1. Purpose, policy statement and regulatory status
The Company adopts a zero-tolerance position toward knowingly facilitating money laundering, terrorist financing, proliferation financing, sanctions evasion, fraud or other unlawful activity. The Company will establish and maintain a written, risk-based AML program proportionate to its actual activities, customers, corridors, channels, size and transaction volumes. No regulated service shall commence until the legal and operational launch conditions in Section 3 are met.
This policy establishes a jurisdiction-neutral, risk-based AML/CFT and sanctions control framework informed by internationally recognised financial crime prevention principles, including the FATF Recommendations. Local legal requirements, licensing conditions and contractual obligations shall be mapped separately before each product or market is activated. Where requirements differ, the stricter applicable lawful control shall be followed, subject to legal review.
2. Applicability, definitions and business-model boundaries
This policy applies to directors, officers, employees, contractors, agents, merchants and third parties performing AML-relevant activities for the Company. The Company must maintain an approved Business Model and Regulatory Applicability Register specifying its legal entity and jurisdictions; product types; whether it receives, holds or transmits funds; currencies; customer and merchant categories; settlement flows; banks/acquirers; agents; and any virtual-asset functionality. Activities not listed and approved in that register are prohibited.
Key terms: AML—anti-money laundering; CFT—counter-terrorist financing; CPF—counter-proliferation financing; UBO—ultimate beneficial owner; PEP—politically exposed person; EDD—enhanced due diligence; KYC/KYB—know your customer/business; EWRA—enterprise-wide risk assessment.
3. Regulatory mapping and launch gate
- Before launch, document the legal and regulatory classification of each service and payment flow in every relevant jurisdiction, including whether licensing, registration, exemptions or partner authorisations apply.
- Complete all applicable licensing, registration, notification and approval requirements before conducting regulated activities; maintain evidence of status, conditions, renewal obligations and regulatory correspondence.
- Maintain a jurisdiction-by-jurisdiction regulatory obligations register covering permitted services, geographic restrictions, local reporting requirements and any legally required arrangements with licensed partners.
- Identify applicable transaction reporting, recordkeeping, customer due diligence, funds-transfer information and financial crime obligations; assign responsible owners and procedures.
- Obtain necessary bank, acquiring, processor, card-network and partner approvals before processing transactions.
- Appoint an empowered AML/CFT Compliance Officer, approve risk assessment and procedures, validate KYC/KYB and sanctions systems, train staff, test monitoring and establish reporting arrangements.
- Maintain evidence of completed controls in a Launch Readiness Register; no live processing on the basis of policy approval alone.
4. Governance and accountability
4.1 Board / senior management
Approve risk appetite, this policy, the enterprise-wide risk assessment and material changes; appoint the AML/CFT Compliance Officer; allocate sufficient budget and authority; receive at least quarterly risk and compliance reports; oversee remediation and approve material exceptions.
4.2 AML/CFT Compliance Officer
The designated officer shall have direct access to senior management, authority to suspend onboarding or transactions, access to systems and records, and responsibility for the AML/CFT framework, risk assessments, procedures, training, monitoring oversight, investigations, regulatory reporting decisions and management reporting.
4.3 First line, second line and independent review
Operations and commercial teams collect and verify information and detect unusual activity; Compliance owns the framework and makes escalations/filing decisions; independent qualified reviewers assess effectiveness without reviewing their own work. A small-company structure may combine operational roles but must document compensating controls and independent challenge.
5. Risk appetite and prohibited relationships
The Company will not knowingly service sanctioned persons or prohibited jurisdictions, shell banks, fictitious identities, unlicensed regulated businesses where a licence is required, undisclosed nested payment aggregators, or activity designed to conceal beneficial ownership or transaction purpose. Anonymous or unverified relationships, deceptive merchant websites, illegal gambling, trafficking, counterfeit goods and other unlawful activity are prohibited. Additional high-risk merchant categories require prior documented compliance and acquiring partner approval.
Any exception to an internal risk limit requires documented justification and senior approval; no exception may waive law, sanctions prohibitions or required customer verification.
6. Enterprise-wide risk assessment (EWRA)
At least annually and before any material new product, corridor or partner, Compliance shall score inherent risk across customer/merchant type, products, payment flows, transaction volumes, geographies, delivery channels, intermediaries, fraud and sanctions exposure. Each factor is rated 1 (low) to 5 (very high), supported by evidence. Control effectiveness is rated strong/adequate/weak; residual risk and treatment plans are documented. Critical risks are escalated to the Board and cannot be accepted without lawful, effective mitigation.
The EWRA shall identify owners, source data, scoring rationale, controls, residual exposure, management approval and target remediation dates. The Company will monitor emerging typologies and reassess after major incidents.
