Know Your Customer & Customer Due Diligence Policy

1. Purpose

Elev8 Labs LLC ("the Company") is committed to conducting business with integrity and maintaining a robust, risk-based Know Your Customer (KYC) and Customer Due Diligence (CDD) program. This policy establishes the standards and procedures for verifying customer identity, assessing customer risk, and ensuring that the Company's research-use-only (RUO) products are supplied exclusively to qualified organizations and professionals engaged in legitimate scientific research.

The objectives of this policy are to:

• Verify the identity and legitimacy of all customers before establishing a business relationship.
• Confirm that products are purchased solely for lawful research purposes.
• Prevent sales to prohibited, sanctioned, or otherwise ineligible persons or organizations.
• Apply a risk-based approach to customer onboarding and ongoing monitoring.
• Protect the Company from financial crime, fraud, diversion, misuse, and reputational risk.
• Maintain accurate records demonstrating compliance with applicable laws, regulations, and internal policies.

This policy supports Elev8 Labs LLC's commitment to ethical business practices, responsible distribution, and effective risk management.

2. Scope

This policy applies to all officers, employees, contractors, and authorized representatives of Elev8 Labs LLC who participate in customer onboarding, sales, order processing, customer service, compliance, finance, or related business activities.

The policy applies to every prospective and existing customer, regardless of geographic location or purchase volume, including:

• Universities and academic institutions
• Government laboratories
• Biotechnology companies
• Pharmaceutical companies
• Contract research organizations (CROs)
• Hospitals and medical research institutions
• Qualified commercial laboratories
• Other organizations or professionals conducting legitimate scientific research

Compliance with this policy is required before any customer account is approved or products are supplied.

3. Definitions

For purposes of this policy, the following definitions apply:

Customer — Any individual or organization seeking to purchase products from Elev8 Labs LLC.

Know Your Customer (KYC) — The process of identifying and verifying a customer's identity before establishing or maintaining a business relationship.

Customer Due Diligence (CDD) — The collection and evaluation of information necessary to understand a customer's identity, business activities, ownership, intended use of products, and overall risk profile.

Enhanced Due Diligence (EDD) — Additional investigation and verification performed when a customer presents elevated compliance, regulatory, financial, geographic, or reputational risk.

Research Use Only (RUO) — Products intended exclusively for laboratory research and scientific investigation. RUO products are not intended for human consumption, clinical use, therapeutic treatment, veterinary use, diagnostic procedures, or any other prohibited application.

Beneficial Owner — The natural person(s) who ultimately owns or controls a legal entity or exercises significant control over its operations.

Sanctions Screening — The process of reviewing customers against applicable government sanctions, restricted-party, denied-party, and watch lists before approving or continuing a business relationship.

High-Risk Customer — A customer whose characteristics, location, ownership, transaction patterns, or intended use of products require Enhanced Due Diligence and management review before approval.

4. Policy statement

Elev8 Labs LLC is committed to supplying research-use-only products exclusively to qualified organizations and professionals engaged in legitimate scientific research.

The Company will establish and maintain a risk-based KYC and CDD program designed to:

• Verify customer identity before establishing a business relationship.
• Understand the customer's business, research activities, and intended product use.
• Assess customer risk using objective, documented criteria.
• Apply Enhanced Due Diligence when elevated risks are identified.
• Screen customers against applicable sanctions and restricted-party lists.
• Monitor customer relationships for changes in risk or suspicious activity.
• Maintain complete and accurate compliance records.
• Decline or terminate customer relationships that present unacceptable legal, regulatory, financial, or reputational risk.

Elev8 Labs LLC will not knowingly sell products to customers who:

• Cannot be adequately identified or verified.
• Refuse to provide requested documentation.
• Intend to use products for human consumption, clinical treatment, veterinary use, diagnostic procedures, performance enhancement, or other prohibited purposes.
• Appear on applicable sanctions or restricted-party lists.
• Seek to circumvent this policy or provide false or misleading information.
• Present risks that cannot be reasonably mitigated through additional due diligence.

All employees are responsible for complying with this policy and promptly escalating unusual, suspicious, or high-risk situations to the designated Compliance Officer or authorized management representative before proceeding with a transaction.

