1. About HansePay

HansePay is a trading name of Atrya Technologies SIA, a company registered in the Republic of Latvia (Commercial Register no. 40203731957), with its registered office at Marijas iela 2A, Rīga, LV-1050, Latvia. The HansePay brand is owned by Caplend Technologies GmbH, Hamburg, Germany, which holds 100% of Atrya Technologies SIA. Your contract for the services described in these Terms is with Atrya Technologies SIA only, irrespective of the channel through which you access them.

Atrya Technologies SIA is authorised by Latvijas Banka (Bank of Latvia) as a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114 (MiCAR), licence No. 27-55/2026/26, and is supervised by Latvijas Banka. HansePay enables business clients to settle cross-border payments using MiCAR-compliant electronic money tokens. Euro funding and local-currency payouts are provided by regulated partners under their own authorisations, and identity verification is carried out by specialised service providers on our behalf (see clause 8 and Annex 2 – Partner Services Schedule). Our full authorisation details are set out in our Legal Notice.

2. Services

Atrya provides the following crypto-asset services to eligible business clients:

• Custody and administration of crypto-assets on behalf of clients (Article 3(1)(16)(a) MiCAR): safekeeping of your e-money tokens in a dedicated wallet assigned only to you;
• Exchange of crypto-assets for other crypto-assets (Article 3(1)(16)(d) MiCAR): conversion between supported e-money tokens (for example from a euro token into a US-dollar token) where this is needed to settle a payment you instruct.

Supported crypto-assets: MiCAR-compliant electronic money tokens referencing the euro or the US dollar. The current list is set out in Annex 4 (Supported Assets).

Conversions are executed against Atrya's own liquidity at a rate shown to you before you confirm. Atrya does not operate a trading venue and does not match third-party orders.

What we do not provide: Atrya is not a credit institution, payment institution or electronic money institution. We do not open payment accounts, execute SEPA or SWIFT payments, provide fiat currency exchange or hold client money. We do not offer deposit-taking, lending, or investment services, and we do not give investment advice.

2A. Key risks

Using our services involves risks, including: an e-money token losing its value against the currency it references, or its issuer becoming insolvent; disruption or failure of the blockchain network or of the smart contracts we use; delays or failures at our partners; and changes in law or regulation. Crypto-assets are not covered by a deposit guarantee scheme or an investor compensation scheme. Further details are set out in Annex 1 (Risk Disclosure), which you receive before you start using our services.

3. Eligibility

Business clients only: our services are offered exclusively to business clients (legal persons). We do not currently accept individual (natural-person) clients.

Business accounts: The authorised representative accepting these Terms on behalf of a legal entity confirms that they have authority to bind the entity, that the entity is duly incorporated and in good standing in its jurisdiction, and that the entity is not subject to sanctions or legal restrictions.

4. Account Opening and Identity Verification

We are required by law to verify your identity and, for business accounts, the identity of directors, authorised signatories and beneficial owners (UBOs) before activating your account. This process (Know Your Customer — KYC) involves providing:

• Personal identification documents (passport or national ID) and a biometric check through our identity-verification service providers
• Proof of address
• For businesses: company registration documents, ownership structure, and information about persons with significant control
• Information about the purpose of your account and the source of your funds
• Expected transaction volumes, main counterparties and counterparty countries
• Tax residence and tax identification number (required under Council Directive (EU) 2023/2226, DAC8)
• A declaration whether any director or beneficial owner is a politically exposed person (PEP)

We may request additional documentation at any time to comply with our regulatory obligations. Failure to provide requested information may result in account restriction or closure.

HansePay reserves the right to decline any application without providing reasons, subject to applicable law. Our AML & Compliance Statement explains these checks in more detail.

5. Using Your Account

5.1 Account Security
You are responsible for maintaining the confidentiality of your account credentials. You must notify us immediately at support@hansepay.de if you become aware of any unauthorised access to your account. We will not be liable for losses resulting from your failure to maintain the security of your credentials. We will never ask for your password, full API secret or private keys — report any such request to us immediately.

