Terms and Conditions for VIABO Technology Services

AGILE PAYMENTS S.A.P.I. DE C.V., a company incorporated under Mexican law with Mexican Tax ID (RFC) APA241113CE2, operates under the trade name VIABO and provides the technology services described in this document. It is referred to below as “VIABO.” “Client” means the individual or legal entity contracting the services, and “Authorized User” means a person who accesses them under authority granted by the Client.

The relationship covers only the features that have been contracted and enabled. Commercial information on www.viabo.com does not replace the service order, the specific agreement, or the terms of the provider executing a transaction.

VIABO provides software, connectivity, document management, transmission of instructions, access to information, and control and reconciliation tools. Depending on the contracted integration, its modules may facilitate access to payment, transfer, card, and international transaction services provided by third parties.

Within the scope governed by these terms, VIABO does not take deposits from the public or receive, hold in custody, manage, invest, or dispose of the Client’s funds on its own account. Fees for its technology services constitute commercial consideration and are not deposits for the execution of financial transactions.

When a feature requires financial services, payment processing, foreign exchange, or virtual asset services, execution and, where applicable, custody will be the responsibility of the provider identified in the specific terms. Before activation, the Client will be informed of that provider’s legal name, role, applicable terms, and channels for inquiries and disputes. The Client must accept the relevant agreements and authorizations.

Funds for those transactions must be directed exclusively to the accounts or destinations identified by the executing provider through authenticated channels. Balances, accounts, cards, or transactions displayed in VIABO reflect information from the integration and do not, by themselves, establish that funds are deposited with or held in custody by VIABO.

This allocation of roles does not remove any obligations legally attributable to VIABO for its acts or omissions. The applicable regulatory framework depends on the activities actually performed, and not solely on the description of the service as technological. VIABO does not represent that its services benefit from IPAB protection or guarantees of principal or returns; any protection applicable to a third-party product must be stated in that product’s own documentation.

The Client must be of legal age and have legal capacity. Anyone contracting on behalf of a legal entity must provide evidence of its existence and of their current authority to represent it. Authorized Users may act only within their assigned permissions.

The specific terms will establish the features, executing providers, fees, limits, additional requirements, service levels, and duration. They will be made available to the Client before contracting. They will prevail over these terms only in relation to the service they govern and may not override mandatory legal provisions.

The Privacy Notice governs the processing of personal data and is provided separately. Contracting technology services does not replace agreements with third parties or authorize the use of products that have not been expressly enabled.

Contracting requires an affirmative act of acceptance, such as selecting a checkbox that is not preselected and confirming the request through the specified authentication mechanism. Merely browsing does not constitute acceptance of charges, contracting of services, or consent to processing that requires express authorization.

The parties may use data messages and electronic signatures in accordance with Articles 89, 89 Bis, 90, 93, and other applicable provisions of the Mexican Commercial Code (Código de Comercio). Their legal effect will depend on compliance with the applicable requirements for attribution, integrity, accessibility, and reliability. A one-time code or password will not automatically be treated as an advanced electronic signature.

VIABO may retain the accepted version, date, time, session identifiers, and authentication records as evidence of the agreement and instructions. The Client may request a copy and challenge records or charges through the applicable legal procedures.

The Client must provide 100% of the information and documentation applicable to its legal status, service, and risk level. This obligation includes customer identification and due diligence, known as Know Your Customer or KYC, and verification of legal entities, known as Know Your Business or KYB. Documents must be authentic, complete, legible, consistent, and current.

A feature requiring identification will not be enabled while the relevant file is incomplete, material inconsistencies remain, or approval by VIABO or the executing provider is pending. Submission of documents, prefilled information, a demonstration, or preliminary commercial approval does not constitute authorization to operate.

VIABO will communicate the applicable requirements and may request additional information that is necessary and proportionate to verify identity, authority, business activity, ultimate beneficial owners (Beneficiarios Controladores), and transactions. A commercial exception cannot waive legal requirements. Completing a file also does not guarantee acceptance of the Client or of any transaction.

