Anti-Fraud, Anti-Money-Laundering, Sanctions and Source-of-Funds Policy

6membership maintains proportionate controls to protect applicants, members, payers, staff, payment providers, affiliated organisations and the integrity of the membership system.

The controls are intended to reduce fraud, impersonation, stolen payment use, laundering of criminal proceeds, refund abuse, sanctions evasion, terrorist financing and other unlawful activity.

The existence of a review does not by itself mean that a person has committed an offence.

6membership does not accept deposits for safekeeping, maintain withdrawable balances, transmit money between users or provide currency exchange.

A membership fee is connected to the identified application, membership period or expressly documented service for which it was paid.

A payer cannot deposit money into 6membership for later withdrawal, transfer, resale or conversion.

This Policy does not state that 6membership is automatically regulated as a bank, financial institution or designated non-financial business or profession.

Legal classification depends on the activities performed, applicable legislation, regulatory designation and competent-authority interpretation.

Where 6membership becomes subject to registration, customer-due-diligence, reporting, programme, training or other statutory obligations, the required controls will be implemented.

6membership will not rely on the name or presentation of a membership service to avoid an obligation that applies to its actual activity.

A future investment, financing, custody, transfer, virtual-asset or other regulated activity must not be launched through the membership platform without the required legal and regulatory assessment.

This Policy must be read with the payment, identity, privacy, card-verification, security, acceptable-use and authority-request policies.

Where an investigation affects a refund, the refund remains governed by the Payments, Taxes, Refunds, Chargebacks and Renewals Policy subject to lawful compliance restrictions.

Money laundering generally concerns conduct intended to conceal, disguise, convert, transfer, acquire, possess, use or otherwise deal with funds or property connected with unlawful activity.

The conduct may involve several transactions, persons, countries, companies, payment methods or apparently legitimate services.

Fraud includes intentional deception, false representation, concealment, impersonation, forged evidence, unauthorised payment use or dishonest conduct intended to obtain a payment, refund, membership, opportunity or other benefit.

Terrorist financing includes collecting, providing, moving or making funds, property, facilities or economic resources available for prohibited terrorist purposes, persons, entities or activities.

Funds used for prohibited financing may originate from lawful or unlawful sources.

Proliferation-financing risk concerns funds or financial services connected with prohibited development, acquisition, possession, transport, transfer or use of weapons of mass destruction and related materials or technology.

Sanctions are legal restrictions imposed by a competent government, international body or authorised sanctions authority.

They may restrict transactions, services, property, economic resources, travel or dealings involving designated countries, territories, persons, entities, vessels, organisations or activities.

Source of funds means the activity, account, transaction or event from which the particular money used for an application, payment, investment or refund originated.

Examples may include employment income, business revenue, savings, sale proceeds, investment proceeds, inheritance, a lawful gift or authorised organisational funds.

Source of wealth means the broader origin of a person’s or beneficial owner’s overall financial position or accumulated assets.

It may be relevant to a substantial investment, strategic relationship, unusually high-value payment or other enhanced review.

A beneficial owner is the natural person who ultimately owns, controls or benefits from a legal entity, arrangement or transaction, or on whose behalf an activity is conducted.

A company name, nominee, intermediary or authorised representative does not replace the need to identify the relevant natural person where identification is legally or reasonably required.

A politically exposed person is a person entrusted with a prominent public function, together with other persons treated as connected under applicable law or risk guidance.

PEP status is a risk factor requiring appropriate assessment and is not an allegation of criminal conduct.

The level of review should reflect the relevant fraud, money-laundering, terrorist-financing, sanctions, payment and reputational risks.

A low-value ordinary application should not automatically receive the same review as a substantial one-time payment, complex entity application or private strategic relationship.

Relevant factors may include the selected tier, payment amount, applicant and payer relationship, country, payment method, entity structure, beneficial ownership, public function, requested refund route, document quality and transaction behaviour.

A single factor does not automatically establish suspicious or unlawful activity.

A lower-risk application may require ordinary identity, contact, payment and application verification.

Reduced review must not remove a control required by law or necessary to prevent a clearly identified risk.

Standard review may confirm the applicant, payer, payment reference, application purpose, selected tier and any predecessor membership.

It may also compare the payment information with the application and existing records.