5.2 Instructions
You authorise Atrya to execute the conversion and transfer instructions submitted through your account. You can transact only with verified, whitelisted counterparties; transfers to unverified external wallets are technically blocked. Euro funding is accepted only from your registered and verified bank account (IBAN). You are responsible for ensuring the accuracy of all payment details including IBAN, account numbers, and beneficiary information. We cannot recover funds sent to incorrect account details.

5.3 Processing Times
On-chain settlement of a conversion is initiated within seconds of your confirmation. The euro funding and the local-currency payout are carried out by our partners under their own terms; their processing times depend on the destination country and the banks involved. We are not responsible for delays caused by third-party financial institutions.

6. Fees

Our prices and fees are published on our website in our Pricing and Fees Policy and are set out in Annex 3 (Fee Schedule) to your contract. Fees may include fixed service charges, percentage-based transaction fees or a spread applied to the exchange rate. The applicable fees, the spread and any network (gas) fees are shown to you before you confirm a transaction. Fees may change on 30 days' notice. Continued use of our services after the effective date of a fee change constitutes acceptance of the new fees.

Completed exchange transactions: we publish information on completed conversions, including the price, volume and date and time of execution, on our website without registration. Each entry is published promptly after execution and remains available until at least midnight of the following business day.

7. Prohibited Activities

You agree not to use HansePay's services for:

• Any activity that is illegal under applicable law, including but not limited to money laundering, tax evasion, fraud, or financing of terrorism
• Transactions involving parties or jurisdictions subject to international sanctions administered by the EU, UN, US (OFAC), or UK
• Transactions with persons established in, or transacting with, jurisdictions on our No-Go list (currently: Russia, Belarus, North Korea, Iran and Myanmar)
• Processing payments on behalf of third parties (money service business activity) without disclosure and our prior written consent
• Gambling, adult entertainment, arms dealing, or other activities that we determine at our sole discretion to present unacceptable risk
• The use of mixers, tumblers or other anonymity-enhancing services
• Any activity that violates any third party's intellectual property rights or privacy

Breach of this section may result in immediate account suspension, reporting to law enforcement, and civil or criminal liability.

8. Custody, Segregation and Partners

Your e-money tokens are held in a dedicated wallet assigned only to you, segregated from Atrya's own assets and from the assets of other clients. Atrya does not use your crypto-assets for its own account. Access keys are protected so that no single party ever holds a complete key.

Atrya does not hold client money. Euro funds are received by our euro funding partner, a regulated electronic money institution, which issues e-money tokens for your wallet and redeems them; local-currency payouts are made by our regulated payout partners. These partners safeguard any funds they hold under their own authorisations. To use these partner services, you may be required to accept the terms of our partner in addition to these Terms. Our current partners are listed in Annex 2 (Partner Services Schedule), which you receive when you open your account; the names are also available on request.

Crypto-assets held with us are not covered by a deposit guarantee scheme or an investor compensation scheme.

9. Liability and Limitation

We will not be liable for:

• Indirect, consequential, or special losses arising from your use of our services
• Losses arising from system outages, third-party payment network failures, or force majeure events
• Losses arising from your provision of incorrect payment details
• Regulatory or compliance actions taken against your account that are required by law

Our aggregate liability to you in any 12-month period shall not exceed the total fees paid by you to HansePay in that period, or €500, whichever is greater.

Nothing in these Terms limits liability for death or personal injury caused by negligence, or for fraud or fraudulent misrepresentation.

10. Intellectual Property

All content on the HansePay platform, including software, design, text, and logos, is the property of Atrya Technologies SIA or its licensors and is protected by copyright, trademark, and other intellectual property laws. You may not reproduce, distribute, or create derivative works without our prior written consent.