5. Customer acceptance standards

5.1 General requirements

Elev8 Labs LLC establishes business relationships only with customers that can be satisfactorily identified, verified, and determined to present an acceptable level of compliance risk.

No customer account may be approved until the Company has completed the applicable customer identification, verification, due diligence, and sanctions screening requirements described in this policy.

The Company reserves the right to request additional information or documentation whenever necessary to verify a customer's identity, business activities, ownership, intended product use, or overall risk profile.

5.2 Eligible customers

Elev8 Labs LLC supplies research-use-only (RUO) products exclusively to qualified organizations and professionals engaged in legitimate scientific research.

Eligible customers may include:

• Accredited colleges and universities
• Government laboratories and research institutions
• Biotechnology companies
• Pharmaceutical companies
• Contract Research Organizations (CROs)
• Hospitals conducting scientific research
• Independent commercial laboratories
• Other qualified organizations whose activities are consistent with lawful scientific research

Approval of a customer relationship remains subject to satisfactory completion of the Company's KYC and CDD requirements.

5.3 Prohibited customers and uses

Elev8 Labs LLC will not knowingly sell products to any customer who:

• Cannot be adequately identified or verified.
• Refuses to provide requested documentation.
• Intends to use products for human consumption.
• Intends to use products for clinical, therapeutic, veterinary, or diagnostic purposes.
• Purchases products for bodybuilding, performance enhancement, cosmetic, or recreational use.
• Appears on applicable sanctions or restricted-party lists.
• Provides false, misleading, or inconsistent information.
• Attempts to circumvent Company policies or applicable laws.
• Presents an unacceptable legal, regulatory, financial, or reputational risk.

The Company may decline any order or terminate any customer relationship when sufficient information cannot be obtained to support an informed compliance decision.

5.4 Right to decline or terminate business

Elev8 Labs LLC reserves the right to refuse, suspend, or terminate any customer relationship when:

• Customer information cannot be independently verified.
• Required documentation is incomplete or inconsistent.
• Product use appears inconsistent with legitimate scientific research.
• The customer refuses to cooperate with reasonable due diligence requests.
• New information materially changes the customer's risk profile.
• Continued business would expose the Company to unacceptable compliance or reputational risk.

Business decisions made under this section will be documented and retained in accordance with the Company's record retention requirements.

6. Customer identification and verification (KYC/CIP)

6.1 Customer identification

Before establishing a business relationship, Elev8 Labs LLC will obtain sufficient information to identify each prospective customer and evaluate the legitimacy of the proposed business relationship.

As applicable, customer information may include:

• Legal name of the organization
• Business address
• Shipping address
• Billing address
• Business website
• Corporate email address
• Telephone number
• Legal entity type
• State or country of formation
• Employer Identification Number (EIN) or equivalent business registration number
• Primary business activities
• Name and title of the authorized purchaser
• Beneficial ownership information, when appropriate

The Company may request additional information based on the customer's risk profile.

6.2 Identity verification

Customer information must be verified using reliable and independent sources whenever reasonably available.

Verification methods may include:

• Review of government-issued business registrations
• Verification of corporate websites
• Public business records
• Professional licensing information
• Academic or institutional affiliations
• Independent commercial databases
• Direct communication with the customer
• Other reliable sources considered appropriate by the Company

Verification procedures will be proportionate to the customer's assessed level of risk.

6.3 Documentation requirements

Customers must provide sufficient documentation to support the Company's verification process.

Depending on the customer relationship, documentation may include:

• Business registration documents
• Tax identification information
• Institutional affiliation
• Purchase authorization
• Research description or intended product use
• Professional credentials
• Laboratory information
• Shipping and billing verification
• Additional documents requested during due diligence

The Company may defer account approval until all required documentation has been received and reviewed.

6.4 Beneficial ownership

When appropriate, Elev8 Labs LLC may identify and verify the individuals who ultimately own or control a customer organization.

Beneficial ownership information may be requested when necessary to:

• Understand ownership structure.
• Evaluate compliance risk.
• Resolve inconsistencies in customer information.
• Support Enhanced Due Diligence.

