Last Update: 2025-01-06

1. Introduction and Policy Statement

Cryptra is committed to maintaining the highest standards of anti-money laundering (AML) and counter-terrorist financing (CTF) compliance. This AML & KYC Policy outlines the framework and procedures Cryptra employs to detect, prevent, and report money laundering and terrorist financing activities, in accordance with applicable laws and regulations in all jurisdictions where Cryptra operates. Our commitment extends to protecting our platform, our users, and the integrity of the global financial system from illicit financial activities. Cryptra will not knowingly engage in any transaction that facilitates money laundering or terrorist financing.

2. Regulatory Framework and Scope

This policy is developed and implemented in compliance with, but not limited to, the following key international and national regulatory frameworks:

• Financial Action Task Force (FATF) Recommendations: The global standard-setter for AML/CTF.
• Bank Secrecy Act (BSA) and its implementing regulations (USA): Administered by the Financial Crimes Enforcement Network (FinCEN).
• EU Anti-Money Laundering Directives (AMLDs): Specifically the 5th and 6th AMLD, which extend to virtual asset service providers (VASPs).
• Relevant national legislation and regulations in jurisdictions where Cryptra offers its services.

This policy applies to all Cryptra employees, contractors, agents, and any third parties acting on behalf of Cryptra, as well as all products, services, and transactions offered through the Cryptra platform.

3. Definitions

• Money Laundering (ML): The process of concealing the origins of illegally obtained money, typically by means of transfers involving foreign banks or legitimate businesses. It typically involves three stages: Placement, Layering, and Integration.
• Terrorist Financing (TF): The financial support, in any form, of terrorism or of those who encourage, plan, or engage in terrorism.
• Know Your Customer (KYC): The process of identifying and verifying the identity of clients, understanding their activities, and assessing their risk.
• Customer Due Diligence (CDD): The process of gathering and analyzing information about a customer to assess their risk profile.
• Enhanced Due Diligence (EDD): Additional measures taken for higher-risk customers or transactions.
• Politically Exposed Person (PEP): An individual who is or has been entrusted with a prominent public function.
• Sanctions: Restrictions imposed by governments or international bodies on individuals, entities, or countries to achieve specific foreign policy or national security objectives.
• Suspicious Activity Report (SAR) / Suspicious Transaction Report (STR): A report filed with a financial intelligence unit (FIU) when there is suspicion of money laundering or terrorist financing.

4. AML/KYC Program Pillars

Cryptra's AML/KYC program is built upon the following essential pillars:

4.1. Appointment of an AML Officer (AMLO)

Cryptra shall appoint a qualified and experienced individual as the Anti-Money Laundering Officer (AMLO). The AMLO will be responsible for:

• Overseeing the implementation and enforcement of this AML & KYC Policy.
• Acting as the primary point of contact with regulatory authorities and Financial Intelligence Units (FIUs).
• Receiving and investigating internal suspicious activity reports.
• Filing SARs/STRs with the relevant authorities.
• Developing and delivering AML/CTF training programs for all relevant employees.
• Staying abreast of changes in AML/CTF laws and regulations and updating the policy accordingly.
• Conducting periodic risk assessments of Cryptra's operations.

4.2. Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD)

Cryptra implements robust CDD procedures for all customers and EDD for higher-risk customers.

4.2.1. Identity Verification (KYC)

All users must undergo identity verification before being able to access certain services or transaction limits on the Cryptra platform. The KYC process includes:

• Collection of Identification Information:
  • For Individuals: Full legal name, date of birth, nationality, residential address, unique identification number (e.g., passport number, national ID number), and contact information.
  • For Legal Entities: Legal name, registration number, date of incorporation, registered address, business nature, ownership structure, and identification of beneficial owners (individuals owning 25% or more of the entity).
• Verification of Identification Information: Cryptra utilizes reliable, independent source documents, data, or information for verification. This may include:
  • Government-issued identification documents (e.g., passport, national ID card, driver's license).
  • Proof of address (e.g., utility bill, bank statement).
  • Biometric verification (e.g., liveness checks, facial recognition against ID documents).
  • Database checks against public records and commercial databases.
  • For legal entities, official company registration documents, articles of incorporation, and shareholder registers.
• Ongoing Monitoring: Customer information will be periodically reviewed and updated to ensure its accuracy and relevance.

4.2.2. Risk-Based Approach

Cryptra adopts a risk-based approach to CDD, meaning the intensity and nature of CDD measures are commensurate with the identified money laundering and terrorist financing risks. Factors considered in assessing customer risk include:

• Customer Type: Individuals vs. legal entities, PEP status, high-net-worth individuals.
• Geographic Risk: Countries identified by FATF as high-risk or subject to sanctions.
• Product/Service Risk: Certain crypto assets or transaction types may carry higher inherent risks.
• Transaction Behavior: Unusual transaction patterns, high volume/value transactions.

4.2.3. Enhanced Due Diligence (EDD)

EDD measures are applied to customers identified as high-risk, including but not limited to:

• Politically Exposed Persons (PEPs).
• Customers from high-risk jurisdictions or those subject to sanctions.
• Customers engaging in complex, unusually large, or unusual patterns of transactions.
• Customers whose beneficial owners are difficult to identify.

EDD measures may include:

• Obtaining additional information on the customer's source of wealth and source of funds.
• Conducting more extensive background checks.
• Requiring senior management approval for establishing or continuing the business relationship.
• Increased ongoing monitoring of the business relationship.

4.3. Transaction Monitoring

Cryptra implements a robust transaction monitoring system to detect and report suspicious activities. This involves:

• Automated Monitoring Systems: Utilizing advanced algorithms and artificial intelligence to analyze transaction data in real-time and identify unusual patterns or deviations from expected behavior.
• Manual Review: Human review of alerts generated by automated systems and suspicious transactions identified through other means.
• Key Indicators of Suspicion:
  • Large, unusual, or complex transactions inconsistent with the customer's profile.
  • Frequent transactions just below reporting thresholds (structuring).
  • Transactions involving high-risk jurisdictions or sanctioned entities.
  • Rapid movement of funds through multiple accounts.
  • Use of multiple accounts or identities.
  • Transactions with no apparent economic or lawful purpose.
  • Attempts to avoid providing required identification or information.
  • Transactions involving known illicit addresses or entities (e.g., darknet markets, ransomware addresses).

4.4. Reporting Suspicious Activities

Upon identifying any suspicious activity or transaction, Cryptra employees are obligated to report their suspicions to the AMLO immediately. The AMLO will investigate the reported activity and, if deemed suspicious, will file a Suspicious Activity Report (SAR) or Suspicious Transaction Report (STR) with the relevant Financial Intelligence Unit (FIU) in accordance with applicable laws and regulations.

• No Tipping-Off: Cryptra employees are strictly prohibited from informing the customer or any third party that a SAR/STR has been filed or that an investigation is underway.

4.5. Sanctions Screening

Cryptra screens all customers and transactions against relevant sanctions lists, including those issued by:

• The Office of Foreign Assets Control (OFAC).
• The United Nations Security Council (UNSC).
• The European Union (EU).
• Other relevant national sanctions authorities.

Any match against a sanctions list will result in immediate blocking of the account/transaction and reporting to the relevant authorities.

4.6. Record Keeping

Cryptra maintains comprehensive records of all customer identification data, transaction records, risk assessments, and SARs/STRs filed, for a minimum period as required by applicable laws and regulations (typically five to seven years). These records will be readily available to regulatory authorities upon request.

4.7. Employee Training

All relevant Cryptra employees receive regular and comprehensive AML/CTF training. This training covers:

• The latest AML/CTF laws and regulations.
• Cryptra's internal AML & KYC Policy and procedures.
• How to identify red flags and suspicious activities.
• Reporting procedures for suspicious activities.
• The importance of AML/CTF compliance.

Training is provided upon hiring and periodically thereafter, at least annually.

4.8. Independent Audit and Review

Cryptra's AML/CTF program will be subject to independent audit and review on a regular basis (e.g., annually) to assess its effectiveness, identify any deficiencies, and ensure ongoing compliance with regulatory requirements and best practices. The findings of these audits will be reported to senior management, and corrective actions will be implemented promptly.

5. Compliance and Enforcement

Failure to comply with this AML & KYC Policy may result in disciplinary action, up to and including termination of employment, and may also lead to civil or criminal penalties for the individual and Cryptra. Cryptra reserves the right to refuse service, suspend, or terminate accounts that fail to meet its KYC requirements or are deemed to pose an unacceptable AML/CTF risk.

6. Policy Review

This AML & KYC Policy will be reviewed and updated at least annually, or more frequently as necessitated by changes in laws, regulations, industry best practices, or Cryptra's business operations.