11. Suspension and Termination

We may suspend or close your account with notice where:

• You breach these Terms or our Acceptable Use Policy
• We are required to do so by law or regulatory authority
• We reasonably suspect fraudulent, unlawful, or harmful activity
• You fail to provide required identity verification documents

Where we identify a sanctions match, we are legally required to freeze the relevant assets and report to the competent authorities, and we may not be able to notify you in advance.

You may close your account at any time by contacting support@hansepay.de. Following account closure, we will return the crypto-assets we hold for you within a reasonable period, less any amounts owed to us, provided we are not legally restricted from doing so.

12. Amendments

We may update these Terms at any time. We will provide at least 60 days' advance notice for material changes by email and/or a prominent notice on our platform. If you do not agree to the updated Terms, you may close your account before the effective date of the change. Continued use after the effective date constitutes acceptance.

13. Governing Law and Dispute Resolution

These Terms and any dispute arising in connection with them are governed by the laws of the Republic of Latvia, without regard to conflict-of-law principles. Disputes are resolved by the competent courts of the Republic of Latvia; we encourage you to contact us first so that we can try to resolve any dispute amicably. Our services are offered exclusively to business clients. Note under § 36 VSBG: we neither participate in, nor are we obliged to participate in, dispute resolution proceedings before a consumer arbitration board.

In the first instance, please contact us at legal@hansepay.de. See our Complaints Policy for details of our formal complaints process and escalation routes. Complaints are free of charge and can be sent to complaints@hansepay.de; if you remain unsatisfied, you can contact Latvijas Banka, which acts as supervisory authority and does not resolve individual disputes or award compensation.

14. Contact

Atrya Technologies SIA, trading as HansePay
Marijas iela 2A, Rīga, LV-1050, Latvia
legal@hansepay.de · support@hansepay.de

15. Annexes

The following annexes form part of your contract and are provided to you when you open your account:

• Annex 1 – Risk Disclosure (the key risks are also summarised in clause 2A)
• Annex 2 – Partner Services Schedule (names, roles and authorisations of our partners and service providers)
• Annex 3 – Fee Schedule (our prices and fees are also published in our Pricing and Fees Policy)
• Annex 4 – Supported Assets

Copies are available on request at support@hansepay.de.

1. Who we are

2. What personal data we process

3. Where the data comes from

We collect data directly from you or from the company you represent, and from: our identity-verification and screening providers; sanctions, PEP and adverse-media databases; our funding and payout partners when they execute your transactions; public registers (for example commercial and beneficial-ownership registers); and public blockchain data.

4. Why we use your data and our legal basis

Providing the data required for anti-money-laundering purposes is a legal requirement. If you do not provide it, we cannot open or keep your account.

5. Blockchain data

Conversions are executed on a public blockchain. Transactions and wallet addresses recorded on a public blockchain are visible to anyone and cannot be altered or deleted. We never write names or other directly identifying data to the blockchain, but a wallet address can become personal data when combined with information we hold. Because on-chain records are immutable, the rights to erasure and rectification can only be applied to the data we hold off-chain.

6. Automated decisions

We use automated tools for identity verification, sanctions and PEP screening and transaction monitoring. Where an outcome could significantly affect you — for example refusing onboarding, blocking a transaction or ending the relationship — a member of our compliance team reviews it before it takes effect. We ask for your consent before the identity-verification step begins. You can ask us to explain the decision, give your point of view and contest it by writing to dpo@hansepay.de. Where anti-money-laundering law prohibits us from disclosing the reasons, we will tell you that we cannot give them.

7. Who we share data with

7.1 Service providers acting on our behalf

7.2 Recipients acting as independent controllers

• Our euro funding partner, a regulated electronic money institution in the Netherlands — euro funding, vIBAN, and issuance and redemption of e-money tokens.
• Our payout partners, regulated payment providers inside and outside the European Economic Area (including the United States) — local-currency payouts to recipient bank accounts.
• Embedded (B2B2B) partners — where we provide back-end settlement services to a regulated partner that has its own client relationship.
• Recipients' banks, payment service providers and crypto-asset service providers — payment instructions and the originator and beneficiary information required by the Travel Rule.
• Authorities — Latvijas Banka, the Financial Intelligence Unit of Latvia, the State Revenue Service, courts and law-enforcement authorities, where the law requires.
• Professional advisers and auditors, under confidentiality obligations.
• A buyer or successor in a merger, acquisition or sale of all or part of our business, under confidentiality protections.

