1. Synthetic demonstration data. This report is a product prototype. The subject entity, its identifiers, the named individuals, ownership particulars, screening outcomes, licensing details, and all findings are synthetic and are presented solely to demonstrate the D7 report format. They do not describe, and must not be taken to describe, any real person or entity, and no inference about any real person or entity may be drawn from them.

2. Confidentiality. This report is strictly confidential and is prepared by Fortifai on the D7 Due Diligence Platform for the sole and exclusive use of the commissioning customer in connection with its own onboarding and risk-assessment process for the subject entity. It must not be copied, redistributed, published, disclosed, or relied upon, in whole or in part, by any third party, and no third party may acquire any rights in it, without Fortifai's prior written consent. Fortifai owes no duty of care to any person other than the commissioning customer.

3. Nature and purpose — not a decision, rating, or advice. The risk scores, verdicts, and recommendations in this report are decision-support inputs only. They are not, and must not be construed as, an approval or rejection decision, a credit rating, a regulatory determination, legal, tax, accounting, investment, or compliance advice, or any warranty, representation, or guarantee regarding the subject entity, its creditworthiness, solvency, integrity, or future conduct. The commissioning customer retains sole and independent responsibility for its onboarding decision and for its own compliance with applicable law, including its obligations under the Bank Secrecy Act, OFAC sanctions programmes, and any applicable anti-money-laundering and counter-terrorist-financing requirements.

4. Sources, third-party data, and reliance. Findings are derived from third-party data providers, public registries and dockets, open-source information, information supplied by or on behalf of the commissioning customer, and automated and AI-assisted analysis, as described in Section 13. Fortifai does not independently audit, and is not the originator of, third-party or customer-supplied data and is not responsible for errors, omissions, or delays in such source data, or for the matching logic and coverage of underlying screening providers. Screening operates on name, identity, and record matching and is inherently subject to both false positives and false negatives; the absence of a match is not proof of the absence of risk.

5. Beneficial-ownership inputs. Beneficial-ownership particulars for the subject entity were provided by or on behalf of the commissioning customer and reconciled against applicant-provided documentation where available. Fortifai has not independently verified ownership beyond the sources described and does not warrant that the beneficial-ownership picture is complete. Residual verification items are identified in Sections 4 and 12.

6. Point-in-time; no duty to update. This report speaks only as of its date and reflects information available up to that date. Risk positions change over time. Fortifai has no obligation to update, supplement, or correct the report after issuance, except under a separately agreed continuous-monitoring arrangement.

7. Limitation of liability. To the maximum extent permitted by law, Fortifai and its affiliates, officers, and personnel accept no liability for any loss or damage — whether direct, indirect, incidental, consequential, or otherwise — arising out of or in connection with the use of, or reliance on, this report. Nothing in this report excludes or limits any liability that cannot lawfully be excluded or limited.

Apex Digital Trading LLC is a registered Money Services Business with FinCEN (Registration No. 31000287654321). Registration is current. Verified against the FinCEN MSB Registrant Search.

Licensed as a money transmitter in 12 states under NMLS ID 2198765: CA, CT, FL, GA, IL, MA, NJ, OH, PA, TX, VA, WA. Verified against the NMLS Consumer Access registry.

Not required. Analyst assessment: the applicant does not conduct NYDFS-regulated virtual-currency business activity with New York residents that would trigger a BitLicense. To be re-confirmed if the account relationship introduces NY-resident retail activity.

Not registered / not required. As an OTC crypto trading desk dealing in non-security digital assets on a principal basis, the applicant is not an SEC-registered broker-dealer or a CFTC registrant. No registration deficiency identified for the stated business model.

No prior crypto-specific enforcement actions (SEC, CFTC, FinCEN, NYDFS, or state regulators) against the applicant or its trade names. Status: Clear.

No nexus to OFAC-sanctioned protocols (e.g., sanctioned mixers) or sanctioned wallet addresses identified in on-chain analytics screening. Status: Clear. Recommend on-chain exposure monitoring be maintained post-onboarding as part of the Enhanced CDD tier.

Under the US Bank Secrecy Act customer-due-diligence rule, beneficial-ownership and control-person information for a legal-entity customer is collected from the customer by certification — this is the mandated primary input, not a fallback. D7's role is to corroborate that certified information against independent, non-customer sources wherever such sources exist, and to record the residual honestly where they do not. The customer's ownership and control submission is collected in a layout aligned to the CTA / FinCEN BOI reporting fields, so the certification mirrors what the entity is obligated to file with FinCEN; a divergence between the two would itself be a flag.

Each material data point is assigned one of three verification statuses. Independently Verified (green) — confirmed against a source outside the customer's control: a government registry, an issuer/licensing registry, a court or regulator database, or a licensed third-party data provider. Self-Disclosed (amber) — provided by the applicant with no independent source available to confirm it; a customer-supplied document that merely corroborates a customer attestation does not upgrade this status, because the loop remains closed within the customer. Partial / Pending / Not Available (red) — an independent check is possible but is awaiting a document or returned nothing conclusive.

For a US private LLC the current shareholding (cap table) is not independently verifiable from any public source — no US registry or data vendor holds a verified private cap table, and access to the FinCEN beneficial-ownership registry is legally restricted. Ownership percentages are therefore recorded as Self-Disclosed by structural necessity. Where a control person is independently named on the entity's own licensing records (FinCEN MSB / NMLS), that person's role is upgraded to Independently Verified; a passive member who appears on no independent record remains Self-Disclosed. D7 additionally runs an undisclosed-owner contradiction check (Section 3C): independent sources are searched for any owner or controller the applicant did not declare.

Screening adjudication (Layer 0–4). Each screening hit is assessed through a five-layer framework — Direct-Listing Gate, Name-Match Quality, Contextual Corroboration, Source-List Tier, and Prior Decision — before a verdict is assigned. A confirmed identity mismatch at the corroboration layer (for example, date-of-birth or patronymic) overrides a high name-match score and yields a FALSE_POSITIVE.

Litigation severity (four-factor model). Each litigation record is scored on Nature (0–8), Court Tier (0–5), Direction (0–4), and Status (0–4), to a maximum of 21 points, mapped to HIGH (15–21), MEDIUM (8–14), and LOW (0–7) bands. Factor tables follow the D7 litigation methodology, adapted to US courts and case types.

Composite risk. Dimension scores are combined on a weighted basis to produce the overall risk rating. The rating is a decision-support input and does not by itself determine account approval.

The following checks were not performed for this report and are not rendered as findings: CTA / FinCEN Beneficial Ownership Information (BOI) filing status (restricted database access); private-company financial-statement analysis (entity is non-SEC-reporting; audited statements requested as a condition of approval); and commercial credit reporting. Their exclusion is a scope decision, not a finding of absence.

All findings reflect data available as of the report date. Screening results reflect the matching logic and source coverage of the underlying providers as of the screening date. Analyst-verified items reflect the state of the relevant issuer registry at the date of verification and should be re-confirmed on the re-screening cadence set in Section 12.