Clear Terms for Technology Services

1Introduction

Welcome to EXICASH SDN BHD ("EXICASH", "we", "us", or "our").

These Terms of Service / Merchant Technology Services Agreement ("Terms") govern your access to and use of our website, merchant dashboard, payment gateway technology, APIs, plugins, webhooks, payment links, QR payment tools, reconciliation dashboard, settlement reports, fraud monitoring tools, white-label frontend, onboarding support, technical support, and related technology services made available through www.exicash.com or any other platform operated by EXICASH.

By registering for an account, accessing our dashboard, using our APIs, integrating our technology, submitting onboarding documents, using our payment links, using our plugins, or otherwise using our services, you agree to be bound by these Terms, together with any applicable order form, quotation, invoice, service schedule, partner terms, privacy policy, data processing terms, acceptable use policy, AML/CFT and sanctions compliance statement, and other policies issued by EXICASH from time to time.

If you do not agree to these Terms, you must not access or use our services.

2Important Regulatory Disclaimer

EXICASH provides technology, integration, onboarding support, merchant dashboard, reporting tools, API connectivity, and related technical services only.

EXICASH is not a bank, financial institution, licensed merchant acquirer, e-money issuer, remittance provider, money services business, deposit-taking institution, card issuer, card scheme, or regulated payment operator, unless expressly stated otherwise in writing and supported by the relevant regulatory approval.

Regulated payment services, where applicable, are provided by licensed or registered banks, acquirers, e-money issuers, payment service providers, payment gateways, card schemes, financial institutions, or other regulated partners ("Licensed Payment Partners").

EXICASH may assist with communication, technical integration, onboarding coordination, merchant support, reconciliation reporting, and partner liaison. However, EXICASH does not make final decisions on merchant approval, payment processing, settlement release, payout withholding, refunds, chargebacks, reversals, transaction monitoring, regulatory reporting, or regulated payment obligations unless expressly authorised and permitted under applicable law.

Where there is any conflict between these Terms and the terms of the relevant Licensed Payment Partner regarding regulated payment services, settlement, transaction processing, refund, chargeback, reversal, risk review, or payout matters, the Licensed Payment Partner's terms shall prevail for those matters.

3Definitions

For the purpose of these Terms:

"Account" means the account, dashboard access, API access, or service profile created for a Merchant to use EXICASH services.

"API" means the application programming interface, webhook, technical documentation, software tools, sandbox environment, production environment, API keys, credentials, endpoints, and related integration technology provided by EXICASH.

"Authorised User" means an employee, officer, representative, contractor, or other person authorised by the Merchant to access or use the Account, dashboard, API, plugin, or any EXICASH service.

"Consumer" means the person or entity making payment to the Merchant for the Merchant's goods, services, donations, membership fees, subscriptions, invoices, or other lawful transactions.

"EXICASH Services" means the technology services provided by EXICASH, including payment gateway integration, merchant dashboard, payment links, QR payment integration, FPX integration, card payment integration, e-wallet integration, BNPL integration, subscription or recurring billing tools, payout or disbursement API connectivity, split payment configuration, reconciliation dashboard, settlement reports, fraud monitoring tools, webhook and API services, website plugins, white-label frontend, technical support, and onboarding or KYB assistance.

"Fees" means any monthly subscription fees, integration fees, API usage fees, MDR markups, technology service fees, support fees, custom development fees, or other charges payable to EXICASH.

"Licensed Payment Partner" means any licensed bank, registered merchant acquirer, e-money issuer, payment gateway, financial institution, card processor, wallet provider, BNPL provider, or other regulated payment partner that processes, acquires, settles, approves, or supports payment services for Merchants.

"Merchant", "you", or "your" means the company, sole proprietor, partnership, association, NGO, organisation, or entity that registers for, accesses, or uses EXICASH Services.

"Payment Method" means any payment method supported through EXICASH technology or Licensed Payment Partners, including FPX, DuitNow QR, credit card, debit card, e-wallet, BNPL, payout, disbursement, and any other payment method made available from time to time.

"Platform" means the EXICASH website, merchant dashboard, API, plugins, payment pages, payment links, reconciliation tools, reports, white-label interface, technical infrastructure, and related software environment.