Our current funding and payout partners are named in Annex 2 (Partner Services Schedule) to our Terms of Service, which we provide to clients. You can also ask us for the names of the recipients of your data at dpo@hansepay.de. We do not sell your personal data and do not share it for third-party advertising.

8. International transfers

Most data is processed in the European Economic Area. Where data leaves the EEA, it is protected as follows:

You can ask our Data Protection Officer for a copy of the relevant safeguards.

9. How long we keep data

When the retention period expires, we delete or anonymise the data securely.

10. How we protect data

We use encryption in transit and at rest, least-privilege access controls, multi-factor authentication, MPC controls for crypto-asset custody, network and vulnerability monitoring, logging and staff training. If a personal-data breach is likely to put your rights at risk, we will notify you and the Latvian Data State Inspectorate without undue delay.

11. Your rights

Under the GDPR you have the right to: access your data (Art. 15); rectification (Art. 16); erasure, unless we must keep the data, for example under AML law (Art. 17); restriction (Art. 18); data portability (Art. 20); object at any time to processing based on legitimate interests, including direct marketing (Art. 21); withdraw consent at any time, without affecting earlier processing (Art. 7(3)); and not to be subject to a solely automated decision with significant effects (Art. 22).

To exercise your rights, write to dpo@hansepay.de. We respond within one month; this can be extended by up to two further months for complex requests, in which case we will tell you why. We may need to verify your identity first.

12. Complaints to a supervisory authority

Please contact our Data Protection Officer first so we can try to resolve your concern. You may also lodge a complaint with a data-protection supervisory authority, in particular in the EU country where you live or work or where the alleged infringement took place. Our lead authority is Datu valsts inspekcija (Data State Inspectorate), Elijas iela 17, Rīga, LV-1050, Latvia — www.dvi.gov.lv · pasts@dvi.gov.lv. In Germany, you can contact the data-protection authority of your federal state, for example in Hamburg the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI).

13. Cookies and similar technologies

We use cookies and similar technologies on our website. Website analytics with Google Analytics 4 runs only with your consent; our own basic page-view statistics use no cookies and do not store your IP address; embedded content such as our interactive product demo may set cookies. You can give, refuse or withdraw your consent at any time through the cookie banner. Details of each cookie, its purpose and retention period are in our Cookie Policy, available through the cookie banner and the website footer.

14. Changes to this Policy

We update this Policy when our processing changes. The current version is always available on our website; previous versions are available on request. We will tell you about material changes by e-mail or through the Platform before they take effect.

1. What cookies and similar technologies are

Cookies are small text files stored on your device when you visit a website. Similar technologies include local storage, session storage, pixels and scripts that read information from your device. In this Policy, “cookies” covers all of them.

2. Legal basis

2.1 Access to your device: Storing or reading information on your device is permitted only where it is strictly necessary to provide a service you have explicitly requested (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG), or with your consent (§ 25(1) TDDDG). The same rule applies under Article 5(3) of Directive 2002/58/EC as implemented in the Latvian Law on Information Society Services.

2.2 Personal data: Where cookies involve personal data, we rely on: performance of a contract (Art. 6(1)(b) GDPR) for login and session; our legal obligation to be able to prove your consent (Art. 6(1)(c) together with Art. 7(1) GDPR) for storing your cookie choice; and your consent (Art. 6(1)(a) GDPR) for analytics.

3. Strictly necessary (no consent required)

These are needed for the website and the platform to work and to keep your account secure. They are set only by HansePay and are not shared with anyone else.

