AML & KYC Policy

Last updated: March 2026

1. Our Commitment

Fintra Ltd ("fintrapay," "we," "us," or "our") maintains a zero-tolerance policy towards money laundering, terrorist financing, proliferation financing, sanctions evasion, and all other forms of financial crime. We are committed to upholding the highest standards of anti-money laundering ("AML") and know your customer ("KYC") compliance across every aspect of our operations.

This policy reflects our dedication to safeguarding the integrity of the global financial system and ensuring that our platform is not exploited for illicit purposes. We implement robust controls, invest in compliance infrastructure, and foster a culture of vigilance at every level of our organisation.

All officers, employees, contractors, and agents of fintrapay are required to adhere to this policy without exception. Failure to comply may result in disciplinary action, termination of engagement, and referral to the appropriate authorities.

2. Scope

This Anti-Money Laundering and Know Your Customer Policy applies to all users of fintrapay services, including but not limited to merchants, their authorised representatives, beneficial owners, and any individual or entity that interacts with the fintrapay platform.

The policy governs all products and services offered by fintrapay, including both custodial and non-custodial payment processing modes, stablecoin payouts, batch disbursements, the Earn product, and any ancillary services provided through our platform or API. It applies regardless of the blockchain network, token type, or jurisdiction from which the service is accessed.

3. Customer Due Diligence (CDD)

fintrapay conducts thorough customer due diligence prior to onboarding any user and at regular intervals thereafter. The scope and depth of due diligence measures are proportionate to the assessed risk profile of the customer, business relationship, and transaction activity.

3.1 Individual Accounts

For individual account holders, fintrapay requires the following identification and verification documentation:

• Full legal name as it appears on government-issued identification documents
• Date of birth
• Nationality and country of citizenship
• Current residential address (P.O. Box addresses are not accepted as primary residential addresses)
• A valid, unexpired government-issued photographic identification document (such as a passport, national identity card, or driving licence)
• Proof of residential address dated within the preceding three months (such as a utility bill, bank statement, or government-issued correspondence)

All documentation must be legible, unaltered, and verifiable. fintrapay reserves the right to request additional documentation or conduct supplementary verification at any time.

3.2 Company Accounts

For corporate, partnership, trust, or other legal entity account holders, fintrapay requires the following:

• Full legal name of the entity as registered with the relevant corporate registry
• Company or entity registration number
• Jurisdiction of incorporation or registration
• Registered office address and principal place of business (if different)
• Certificate of incorporation or equivalent formation document
• Memorandum and articles of association, charter, or equivalent governing documents
• Full identification and verification of all directors, officers, and authorised signatories
• Full identification and verification of all beneficial owners holding, directly or indirectly, twenty-five percent (25%) or more of the ownership interest, voting rights, or control of the entity
• A current register of shareholders or equivalent ownership documentation
• Board resolution or equivalent authorisation to open and operate the account

Where the ownership structure involves multiple layers of entities, fintrapay will trace the chain of ownership until all ultimate beneficial owners meeting the twenty-five percent threshold are identified and verified. Complex or opaque ownership structures may result in enhanced due diligence measures or, where the structure cannot be satisfactorily resolved, refusal to establish the business relationship.

4. Enhanced Due Diligence (EDD)

fintrapay applies enhanced due diligence measures where the risk assessment indicates that a customer, business relationship, or transaction presents a higher risk of money laundering, terrorist financing, or other financial crime. Enhanced due diligence is mandatory in the following circumstances:

• High-value transactions: Any single transaction or series of linked transactions exceeding ten thousand United States dollars ($10,000) or its equivalent in any supported stablecoin or fiat currency
• Politically Exposed Persons (PEPs): Customers who are, or who are closely associated with, individuals holding prominent public functions, including heads of state, senior government officials, senior judicial or military officials, senior executives of state-owned enterprises, and senior officials of major political parties, as well as their immediate family members and known close associates
• High-risk jurisdictions: Customers or transactions involving jurisdictions identified by credible international bodies as having strategic deficiencies in their AML frameworks, or jurisdictions subject to international sanctions, embargoes, or elevated financial crime risk assessments
• Unusual transaction patterns: Activity that is inconsistent with the customer's stated business profile, expected transaction volume, or historical transaction behaviour, including but not limited to rapid movement of funds, transactions with no apparent economic rationale, structuring of transactions to avoid reporting thresholds, and frequent changes to account details or beneficiary information
• Complex ownership structures: Entities with multi-layered ownership arrangements, nominee shareholders, bearer shares, or other structures that may obscure the identity of the ultimate beneficial owner
• Adverse media: Customers or associated parties who appear in adverse media reports relating to financial crime, fraud, corruption, or other serious criminal activity

Enhanced due diligence measures may include, but are not limited to: obtaining additional identification documentation, conducting independent verification of the source of funds and source of wealth, obtaining senior management approval before establishing or continuing the business relationship, conducting more frequent periodic reviews, and applying heightened ongoing monitoring to the account.