"Restricted Business" means a business category that may be subject to additional review, conditions, approval, documentation, monitoring, or rejection by EXICASH or Licensed Payment Partners.

"Prohibited Business" means a business category or activity that is not permitted to use EXICASH Services.

"Transaction Data" means information relating to payment attempts, successful payments, failed payments, refunds, chargebacks, reversals, settlement reports, payment references, payment status, IP address, device data, fraud signals, webhook logs, API logs, consumer payment details, and related metadata.

4Scope of EXICASH Services

EXICASH may provide some or all of the following technology services:

• payment gateway integration;
• merchant dashboard;
• payment link generation;
• QR payment integration;
• FPX integration;
• credit and debit card payment integration;
• e-wallet integration;
• BNPL integration;
• subscription and recurring billing tools;
• payout and disbursement API connectivity;
• split payment configuration tools;
• reconciliation dashboard;
• settlement report display;
• fraud monitoring tools;
• webhook and API services;
• Shopify, WooCommerce, or custom website plugins;
• white-label payment frontend;
• technical support;
• onboarding and KYB assistance.

EXICASH may modify, add, suspend, restrict, or remove any service, feature, integration, API, plugin, payment method, payment partner, dashboard function, or report from time to time.

EXICASH may provide access to both sandbox and production environments. Sandbox access is provided for testing and development purposes only and must not be treated as a live payment environment.

5Relationship with Licensed Payment Partners

EXICASH works with Licensed Payment Partners to support payment acceptance, payment processing, acquiring, settlement, fraud review, refunds, chargebacks, reversals, payout, and other regulated payment-related functions.

Merchants may be required to enter into separate agreements, onboarding forms, declarations, terms of service, merchant agreements, risk policies, or compliance documents with the relevant Licensed Payment Partner.

By using EXICASH Services, you agree that:

• Licensed Payment Partners may approve, reject, suspend, terminate, review, monitor, or impose conditions on your access to Payment Methods;
• Licensed Payment Partners may request additional documents, declarations, business information, transaction evidence, consumer information, or compliance details;
• Licensed Payment Partners may withhold, delay, reverse, refund, suspend, or reject transactions or settlements according to their own policies and applicable law;
• Licensed Payment Partners may impose transaction limits, settlement schedules, rolling reserves, chargeback processes, refund processes, fraud controls, restricted business rules, or other requirements;
• EXICASH is not responsible for any decision, delay, suspension, rejection, withholding, chargeback, refund, reversal, technical downtime, compliance action, or settlement action taken by a Licensed Payment Partner.

EXICASH may assist communication between the Merchant and the Licensed Payment Partner on a best-effort basis, but EXICASH does not guarantee any outcome.

6Merchant Eligibility

EXICASH currently supports Merchants operating in Malaysia only.

To use EXICASH Services, you must be one of the following:

• a company registered with the Companies Commission of Malaysia;
• a sole proprietor registered with the Companies Commission of Malaysia;
• a partnership registered with the Companies Commission of Malaysia;
• an association, society, NGO, or organisation properly registered or recognised under applicable Malaysian law; or
• another entity accepted by EXICASH and the relevant Licensed Payment Partner.

You must have a valid Malaysian business bank account or such other account accepted by the relevant Licensed Payment Partner.

EXICASH does not support high-risk merchants, prohibited businesses, illegal businesses, or businesses rejected by Licensed Payment Partners.

EXICASH may reject any application at its sole discretion or upon instruction from a Licensed Payment Partner.

7Merchant Onboarding and Verification

Before using certain EXICASH Services or Payment Methods, you may be required to submit onboarding, KYB, KYC, business verification, and supporting documents.

Documents and information may include, but are not limited to:

• SSM statutory documents;
• company profile;
• director details;
• shareholder details;
• beneficial ownership information;
• NRIC or passport copies;
• bank statements;
• business bank account details;
• website, social media, or online store URL;
• nature of business;
• product and service information;
• licences, approvals, permits, or certificates;
• tax information;
• proof of business address;
• transaction volume estimates;
• refund, chargeback, and fulfilment information;
• any other information requested by EXICASH or a Licensed Payment Partner.

You confirm that all information submitted is true, accurate, complete, current, and not misleading.