4. Analytics (only with your consent)

Analytics helps us understand how visitors use our website so that we can improve it. It is switched off until you agree, by clicking “Accept all” or switching on “Analytics” in the cookie settings. If you reject or later withdraw your consent, no analytics data is collected and we delete the analytics cookies.

4.1 Google Analytics 4

Google Analytics 4 is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which acts as our processor. Google Signals is switched off. Data may be transferred to Google LLC in the United States. This transfer is based on the EU–US Data Privacy Framework, under which Google LLC is certified, and on the Standard Contractual Clauses in Google’s data processing terms as a fallback.

4.2 Our own page-view statistics

With your consent, we also count page views with our own tool. It records the page visited, the referring page, campaign parameters (UTM) and your country. To determine the country, your IP address is processed briefly and then discarded; it is not stored. The data is not shared with third parties and is deleted after 14 months.

5. Other content on our website

• Interactive product demo: the demo opens on the website of Supademo, Inc. (United States) only when you click the link. No data is sent to Supademo before you click. After that, Supademo’s own privacy policy applies.
• Demo bookings: our booking form is our own. Appointments are scheduled with Google Calendar and held via Google Meet; Google processes the data needed for this (see our Privacy Policy).
• LinkedIn appears on our website only as a link. No data is sent to LinkedIn unless you click it.

6. Advertising

We do not use advertising or retargeting cookies.

7. Your choices

7.1 Banner: On your first visit, our banner lets you accept all, reject all or choose by category. Rejecting is as easy as accepting. Nothing that requires consent is loaded before you choose.

7.2 Changing your mind: You can change or withdraw your consent at any time via “Cookie settings” in the footer of every page and inside the platform after you log in. Withdrawal does not affect processing carried out before it. We ask for your choice again after 12 months, or earlier if we add new cookies.

7.3 Proof of consent: We record your choice (the version of the banner, the time and your selection) so that we can show that you consented.

7.4 Browser settings: You can also delete or block cookies in your browser. Blocking strictly necessary cookies or local storage will prevent you from logging in and using the platform.

8. Your rights and contact

You can withdraw your consent at any time (Art. 7(3) GDPR) and object to processing based on legitimate interests (Art. 21 GDPR). Your other rights, including the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), are set out in our Privacy Policy. Controller: Atrya Technologies SIA, Marijas iela 2A, Rīga, LV-1050, Latvia. Questions about cookies: dpo@hansepay.de.

1. Legal framework

As a crypto-asset service provider, Atrya Technologies SIA is an obliged entity under anti-money-laundering law. It complies in particular with:

• the Latvian Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing, and the Latvian Law on International Sanctions and National Sanctions;
• Directive (EU) 2015/849, as amended, as implemented in Latvia;
• Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (the “Travel Rule”);
• Regulation (EU) 2023/1114 (MiCAR) and EU restrictive measures (sanctions) regulations;
• the regulations and guidance of Latvijas Banka.

The EU's new single AML Rulebook, Regulation (EU) 2024/1624, applies from 10 July 2027, under the supervision framework of the new EU Anti-Money Laundering Authority (AMLA). We are preparing for the transition.

2. Governance

The Management Board has overall responsibility for our AML/CTPF and sanctions framework. A designated Board member, our Chief Risk and Compliance Officer, holds board-level accountability for the framework, approves the onboarding of high-risk clients and politically exposed persons, and approves decisions to refuse or end a business relationship. Day-to-day responsibility sits with our Money Laundering Reporting Officer (MLRO / responsible employee), who also performs the sanctions-compliance function, acts independently, files suspicious transaction reports under her own authority and reports directly to the Board, at least quarterly and whenever a matter requires the Board's attention. The MLRO is based full-time in Riga. We follow a three-lines-of-defence model, carry out an enterprise-wide risk assessment at least annually, train all staff at least annually, and have the framework reviewed independently.