Depending on the service and the applicable assessment, the file will include:

• Full name, date and place of birth, nationality, residence, and business activity or occupation.
• Valid government-issued identification and, where applicable, CURP, RFC, foreign tax identification, and immigration documentation.
• Address and proof of address issued within the specified period; verifiable email address and telephone number.
• Information on income, the source and destination of funds, the purpose of the relationship, expected transactions, and accounts or payment methods held in the individual’s name.
• A declaration on whether the individual acts on their own behalf or for third parties, the ultimate beneficial owner, and politically exposed person status, where applicable.
• Identity evidence, interviews, document comparisons, or additional checks justified by the service and risk. If biometric data is required, information on its processing will be provided in advance and legally required consent will be obtained.

Depending on the service and the applicable assessment, the file will include:

• Incorporation documents, relevant amendments, registration details, and documentation establishing legal existence.
• RFC, Mexican tax status certificate or foreign equivalent, registered tax and operating addresses, and the required supporting documents.
• Powers of attorney and documents establishing authority; identification and details of representatives and persons issuing transaction instructions.
• Complete ownership and control structure, ownership percentages, ownership chain, and documentation of ultimate beneficial owners.
• Actual economic activity, line of business, required licenses or authorizations, purpose of the relationship, and expected transaction profile.
• Information on account ownership, relevant counterparties, countries involved, and evidence of the source and destination of funds.
• For trusts or other legal arrangements, governing instruments and details of the parties, decision-making bodies, and individuals exercising effective control, as applicable.

Document recency requirements will be specified in the onboarding or update request. Additional requirements imposed by VIABO or the provider will be identified as service requirements when they do not arise directly from a legal provision. Foreign documents must be accompanied by a translation, apostille, legalization, or certification when legally required or necessary for validation.

The Client must identify the individuals who ultimately benefit from the services or exercise effective control, in accordance with the applicable legal framework. It must disclose the ownership chain, control arrangements, and persons on whose behalf it acts. The assessment is not limited to the legal representative or the percentage of direct ownership.

The Client may not use front persons, omit intermediate structures, conceal principals, or present a person as an apparent owner. Identification of a representative or administrator does not replace identification of the ultimate beneficial owner, except in the circumstances and under the procedure permitted by law.

Services for corporate groups, subaccounts, end users, or white-label arrangements require an expressly agreed scope. Each person or entity involved must satisfy the applicable identification requirements; membership in the same group does not create an exemption. The Client may provide third-party data only on a valid legal basis and with the relevant notices and consents.

The Client represents and undertakes that:

• Its activity and requested transactions have a lawful, genuine purpose consistent with the information provided.
• Funds related to the service come from lawful sources and will not be used for money laundering, terrorist financing, fraud, corruption, or other crimes.
• It has authority to use the accounts, instruments, documents, and funds involved, and discloses any action on behalf of third parties.
• It will provide sufficient evidence of the source, destination, and economic purpose of transactions when requested on justified grounds.
• It will disclose legal or administrative restrictions affecting its ability to contract or transact when such disclosure is legally permissible.

Contracts, invoices, receipts, account statements, declarations, customs documents, or other relevant evidence may be requested. Documentation must be consistent with the parties and amounts involved in the transaction. Document review does not constitute a general certification of the Client’s lawfulness or replace its legal obligations.

VIABO may establish anti-money laundering and countering the financing of terrorism controls, referred to as AML and CFT, as conditions of its technology services and to support the processes of participating providers. The Client must cooperate with justified initial, periodic, and exceptional reviews.

The assessment may consider economic activity, jurisdictions, amounts, frequency, methods used, counterparties, ownership structures, and consistency of activity with the declared profile. The risk classification may change based on new information and may result in additional documentation requirements, limits, or reviews.

VIABO and each provider retain the obligations arising from their own activities. The Client’s obligation to provide all information does not transfer to the Client any identification, oversight, recordkeeping, retention, or reporting responsibilities that the law imposes on another participant.

Where applicable, the Client must disclose whether it, its representatives, or its ultimate beneficial owners hold or have held prominent public functions, as well as the related connections specified by applicable regulations. This status may require enhanced due diligence and additional evidence of the source of wealth or funds; it does not, by itself, imply unlawful conduct.