Enhanced review may be used for a higher-value payment, complex entity, private relationship, unexplained third-party payer, unusual refund request, sanctions concern, PEP connection or other elevated risk.

The additional information requested must remain proportionate to the identified concern.

An application may begin as lower risk and later require enhanced review if new information appears.

A previously elevated concern may also be resolved through reliable evidence and human review.

Risk assessment must not be based solely on race, ethnicity, religion, disability, lawful political opinion, gender or another protected characteristic.

Country, public function and geographic information may be considered only where relevant to lawful sanctions, payment, fraud or financial-crime risk.

A person must not pay, invest, subscribe or otherwise deal through 6membership using funds or property known or reasonably suspected to represent proceeds of unlawful activity.

A person must not split, rotate, redirect or structure payments and refunds to disguise the origin, ownership, destination or purpose of funds.

Multiple small transactions must not be used to avoid an applicable review or reporting threshold.

6membership must not be used to receive money from one person and return it to another person without a genuine membership or documented commercial purpose.

A payer must not create an application solely to obtain a refund to a different destination.

A person must not use a stolen card, compromised account, unauthorised wallet or another person’s payment method without lawful permission.

A person must not conceal identity, ownership, country, control or transaction purpose to evade an applicable sanction or restriction.

The use of an intermediary, nominee or unrelated payer does not make a prohibited transaction permissible.

A person must not use 6membership to provide, collect, move, disguise or make funds or economic resources available for terrorism, terrorist organisations, prohibited weapons activity or another unlawful purpose.

A person must not offer a payment, gift, commission, benefit or favour to obtain unlawful approval, avoid verification, alter a decision or influence an administrator improperly.

An administrator must not request payment to a personal account in exchange for approval or faster review.

A person must not request a refund after the payment has already been reversed, refunded or successfully charged back.

False evidence must not be submitted to obtain duplicate reimbursement.

The applicant must provide accurate identifying and contact information appropriate to the selected membership.

The applicant must not use a false, stolen, synthetic or impersonated identity.

6membership may receive the payer’s name, email, Flutterwave transaction identifier or reference, amount, currency, payment-method category, transaction status and other limited payment or risk information made available through the authorised integration.

A browser redirect, screenshot, debit alert, applicant statement or unverified webhook payload does not by itself establish that payment succeeded.

Before an application enters substantive review or membership value is granted, server-side verification should confirm the final transaction status, expected amount, expected currency, transaction reference and the relationship between the payer, customer and application.

Incoming Flutterwave webhooks must be authenticated using the configured signature mechanism. Repeated webhook deliveries and retried payment or refund requests must be processed idempotently so that one transaction cannot create duplicate approvals, receipts, memberships or refunds.

Flutterwave API credentials, secret keys, encryption material and webhook secrets must remain in approved server-side configuration and must not be exposed in browser code, public repositories, policy pages, email or administrator messages.

Additional payer verification may be requested where the payment does not reasonably align with the application.

A third party may pay for an applicant where the payment is authorised and lawful.

6membership may request the payer’s relationship to the applicant, reason for payment and evidence of authority.

The third-party payer does not automatically become the member or obtain control over the membership.

A person applying or paying for a company, organisation or other entity must be authorised to act for that entity.

Evidence may include position, corporate authority, board authority, signatory authority or another reliable record.

A mismatch between the applicant, payer, cardholder, account holder, representative or entity may require clarification.

A mismatch does not automatically prove fraud, but an unresolved material mismatch may prevent review, activation or refund redirection.

Identity evidence may be requested through the approved private submission process.

The requester must not send passwords, payment PINs, complete card credentials or email OTPs.

For an entity, investor, strategic partner or substantial payment, 6membership may seek to identify the natural persons who ultimately own, control or benefit from the relationship.

The review may also identify persons who exercise effective control without holding the largest formal ownership percentage.

Information may include legal name, registration details, ownership structure, directors, trustees, partners, controlling persons, authorised signatories and beneficial owners.

A structure chart or supporting corporate record may be requested where ownership is not clear.

A nominee, agent, consultant, lawyer, accountant or intermediary must not be used to conceal the person who owns, controls or benefits from the relationship.

Use of a legitimate professional representative is permitted where the representative’s authority and the underlying party are appropriately disclosed.

An unnecessarily complex ownership or payment structure may require an explanation of its lawful purpose.