3. Risk-based approach

We assess the money-laundering and sanctions risk of every client and relationship, considering the client's activity, ownership, geography, counterparties and payment corridors. The level of due diligence and monitoring follows that risk.

4. Client due diligence

4.1 Business clients

• Company name, registration number, jurisdiction, legal form, registered address and proof of good standing;
• business activity description and industry classification (NACE code);
• articles of association, register of shareholders or other proof of ownership, and evidence of the authority of the persons acting for the company;
• identity of directors and authorised signatories;
• identity of each ultimate beneficial owner — any natural person who owns or controls more than 25% of the company or otherwise exercises control;
• expected transaction volumes, main counterparties and counterparty countries, and source of funds;
• tax residence and tax identification number of the company.

4.2 Individual clients
We do not currently accept individual (natural-person) clients. We will update this Statement before any individual clients are onboarded.

4.3 Verification and updates
Identity documents and biometric checks are verified through our identity-verification service providers, acting on our behalf. All clients, directors and beneficial owners are asked to self-declare whether they are a politically exposed person, and are also screened against PEP databases. We keep due-diligence information up to date through periodic reviews, and you must tell us promptly about any material change (section 11 below).

4.4 Tax information (DAC8)
Under Council Directive (EU) 2023/2226 (DAC8), Atrya must collect the tax residence and tax identification number of each client and report information on reportable crypto-asset transactions to the competent tax authority. If you do not provide this information, we may be unable to open or maintain your account.

5. Enhanced due diligence

We apply enhanced measures — such as source-of-wealth evidence, additional documentation or approval by the Management Board — where risk is higher, including for:

• politically exposed persons (PEPs), their family members and close associates, including for at least 12 months after a person leaves a prominent public function;
• links to high-risk third countries identified by the European Commission or FATF;
• complex or unusual ownership structures, or activity inconsistent with the client's profile;
• higher-risk sectors and corridors, and clients subject to relevant adverse media;
• clients that have previously been flagged, restricted or exited by another financial institution.

Being a PEP does not by itself prevent you from using HansePay.

6. Prohibited clients and activities

We do not onboard or serve: sanctioned persons and entities; shell banks; companies that have issued bearer shares or are controlled through bearer-share structures; clients who refuse to provide the identification or documentation we require; persons established in, or transacting with, jurisdictions on our No-Go list (currently: Russia, Belarus, North Korea, Iran and Myanmar); and prohibited businesses or activities, including unlicensed financial services, unlicensed gambling, weapons trading without required licences, and the use of mixers, tumblers or other anonymity-enhancing services.

7. Sanctions screening

We screen clients, directors, beneficial owners and counterparties at onboarding, on an ongoing basis and during transactional activity against the EU and international sanctions lists applicable to us, including the EU consolidated sanctions list, United Nations Security Council sanctions, the lists published by the Financial Intelligence Unit of Latvia and, as a matter of risk policy, the US OFAC lists. Where we identify a match, we are legally required to freeze the relevant assets and report to the competent authorities, and we may not be able to notify you in advance.

8. Controls specific to crypto-assets

8.1 Closed loop: you can transact only with verified, whitelisted counterparties; transfers to unverified external wallets are technically blocked. Euro funding is accepted only from your registered and verified bank account (IBAN).

8.2 Whitelisted wallets: every wallet address in the HansePay ecosystem is either provisioned by us for a verified client or belongs to a verified, whitelisted counterparty or regulated Partner, and is recorded in our on-chain registry. Our policy engine blocks transfers to any address that is not whitelisted. Every wallet operation is checked against default-deny policy rules before it can be signed.

8.3 Travel Rule: originator and beneficiary information accompanies every transfer of crypto-assets in accordance with Regulation (EU) 2023/1113. We may delay, return or reject a transfer where required information is missing or incomplete.

8.4 Partners: our funding and payout Partners apply their own AML and sanctions checks under their own authorisations and may ask you for information directly. Our current Partners are listed in Annex 2 (Partner Services Schedule) to our Terms of Service.