EXICASH may collect and retain onboarding documents for internal records, risk review, audit, compliance, partner submission, customer support, legal defence, and operational purposes.

You authorise EXICASH to share onboarding documents and information with Licensed Payment Partners, banks, acquirers, payment providers, compliance service providers, professional advisers, regulators, law enforcement agencies, and other relevant parties where necessary for onboarding, approval, risk review, service provision, legal compliance, or investigation.

Merchant approval is subject to review by the relevant Licensed Payment Partner. EXICASH does not guarantee approval.

8Merchant Account and Authorised Users

Merchants may be granted access to the EXICASH dashboard, APIs, plugins, reports, payment tools, or other services.

Upon request, EXICASH may create sub-users, administrators, or user roles for the Merchant. The Merchant is responsible for all activity carried out under its Account and by its Authorised Users.

You must ensure that each Authorised User:

• is properly authorised by you;
• uses the Account only for lawful business purposes;
• keeps login details, passwords, API keys, tokens, and credentials confidential;
• does not share access with unauthorised persons;
• complies with these Terms and all applicable policies.

EXICASH is not responsible for any loss, misuse, unauthorised transaction, data exposure, API misuse, account compromise, or prohibited activity caused by your Authorised Users or your failure to secure your Account, API keys, credentials, systems, or devices.

9API, Webhook, Plugin, and Integration Use

EXICASH may provide APIs, webhooks, plugins, documentation, sandbox access, production access, white-label frontend, or technical tools to support integration.

You are responsible for ensuring that your integration is properly developed, tested, secured, monitored, and maintained.

You must not:

• share, sell, transfer, expose, or disclose API keys, tokens, secrets, credentials, or access details;
• use APIs for unauthorised, illegal, fraudulent, prohibited, or restricted purposes;
• use APIs to process transactions for another merchant, business, website, or third party without approval;
• use APIs for payment aggregation or sub-merchant activity unless expressly approved by EXICASH and the relevant Licensed Payment Partner;
• bypass security controls, risk checks, partner requirements, rate limits, or transaction restrictions;
• reverse engineer, decompile, copy, modify, or create derivative works from EXICASH technology;
• overload, disrupt, scrape, attack, test vulnerabilities without permission, or interfere with the Platform;
• use EXICASH technology to compete with EXICASH or build a competing payment gateway service.

If your API key or credential is leaked, compromised, exposed, stolen, misused, or used for prohibited activity, you must notify EXICASH immediately.

You are responsible for all consequences, losses, penalties, claims, chargebacks, fraud, unauthorised use, prohibited activity, partner action, and regulatory issues arising from leaked, compromised, misused, or unsecured API keys, credentials, webhooks, plugins, systems, or integrations, except to the extent caused by EXICASH's proven negligence or wilful misconduct.

EXICASH may suspend, rotate, revoke, restrict, or disable API access if we suspect misuse, security compromise, prohibited activity, unauthorised access, partner instruction, regulatory issue, or breach of these Terms.

10Payment Methods

EXICASH may support the following Payment Methods through its technology and Licensed Payment Partners:

• FPX;
• DuitNow QR;
• credit card;
• debit card;
• e-wallet;
• BNPL;
• payout or disbursement;
• any other method made available from time to time.

Payment Methods are subject to availability, approval, technical compatibility, Licensed Payment Partner terms, scheme rules, regulatory requirements, risk review, business category, and merchant eligibility.

EXICASH may add, remove, suspend, restrict, or modify Payment Methods at any time.

EXICASH does not guarantee that any Payment Method will be approved, uninterrupted, error-free, available at all times, or suitable for your business.

11Settlement, Payouts, Refunds, Chargebacks, and Reversals

Settlement, payout, refund, chargeback, reversal, transaction hold, rolling reserve, risk review, transaction investigation, and payment release are handled by the relevant Licensed Payment Partner, acquirer, bank, payment provider, or scheme according to their own terms and processes.

EXICASH does not receive, hold, pool, control, safeguard, release, freeze, delay, or settle merchant funds.

You acknowledge and agree that:

• settlement is made directly by the Licensed Payment Partner or acquirer to the Merchant, unless otherwise required by the relevant payment arrangement;
• EXICASH is not responsible for settlement delays, failed payouts, payout holds, rejected settlements, chargebacks, refunds, reversals, rolling reserves, acquirer deductions, or partner decisions;
• EXICASH may display settlement reports or reconciliation information for convenience, but such reports may depend on data received from Licensed Payment Partners;
• final settlement, payout, refund, chargeback, and transaction status shall be determined by the relevant Licensed Payment Partner, acquirer, bank, or payment provider.

Merchant disputes relating to settlement, refund, chargeback, reversal, fraud, or payout must be resolved between the Merchant and the relevant Licensed Payment Partner. EXICASH may assist with communication on a best-effort basis only.

12Fees and Billing

EXICASH may charge Fees for its technology services, including:

• monthly subscription fees;
• MDR markups or technology service markups;
• integration fees;
• API usage fees;
• custom development fees;
• support fees;
• any other agreed charges.

Fees may be stated on the website, dashboard, pricing page, quotation, service order, invoice, merchant agreement, email confirmation, or other written communication.

Where permitted under the relevant Licensed Payment Partner arrangement, certain Fees may be deducted, netted, or reflected in the Merchant's settlement by the Licensed Payment Partner. In other circumstances, the Merchant may be required to pay EXICASH separately based on invoices issued by EXICASH.

Invoices must be paid within the payment period stated in the invoice. If no payment period is stated, invoices must be paid within thirty (30) days from the invoice date.

EXICASH may suspend or restrict access to services if Fees remain unpaid, if payment is disputed without valid basis, or if the Merchant fails to settle outstanding amounts after notice.

All Fees are stated in Malaysian Ringgit unless otherwise specified and are exclusive of applicable taxes, duties, levies, or charges unless stated otherwise.

13Taxes

You are responsible for determining and paying any taxes, duties, levies, charges, or reporting obligations applicable to your business, transactions, products, services, income, or customers.

EXICASH is not responsible for determining, collecting, reporting, or remitting taxes arising from your sale of goods, services, donations, subscriptions, memberships, invoices, or transactions unless expressly required by law.

If EXICASH is required to collect or charge any applicable tax on its Fees, such tax may be added to the invoice and shall be payable by you.

14Merchant Obligations

You agree to:

• use EXICASH Services only for lawful business purposes;
• comply with all applicable laws, regulations, payment partner rules, card scheme rules, bank requirements, e-wallet requirements, BNPL provider requirements, and these Terms;
• provide accurate and current business, ownership, product, service, bank, contact, and onboarding information;
• obtain and maintain all licences, permits, approvals, registrations, and authorisations required for your business;
• ensure that your website, social media, product information, refund policy, delivery policy, privacy policy, and customer support information are accurate and lawful;
• be solely responsible for your goods, services, donations, subscriptions, memberships, invoices, fulfilment, delivery, refunds, consumer complaints, warranties, and legal obligations;
• keep all API keys, credentials, login details, passwords, and integration secrets secure;
• promptly notify EXICASH of any actual or suspected security incident, API leak, suspicious transaction, fraud, unauthorised access, data breach, or prohibited activity;
• cooperate with EXICASH and Licensed Payment Partners in investigations, audits, compliance reviews, refund requests, chargebacks, disputes, and regulatory enquiries;
• not misrepresent EXICASH's role, payment partner arrangements, pricing, approval status, or regulatory status;
• not use EXICASH Services for high-risk, prohibited, illegal, fraudulent, or unauthorised activity.

15Consumer Relationship and Merchant Responsibility

The Merchant is solely responsible for its relationship with Consumers.

EXICASH is not responsible for:

• the Merchant's goods or services;
• product quality, safety, legality, description, availability, delivery, or fulfilment;
• refunds owed by the Merchant to Consumers;
• Consumer disputes, complaints, chargebacks, or fraud claims;
• the Merchant's customer support obligations;
• the Merchant's tax, licensing, regulatory, or business obligations;
• any loss suffered by Consumers due to the Merchant's conduct.

If a Consumer contacts EXICASH regarding a payment, dispute, refund, delivery issue, or Merchant transaction, EXICASH may direct the Consumer to contact the Merchant and/or the relevant Licensed Payment Partner.

EXICASH may assist on a best-effort basis but is not responsible for resolving Consumer disputes.

Receipts or payment confirmations issued through EXICASH technology are provided in a technology capacity only and do not make EXICASH responsible for the Merchant's goods, services, refunds, delivery, or contractual obligations to the Consumer.

16Prohibited and Restricted Businesses

You must not use EXICASH Services for any prohibited, restricted, illegal, unauthorised, or high-risk business unless expressly approved in writing by EXICASH and the relevant Licensed Payment Partner.

The Prohibited and Restricted Business Appendix at the end of these Terms applies to your use of EXICASH Services.

EXICASH and Licensed Payment Partners may reject, suspend, terminate, or impose conditions on any Merchant based on business type, transaction risk, regulatory concern, scheme rules, partner requirements, customer complaints, fraud indicators, or reputation risk.

The appendix is non-exhaustive and may include but is not limited to the categories listed.

17Suspicious, Illegal, or Unauthorised Activity

EXICASH may monitor, review, investigate, or flag suspicious activity through its dashboard, fraud monitoring tools, transaction logs, API logs, device data, IP data, webhook data, or partner reports.

EXICASH may suspend, restrict, terminate, or report activity where we suspect:

• fraud;
• illegal activity;
• prohibited business activity;
• unauthorised payment aggregation;
• false onboarding information;
• suspicious transaction pattern;
• money laundering risk;
• sanctions risk;
• terrorism financing risk;
• chargeback abuse;
• API misuse;
• credential compromise;
• regulatory breach;
• violation of partner requirements;
• breach of these Terms.

EXICASH may share relevant information with Licensed Payment Partners, banks, acquirers, payment providers, regulators, law enforcement agencies, professional advisers, and affected parties where necessary for investigation, compliance, fraud prevention, legal protection, or service operation.

18Service Availability, Support, and Maintenance

EXICASH will use reasonable efforts to provide stable and reliable technology services.

EXICASH does not guarantee that the Platform, APIs, dashboard, plugins, payment links, reports, webhooks, or integrations will always be uninterrupted, error-free, secure, timely, or available at all times.

Service availability may be affected by:

• scheduled maintenance;
• emergency maintenance;
• system upgrades;
• internet connectivity issues;
• merchant system issues;
• Licensed Payment Partner downtime;
• bank, acquirer, card scheme, e-wallet, BNPL, or payment network downtime;
• third-party service provider failures;
• cyberattacks, malware, denial-of-service events, or security incidents;
• regulatory or partner instructions;
• force majeure events.

EXICASH is not responsible for downtime, transaction failure, settlement delay, data delay, report delay, or service interruption caused by Licensed Payment Partners or third-party systems outside EXICASH's reasonable control.

19Data, Privacy, and Transaction Information

EXICASH may collect and process Merchant data, Authorised User data, Consumer payment details, bank account details, transaction history, IP and device data, webhook logs, API logs, fraud and risk signals, KYB/KYC documents, and support tickets.

EXICASH may process such data for onboarding, technology service delivery, integration, reporting, reconciliation, support, security, fraud monitoring, compliance, partner submission, legal defence, audit, and service improvement.

You agree to comply with all applicable personal data protection laws and ensure that you have provided all required notices and obtained all required consents from Consumers, Authorised Users, directors, shareholders, beneficial owners, officers, employees, and representatives whose personal data is provided to EXICASH.

EXICASH's processing of personal data is further governed by its Privacy Policy and, where applicable, Data Processing Agreement / Data Protection Addendum.

20PCI and Security Standards

EXICASH may maintain PCI certification or other applicable security standards relevant to its role and service scope.

However, the Merchant remains responsible for the security of its own website, systems, devices, applications, staff access, API credentials, plugins, integrations, servers, and data handling practices.

You must not store, process, transmit, expose, or misuse cardholder data or sensitive authentication data except in accordance with applicable PCI DSS requirements, payment partner rules, and EXICASH instructions.

If you handle cardholder data or sensitive payment data outside the authorised EXICASH or Licensed Payment Partner flow, you are solely responsible for the consequences, including regulatory, scheme, partner, legal, security, and financial consequences.

21Confidentiality

Each party may receive confidential information from the other party, including business information, technical information, API documentation, pricing, transaction data, onboarding documents, customer data, partner information, security information, product roadmap, commercial terms, and non-public information.

Each party agrees to:

• keep confidential information confidential;
• use confidential information only for the purpose of performing these Terms;
• protect confidential information using reasonable security measures;
• restrict access to persons who need to know the information;
• not disclose confidential information to third parties except as permitted by these Terms or required by law.

EXICASH may disclose confidential information to Licensed Payment Partners, service providers, professional advisers, regulators, law enforcement agencies, and other relevant parties where necessary to provide services, comply with law, support onboarding, prevent fraud, investigate suspicious activity, or protect legal rights.

Confidentiality obligations survive termination of these Terms.

22Intellectual Property

EXICASH owns or licenses all rights, title, and interest in its Platform, APIs, dashboard, plugins, documentation, software, designs, workflows, interfaces, payment pages, reports, technology, processes, know-how, trademarks, logos, and related materials.

Subject to these Terms, EXICASH grants you a limited, revocable, non-exclusive, non-transferable, non-sublicensable licence to access and use the EXICASH Services for your internal business purposes only.

You must not copy, reproduce, modify, reverse engineer, decompile, resell, sublicence, distribute, exploit, or create derivative works from EXICASH technology, documentation, APIs, plugins, dashboard, or materials except as expressly permitted in writing.

You grant EXICASH a limited licence to use your business name, logo, data, and information as reasonably necessary to provide services, configure payment pages, support integrations, submit onboarding documents to Licensed Payment Partners, display merchant branding where requested, and operate the Platform.

Neither party may use the other party's trademark, logo, brand name, or marketing material for public promotion without prior written approval, unless required for service operation or allowed under a separate brand usage agreement.

23White-Label Frontend

Where EXICASH provides a white-label payment frontend, the Merchant acknowledges that:

• the frontend is provided as a technology interface only;
• regulated payment processing remains provided by Licensed Payment Partners;
• EXICASH may appear on the payment page;
• the Licensed Payment Partner's brand may or may not appear depending on partner requirements;
• the Merchant's brand may appear upon request and approval;
• EXICASH is not responsible for the Merchant's goods, services, refunds, fulfilment, delivery, or Consumer relationship.

EXICASH may modify, suspend, remove, or restrict white-label frontend access if required for technical, legal, security, compliance, partner, or business reasons.

24Third-Party Services and Links

EXICASH Services may rely on third-party services, including Licensed Payment Partners, banks, acquirers, e-wallet providers, BNPL providers, card schemes, hosting providers, communication providers, analytics providers, fraud monitoring providers, verification providers, and software vendors.

Your use of such services may be subject to third-party terms, privacy policies, fees, restrictions, and service conditions.

EXICASH is not responsible for third-party service downtime, errors, data delays, settlement delays, declined transactions, partner decisions, payment network issues, or other third-party failures outside EXICASH's reasonable control.

25Disclaimers

EXICASH Services are provided on an "as is" and "as available" basis.

To the fullest extent permitted by law, EXICASH makes no warranty that:

• the Platform will be uninterrupted, secure, timely, error-free, or always available;
• all payment methods will be approved or available;
• all transactions will be successful;
• all settlement reports will be real-time or error-free;
• Licensed Payment Partners will approve the Merchant;
• Licensed Payment Partners will process or settle transactions within any specific time;
• EXICASH Services will meet all of the Merchant's business, technical, legal, or operational requirements.

You are responsible for evaluating whether EXICASH Services are suitable for your business.

26Limitation of Liability

To the fullest extent permitted by law, EXICASH shall not be liable for any indirect, incidental, special, consequential, punitive, exemplary, or economic losses, including loss of revenue, loss of profit, loss of business, loss of goodwill, loss of opportunity, loss of data, system downtime, failed transactions, declined transactions, settlement delays, chargebacks, refunds, reversals, partner actions, regulatory actions, or Consumer disputes.

EXICASH shall not be liable for losses caused by:

• Licensed Payment Partners;
• banks, acquirers, card schemes, e-wallet providers, BNPL providers, or payment networks;
• Merchant systems, websites, plugins, servers, integrations, or staff;
• leaked or compromised API keys or credentials;
• unauthorised access caused by Merchant negligence;
• prohibited business activity;
• false onboarding information;
• Consumer disputes;
• fraud, chargebacks, refunds, or reversals;
• downtime or failure of third-party systems.