Complexity alone is not unlawful, but unexplained complexity combined with other risk indicators may require enhanced review.

A material change in ownership, control, authorised signatories or primary representation must be disclosed where it affects an active entity or private membership relationship.

Re-verification may be required before payments, refunds, benefits or communications continue.

6membership may decline or pause a high-value or entity relationship where beneficial ownership cannot be reasonably established.

A payment must not be accepted merely because a company exists on a public registry where the persons controlling the relationship remain concealed.

Source-of-funds information may be requested for a substantial, unusual, mismatched, third-party, one-time, private-tier or otherwise elevated-risk transaction.

It may also be requested where the payment appears inconsistent with the applicant’s explanation or stated relationship.

A lawful source may include employment income, business revenue, personal savings, sale proceeds, investment income, inheritance, a lawful gift, loan proceeds or authorised organisational funds.

The relevant question is whether the particular funds used can be reasonably connected to a lawful source and authorised payer.

Evidence may include a limited bank statement, payslip, audited account, sale agreement, investment statement, inheritance record, loan agreement, gift declaration or another reliable document.

Only information reasonably necessary to understand the transaction should be requested.

An applicant may be permitted to obscure unrelated transactions, account numbers or private details where the remaining document still supports the required check.

A redaction must not hide the payer, relevant amount, source, ownership, date or another material fact.

A lawful gift or sponsored payment may require identification of the donor or sponsor, relationship, authority and reason for payment.

A gift must not be used to conceal the actual payer, create a false refund route or avoid sanctions and financial-crime controls.

Where funds are described as a loan, 6membership may request enough information to understand the lender, borrower, relationship and lawful purpose.

6membership does not assess the commercial suitability of the loan unless a separate relationship requires that assessment.

A transaction may be refused, restricted or returned where the source of funds remains materially unexplained.

Funds must not be redirected to a different person merely because the applicant cannot establish their origin.

Source-of-wealth information may be relevant to a substantial one-time payment, private 6clement Joshua relationship, investment, strategic partnership or another significant commercial arrangement.

It is not ordinarily required for every ordinary membership application.

Possible sources may include business ownership, employment, professional earnings, investments, property, inheritance, intellectual property or another lawful economic activity.

Evidence may include business records, audited accounts, investment records, sale documents, public filings or a professionally supported explanation.

The review must not demand an applicant’s entire financial history where a narrower record sufficiently addresses the risk.

The initial request for private 6clement Joshua consideration does not require immediate payment.

Where the relationship later involves investment, financing, equity, major commercial value or another separate agreement, source-of-wealth and source-of-funds review may form part of formal due diligence.

Providing financial evidence does not guarantee investment acceptance, partnership, equity, board rights, approval or private-tier onboarding.

The evidence addresses due-diligence requirements and does not replace a separate commercial decision.

A substantial transaction is not automatically suspicious merely because of its value.

Higher value can nevertheless increase fraud, sanctions, ownership, source-of-funds and refund risks and may justify stronger review.

Relevant factors may include the amount, currency, Flutterwave payment route, payer location, applicant location, timing, frequency, relationship, prior history, selected tier and requested refund destination.

A person must not divide one intended payment into several transactions to avoid a provider control, legal threshold or enhanced review.

Legitimate instalment or multi-payment arrangements must be expressly approved and connected to the same documented purpose.

6membership does not intentionally accept unexplained overpayments.

A payer who sends more than the required amount may be asked to explain the error and verify the original payment source.

Any return should ordinarily follow the original payment route rather than a new destination.

A high-value payment followed quickly by a request to refund another person, account, country, wallet or currency may require enhanced review.

The review protects both the legitimate payer and 6membership from artificial transaction cycling.

Payments across several applications that share applicants, payers, entities, devices or refund destinations may be reviewed together.

Related applications are not automatically improper, but their legitimate purpose may need to be established.

A person is not accused of corruption, fraud or another offence merely because they hold or previously held a prominent public function.

PEP status may require enhanced review because of the nature and influence associated with the role.

Applicable law or risk guidance may extend relevant review to close family members, known close associates, beneficial owners or entities connected with a PEP.

The connection must be assessed carefully and must not be inferred from an unrelated shared name.

Review may consider the public function, country, duration, relationship, payment purpose, beneficial ownership, source of funds and source of wealth.

Reliable public records and information supplied by the applicant may be considered.

