AML and KYC Policy

1 Purpose

This policy explains how BOLDHASH IBC prevents, detects and responds to money laundering, terrorist and proliferation financing, sanctions evasion, fraud and other financial crime. It is a summary of the controls we operate, written for our clients. Our full internal policies are confidential and are made available to KUNAISA and other competent authorities on request.
BOLDHASH IBC is licensed as a Virtual Asset Service Provider by the Kuna de Wargandí International Services Authority (KUNAISA) under licence number V0062026, and applies the FATF Recommendations together with the conditions of that licence.
We provide non-custodial exchange between fiat currency and virtual assets to individual clients only. We do not open accounts for companies or other legal persons.

2 Governance

We have appointed a Compliance Officer, who also acts as Money Laundering Reporting Officer. The Compliance Officer is independent of commercial functions, has unrestricted access to our records, systems and personnel, and reports to senior management.
The Compliance Officer is responsible for the operation of our AML framework, for reviewing higher- risk clients and enhanced due diligence cases, for oversight of screening and verification, and for record-keeping. Higher-risk relationships are approved by senior management on the Compliance Officer's recommendation; for politically exposed persons, senior management and the Compliance Officer approve jointly.
All personnel must apply our policies, complete AML training, and report any suspicion to the Compliance Officer without delay and without alerting the client.

3 Customer due diligence

We do not offer anonymous or numbered accounts, and we do not accept clients we cannot identify. Before we open a relationship we:
> • verify your identity from a government-issued passport or identity > card; > > • run a liveness check confirming that you are physically present and > that your face matches the document; > > • collect your country of residence, date of birth and nationality; > > • ask about your income, the origin of your assets, your professional > or business activity, your expected account turnover and the purpose > of the relationship; and > > • screen you against sanctions, politically-exposed-person and > adverse- media sources.
We use a specialist identity-verification provider for these checks. Where we rely on a third party for elements of due diligence, we obtain the resulting information immediately, satisfy ourselves that the provider is regulated, supervised and keeps due diligence records, and remain fully responsible for the adequacy of the due diligence.
We keep your information current throughout the relationship and will ask you to update or re-confirm it periodically, and whenever your circumstances or activity change.

4 Risk-based approach

We classify every client as low, medium or high risk. The classification takes account of country of residence, the nature and expected volume of activity, transaction frequency, politically-exposed- person status, the origin of assets, and the quality and consistency of the information we hold. The classification determines how closely we monitor the relationship and how often we review it.
Enhanced due diligence applies where a client is classified as high risk, where the relationship or activity reaches the thresholds set in our internal policy, where there is a connection to a higher-risk jurisdiction, where a client is a politically exposed person, or where activity is inconsistent with what we know about the client.
Enhanced due diligence means we take additional measures, which may include obtaining documentary evidence of source of wealth and source of funds — payslips, bank or brokerage statements, sale or investment contracts — rather than relying on what you tell us; obtaining further information on your tax residency and actual place of residence; applying more frequent monitoring with lower alert thresholds; reviewing the relationship more often; and obtaining approval before establishing or continuing it.

5 Sanctions and politically exposed persons

We screen clients, counterparties and wallet addresses against the sanctions lists maintained by the United Nations Security Council, OFAC, the European Union and the United Kingdom, on onboarding and daily thereafter.
A confirmed sanctions match on a client results in suspension of the relationship and of any processing, escalation to the Compliance Officer and, where legally required, notification of the competent authorities. We do not release assets or complete transactions in those circumstances without appropriate authority.
A sanctions connection short of a confirmed match on the client, and an adverse-media match relating to financial crime, are handled through enhanced due diligence rather than automatic refusal.
We identify foreign, domestic and international-organisation politically exposed persons, their family members and close associates, and apply a risk-based approach to persons who have left office. Politically-exposed-person status is not, by itself, a ground for refusing a relationship: it triggers enhanced due diligence and the joint approval described in section 2.