7. Customer and merchant onboarding (KYC/KYB)
7.1 Individuals
Before activation, collect legal name, date of birth, residential address, nationality, contact information, government-issued identification and other information needed for applicable law and risk. Verify identity using reliable independent sources and document the method, outcome, discrepancies and reviewer. Screen names and relevant identifiers for sanctions and adverse information. Do not activate if identity cannot reasonably be verified.
7.2 Legal entities and merchants
Collect registered and trading names, incorporation/registration number, legal form, registered and operating addresses, website/app, nature of business, goods/services, anticipated turnover, processing corridors, settlement accounts, directors, authorized signatories and ownership/control structure. Obtain formation evidence and verify corporate status where possible. Identify natural persons exercising ownership or control using a risk-based threshold (normally 25% ownership as an internal trigger, plus any controlling person), and look through layered structures; lower thresholds may be imposed for high risk. This internal 25% rule is not represented as a universal statutory MSB beneficial-ownership rule.
Merchant due diligence must include website/app review, product legitimacy, terms/refunds, delivery model, chargeback exposure, business licensing where relevant, processing history, MCC and potential transaction laundering. Settlement account name must match the approved merchant or have documented authorization and Compliance approval.
7.3 Verification failures
Missing, conflicting or suspicious information is placed on hold; Compliance requests clarification, verifies independently, and records accept/reject decisions. Commercial staff cannot override a failed verification. False information, concealment of ownership or unresolvable sanctions matches result in rejection or appropriate legal handling.
8. Customer risk rating and periodic due diligence
Each relationship is rated low, medium or high before activation based on documented risk factors. Illustrative review targets: high risk every 12 months, medium every 24 months, low every 36 months; event-driven review always takes priority. These are internal service standards, not universally prescribed statutory intervals. Trigger events include ownership change, abnormal volumes, new jurisdictions, adverse media, repeated fraud/chargebacks, sanctions alerts or law-enforcement requests.
9. Enhanced due diligence (EDD)
EDD is mandatory for materially high-risk relationships, including PEP exposure, complex or opaque ownership, higher-risk jurisdictions, unusual funding/settlement arrangements, high-risk merchant activities and significant unexplained volumes. Measures include enhanced ownership verification, source of funds/source of wealth where relevant, business rationale, supporting invoices/contracts, site or video checks, transaction limits, tighter monitoring and senior-management approval. PEP status alone does not automatically prohibit a relationship; risk and applicable law govern the decision.
10. Sanctions and prohibited-country controls
Screen customers, merchants, beneficial owners, directors, authorised users, relevant payers/payees and counterparties against applicable sanctions, terrorism-related and other legally or contractually required restricted-party lists before activation and on an ongoing risk-based basis. Screen transactions where appropriate.
Potential matches shall be held pending review. Trained Compliance staff shall compare identifiers and document false-positive or confirmed-match decisions. Confirmed matches shall be blocked, frozen, rejected or otherwise handled where required by applicable law; notifications to competent authorities and partners shall follow applicable rules and deadlines.
11. Transaction monitoring and payment risk controls
The Company should monitor transactions using risk-based automated rules and documented manual review appropriate to its actual platform. Rules shall consider customer profile, velocity, cumulative volume, cross-border patterns, rapid in/out movements, split payments, unusual refunds, unrelated third-party settlement, merchant MCC mismatch, sudden spikes, multiple cards/devices/accounts, high chargeback ratios, sanctions geographies and attempts to bypass controls.
Each alert receives a case identifier, source, timestamps, transactions, customer profile, analyst findings, supporting documents, decision and approver. Priority alerts are triaged promptly, escalated to Compliance and resolved or referred to with documented rationale. Monitoring thresholds and effectiveness shall be reviewed at least quarterly and tuned based on false positives, misses, typologies and transaction volumes. Changes are approved and logged.
12. Suspicious activity escalation and external reporting
All personnel shall promptly escalate suspected illicit activity to the AML/CFT Compliance Officer through a confidential channel, including attempted transactions. Compliance shall assess facts, document its decision and determine whether a suspicious transaction or activity report must be filed with the competent authority under applicable law.
Where external reporting is required, Compliance shall file within the applicable jurisdictional deadline, retain evidence and supporting records, consider ongoing activity and protect the confidentiality of reports. No universal filing threshold or deadline is assumed. Staff shall not improperly disclose investigations or reports to customers or unauthorised persons.
13. Cash activity and applicable threshold reporting
The Company shall not accept physical cash unless expressly approved in its Business Model Register and supported by appropriate controls. Where cash or other reportable transactions are offered, the Company shall identify applicable thresholds, aggregation rules, reporting obligations and filing deadlines in its jurisdiction-specific procedures.
14. Fund transfer information and payment traceability
For transfers subject to originator and beneficiary information requirements, collect, verify where required, retain and transmit the prescribed information in accordance with applicable law and payment-partner requirements. Incomplete or inconsistent information shall trigger risk-based review, repair, rejection or escalation. No universal monetary threshold is adopted.
15. Payment facilitation, merchants and card-network exposure
Before onboarding any merchant, identify the Company’s actual role in the payment chain, including gateway, facilitator, processor, intermediary or other service provider, and obtain all necessary partner, acquirer and network approvals. Applicable contractual and card-network controls shall be recorded in the Partner Obligations Register.
Merchant monitoring includes transaction laundering, undisclosed submerchants, prohibited MCCs, card testing, excessive disputes, refunds to unrelated cards/accounts, split settlement, deceptive descriptors and anomalous cross-border acceptance. Submerchant onboarding, if permitted, requires risk-based KYB, beneficial ownership checks and clear responsibility allocation. Suspected illegal or network-prohibited merchants must be suspended and escalated.
16. Fraud, cybersecurity and financial crime coordination
Fraud Operations and Compliance shall share alerts concerning account takeover, identity theft, synthetic identities, mule activity, phishing, stolen cards and compromised credentials. Incidents shall be logged, contained, investigated and assessed for suspicious activity reporting, sanctions exposure and other legally required notifications.
17. Third parties, agents and outsourced services
Before engagement, conduct risk-based diligence on banks, acquirers, payment processors, KYC vendors, sanctions-screening providers, agents and technology providers. Assess licensing/registration where relevant, ownership, security, service levels, subcontracting, data location, auditability, incident history and financial condition. Written agreements must specify onboarding responsibilities, monitoring, information-sharing, confidentiality, audit rights, incident notice, termination and record access. The Company retains accountability for its own legal obligations. High-risk providers receive enhanced ongoing reviews.
18. Customer funds, settlement and refunds
Where the Company legally handles customer or merchant funds, approved procedures shall govern funding-source verification, settlement-account changes, reconciliation, exceptions, refunds, reserves, safeguarding and release controls. No representation of deposit insurance, trust status or statutory segregation may be made unless substantiated. Unexplained reconciliation differences, third-party payouts and rapid circular flows are escalated. Dual control is required for material changes to settlement instructions.
19. Recordkeeping, privacy and information security
Maintain KYC/KYB files, ownership records, risk assessments, transaction records, alerts, investigations, external reporting decisions and evidence, sanctions decisions, training, testing, regulatory correspondence and partner due diligence in secure searchable systems. Retention periods shall follow the applicable jurisdiction-specific schedule and contractual obligations; records shall be accessible, protected and securely disposed of when eligible.
20. Training, employee screening and conduct
Relevant staff shall complete AML/CFT induction training before undertaking sensitive duties, and refresher training at least annually as an internal policy standard and following material changes. Training covers customer due diligence, suspicious activity, sanctions, merchant risks, escalation, confidentiality, data security and role-specific controls.
21. Independent testing and management information
A qualified independent party shall test the programme at least annually as an internal policy target, with frequency adjusted where law and risk require. Testing covers governance, EWRA, customer files, sanctions screening, monitoring rule effectiveness, SAR/CTR decisioning, Travel Rule, agents, training, retention and remediation. Findings are risk-ranked, assigned to owners and tracked to closure; significant deficiencies are reported promptly to senior management. Quarterly dashboards cover high-risk customers, overdue reviews, alerts, SARs, sanctions matches, fraud, training, vendor incidents and remediation.
22. Regulatory requests, subpoenas and confidentiality
Only authorised personnel shall respond to competent authorities, law enforcement and legally binding information requests. The AML/CFT Compliance Officer shall verify authority, coordinate preservation, observe applicable deadlines, protect confidentiality and maintain an auditable request log.
23. Breaches, disciplinary measures and remediation
Material AML breaches, system outages or suspected employee misconduct must be reported immediately to Compliance. Compliance may impose holds, suspend activity, investigate root causes, require corrective action and notify regulators or partners where required. Management shall track remedial actions to closure and consider disciplinary action, contract termination and external reporting where appropriate.
24. Change management, approval and policy review
New products, markets, customer types, payment methods, third-party relationships or material rule changes require a documented AML impact assessment and Compliance approval before launch. This policy is reviewed at least annually. The approved version, change log, supporting procedures and evidence of staff acknowledgement shall be retained. If law or binding contractual obligations impose stricter controls, those obligations prevail.