7. Customer due diligence (CDD)

7.1 Purpose

Customer Due Diligence enables Elev8 Labs LLC to understand each customer's identity, research activities, intended product use, and overall compliance risk before establishing or continuing a business relationship.

CDD is applied using a risk-based approach and is appropriate to the nature of the customer and the proposed transaction.

7.2 Standard due diligence

Prior to approving a customer relationship, the Company will evaluate information sufficient to:

• Verify customer identity.
• Confirm legitimate business or research activities.
• Understand the intended use of Company products.
• Assess geographic and regulatory risk.
• Review available ownership information, when appropriate.
• Determine whether Enhanced Due Diligence is required.

7.3 Customer risk assessment

Each customer will be assigned an initial risk classification based on factors including:

• Customer type
• Nature of research activities
• Geographic location
• Product requested
• Transaction characteristics
• Ownership structure
• Verification results
• Sanctions screening results
• Any other relevant compliance considerations

The assigned risk rating determines the level of due diligence and ongoing monitoring required.

7.4 Ongoing due diligence

Customer due diligence does not end when an account is approved.

Elev8 Labs LLC will periodically review customer information to confirm that it remains accurate, complete, and consistent with the customer's business activities, purchasing patterns, and assessed risk profile.

The frequency and scope of ongoing reviews will be proportionate to the customer's risk classification.

8. Enhanced due diligence (EDD)

8.1 Purpose

Enhanced Due Diligence (EDD) is performed when a prospective or existing customer presents elevated legal, regulatory, financial, geographic, operational, or reputational risk. EDD enables Elev8 Labs LLC to obtain additional information necessary to evaluate the customer relationship and determine whether the identified risks can be appropriately managed.

EDD supplements, but does not replace, the Company's standard Customer Due Diligence procedures.

8.2 When enhanced due diligence is required

EDD should be considered whenever one or more of the following conditions exist:

• The customer operates in, or conducts business with, a high-risk jurisdiction.
• Customer ownership or control cannot be readily verified.
• The proposed purchase is inconsistent with the customer's stated research activities.
• The customer requests unusually large quantities or recurring purchases that cannot be reasonably explained.
• The customer refuses to provide requested documentation or provides incomplete or inconsistent information.
• The transaction involves an unrelated third-party payer or other unusual payment arrangements.
• Sanctions or restricted-party screening identifies a potential match requiring additional review.
• The customer has previously been declined, suspended, or terminated by the Company.
• Other circumstances indicate elevated compliance or reputational risk.

The Compliance Officer may require EDD whenever additional review is considered appropriate.

8.3 Enhanced due diligence measures

Depending on the identified risk, EDD may include:

• Obtaining additional business registration or organizational documents.
• Verifying beneficial ownership or management information.
• Requesting additional information regarding research activities or intended product use.
• Confirming institutional affiliations or laboratory facilities.
• Verifying funding sources or payment arrangements.
• Reviewing publicly available information regarding the customer.
• Conducting additional sanctions or restricted-party screening.
• Performing other verification procedures appropriate to the identified risk.

The scope of EDD will be proportionate to the nature and level of the identified risk.

8.4 Approval of high-risk customers

High-risk customer relationships require documented review and approval by the Compliance Officer or designated management representative before products are supplied.

Approval should consider:

• Results of the due diligence review.
• Remaining compliance or reputational risks.
• Whether identified risks can be appropriately mitigated.
• Whether the proposed relationship is consistent with the Company's business objectives and compliance standards.

Where risks cannot be satisfactorily resolved, the customer relationship will be declined or terminated.

9. Sanctions and restricted-party screening

9.1 Policy

Elev8 Labs LLC will screen prospective and existing customers, when appropriate, against applicable government sanctions, restricted-party, denied-party, and watch lists before establishing or continuing a business relationship.

The Company will not knowingly conduct business with any individual or organization that is subject to applicable legal restrictions or sanctions.

9.2 Screening procedures

Sanctions screening will be conducted:

• Before approving a new customer account.
• When significant customer information changes.
• Before approving high-risk transactions, when appropriate.
• Periodically for existing higher-risk customers.
• Whenever additional review is warranted.

Screening may be performed using commercially available screening tools, government resources, or other reliable sources.

