AML & KYC Policy

This Anti-Money Laundering (AML) and Know Your Customer (KYC) Policy outlines KryptoMate's commitment to preventing the use of our Platform for money laundering, terrorist financing, proliferation financing, and other financial crimes. This policy applies to all users, employees, contractors, agents, and wholesale partners of KryptoMate across all services, including gift cards, games, eSIMs, mobile top-ups, flight bookings, hotel stays, airport lounge access, KryptoCard, and wholesale/API operations.

KryptoMate complies with all applicable AML laws and regulations, including but not limited to FATF Recommendations, EU Anti-Money Laundering Directives (AMLD5/AMLD6), the U.S. Bank Secrecy Act (BSA), the UK Proceeds of Crime Act, and other relevant national and international regulations. We continuously update our compliance framework to reflect evolving regulatory requirements and emerging financial crime typologies.

KryptoMate adopts a comprehensive risk-based approach to AML/KYC compliance, allocating resources proportionate to the identified risks. Our risk assessment framework evaluates the following dimensions:

Risk assessments are reviewed and updated at least annually, or more frequently when triggered by regulatory changes, emerging threats, or significant business changes.

4.1 Customer Identification & Verification

You can make purchases on KryptoMate with guest checkout, and identity verification is not required for every order. We apply a risk-based approach: we may require you to verify your identity, through our verification partner's secure process, before or after a transaction, based on risk, transaction value or volume thresholds, product type, payment method, unusual activity, or a legal obligation. We may hold, refuse, or refund an order until verification is completed. Where verification is required, our tiered KYC process is designed to balance security with user experience:

4.2 Verification Process

Identity verification is conducted through a combination of automated AI-powered systems and manual review by trained compliance personnel, utilizing trusted third-party verification providers. Automated checks include document authenticity verification, facial recognition matching, liveness detection, and database cross-referencing. Standard verification is typically completed within minutes for automated approvals, or within 24 to 48 hours when manual review is required.

4.3 Business & Wholesale Verification

Wholesale and business accounts are subject to additional verification requirements, including company registration documents, certificate of incorporation, articles of association, identification of all Ultimate Beneficial Owners (UBOs) holding 25% or more ownership, director identification, and proof of business address. Enhanced due diligence is applied to all wholesale relationships.

4.4 Ongoing Monitoring & Periodic Review

KYC is not a one-time event. We conduct ongoing monitoring to ensure customer activity remains consistent with their known risk profile. Customer records and risk assessments are reviewed periodically: annually for standard-risk customers, semi-annually for medium-risk customers, and quarterly for high-risk customers. Updated documentation may be requested at any time based on changes in risk profile or regulatory requirements.

Enhanced Due Diligence (EDD) measures are applied in the following circumstances:

• 1Politically Exposed Persons (PEPs), their family members, and known close associates.
• 2Customers resident in or conducting transactions involving high-risk or sanctioned jurisdictions.
• 3Unusually large, complex, or economically purposeless transactions.
• 4Customers whose source of funds or source of wealth cannot be readily determined or verified.
• 5Wholesale and business accounts with complex ownership structures.
• 6Transactions involving privacy coins, mixing services, or high-risk blockchain addresses.
• 7Customers flagged by internal monitoring systems or external intelligence.

EDD measures may include, but are not limited to: additional identification documents, enhanced background and adverse media checks, detailed source of funds and source of wealth declarations with supporting evidence, reduced transaction limits, increased monitoring frequency, senior management approval for the business relationship, and periodic relationship reviews.

We employ a multi-layered transaction monitoring framework combining automated systems with expert human analysis:

All customers, beneficial owners, and transactions are screened against applicable sanctions lists, including:

• 1United Nations Security Council Consolidated List.
• 2U.S. Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) List and other OFAC lists.
• 3European Union Consolidated Financial Sanctions List.
• 4UK HM Treasury Financial Sanctions List.
• 5Other applicable national, regional, and international sanctions lists.

Screening is performed at account creation, at the time of each transaction, periodically during the business relationship, and whenever sanctions lists are updated. Confirmed matches result in immediate account freezing, transaction blocking, and mandatory reporting to the relevant authorities. Potential matches are escalated for manual review and resolution.