Where EXICASH is found liable despite the above, EXICASH's total aggregate liability shall be limited to the Fees paid by the Merchant to EXICASH for the affected service during the one (1) month immediately preceding the event giving rise to the claim, unless a higher amount is required by applicable law.

Nothing in these Terms excludes liability that cannot be excluded under Malaysian law.

27Indemnity

You agree to indemnify, defend, and hold harmless EXICASH, its directors, officers, employees, agents, affiliates, service providers, and partners from and against any claims, losses, damages, liabilities, penalties, fines, costs, and expenses arising from:

• your breach of these Terms;
• your misuse of EXICASH Services;
• your goods, services, donations, subscriptions, invoices, or Consumer transactions;
• Consumer disputes, refunds, chargebacks, reversals, fraud claims, or complaints;
• your false, inaccurate, incomplete, or misleading information;
• your prohibited or restricted business activity;
• your violation of any law, regulation, payment partner rule, card scheme rule, or third-party right;
• leaked, compromised, or misused API keys, credentials, accounts, systems, or integrations;
• unauthorised access caused by your act or omission;
• your data protection breach or failure to obtain required consents;
• claims by Licensed Payment Partners, banks, acquirers, payment providers, Consumers, regulators, or third parties arising from your business or transactions.

28Suspension, Restriction, and Termination

EXICASH may suspend, restrict, disable, or terminate your access to EXICASH Services immediately, with or without notice, if:

• instructed by a Licensed Payment Partner, bank, acquirer, regulator, or law enforcement agency;
• you breach these Terms or any applicable policy;
• you fail to pay Fees;
• you submit false, misleading, incomplete, or outdated information;
• your business falls under prohibited or unacceptable risk categories;
• you engage in suspicious, fraudulent, illegal, or unauthorised activity;
• your API keys, credentials, account, or systems are compromised;
• your use of EXICASH Services creates security, legal, operational, compliance, reputational, or financial risk;
• your Licensed Payment Partner approval is rejected, suspended, or terminated;
• you misuse refunds, chargebacks, payouts, payment links, split payments, or disbursement tools;
• continuation of services may expose EXICASH to risk.

You may terminate your use of EXICASH Services by giving written notice to EXICASH, subject to payment of outstanding Fees and completion of any applicable obligations.

Termination does not affect any rights, obligations, Fees, indemnities, confidentiality obligations, data retention rights, or liability that arose before termination.

29Effect of Termination

Upon termination:

• your access to the dashboard, APIs, plugins, reports, payment links, and other services may be disabled;
• you must stop using EXICASH technology, documentation, API keys, payment pages, plugins, and marks;
• outstanding Fees remain payable;
• EXICASH may retain records as required for legal, compliance, audit, tax, accounting, security, fraud prevention, and dispute purposes;
• any active payment processing, settlement, refund, chargeback, or dispute matter will remain subject to the relevant Licensed Payment Partner's terms.

30Changes to These Terms

EXICASH may update, amend, or replace these Terms from time to time.

Changes may be posted on our website, dashboard, or notified by email. Your continued use of EXICASH Services after the updated Terms become effective means that you accept the revised Terms.

If you do not agree with the revised Terms, you must stop using EXICASH Services.

31Force Majeure

EXICASH shall not be liable for delay or failure to perform due to events beyond its reasonable control, including natural disasters, fire, flood, pandemic, war, terrorism, civil unrest, cyberattacks, power failure, internet disruption, telecommunications failure, banking system failure, payment network failure, regulatory action, government order, labour dispute, third-party system failure, or failure of Licensed Payment Partners.

32Anti-Bribery, AML/CFT, and Sanctions Compliance

You agree to comply with all applicable anti-bribery, anti-corruption, anti-money laundering, counter-terrorism financing, sanctions, fraud prevention, and financial crime laws and requirements.

You must not use EXICASH Services to process transactions involving bribery, corruption, money laundering, terrorism financing, sanctions evasion, fraud, scams, illegal goods, illegal services, or prohibited business activity.

EXICASH may request information, suspend access, reject transactions, restrict services, or report activity to Licensed Payment Partners or authorities where required or appropriate.

33Notices

Notices to EXICASH must be sent to:

EXICASH SDN BHD Email: support@exicash.com Address: 16-19, Menara Mutiara Sentral, No. 2, Jalan Desa Aman 1, Cheras Business Centre, 56000 Kuala Lumpur, Malaysia

EXICASH may send notices to you by email, dashboard notification, website notice, invoice, or other contact details provided by you.

34Governing Law and Jurisdiction

These Terms shall be governed by and interpreted in accordance with the laws of Malaysia.

The parties shall first attempt to resolve disputes through good-faith discussion.

If a dispute cannot be resolved amicably, the parties agree to submit to the courts of Malaysia, unless another dispute resolution process is agreed in writing or required by applicable law.

35General Provisions

If any provision of these Terms is found to be invalid, unlawful, or unenforceable, the remaining provisions shall continue in full force.

Failure by EXICASH to enforce any provision shall not be treated as a waiver of its rights.

You may not assign or transfer your rights or obligations under these Terms without EXICASH's prior written consent. EXICASH may assign, transfer, subcontract, or novate its rights or obligations where necessary for business, operational, restructuring, partnership, or legal reasons.

These Terms, together with applicable policies, invoices, service schedules, partner terms, and written agreements, form the entire agreement between EXICASH and the Merchant regarding the use of EXICASH Services.

Appendix 1: Prohibited and Restricted Businesses

EXICASH does not support high-risk merchants. The following business categories are prohibited or restricted and may be rejected, suspended, terminated, or subject to additional review by EXICASH or Licensed Payment Partners.

This list is non-exhaustive and includes, but is not limited to:

A. Prohibited Businesses

• illegal goods or services;
• drugs, narcotics, controlled substances, illegal pharmaceuticals, or drug paraphernalia;
• gambling, betting, casino services, lottery, sweepstakes, gaming with cash-out value, or games of chance;
• pornography, adult entertainment, escort services, sexual services, or obscene content;
• firearms, ammunition, explosives, weapons, or regulated defence items;
• counterfeit, pirated, replica, stolen, or unauthorised branded goods;
• infringement of copyright, trademark, design rights, or intellectual property rights;
• cryptocurrency, NFTs, token sales, digital asset exchange, mining, staking, or virtual asset investment activity;
• payment aggregation, sub-merchant processing, money transmission, remittance, e-money, wallet, or payment services without proper approval;
• unlicensed lending, loan sharking, debt collection, payday loans, or unlawful credit services;
• investment schemes, get-rich-quick schemes, pyramid schemes, Ponzi schemes, or multi-level marketing schemes that are unlawful or misleading;
• unregulated charities, donation campaigns, crowdfunding, or fundraising without proper approval;
• scams, fraudulent schemes, fake documents, fake certificates, fake accounts, or impersonation services;
• hacking tools, malware, spyware, botnets, cybercrime tools, phishing services, or unlawful surveillance tools;
• products or services that promote hate, violence, terrorism, extremism, harassment, or discrimination;
• sanctioned persons, sanctioned countries, or transactions prohibited by sanctions laws;
• businesses prohibited by banks, acquirers, card schemes, e-wallet providers, BNPL providers, payment networks, regulators, or applicable law.

B. Restricted Businesses

The following may require additional review, documents, approvals, conditions, or rejection:

• insurance products or services;
• financial services, investment advisory, brokerage, securities, trading, or wealth products;
• medical, telemedicine, health-related, pharmaceutical, or wellness services;
• online pharmacy or health supplement sales;
• alcohol-related products;
• tobacco, vape, nicotine, or smoking-related products;
• charity, NGO, donation, religious, or fundraising activities;
• travel, ticketing, event, hotel, or tour services;
• education, training, membership, coaching, or subscription businesses with advance payment risk;
• digital goods, software, online courses, downloadable products, or intangible services;
• marketplace, platform, aggregator, reseller, or multi-vendor business models;
• high-value goods such as jewellery, gold, luxury goods, collectibles, or electronics;
• prepayment, stored value, credit, voucher, points, or wallet-like business models;
• businesses with high refund, chargeback, fraud, consumer complaint, or delivery risk;
• any business requiring licences, permits, or regulatory approval.

EXICASH and Licensed Payment Partners may require additional documents, impose transaction limits, hold approvals, reject payment methods, request clarification, or terminate access for any restricted business.