9.3 Potential matches

Potential sanctions or restricted-party matches must be reviewed before any transaction proceeds.

Where appropriate, the Company will:

• Verify the identity of the customer.
• Review available supporting information.
• Resolve false-positive matches.
• Escalate confirmed or unresolved matches to the Compliance Officer.

No transaction may proceed while a confirmed or unresolved sanctions concern remains under review.

10. Payment verification

10.1 General requirements

Elev8 Labs LLC expects payments to be consistent with the approved customer relationship and the information obtained during Customer Due Diligence.

Payment methods or arrangements that are inconsistent with normal business practices may require additional review before an order is approved.

10.2 Indicators requiring additional review

Additional verification may be required when:

• Payment is received from an unrelated third party.
• Billing and customer information are materially inconsistent.
• Multiple payment methods are used without reasonable explanation.
• Payment instructions change unexpectedly.
• Transactions appear unusually complex or inconsistent with previous purchasing activity.
• Other circumstances indicate elevated compliance or fraud risk.

The Company may request additional information before accepting payment or fulfilling an order.

11. Customer risk classification

11.1 Risk-based approach

Elev8 Labs LLC assigns each customer a risk classification to determine the appropriate level of due diligence, monitoring, and management oversight.

Risk classifications support consistent decision-making while recognizing that customer risk may change over time.

11.2 Risk categories

Low risk. Customers whose identity, ownership, research activities, and intended product use have been satisfactorily verified and present minimal compliance concerns. Standard Customer Due Diligence is generally sufficient.

Moderate risk. Customers presenting one or more characteristics requiring additional review but not rising to the level of Enhanced Due Diligence. Additional documentation or verification may be required before approval.

High risk. Customers presenting elevated legal, regulatory, geographic, operational, financial, or reputational risk. Enhanced Due Diligence and management approval are required before establishing or continuing the business relationship.

11.3 Risk review

Customer risk classifications will be reviewed whenever:

• Significant customer information changes.
• Purchasing patterns change materially.
• New compliance concerns arise.
• Periodic customer reviews are conducted.
• Other information indicates a change in risk.

Risk classifications may be increased or decreased based on updated information.

12. Ongoing monitoring

12.1 Policy

Customer relationships will be monitored throughout the business relationship to ensure that customer information remains accurate, purchasing activity remains consistent with legitimate research purposes, and the customer's overall risk profile has not materially changed.

Monitoring supports the Company's ongoing compliance obligations and helps identify circumstances requiring additional review.

12.2 Monitoring activities

Monitoring may include:

• Periodic review of customer information.
• Review of purchasing patterns.
• Confirmation of continued research activities, when appropriate.
• Updated sanctions or restricted-party screening.
• Review of unusual orders or transactions.
• Assessment of new compliance or reputational risks.

The frequency and scope of monitoring will be proportionate to the customer's assigned risk classification.

12.3 Escalation

If ongoing monitoring identifies information that materially changes the customer's risk profile, Elev8 Labs LLC may:

• Request updated documentation.
• Perform Enhanced Due Diligence.
• Reclassify the customer's risk level.
• Suspend pending transactions.
• Decline future orders.
• Terminate the customer relationship when appropriate.

All material compliance decisions will be documented in accordance with the Company's record retention requirements.

13. Suspicious activity and escalation

13.1 Policy

Elev8 Labs LLC is committed to identifying and responding appropriately to customer activity that may present legal, regulatory, operational, or reputational risk.

Employees are responsible for promptly reporting unusual or suspicious customer activity to the Compliance Officer before processing the transaction whenever practicable.

13.2 Indicators of suspicious activity

Examples of activity that may require additional review include:

• Refusal to provide requested identification or supporting documentation.
• Information that cannot be independently verified.
• Material inconsistencies between customer information and purchasing activity.
• Requests inconsistent with legitimate scientific research.
• Orders involving unusually large quantities or unexpected purchasing patterns.
• Multiple failed attempts to bypass Company procedures.
• Requests to ship products to residential addresses or locations inconsistent with the customer's business, unless satisfactorily explained and approved.
• Payments from unrelated third parties without a reasonable business explanation.
• Potential sanctions or restricted-party screening matches.
• Any other activity that appears unusual or inconsistent with the customer's known business activities.