A higher-risk PEP relationship may require review or approval by an appropriately authorised senior person before acceptance or continuation.

The reviewer must consider the actual risk rather than applying automatic denial.

A significant PEP, investor or strategic relationship may be reviewed periodically where appropriate.

Review may continue for a proportionate period after the public function ends where residual risk remains relevant.

PEP information must be handled securely and must not be published merely because enhanced review occurred.

Public office information may be publicly available, but internal risk assessments and private financial evidence remain protected.

6membership will not knowingly provide a prohibited service or make funds or economic resources available in breach of an applicable binding sanction.

Applicable restrictions may arise from Nigerian law, a competent authority, Flutterwave’s or another participating financial institution’s lawful obligations, or another legal regime governing the transaction.

Where appropriate, applicants, payers, beneficial owners, controlling persons, representatives or entities may be checked against authoritative sanctions information.

Screening may be completed directly or through an approved payment, identity or risk provider.

A name match does not automatically prove that the applicant is the designated person.

A potential match may require comparison of date of birth, nationality, location, entity details, aliases and other distinguishing information.

A person must not misspell a name, use a nominee, conceal ownership, route payment through another country or use an unrelated payer to avoid an applicable restriction.

A potentially prohibited application, payment, refund or benefit may be paused while the match and applicable law are assessed.

Where a transaction is prohibited, 6membership may refuse, block, freeze, preserve or report it to the extent required or permitted by law and subject to the capabilities and restrictions of Flutterwave and the relevant financial institution.

A refund cannot be completed where Flutterwave, the relevant financial institution or applicable law prohibits movement of the funds.

The funds must not be redirected to an alternative person merely to bypass the restriction.

A restriction does not transfer ownership of the money to 6membership unless a lawful process determines otherwise.

Sanctions designations, licences, exemptions and restrictions may change.

A relationship may be re-evaluated where authoritative information changes or an applicable licence is issued, amended or withdrawn.

A person must not use 6membership to collect, provide, make available or disguise funds, property, services or economic resources for a prohibited terrorist purpose, person, group or activity.

Funds do not need to originate from crime to create terrorist-financing risk.

Lawfully earned money may become prohibited where it is intentionally collected, provided or made available for an unlawful terrorist purpose.

Describing a payment as charity, sponsorship, empowerment or humanitarian support does not remove the need to understand its actual destination and purpose.

6membership will not knowingly route funds to an undisclosed beneficiary through a membership or refund process.

6membership must not be used to support prohibited procurement, transfer, financing or facilitation connected with weapons of mass destruction or restricted related materials and technology.

A credible terrorist-financing or proliferation-financing concern may require immediate restriction, evidence preservation, provider notification and lawful authority escalation.

Information may be withheld from the affected person where disclosure would violate law or compromise an investigation.

An indicator is a reason to examine the activity more closely and is not automatic proof of money laundering, fraud or another offence.

Several weak indicators may become significant when considered together.

Identity indicators may require clarification, replacement evidence or enhanced review.

A Flutterwave fraud alert, chargeback notice, transaction restriction or other verified provider risk signal may also require investigation.

Refund controls must still preserve the legitimate payer’s lawful rights.

Legitimate international and complex organisations should receive a fair opportunity to explain their structure.

Difficult behaviour alone does not establish financial crime, but conduct intended to evade verification may increase risk.

Enhanced review may apply to high-value payments, unusual transactions, PEP relationships, sanctions concerns, complex ownership, private-tier relationships, source-of-funds concerns or repeated suspicious indicators.

Additional information may concern identity, payer authority, beneficial ownership, business purpose, source of funds, source of wealth, transaction destination and expected relationship.

The request must remain relevant to the identified risk.

6membership may compare information with reliable public records, company registries, verified Flutterwave transaction information, authoritative sanctions information and other lawful sources.

Public information must not automatically be treated as correct where credible contradictory evidence exists.

A substantial, private, PEP, sanctions-sensitive or otherwise elevated relationship may require approval from an appropriately authorised senior reviewer.

The reviewer should receive enough information to understand the risk and decision without receiving unrelated personal information.

A relationship may be accepted subject to documented conditions, payment-route limits, periodic updates, additional approvals or restricted benefits.

Conditions must be lawful, understandable and connected to the identified risk.

A significant or higher-risk relationship may be reviewed periodically or when a material event occurs.