5. Ongoing Monitoring

fintrapay implements comprehensive ongoing monitoring of all customer relationships and transactions to detect and prevent suspicious activity. Our monitoring framework includes the following components:

• Transaction monitoring: Automated systems that analyse all transactions in real time and on a retrospective basis to identify patterns, anomalies, and indicators of potentially suspicious activity
• Pattern analysis: Algorithmic detection of unusual transaction patterns, including rapid movement of funds, circular transactions, transactions inconsistent with the customer's stated business profile, and activity indicative of structuring or layering
• Threshold alerts: Automated alerts triggered when transactions exceed specified monetary thresholds, volume thresholds, or velocity parameters, calibrated to the customer's risk profile and expected activity
• Periodic customer review: Regular reassessment of customer information, risk classification, and due diligence documentation to ensure that all records remain current, accurate, and commensurate with the level of risk presented by the relationship
• Sanctions screening: Continuous screening of all customers, counterparties, and transaction participants against applicable international sanctions lists, with immediate escalation and action upon any positive or potential match
• Blockchain analytics: Utilisation of blockchain analytics tools to assess the provenance of funds, identify exposure to high-risk wallets, and monitor on-chain activity for indicators of illicit use

6. Risk Assessment

fintrapay adopts a risk-based approach to AML and KYC compliance, allocating resources and applying controls in proportion to the level of risk identified. Our risk assessment framework evaluates the following dimensions:

6.1 Customer Risk

Each customer is assigned a risk category upon onboarding and reassessed periodically. Risk categories are defined as follows:

• Low risk: Customers operating in well-regulated jurisdictions, with transparent ownership structures, established business histories, and transaction volumes consistent with their stated business activities
• Medium risk: Customers presenting one or more factors that moderately elevate the risk of financial crime, such as operating in sectors with higher inherent risk, moderate transaction volumes, or limited operating history
• High risk: Customers exhibiting multiple elevated risk indicators, including PEP status, connections to high-risk jurisdictions, complex ownership structures, adverse media, or transaction patterns inconsistent with their stated profile. High-risk customers are subject to enhanced due diligence and more frequent periodic review

6.2 Geographic Risk

fintrapay assesses the geographic risk associated with each customer and transaction, taking into account the jurisdiction of the customer's incorporation or residence, the jurisdictions in which the customer conducts business, and the jurisdictions from or to which funds are transmitted. Jurisdictions identified by credible international bodies as presenting elevated financial crime risks are treated with heightened scrutiny.

6.3 Product and Service Risk

Different products and services offered by fintrapay carry varying levels of inherent risk. Our risk framework accounts for the specific characteristics of each product, including the degree of anonymity it affords, the speed and finality of transactions, and the potential for misuse. Custodial services, which involve the holding and management of customer funds, are subject to a higher baseline level of control than non-custodial services.

6.4 Transaction Risk

Transaction risk is evaluated based on the nature, size, frequency, and geographic characteristics of individual transactions and aggregate transaction activity. Transactions that are unusually large, unusually frequent, inconsistent with the customer's profile, or that involve high-risk counterparties or jurisdictions are flagged for further review.

7. Suspicious Activity Reporting

fintrapay maintains robust internal procedures for the identification, escalation, and reporting of suspicious activity. All employees, officers, and agents are required to report any knowledge, suspicion, or reasonable grounds for suspicion of money laundering, terrorist financing, or other financial crime to the designated Compliance Officer without delay.

• Internal escalation: Upon identification of potentially suspicious activity, the matter is escalated immediately to the Compliance Officer, who conducts an assessment and determines whether a report to the relevant authorities is warranted
• Reporting to authorities: Where the Compliance Officer determines that there are reasonable grounds for suspicion, a suspicious activity report is filed with the appropriate financial intelligence unit or regulatory authority in accordance with applicable law
• Tipping-off prohibition: It is strictly prohibited for any person to disclose to the customer or to any third party that a suspicious activity report has been filed, is being considered, or that an investigation is underway. Any such disclosure constitutes a serious violation of this policy and may constitute a criminal offence under applicable law
• Record of reports: All internal reports, assessments, and external filings are documented and retained in accordance with our record-keeping obligations

8. Sanctions Compliance

fintrapay is committed to full compliance with all applicable international sanctions regimes. We maintain comprehensive procedures to ensure that our platform is not used, directly or indirectly, to facilitate transactions involving sanctioned individuals, entities, or jurisdictions.

• Screening: All customers, beneficial owners, directors, counterparties, and transaction participants are screened at the point of onboarding and on a continuous basis against all applicable international sanctions lists, including those maintained by the United Nations, the European Union, the United Kingdom, the United States, and other relevant jurisdictions
• Real-time screening: Transactions are screened in real time prior to execution to detect and prevent any payment to or from a sanctioned party or jurisdiction
• Prohibition: fintrapay will not establish or maintain business relationships with, process transactions for, or provide any services to individuals, entities, or jurisdictions that are subject to comprehensive sanctions. Where a match is identified, the transaction is immediately blocked, the account is frozen, and the matter is reported to the relevant authorities
• Updates: Our sanctions screening databases are updated promptly upon the publication of new designations, amendments, or delistings by the relevant sanctions authorities

9. Record Keeping

fintrapay maintains comprehensive records of all customer identification and verification documentation, transaction records, risk assessments, monitoring alerts, suspicious activity reports, and all other documentation generated in connection with our AML and KYC compliance obligations.