The presence of a red flag does not necessarily indicate misconduct; however, it requires appropriate review before the transaction proceeds.

13.3 Escalation procedures

When suspicious activity is identified, employees must:

1. Suspend processing of the transaction, when appropriate.
2. Notify the Compliance Officer.
3. Document the circumstances supporting the escalation.
4. Cooperate with any additional due diligence or investigation.

Only the Compliance Officer or designated management representative may approve, decline, suspend, or terminate a customer relationship following an escalation review.

14. Record retention

14.1 Policy

Elev8 Labs LLC will maintain complete and accurate records demonstrating compliance with this policy.

Records must be retained in a manner that protects confidentiality, supports regulatory and business requirements, and allows for efficient retrieval when needed.

14.2 Records maintained

As applicable, records may include:

• Customer identification information.
• Verification documentation.
• Customer Due Diligence records.
• Enhanced Due Diligence documentation.
• Risk assessments.
• Sanctions screening results.
• Approval and escalation decisions.
• Customer communications relevant to compliance.
• Documentation supporting declined or terminated customer relationships.

14.3 Retention period

Compliance records will be retained for a minimum of five (5) years following the end of the customer relationship, or longer if required by applicable law, contractual obligation, or Company policy.

Records must be protected against unauthorized access, alteration, or destruction.

15. Employee responsibilities

All employees involved in customer onboarding, sales, customer service, finance, compliance, or related activities are responsible for complying with this policy.

Employees must:

• Complete required KYC procedures before establishing customer relationships.
• Obtain and review required documentation.
• Escalate unusual or high-risk situations.
• Protect confidential customer information.
• Maintain accurate compliance records.
• Complete required compliance training.
• Cooperate with compliance reviews and internal audits.

Failure to comply with this policy may result in corrective action, up to and including termination of employment or other appropriate disciplinary measures.

16. Training

Elev8 Labs LLC will provide appropriate training to employees whose responsibilities include customer onboarding, sales, compliance, finance, or other functions subject to this policy.

Training will be designed to ensure employees understand:

• Their responsibilities under this policy.
• Customer identification and verification procedures.
• Customer Due Diligence requirements.
• Enhanced Due Diligence procedures.
• Red flags and escalation requirements.
• Recordkeeping responsibilities.

Additional training may be provided when significant regulatory changes, business changes, or policy revisions occur.

17. Compliance reviews

The Compliance Officer will periodically review the effectiveness of the Company's KYC and Customer Due Diligence program.

Reviews may include evaluation of:

• Customer files.
• Documentation quality.
• Risk classifications.
• Escalation decisions.
• Record retention practices.
• Employee adherence to policy requirements.

Recommendations for improvements will be implemented as appropriate to strengthen the Company's compliance program.

18. Red flags

The following circumstances require additional review before approving or continuing a customer relationship:

The Compliance Officer will determine whether additional due diligence, management approval, suspension, or termination of the customer relationship is appropriate.

19. Compliance contact

Questions about this policy, requests for due diligence documentation, and escalations under Sections 13 and 17 should be directed to the Compliance Officer:

Daniel Ordonez — Compliance Officer, Elev8 Labs LLC Email: support@elev8labsrx.com Phone: 714.217.8997 Mail: 30 N Gould St #65410, Sheridan, WY 82801

Appendix A — Customer documentation guide

Depending on the customer's risk profile and the nature of the business relationship, Elev8 Labs LLC may request one or more of the following:

Organizational information

• Legal name of the organization
• Business address
• Business registration
• Employer Identification Number (EIN) or equivalent
• Corporate website
• Business telephone number

Authorized representative

• Name
• Title
• Business email address
• Business telephone number

Research information

• Organization type
• Research activities
• Intended product use
• Laboratory or institutional affiliation

Additional information (when required)

• Beneficial ownership information
• Additional organizational documentation
• Payment verification
• Information supporting Enhanced Due Diligence

The Company may request additional information whenever necessary to complete its risk assessment.

Appendix B — Customer risk classification matrix

Risk classifications may be revised whenever new information becomes available or customer circumstances materially change.