Checks may include official sources, public registries, legally applicable lists, and verification providers authorized to process the data. Foreign lists will apply only to the extent required by law, jurisdiction, counterparty requirements, or service conditions disclosed to the Client.

A name match must be assessed using additional information before being attributed to the Client, unless a mandatory measure must be implemented immediately. Clarifications may be requested to resolve name similarities or inconsistencies without disclosing legally protected information.

As a contractual obligation, the Client must notify relevant changes within five business days after becoming aware of them. This includes changes to identity, address, activity, representation, shareholders, control, ultimate beneficial owners, accounts, countries of operation, and contact details. Revocation of access and security incidents must be reported immediately.

The Client must cooperate with periodic reviews and provide updated documents when requested. Requests will identify the general reason, the required documents, and a reasonable response period; a shorter statutory deadline, an authority’s order, or an immediate risk may require priority attention and a preventive restriction.

If an extension is needed, the Client must request it before the deadline and explain the reason. An extension is not automatic and will not allow a transaction to proceed while a legal requirement remains unmet. Affected features may remain restricted during the review.

The services may not be used to:

• Conceal identity, ultimate beneficial owners, participants, or the source, destination, or purpose of funds.
• Split, simulate, or route transactions through intermediaries to evade controls, limits, identification, or disclosure duties.
• Submit altered documentation, fictitious transactions, or unauthorized instructions.
• Facilitate services for unidentified third parties or conduct regulated activities without the required authorizations.
• Evade applicable legal restrictions or sanctions, engage in unlawful activities, or finance acts of terrorism.
• Lend or sell access credentials, extract information without authorization, introduce malicious code, compromise systems, or deliberately exceed interface permissions and limits.

VIABO may reject an onboarding request or instruction, request additional information, limit features, or suspend access in the event of an incomplete file, false or inconsistent information, unauthorized use, a substantiated risk of fraud or unlawful conduct, a material contractual breach, a legitimate instruction from the provider, or an authority’s order.

The measure must be proportionate to its cause and may be implemented immediately if a delay would increase the risk or breach an obligation. VIABO will communicate the measure and the steps needed to remedy the issue through a registered channel, unless prohibited by law or where withholding that information is justified to protect an investigation or security.

The Client may provide clarifications and request a review through the support channels. Submission of documents does not guarantee reinstatement: the cause must be resolved and approval obtained from the competent participant. VIABO will review whether restrictions within its control should continue and will communicate the outcome to the extent legally permitted.

These powers concern access and technology-based processing. They do not authorize VIABO to appropriate the Client’s funds or order attachments, forfeitures, or bank freezes. Any restriction on funds held by third parties will be governed by law, the relevant agreement, and the actions of the competent provider or authority.

VIABO will respond to requests from competent authorities within their lawful scope and may provide information when required by an obligation, a valid order, or another permissible legal basis. AML or CFT notices and reports are the responsibility of the legally obligated party and must be submitted through the applicable channels and within the applicable deadlines.

The Client acknowledges that certain actions, analyses, notices, investigations, or communications cannot be disclosed. Contractual confidentiality will not prevent compliance with a legal duty to report. This clause does not authorize indiscriminate disclosures or replace personal data protection rules.

The Client must protect its devices, credentials, and integration keys; enable the required authentication mechanisms; assign appropriate permissions; and promptly revoke access for personnel who should no longer operate. Each Authorized User must use their own access identity.

Passwords, authentication codes, PINs, private electronic signature keys, and virtual asset recovery phrases must not be sent by email or WhatsApp or disclosed to support personnel. Documents must be submitted through the secure channel specified for the procedure.

The Client must immediately report any suspicious access, loss, or unrecognized instruction and preserve available evidence. Authentication of a transaction is one verification element, but it does not remove the right to challenge the transaction or VIABO’s liability for failures attributable to it.

Before confirming an instruction, the Client must review the beneficiary, account or CLABE, amount, currency, reference, payment description, and other required details. For international transactions, it must also verify banking details, country, charges, and conversion terms. A technological acknowledgment of receipt does not constitute settlement or final execution.

Availability, operating hours, limits, checks, refunds, and execution times depend on the contracted service and executing provider. Foreign exchange or asset quotes will be subject to the validity period and conditions disclosed upon confirmation; a preliminary inquiry does not guarantee them.

When a virtual asset integration is enabled, only expressly supported assets, networks, and destinations may be used. The Client must identify the participants and verify the destination address, network, and the required ownership or control of the destination. Risks, costs, custody, and the possibility of reversal must be explained in the specific terms. These terms do not, by themselves, authorize VIABO to exchange or hold virtual assets in custody.

Inquiries and disputes concerning errors, duplicates, rejections, or unrecognized instructions will be handled by VIABO within the scope of its involvement and by the competent provider. Responsibility will be determined based on the established cause, the agreements, and applicable law.

Implementation, licensing, support, integration, and other fees will be disclosed before contracting, including currency, taxes, billing frequency, and cancellation or refund rules. Third-party charges will be distinguished from VIABO’s charges. No undisclosed and unaccepted charges will be imposed.

Recurring charges and automatic renewals require the relevant authorization. Where the Mexican Federal Consumer Protection Law (Ley Federal de Protección al Consumidor) applies, its rules on disclosure, advance renewal notices, and immediate cancellation of the service, subscription, or membership will be observed, including legally required time limits.

Cancellation does not eliminate amounts validly accrued, but it does not permit charges for canceled future services or the denial of mandatory refunds or compensation. Rejection of an onboarding request does not, by itself, trigger a penalty; any chargeable implementation work must have been requested and accepted in advance, including its scope and price.

VIABO must implement administrative, technical, and physical security measures appropriate to the service, the information, and the risks of processing it. Maintenance, communication outages, or integration failures may occur; committed availability and support levels will be those expressly agreed.

VIABO will address incidents within its area of responsibility, take reasonable steps to mitigate their effects, and communicate material impacts in accordance with the law and the agreement. Invulnerability or uninterrupted operation is not promised. Nor does every third-party failure or cyberattack automatically exempt VIABO from liability.

Data will be processed in accordance with the applicable Privacy Notice and the current Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares). Depending on the service, purposes will include identification, verification, provision of technology services, security, fraud prevention, support, and compliance with legal obligations.

When VIABO processes data on the instructions of a Client or provider, the relevant roles and obligations will be defined. Access by processors and providers must be limited to the authorized purpose and subject to confidentiality and security measures. Domestic or international transfers require a valid legal basis and, where applicable, the relevant consent.

Acceptance of these terms does not constitute unrestricted consent to transfer information, make inquiries with credit information companies, conduct advertising, or process sensitive data. Authorizations that must legally be specific, express, or in writing will be obtained separately. Declining the processing of data for advertising purposes will not affect access to the service.

Rights of access, rectification, cancellation, and objection, and withdrawal of consent, may be exercised in accordance with the Privacy Notice. Confidential information will remain protected after the relationship ends.

Information will be retained for the periods necessary to provide the service, comply with obligations, and address liabilities. Where Article 18, section IV, of the LFPIORPI applies, the obligated party must retain the relevant files and supporting records for at least ten years from the vulnerable activity, subject to the statutory rules on interruption of that period.

That period will not automatically extend to all data collected by VIABO. Other processing will be subject to the applicable statutory periods and disclosed purposes; once those periods end, the relevant blocking, deletion, or otherwise permitted processing must take place. Closing an account does not require the destruction of evidence subject to mandatory retention.

The Client is responsible for the authenticity of the documents it provides, the authority it claims, its use of the services, and breaches attributable to it. If it causes proven damage through misrepresentation, fraud, or misuse, it must compensate for that damage in accordance with the law and the applicable determination.

VIABO is responsible for its own breaches and for acts or omissions legally attributable to it. The involvement of an executing provider defines the parties’ roles but does not exclude VIABO’s own duties or liabilities that cannot be waived.

No clause releases a party from liability for willful misconduct, gross negligence, or non-waivable legal liability, automatically transfers VIABO’s own penalties to the Client, or prevents recourse to authorities. Force majeure must be established and assessed according to its actual effect and the duty to mitigate.

For the contracted term, VIABO grants the Client a limited, nonexclusive license to use the authorized features. Developments, trademarks, code, and documentation belong to their respective owners; rights in the data and content supplied by the Client are not transferred through use of the service.

Resale, sublicensing, white-label use, third-party access, or integration beyond the contracted scope requires express authorization. The Client must comply with the technical documentation and respect third-party rights, without prejudice to exceptions recognized by law.

The relationship will continue for the term specified in the specific agreement. The Client may request cancellation through official channels, and VIABO will process it in accordance with the agreement and applicable statutory rights. VIABO may terminate the relationship for material breach, legal inability to continue, or a justified risk that cannot reasonably be mitigated.

Where a breach can be remedied, the deadline for doing so will be communicated. Immediate termination may apply in the event of a legal prohibition, false documentation, fraud, or serious risk, while respecting surviving rights.

Termination will result in closure of access, reconciliation of obligations, and repayment of any amounts due for return. The Client may request its information through a secure channel in accordance with its rights and the agreed delivery conditions. Cancellation of the technology services does not extinguish pending transactions or obligations with providers; these must be resolved under their agreements and the law.

VIABO will identify the version and update date of these terms. Material amendments will be communicated at least fifteen calendar days before they take contractual effect, unless a legal, regulatory authority, or security requirement justifies a shorter period.

New charges, service expansions, and other changes requiring consent will not be imposed merely on the basis of silence. The relevant acceptance will be obtained, and applicable termination rights will be respected. Amendments will not have retroactive effect or extinguish previously accrued claims, balances, or obligations.

These terms will be interpreted under the Mexican laws applicable to each activity, including the Federal Law for the Prevention and Identification of Transactions Involving Illicit Proceeds (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita), referred to as the LFPIORPI, its Regulations, applicable sector-specific provisions, the Commercial Code, and data protection and consumer protection laws.

These terms take into account the LFPIORPI reform published on July 16, 2025, the reform to its Regulations of March 27, 2026, and Agreement 115/2026, published on August 7, 2026. The latter generally takes effect on November 30, 2026, with specific later deadlines, including certain risk and due diligence controls from March 2027, automated mechanisms from June 2027, and the first audit period in 2028.

Statutory obligations will apply to the persons subject to them from the dates established in the transitional provisions. Identification and cooperation requirements agreed as service conditions may apply from acceptance, without being presented as statutory obligations already in force before their effective dates or as evidence of financial authorization granted to VIABO.

For support, document requests, inquiries, complaints, cancellations, incidents, and requests relating to these terms, the Client may contact AGILE PAYMENTS S.A.P.I. DE C.V. through:

• Email: pay@viabo.com
• Support WhatsApp: +52 81 4681 1481
• Direct WhatsApp link: https://wa.me/528146811481
• Official website: https://www.viabo.com/

The request must include the individual’s or entity’s name, Client identifier, a description, and relevant evidence, without including passwords or authentication secrets. VIABO may verify the requester’s identity and refer the relevant portion to the executing provider while following up on its own involvement.

Before contracting, and through the legally required means, VIABO will provide the physical service address and provider details required by applicable regulations. Electronic channels do not replace notices or physical information required by law.

Disputes will be governed by Mexican law and submitted to the competent courts of Monterrey, Nuevo León, to the extent that this choice is valid. Mandatory jurisdiction rules and non-waivable rights concerning consumers and personal data will be respected, as will legally applicable protection mechanisms for third-party financial services. Contacting support is not a prerequisite for bringing a claim before an authority.

I declare that I have read and accept the Terms and Conditions for VIABO Technology Services, that I have sufficient legal capacity and authority, and that the information provided is authentic, complete, and current. I undertake to establish and maintain a complete applicable file, identify ultimate beneficial owners, and substantiate the source, destination, and lawful purpose of transactions. I acknowledge the involvement of the providers identified for each service and that activation is subject to the relevant verification procedures. The Privacy Notice has been made available to me; this statement does not replace any specific consent required by law.