When suspicious activity is identified, the following procedure is followed:

• 1The transaction, account, or activity is flagged and immediately escalated to the Compliance team.
• 2A thorough investigation is conducted, including review of the customer's profile, transaction history, verification documents, and any available external intelligence.
• 3If the investigation confirms reasonable grounds for suspicion, a Suspicious Activity Report (SAR) is filed with the appropriate Financial Intelligence Unit (FIU) within the legally required timeframe.
• 4The customer is not informed of the filing or the investigation. Tipping off is a criminal offense under most AML legislation.
• 5All relevant records, evidence, and investigation notes are preserved and made available to authorities upon lawful request.
• 6The account may be suspended, restricted, or terminated based on the severity of the findings and regulatory guidance.

KryptoMate applies enhanced scrutiny to all relationships involving PEPs, including:

• 1Senior management approval before establishing or continuing the business relationship.
• 2Establishing and verifying the source of wealth and source of funds through documentary evidence.
• 3Enhanced ongoing monitoring of all transactions and account activity.
• 4Regular review (at least quarterly) of PEP status, associated risk level, and relationship justification.
• 5Screening of family members and known close associates of identified PEPs.

We maintain comprehensive records of all customer identification and verification documents, transaction records, risk assessments, monitoring alerts, investigation files, SAR filings, and compliance decisions. Records are retained for a minimum of five (5) years after the end of the business relationship or the date of the transaction, whichever is later, or longer where required by applicable law. Records are stored securely with appropriate access controls and are available for inspection by regulatory authorities upon lawful request.

All KryptoMate employees, contractors, and relevant third parties receive comprehensive AML/KYC training, including:

• 1Recognition of money laundering, terrorist financing, and financial crime indicators and red flags.
• 2KYC verification procedures, documentation requirements, and escalation protocols.
• 3Internal and external reporting obligations, including SAR filing procedures.
• 4Sanctions compliance, screening procedures, and embargo requirements.
• 5Cryptocurrency-specific risks, including blockchain analytics, privacy coins, and DeFi-related typologies.
• 6Regulatory changes, enforcement actions, and emerging financial crime trends.

Training is provided upon onboarding and refreshed at least annually, with additional targeted training when significant regulatory changes occur or new products/services are launched.

KryptoMate's designated Money Laundering Reporting Officer (MLRO) / AML Compliance Officer is responsible for:

• 1Overseeing the design, implementation, and effectiveness of this AML & KYC Policy and all related procedures.
• 2Ensuring compliance with all applicable AML/CFT laws, regulations, and regulatory guidance.
• 3Reviewing, approving, and filing Suspicious Activity Reports with relevant authorities.
• 4Liaising with regulatory authorities, Financial Intelligence Units, and law enforcement agencies.
• 5Conducting and overseeing the enterprise-wide risk assessment.
• 6Reporting to senior management and the board on compliance matters, risks, and program effectiveness.
• 7Conducting periodic independent reviews and updates of this policy and related procedures.

KryptoMate fully cooperates with law enforcement agencies, regulatory authorities, Financial Intelligence Units, and other competent bodies. We respond promptly and comprehensively to lawful requests for information, production orders, freezing orders, and other legal processes. We do not require a court order to voluntarily report suspicious activity to the relevant FIU.

Users who fail to comply with KYC requirements, provide false or misleading information, or are found to be involved in prohibited activities may face one or more of the following consequences:

• 1Immediate account suspension or restriction.
• 2Transaction reversal or freezing of funds (where legally required or permitted).
• 3Permanent account termination and ban from the Platform.
• 4Reporting to relevant law enforcement and regulatory authorities.
• 5Pursuit of civil or criminal legal remedies as appropriate.

Our AML/KYC compliance program is subject to periodic independent audit by qualified external auditors. Audit findings and recommendations are reported to senior management and acted upon in a timely manner to ensure continuous improvement of our compliance framework.

For questions regarding our AML & KYC Policy, to report suspicious activity, or for compliance-related inquiries: