AML & KYC policy

Our position

We do not make exceptions to these checks. Not for size, not for urgency, not for referral. A counterparty who objects to verification is telling you something useful.

The thresholds that apply to us

Virtual asset service providers are held to a much lower threshold than banks. The FATF standard sets customer due diligence on occasional transactions at USD/EUR 15,000 for financial institutions generally, but USD/EUR 1,000 for virtual asset service providers, a fifteenfold difference. Any policy copied from a bank is wrong by that margin.

Since our minimum deal size is $5,000, every deal we handle sits well above the threshold. In practice there is no deal we do not verify.

Linked transactions aggregate. Splitting a deal into smaller pieces to sit under a threshold does not work and is itself a reporting trigger.

The Travel Rule

Identifying information must accompany a transfer. Above the USD/EUR 1,000 line this means:

• The originator's name, verified against government-issued identification
• The originator's wallet identifier
• One further originator identifier: a physical address, national identity number, customer identification number, or date and place of birth
• The beneficiary's name and wallet identifier

Below that line, names and wallet identifiers alone.

Regional floors are lower, not higher. Dubai applies AED 3,500 under the VARA Travel Rule circular of 24 February 2026. Bahrain applies no de minimis at all. The rule attaches to every transfer.

Customer due diligence

Before we act on any deal, for both parties:

• Verification of identity: government-issued photographic identification for individuals; incorporation documents, ownership structure and ultimate beneficial ownership for companies
• Verification of address
• Evidence of source of funds, proportionate to the value of the deal
• Screening against sanctions lists and politically-exposed-person databases
• On-chain screening of every wallet address involved

Enhanced due diligence applies to politically exposed persons and their close associates, counterparties in jurisdictions on the FATF list for increased monitoring, structures that obscure beneficial ownership, and any deal whose stated purpose does not match its shape.

Wallet screening

Every address in a deal is screened before funding. Addresses with exposure to sanctioned entities, known theft, ransomware, darknet markets or mixing services will not be accepted, and we do not accept assurances in place of a clean screen.

We screen with Crystal Intelligence.

Ongoing monitoring

We monitor for the life of the escrow. Where activity is inconsistent with what we were told at onboarding we will ask, and we may suspend the deal while we do.

When we decline

We will not proceed where:

• Either party refuses or fails verification
• A wallet fails screening
• We cannot establish the source of funds to our satisfaction
• The deal appears structured to avoid a threshold or to disguise its purpose
• A party is in a restricted jurisdiction. See Restricted Jurisdictions
• We have reasonable grounds to suspect the deal involves the proceeds of crime

We are not always permitted to tell you why. Where disclosure is prohibited we will say only that we cannot act.

Reporting, and why we cannot tell you about it

Where we suspect money laundering or terrorist financing we must report it to the relevant financial intelligence unit. In Kuwait that is the Kuwait Financial Intelligence Unit, and reports go without delay and regardless of value. In the UAE reporting is through the goAML platform.

Telling you that a report has been made is a criminal offence. In the UAE, tipping off carries a minimum of six months' imprisonment and a fine of AED 100,000 to 500,000 under Article 25 of Federal Decree-Law No. 20 of 2018, extended in 2025 to cover grossly negligent disclosure as well as deliberate.

This obligation overrides our duty of confidentiality to you. We would rather you knew that in advance.

Record keeping

Five years, consistently across every regime that could apply to us: FATF Recommendation 11, Kuwait's Law No. 106 of 2013, UAE Federal Decree-Law No. 20 of 2018, and Bahraini requirements. The clock runs from the end of the business relationship or the date of the transaction, whichever is later.

This obligation constrains what we can delete on request. See Privacy Policy.

Responsibility

This policy is owned by our Compliance Officer, who also acts as Money Laundering Reporting Officer and holds a CAMS qualification. The role is deliberately separate from Operations, so the person running a deal is never the person deciding whether it should be reported.

Every member of staff completes AML training on joining and refresher training annually, covering typologies specific to virtual assets, sanctions, the Travel Rule, and the tipping-off prohibition. Training records are retained for five years and are available to the regulator on request.

Which regime binds us

As a Category 2 Crypto-Asset Services Company licensed by the Central Bank of Bahrain, we are bound by Bahrain's AML framework and by the CBB Rulebook, which implement the FATF standard.

The instrument that governs us directly is Volume 6 (Capital Markets) of the CBB Rulebook, Crypto-Asset Module (CRA). The CRA Module does not restate everything from scratch. It imports rules from elsewhere in the Rulebook, and two imports matter to you in particular:

• Client assets. The CRA Module applies the segregation and handling rules for clients' assets and money set out in the CBB's Market Intermediaries and Representatives (MIR) module. That is the rule under which client crypto-assets are held separately from our own and are not available to our creditors.
• Financial crime. Customer due diligence, sanctions screening, suspicious-transaction reporting and record-keeping run to the Bahraini AML framework applied through the Rulebook, on top of which we are subject to periodic reporting and audit obligations to the CBB.

Being licensed changes the enforcement, not the standard. Everything above is what we would do regardless; what the licence adds is a regulator entitled to inspect whether we actually do it, approved-person status for our Compliance Officer, and consequences that do not depend on a client noticing first.

Where a deal has a Kuwaiti nexus, Kuwait's Law No. 106 of 2013 is relevant to our counterparties even though it does not license us, and CMA Circular No. (10) of 2023 attaches its own penalties by reference to Article 15 of that law. See Regulatory status.