their independence in carrying out their primary audit duties. The company should not hire an external auditor or any associated firm to conduct internal audit services in order to maintain the audit's objectivity.

An Audit Committee or an external audit company may be assigned by the Board to oversee the internal audit function and receive internal audit reports, as long as the organization is qualified and able to guarantee independence and efficacy.

Giving the Board independent assurance on the application, functionality, and efficacy of internal controls and risk management procedures is the responsibility of the internal audit function. The Board of Directors must regularly and freely be accessible to internal audit in order to guarantee that important issues are brought to their attention and dealt with quickly.

The highest standards of professional and business ethics are expected of the auditors the company hires. Their autonomy must be preserved and should never be jeopardized.

8. REPORTING AND DISCLOSURE

Orion Transact Inc.'s Board of Directors is in charge of making sure the company complies with all applicable regulations, including those pertaining to reporting and disclosure under Canadian law, and that all disclosures are transparent to stakeholders, including shareholders and regulators.

The Board will make sure that any report mandated by FINTRAC and PCMLTFA contains a clear acknowledgement of the Directors' internal control responsibilities as part of its dedication to transparency. The report will also outline the procedures and methods used to carry out these duties. This includes a thorough explanation of how the Board has set up its internal control framework to guarantee asset protection, regulatory compliance, and the accuracy of financial reporting.

The disclosure of internal control methods should, at a minimum, address the following elements:

- Systems and Processes: A description of the systems and processes that the Company has in place to implement, maintain, and monitor internal controls. This includes an overview of the Company’s compliance procedures, risk assessment models, and monitoring mechanisms, ensuring the effectiveness of these controls over time.

- Assurance of Effectiveness: The methods used by the Board to derive assurance that internal control systems are effective. This could involve independent reviews, audits, and evaluations of the Company's internal processes, as well as reports from management on the performance and reliability of these systems.

- Internal Audit Function: A statement on the existence or absence of an internal audit function within the Company. If no internal audit function exists, the Board should provide information on the frequency of internal control reviews or the necessity of establishing an internal audit department. The Board should also disclose the date of the last review conducted.

- Significant Enterprise Areas: Identification of any significant business areas not covered by the Company’s internal control systems. This includes joint ventures, subsidiaries, and associates, as well as any other operations that might fall outside the direct scope of internal audits.

Additionally, the Board is responsible for making disclosures regarding the Company’s risk management practices. The disclosure on risk management shall, at a minimum, cover the following elements:

- Right to Dividends:

- Risk Identification and Management: An overview of the structures and processes in place for identifying and managing risks within the Company. This includes the Company's risk assessment framework, identification of potential financial, operational, and compliance-related risks, and mitigation strategies.

- Integration of Internal Control and Risk Management: A description of how internal control processes and risk management systems are integrated within the Company. This includes how both functions work in tandem to ensure the Company’s operations remain compliant, efficient, and secure.

- Assurance on Risk Management: The methods by which the Board derives assurance that the risk management processes are in place and operating effectively. This could include internal audits, external reviews, and reporting from management.

- Key Risks and Management Strategies: A brief description of each of the key risks identified by the Company, including any emerging risks, and the specific methods used to manage and mitigate each of these risks. This could cover areas such as market risk, compliance risk, operational risk, and cybersecurity threats.

9. CODE OF ETHICS

The fundamental values, standards, and principles that Orion Transact Inc. maintains in its corporate culture are described in the Code of Ethics, which serves as a guide for all internal and external interactions and activities.

The company is dedicated to operating with the highest moral standards, making sure that choices and actions are founded on accountability, transparency, and integrity. Treating stakeholders and employees fairly and with dignity promotes moral decision-making at all levels.

The company's operations revolve around integrity, which calls for everyone to conduct themselves with honesty and equity. Employees must accept accountability for their actions, and ethical transgressions must be promptly remedied. The company makes sure that business operations are completely in line with legal requirements by adhering to all applicable laws and regulations, including those issued by FINTRAC and PCMLTFA.

Maintaining confidentiality is essential, and everyone must adhere to PIPEDA and other applicable data protection laws when safeguarding sensitive information, such as client information and intellectual property. Fair treatment is encouraged by the company, which forbids harassment and discrimination and guarantees equal opportunities for all workers.