8.5 Supported crypto-assets: we support only MiCAR-compliant electronic money tokens (the current list is set out in Annex 4 to our Terms of Service). We do not support crypto-assets with an anonymisation function.

9. Transaction monitoring

We monitor transactions continuously for activity that is inconsistent with a client's stated business or expected volumes; unusual in size, frequency or structure (for example, splitting payments to stay below thresholds); connected to high-risk jurisdictions without a clear business rationale; or linked to counterparties flagged in sanctions lists or adverse media. We may ask you to explain or document a transaction before executing it.

10. Reporting and confidentiality

We are required to report suspicious activity to the Financial Intelligence Unit of Latvia (Finanšu izlūkošanas dienests). The law prohibits us from telling a client that a report has been, or may be, made (“tipping-off”). For this reason we may be unable to explain why a transaction was delayed or refused, or why a relationship was ended.

11. What we ask of you

• Provide complete and accurate information at onboarding and whenever we request it.
• Tell us promptly about changes to your ownership, management, business activity or contact details.
• Use the Services only for lawful purposes and only for your own account, unless we have agreed otherwise in writing.
• Ensure that neither you nor your counterparties are sanctioned or acting on behalf of sanctioned persons.

If you do not cooperate, we may restrict or close your account and, where required, report to the authorities.

12. Record keeping

We keep due-diligence and transaction records for at least five years after the end of the business relationship or the date of the transaction, and longer where Latvian law or an authority requires it. See our Privacy Policy for details.

13. Contact

Compliance enquiries and fraud reports: compliance@hansepay.de. We will never ask for your password, full API secret or private keys — report any such request to us immediately. Our whistleblowing channel is open to staff and to external persons, allows anonymous reports, and is received by our Chief Risk and Compliance Officer. Access details are available on request at compliance@hansepay.de.

1. Scope

1.1 A complaint is any expression of dissatisfaction addressed to us about the Custody or Exchange Services, the Platform, onboarding, fees, communications or the conduct of our staff.

1.2 Partner services: The euro funding and local-currency payout are provided by Partners under their own authorisations, and identity verification is carried out by service providers on our behalf (Annex 2 (Partner Services Schedule) to our Terms of Service). You can still send us a complaint about these steps. We handle complaints about identity verification ourselves. For the funding and payout steps, we will handle any part that concerns Atrya and, with your consent, forward the remainder to the relevant Partner, telling you its complaint contact details.

2. How to complain

You may use the complaint form in the Annex, but you do not have to: we will not reject a complaint because it was not made on the form. Please include your name and client reference, a description of the issue and the outcome you are seeking, the relevant dates and transaction references, and any supporting documents. If a representative complains on your behalf, please attach a power of attorney.

3. What happens next

3.1 Acknowledgement: Without undue delay, and at the latest within 5 Business Days, we confirm receipt in writing and tell you: your complaint reference; the person or team handling it and how to contact them; whether the complaint is admissible (with reasons if it is not); and the indicative time for our decision.

3.2 Investigation: We check whether your complaint is clear and complete and, where needed, ask you for further information without undue delay. We gather and review all relevant information and keep you informed of progress. Complaints are investigated by our Compliance Officer, independently of the business function concerned and by staff who were not involved in the matter complained about. Overall responsibility for complaints handling lies with our Chief Risk and Compliance Officer, a member of the Management Board. Aspects relating to anti-money laundering, sanctions or the Travel Rule are handled by our Money Laundering Reporting Officer (MLRO); where the MLRO was personally involved in the matter, it is escalated to the Management Board. Complaints that remain unresolved after the internal investigation are escalated to the Management Board.

3.3 Decision: We send you a written decision in clear and plain language that addresses every point you raised and explains our reasons and any remedy offered. We aim to decide within 30 Business Days and in any event no later than two months after receiving your complaint.

3.4 Delays: If, exceptionally, we cannot meet that timeframe, we will tell you the reasons and the date by which you can expect our decision.