6 Transaction monitoring and blockchain analytics

We monitor fiat and virtual asset activity on an ongoing basis against the profile you gave us at onboarding, and investigate activity that is unusual, inconsistent or unexplained.
Incoming and outgoing wallet addresses are screened using blockchain analytics for exposure to darknet markets, stolen assets and exchange hacks, mixing and anonymisation services, sanctioned addresses and other illicit sources. Where a wallet presents unacceptable exposure, we decline or reject it.
Alerts are reviewed by the Compliance Officer. We may pause a transaction while a review is under way, ask you for further information or documents, and decline to proceed if the matter is not resolved satisfactorily.

7 Travel Rule

We apply the Travel Rule under FATF Recommendation 16, as applied to virtual asset service providers through Recommendation 15 and its Interpretive Note (INR.15), to virtual asset transfers at or above the applicable threshold.
For those transfers we obtain and check the originator's name, account number or wallet address and address details, and the beneficiary's name and account number or wallet address, and screen both against the applicable sanctions lists. Where required information is missing or incomplete, we do not execute the transfer and escalate it to the Compliance Officer.
For transfers to or from self-hosted wallets, we obtain the required counterparty information from you and verify your ownership and control of the wallet before processing.

8 Our non-custodial model

We do not provide wallets, and we do not hold or control your private keys. Every transfer is initiated and executed by you from a wallet you own and control, and references to a Company wallet are to technical blockchain addresses used for transaction routing only.
The fiat leg of every transaction must be paid from, or paid to, a bank account in your own name. Third- party payments and cash are not accepted. These rules are a control in themselves: they prevent the use of our services to move value between unconnected parties and reduce exposure to impersonation, stolen payment instruments and refund fraud.

9 Prohibited activity

We do not enter into or maintain a relationship with anyone we know or suspect to be involved in:
> • terrorist organisations or terrorist financing; > > • activity involving sanctioned individuals, entities or countries; > > • production or trafficking of illegal drugs; > > • human trafficking or forced labour; > > • child exploitation in any form; > > • illegal arms trafficking, or weapons of mass destruction and > proliferation; > > • unlicensed financial services, or shell banks; > > • ransomware and other cybercrime operations; > > • darknet markets and other illicit marketplaces; > > • fraud schemes and scams; > > • corruption and bribery networks; > > • production of counterfeit goods; or > > • unlicensed gambling operations.

10 Geographic restrictions

11 Reporting suspicion

We maintain an internal suspicious activity reporting process. Personnel escalate any suspicion to the Compliance Officer, who investigates and decides whether a report is warranted, and we report to KUNAISA and other competent authorities where legally required.
Where a suspicion has been raised or a report made, we are prohibited by law from telling the client. In those circumstances we cannot explain a decision to restrict, suspend or decline, and may not be able to give advance notice of it.

12 Records

We retain due diligence records, identity and verification documents, screening results, transaction records, internal reports and supporting analysis for a minimum of five years after the end of the relationship or the conclusion of the transaction, in line with the FATF Recommendations, and for longer where the law or a competent authority requires it. Records are stored securely and are retrievable on request by KUNAISA or another competent authority.
Personal data within those records is processed as described in our Privacy Policy.

13 What we may do

Where necessary for compliance, sanctions, fraud-prevention, legal or regulatory reasons, or where we suspect prohibited or high-risk activity, we may refuse to open a relationship, request further information, decline, delay, suspend or reverse a transaction, restrict or reject a wallet address, freeze funds or assets where required, suspend or terminate access, and report the matter to the competent authorities. We are not liable for loss arising from measures taken in good faith to comply with our legal and regulatory obligations.

14 What we expect from you

Give us accurate, complete and current information, and tell us when it changes. Use only your own bank account and your own wallet. Do not act on behalf of anyone else without telling us. Do not attempt to disguise your identity, location or the source or destination of funds, and do not try to circumvent our controls. Respond to requests for information and documents within the time we specify — if you do not, we may be unable to continue the relationship.

AML and KYC Policy

On this page

1

Purpose

2

Governance

3

Customer due diligence

4

Risk-based approach

5

Sanctions and politically exposed persons

6

Transaction monitoring and blockchain analytics

7

Travel Rule

8

Our non-custodial model

9

Prohibited activity

10

Geographic restrictions

11

Reporting suspicion

12

Records

13

What we may do

14

What we expect from you

15

Updates and contact