Material events may include ownership change, new payment source, sanctions development, public-office change, chargeback pattern or change in the purpose of the relationship.

A final material decision should consider reliable evidence and the person’s explanation where appropriate.

A database, automated risk score or provider flag should not be treated as infallible.

An application, payment, refund, card issuance or benefit may be paused while material concerns are investigated.

A pause should continue only for a reasonable period or as required by law, a Flutterwave or financial-institution restriction, or an authority process.

The affected person may be asked to supply clarification or evidence within a stated period.

The request may omit details that would reveal confidential fraud methods, sanctions controls or a prohibited investigation.

6membership may decline a payment where ownership, authority, source, legality or independent Flutterwave verification cannot be established sufficiently.

Declining a payment does not itself determine that the payer committed a criminal offence.

An application may be denied where financial-crime, identity, sanctions or payment concerns make the relationship unlawful or unacceptably risky.

Any eligible refund remains subject to the payment and compliance provisions governing the original transaction.

An approved membership may be suspended or revoked where it was obtained through fraud, funded through unauthorised payment, transferred unlawfully or used for prohibited financial activity.

The current card or Membership ID may be marked restricted, invalid or revoked.

Where funds may lawfully be returned, the payment should ordinarily be returned through Flutterwave to the original payment method or original provider-supported route.

6membership must not return funds to a different person merely because the applicant requests it.

Suspicion, denial or compliance review does not automatically make disputed funds the property of 6membership.

The funds must be refunded, reversed, restricted, preserved or otherwise handled according to payment ownership, the verified Flutterwave and financial-institution outcome, and applicable law.

Where 6membership is legally classified as a reporting entity or receives a valid regulatory direction, it will submit the reports and information required by applicable law.

This Policy does not invent a statutory reporting duty where one does not apply.

Even where a particular statutory transaction-reporting duty does not apply, 6membership may report suspected fraud, identity theft, stolen payment use, threats or other apparent crime to Flutterwave, an affected financial institution or a competent authority where permitted or required.

Relevant information may be supplied to Flutterwave and, where appropriate, the affected bank, card issuer, wallet provider or payment network to investigate unauthorised payments, chargebacks, refund abuse, transaction restrictions and fraud alerts.

The information disclosed should be limited to what is reasonably necessary for the identified transaction, dispute, compliance review or legal purpose.

6membership may retain the resulting provider reference, verified status, dispute event and response needed to preserve the payment and audit history.

A court, regulator, law-enforcement body or other competent authority may request records or preservation.

6membership may assess the authenticity, jurisdiction, legal basis, scope and proportionality of the request.

Where law prohibits disclosure of a report, investigation or restriction, 6membership may be unable to explain every reason or action to the affected person.

A restricted explanation must not be used casually to conceal an ordinary administrative error.

An employee or representative must not unlawfully warn a person about a protected report, authority action or investigation where doing so is prohibited.

A person must not destroy, alter, remove or conceal relevant records after receiving a lawful preservation instruction.

Immediate protective action may be taken where there is a credible risk of serious fraud, theft, prohibited financing, dissipation of funds or other urgent harm.

The action must remain proportionate and subject to applicable law.

A refund ordinarily returns through Flutterwave to the original payment method or original provider-supported destination.

This reduces the risk that a stolen or illicit payment is converted into funds for another person.

Where a third party made the payment, the refund ordinarily returns to the third party’s original method rather than to the applicant.

The applicant cannot ordinarily redirect the payer’s funds.

A refund may be paused while payment ownership, sanctions, fraud, chargeback, Flutterwave restrictions or legal restrictions are investigated.

The pause does not automatically cancel an otherwise valid refund right.

An internal approval must remain distinct from submission to Flutterwave, Flutterwave processing and the final verified refund outcome.

A refund must not be described as initiated merely because an administrator approved it internally.

It may be described as submitted only after Flutterwave accepts the refund API request and returns a provider refund reference.

Flutterwave refund states may progress from new to pending and then to succeeded or failed. The public-facing status must reflect the latest independently verified provider state rather than a browser response, administrator assumption or stale webhook.

A refund must not be described as completed until the verified Flutterwave status confirms success. The payer’s bank or wallet may still require additional posting time after provider completion.

Refund creation and retried refund requests must use idempotency controls so the same payment cannot be refunded more than once accidentally.