• All customer identification and verification records are retained for a minimum period of seven (7) years following the termination of the business relationship
• All transaction records, including details of the amount, currency, blockchain, sender, recipient, and timestamp, are retained for a minimum period of seven (7) years from the date of the transaction
• All records relating to suspicious activity reports, internal assessments, and communications with authorities are retained for a minimum period of seven (7) years from the date of filing or creation
• Records are stored securely and are protected against unauthorised access, alteration, or destruction
• All records are made available to competent authorities upon receipt of a lawful request, court order, or regulatory direction

10. Non-Custodial Mode

fintrapay offers a non-custodial payment processing mode in which customer payments are routed directly to the merchant's own wallet address via a transparent, auditable smart contract. In non-custodial mode, fintrapay does not at any time hold, control, or have access to the merchant's funds.

The non-custodial mode is subject to the following compliance framework:

• Reduced KYC requirements: As fintrapay does not hold or transmit customer funds in this mode, the KYC requirements applicable to non-custodial merchants are calibrated to reflect the reduced risk profile. Basic identity verification is required, but the scope of due diligence is proportionate to the platform's limited role as a technology provider
• Smart contract transparency: All payment routing in non-custodial mode is executed via publicly deployed, verified smart contracts on the relevant blockchain. The contract logic, including the fee split mechanism, is open and auditable by any party
• On-chain auditability: Every transaction processed through the non-custodial smart contract is recorded immutably on the public blockchain, providing a permanent, tamper-proof audit trail that is independently verifiable
• No fund custody: fintrapay does not hold, pool, or otherwise exercise custody over merchant or customer funds in non-custodial mode. The platform's role is limited to generating payment instructions, deploying smart contracts, and monitoring transaction status

11. Custodial Mode

fintrapay's custodial mode involves the receipt, holding, and transmission of customer and merchant funds by the platform. Given the elevated risk profile associated with custodial services, this mode is subject to the full scope of AML and KYC controls.

• Full KYC required: All merchants utilising custodial mode must complete the full customer due diligence process, including identity verification, beneficial ownership identification, and source of funds documentation, prior to activation of custodial services
• Enhanced monitoring: Custodial accounts are subject to heightened ongoing transaction monitoring, including real-time screening, threshold-based alerts, and periodic compliance reviews
• Withdrawal limits before verification: Merchants who have not completed the full KYC verification process are subject to strict withdrawal limits. These limits are progressively increased upon satisfactory completion of each stage of the verification process
• Payout approval workflows: All payouts and withdrawals from custodial accounts are subject to an approval workflow. Depending on the merchant's risk profile and the administrator's assessment, payouts may require manual approval by a compliance officer or administrator before execution
• Fund segregation: fintrapay maintains clear records of each merchant's custodial balance, ensuring that funds attributable to each merchant are accurately tracked and reconciled at all times

12. Training

fintrapay maintains a comprehensive AML and KYC training programme to ensure that all relevant personnel are equipped with the knowledge and skills necessary to fulfil their compliance responsibilities.

• All employees, officers, and contractors whose roles involve customer onboarding, transaction processing, account management, or compliance functions receive mandatory AML training upon commencement of their engagement and at regular intervals thereafter
• Training content is regularly updated to reflect evolving threats, emerging typologies, changes in regulatory expectations, and developments in the cryptocurrency and stablecoin landscape
• The Compliance Officer is responsible for the design, delivery, and oversight of the training programme, and for maintaining records of all training completed
• Supplementary training is provided in response to identified deficiencies, significant changes in policy or procedure, or upon the occurrence of material compliance events

13. Cooperation with Authorities

fintrapay is committed to full and timely cooperation with law enforcement agencies, financial intelligence units, regulatory authorities, and other competent bodies in connection with the prevention, detection, and investigation of money laundering, terrorist financing, and other financial crime.

• Lawful requests: fintrapay responds promptly and completely to all lawful requests for information, documentation, or data from competent authorities, including production orders, court orders, and regulatory directions
• Preservation orders: Upon receipt of a lawful preservation order, fintrapay will take immediate steps to preserve and protect the relevant records, account data, and transaction history from alteration or destruction
• Proactive engagement: Where fintrapay identifies activity that may be relevant to an ongoing investigation or that may indicate a threat to the integrity of the financial system, we will proactively engage with the relevant authorities to the extent permitted by law

14. Policy Updates

This policy is reviewed and updated on a regular basis to ensure that it remains effective, proportionate, and aligned with evolving risks, threats, industry best practices, and regulatory expectations. Material changes to this policy will be communicated to all affected parties and published on our website.

The Compliance Officer is responsible for initiating and overseeing the periodic review process. Reviews are conducted at least annually and on an ad hoc basis in response to significant changes in the regulatory environment, the emergence of new financial crime typologies, material changes to fintrapay's products or services, or the identification of compliance deficiencies.

15. Contact

For any questions, concerns, or reports relating to this Anti-Money Laundering and Know Your Customer Policy, or to report suspected financial crime, please contact our Compliance team: