This Annex forms part of the Policy and describes the framework used by Nortyx to classify jurisdictions, persons, entities, wallet addresses, platforms, transaction corridors and activity. The lists below are indicative and must be reviewed regularly against current EU, UN, FATF, Finnish, partner and internal risk sources. 

A. Prohibited or Blocked Connections. Nortyx may prohibit or block services involving any of the following connections: 

• persons, entities, organisations, vessels, wallet addresses, crypto-asset service providers or platforms subject to applicable EU, UN or other legally relevant sanctions; 
• persons or entities owned or controlled by, acting on behalf of, or otherwise connected to sanctioned or restricted persons or entities; 
• jurisdictions, territories or regions subject to comprehensive or sectoral restrictions that prevent the provision of the relevant service; 
• North Korea (DPRK), Iran, and other jurisdictions subject to FATF countermeasure calls or equivalent internal prohibition, unless a specific legal exception and internal approval applies;
• Russia, Belarus, occupied territories of Ukraine including Crimea, Sevastopol, Donetsk, Luhansk and any other territories subject to relevant restrictions, where the service or transaction would be prohibited or outside Nortyx’s risk appetite;
• transactions involving sanctioned wallet addresses, sanctioned crypto platforms, sanctioned payment channels, sanctions evasion, terrorist financing, proliferation financing or prohibited blockchain exposure.

B. Restricted / Enhanced Review Jurisdictions. Nortyx may apply enhanced due diligence, transaction restrictions or manual approval to jurisdictions identified by the EU as high-risk third countries, by FATF as high-risk or under increased monitoring, by competent authorities or by Nortyx’s internal risk assessment. As of the date of this draft, such sources may include, among others: Afghanistan, Algeria, Angola, Bolivia, British Virgin Islands, Bulgaria, Cameroon, Côte d’Ivoire, Democratic Republic of the Congo, Haiti, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Myanmar, Namibia, Nepal, Papua New Guinea, Russian Federation, South Sudan, Syria, Trinidad and Tobago, Vanuatu, Venezuela, Vietnam and Yemen. 

A jurisdiction appearing in this section does not automatically mean that services are available. Nortyx may treat any such jurisdiction as restricted, unsupported or prohibited depending on the specific user, transaction, payment method, crypto-asset, wallet exposure, sanctions connection and current legal requirements. 

C. Unsupported Jurisdictions. Unless otherwise approved by Nortyx, services may be unsupported in jurisdictions outside Finland, the EU or EEA, or in any jurisdiction where Nortyx has not completed a legal, compliance, operational, payment, Travel Rule, wallet screening or partner-support assessment. Nortyx may also treat a jurisdiction as unsupported where local law restricts crypto-asset services, where local licensing may be required, where payment or banking partners do not support the jurisdiction, where sanctions or AML/CFT risk cannot be adequately mitigated, or where required records, verification or transaction monitoring cannot be completed. 

D. Case-by-Case Review. Nortyx may conduct case-by-case review where there are mixed indicators, humanitarian considerations, permitted legal exceptions, residency conflicts, dual nationality issues, business-user complexities, historical exposure, source of funds concerns, indirect sanctions links, wallet clustering alerts or inconsistent technical and documentary information. Case-by-case review does not create any obligation to provide services.