A direct refund may be paused while a chargeback concerning the same payment is pending.

The same transaction must not be reimbursed twice.

A genuine unauthorised-payment claim remains subject to Flutterwave’s, the issuing institution’s or the payment network’s dispute process and applicable law.

An alternative refund destination may be considered only where the original method is unavailable and ownership, identity, provider and legal requirements have been satisfied.

Cash, cryptocurrency, gift cards and unrelated third-party accounts will not ordinarily be used as substitute refund destinations.

Financial-crime controls must not be used as a blanket excuse to deny a lawful consumer refund.

Where immediate payment is legally restricted, the affected person will receive the information that may lawfully be provided about the status and available complaint route.

Relevant records may include applicant and payer identity, beneficial ownership, payment references, source-of-funds evidence, source-of-wealth evidence, screening results, risk assessments, requests for information, restrictions, decisions and authority communications.

Compliance information may be used for fraud prevention, application decisions, payment handling, legal obligations, security, audits, complaints and claims.

It must not be used for unrelated advertising or public humiliation.

Access should be limited to authorised application, payment, compliance, security, legal or senior personnel whose role requires the information.

A general website or marketing administrator should not automatically receive access to source-of-funds documents.

Identity and financial evidence should remain in private storage and be transmitted through approved secure channels.

Temporary access links should expire.

Records may be retained for the period reasonably necessary for verification, payment disputes, fraud prevention, legal obligations, authority requests, audits and claims.

A legal hold or investigation may temporarily override an ordinary deletion schedule.

Applicable privacy rights may include access, correction, deletion, restriction and objection.

A response may be limited where disclosure would reveal confidential fraud controls, another person’s information, a protected report, legal privilege or an investigation restriction.

A person may provide evidence that a screening match, ownership record, payment indicator or other compliance record is inaccurate.

Where an error is established, the relevant record and decision should be corrected while preserving an appropriate audit history.

Where reasonably practical, the person who submits or reviews an application should not have unlimited authority to approve the application, redirect a refund, delete evidence and alter audit records without oversight.

Application reviewers, verification administrators, payment reviewers and senior administrators should receive permissions appropriate to their roles.

Privileged actions should be logged.

An administrator, employee or representative must not instruct an applicant to send an official membership payment to a personal bank account, personal wallet, private cryptocurrency address or unofficial payment link.

Approved payments must use the authorised checkout or official documented route.

An administrator must not request or accept money, gifts, favours or private benefits to bypass verification, approve an application, conceal a match or alter a refund.

A reviewer should disclose a personal, family, business or financial interest that could impair objective handling of a material application or investigation.

The matter may be reassigned where appropriate.

Personnel handling relevant applications, payments, refunds or private relationships should receive proportionate instruction concerning fraud indicators, privacy, sanctions, prohibited payment requests and escalation procedures.

6membership may periodically review whether payment verification, refund routing, access controls, audit logs and escalation procedures operate as intended.

Material weaknesses should be corrected and documented.

Suspected theft, bribery, unauthorised access, record alteration, payment diversion or disclosure of private evidence should be reported promptly through an authorised administrative or security channel.

Where lawful and appropriate, an applicant may receive a general explanation that an application, payment or refund requires additional verification or could not proceed.

6membership may withhold details that would reveal confidential controls, enable evasion, expose another person or violate a legal restriction.

A person may submit evidence that their identity, payer relationship, ownership, sanctions match, PEP status or source information was recorded incorrectly.

Reliable corrections should be considered through an appropriate human review.

An internal risk review, provider alert or application refusal will not ordinarily be published as an accusation of criminal conduct.

Public verification may show that a Membership ID is restricted or invalid without displaying confidential financial-crime allegations.

An affected applicant, payer or member may complain about an incorrect payment restriction, identity finding, refund delay or other administrative outcome.

The complaint should identify the Application Reference, Membership ID or transaction reference and provide the relevant evidence.

Nothing in this Policy removes a mandatory right to contact Flutterwave, a bank, card issuer, payment network, consumer authority, privacy regulator, law-enforcement body, court or other competent authority.

6membership may update this Policy to reflect changes in applicable law, regulatory classification, sanctions requirements, providers, payment methods, risk controls or business activities.

A policy update will not be used retrospectively to legitimise unlawful processing or remove a mandatory right.