3.5 Form of communication: We communicate with you in writing by electronic means, or on paper if you ask us to.

4. If you are not satisfied

4.1 Supervisory authority: You can submit a complaint to Latvijas Banka (Bank of Latvia), K. Valdemāra iela 2A, Rīga, LV-1050, Latvia — www.bank.lv — tel. +371 67022300 — e-mail info@bank.lv. Latvijas Banka acts as supervisory authority: it reviews possible breaches of regulatory requirements but does not resolve individual disputes or award compensation.

4.2 Out-of-court dispute resolution: Our services are offered exclusively to business clients, so consumer arbitration boards are not available. Latvia has no general statutory out-of-court dispute resolution body for business clients; disputes are resolved by the competent courts of the Republic of Latvia. We encourage you to contact us first so that we can try to resolve any dispute amicably. The European Commission's Online Dispute Resolution platform closed on 20 July 2025.

4.3 Partner services: For disputes about a Partner-provided step (for example a euro payment to or from the funding Partner), the Partner's own complaints procedure and dispute-resolution body apply. We will give you the relevant details.

4.4 Courts: Your right to bring proceedings before the competent courts is not affected.

4.5 Data protection: For matters involving personal data, you may also lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija) of Latvia — see our Privacy Policy.

5. Decisions required by law

You may complain about how we handled an account restriction, a delayed or refused transaction or the end of a relationship. Where anti-money-laundering or sanctions law prohibits us from disclosing the reasons, our decision will say so, but we will still review whether our procedures were followed correctly.

6. How we manage complaints

Our Management Board approves this Policy and oversees its implementation. We record every complaint and the measures taken for at least five years, analyse complaints data continuously — including the average processing time for each step — to detect recurring problems, apply consistent decisions to similar cases, train the staff who handle complaints, and review this Policy at least annually.

7. Contact

complaints@hansepay.de — Atrya Technologies SIA, trading as HansePay, registration no. 40203731957, Marijas iela 2A, Rīga, LV-1050, Latvia.

Annex — Complaint form

Template for the filing of complaints under the Annex to Commission Delegated Regulation (EU) 2025/294. Please send it to complaints@hansepay.de or by post.

1.a Information about the complainant

1.b Contact details (if different from 1.a)

2.a Information about the legal representative (if applicable)

A power of attorney or other official document proving the appointment of the representative must be attached to this form.

2.b Contact details of the representative (if different from 2.a)

3. Information about the complaint

Place: _____________________    Date: _____________________

Signature — complainant / legal representative of the complainant: _____________________

Documentation provided (please tick): ☐ Power of attorney or other official document proving the appointment of the representative    ☐ Other (please specify): _____________________

1. Pricing tailored to you

Every business uses cross-border payments differently. That is why our fees are set individually for each client, to reflect its needs: the expected monthly volume and the payment corridors used. Before you start, you receive your own Fee Schedule (Annex 3 to our Terms of Service) with the prices that apply to you. The principles below apply to all clients equally.

2. What we charge and what we do not

3. How your individual prices are set

3.1 Objective criteria: Your prices depend on your expected monthly volume and the payment corridors you use. Clients with comparable volumes and corridors receive comparable prices (non-discriminatory commercial policy, Article 77 MiCAR).

3.2 Reference rate and markup: Each conversion is priced on the basis of an independent reference rate that Atrya cannot alter. Atrya acts as your counterparty and adds the markup agreed in your Fee Schedule.

3.3 Before you confirm: The rate and the applicable fees are shown to you before you confirm a conversion. Quotes are time-limited.

3.4 Review: If your volume or corridors change significantly, you can ask us to review your Fee Schedule.

4. Changes to fees

We may change your Fee Schedule on at least 14 days’ notice by durable medium. If you do not agree, you may close your account free of charge before the change takes effect.

5. Contact

For an individual offer or questions about pricing: support@hansepay.de.

Loading…