AUSTRAC directs audit of payment platform over AML/CTF concerns

Page 1 of 5 NOTICE TO APPOINT AN EXTERNAL AUDITOR TO CONDUCT COMPLIANCE AUDIT SUBSECTION 162(2) ANTI-MONEY LAUNDERING AND COUNTER-TERRORISM FINANCING ACT 2006 TO: MHITS Limited Level 1 Melbourne Building 43-45 Northbourne Avenue CITY ACT 2601 Attention: The Proper Officer

1. I, Bradley Brown, National Manager, Regulatory Operations of the Australian Transaction Reports and Analysis Centre (AUSTRAC), as delegate of the Chief Executive Officer of AUSTRAC (the AUSTRAC CEO), have reasonable grounds to suspect that MHITS Limited (MHITS) is a reporting entity as referred to in section 5 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act), has contravened sections 36 and 81 of the AML/CTF Act as in force during the period 1 January 2024 to 30 March 2026.
2. Pursuant to subsection 162(2) of the AML/CTF Act, as delegate of the AUSTRAC CEO, I require MHITS to appoint (the external auditor), arrange for the external auditor to carry out an external audit of one or more specified aspects of MHITS’ compliance with the AML/CTF Act, AML/CTF Regulations and the AML/CTF Rules and provide a copy of the audit report to AUSTRAC in accordance with paragraphs [3] – [9] of this Notice and the Schedule. Requirements under section 162(2)(b) of the AML/CTF Act Within 14 days of the date AUSTRAC has authorised a Nominated Individual under section 164 of the AML/CTF Act, MHITS must:
3. Engage the external auditor to conduct an audit covering the matters specified in the Schedule to this Notice including giving a written report (the audit report) to MHITS. Within 180 days of the external auditor being engaged, MHITS must:
4. Give the AUSTRAC CEO a copy of the audit report setting out the external auditor’s findings. The matters to be covered by the audit:
5. The audit must cover the matters set out in the Schedule to this Notice. The form of the audit report:
6. The audit report must be in a form that:

Page 3 of 5 Schedule Definitions The following definitions apply to this schedule. AML/CTF Act means the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 as in force during the Relevant Period. AML/CTF Rules 2007 means the Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) as in force during the Relevant Period. Part A Program means Part A of: • a standard anti-money laundering and counter-terrorism program as defined in subsection 84(2) of the AML/CTF Act. Program means: • a standard anti-money laundering and counter-terrorism program as defined in subsection 84(1) of the AML/CTF Act. Relevant Period means the period 1 January 2024 to 30 March 2026. Sampling expectations:

1. The external auditor must determine sample sizes that are appropriate to the nature, size, complexity, and ML/TF risk of MHITS’ operations.
2. Sampling must ensure coverage across all relevant channels, product types, and risk levels. The audit must use a methodology that allows for: a. Representative sampling based on transaction volume, customer base, and risk profile b. Risk-based stratification where appropriate (e.g., high-risk corridors, SMR-linked customers, PEPs) c. Justification of how the samples were selected in the context of the audit scope Details to be included in the audit report:
3. The audit report must contain details of: a. The external auditor’s assessment of the matters set out in the Schedule. b. The facts on which the external auditor has relied to make the assessment identified in paragraph [3a]. c. Any measures which the external auditor believes MHITS should implement to ensure that it complies with the AML/CTF Act and the AML/CTF Rules 2007. d. The capacity of MHITS to implement the measures set out in paragraph [3.C]. e. The report must outline the rationale for the sampling approach, including how the selected samples are representative of MHITS’ business model, delivery channels, and identified AML/CTF risks.

Page 4 of 5 f. AUSTRAC recommends that the findings and insights from the audit report be actively considered as part of MHITS' preparation for the forthcoming reforms to the AML/CTF Act and Rules, scheduled to commence in 2026. The results should inform updates to compliance frameworks, risk assessments, and control measures to ensure compliance with the new AML/CTF regulatory requirements. Matters to be covered by the audit Money Laundering and Terrorism Financing Risk Assessment 4. Whether MHITS has during the Relevant Period complied with the requirements of Part 8.1 of the AML/CTF Rules 2007. Transaction Monitoring Program (TMP) 5. Assess whether MHITS’ Part A Program has during the Relevant Period complied with the requirements of paragraphs 15.4, 15.5, 15.6, and 15.7 of the AML/CTF Rules 2007. 6. Evaluate the effectiveness of its TMP, including: a. escalation procedures. b. alert review, prioritisation and typology coverage. c. change management and testing controls. 7. Evaluate the effectiveness of MHITS’ TMP to detect and escalate transactions indicative of the full array of financial crime risks the business is exposed to. The evaluation must cover specific ML/TF risk assessments, financial crime guides, and other AUSTRAC publications and associated red flags and typologies relevant to MHITS. This includes Child Sexual Exploitation risks. 8. When determining MHITS’ compliance with the matters outlined in paragraphs 3, 4 and 5 above, include the methodology for conducting the audit, in addition to sampling and data collection. Suspicious Matter Reporting (SMR) 9. Assess whether MHITS has during the Relevant Period complied with the requirements of section 41 of the AML/CTF Act. a. Evaluate whether MHITS’ processes support timely and risk-based SMR submissions, across all ML/TF risks and crime types it is exposed to. b. Include testing of alerts and case escalations c. Evaluate the timeliness of SMRs. This includes evaluating whether SMRs were initiated independently or in response to queries or notices from AUSTRAC or other Government agencies and identifying patterns that may indicate a reactive rather than proactive compliance posture. d. Review matters that were escalated for review but did not result in SMRs being submitted, including analysis of decision-making processes and documentation to determine whether suspicion should reasonably have been formed under section 41. e. Sample must include SMRs tied to high-risk customers and jurisdictions. Enhanced Customer Due Diligence (ECDD) Program 10. Whether MHITS’ Part A Program has during the Relevant Period complied with the requirements of paragraphs 15.8, 15.9, 15.10 and 15.11 of the AML/CTF Rules 2007.

Page 5 of 5 11. When determining MHITS’ compliance with the matters outlined in paragraph above: a. the methodology for conducting the audit by the external auditor must include sampling and data collection; and b. the external auditor must have regard to how MHITS met its obligations with reference to customers subject to SMRs, PEPs and high-risk corridors to which MHITS was required to apply its ECDD Program during the Relevant period. 12. The audit should assess MHITS’ policies and procedures for off boarding high-risk customers, including those subject to SMRs and must review decision making, consistency and timeliness associated with off boarding decisions. Compliance with ongoing customer due diligence (OCDD) 13. Whether MHITS has complied with section 36 of the AML/CTF Act during the Relevant Period. Governance and Oversight 14. Review the effectiveness of MHITS’ AML/CTF governance during the Relevant Period, in accordance with section 81 of the AML/CTF Act including: a. Internal audit independence and coverage of internal audits b. Board and executive oversight c. Effectiveness of quality assurance over the TMP and prevention and detective controls.