de
ANTI-MONEY LAUNDERING AND COMBATING TERRORIST FINANCING POLICY AND PROCEDURES OF THE COMPANY.
1. Introduction
The objective of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (hereinafter: the AML/CTF
Act) is to help detect and deter money laundering and the financing of terrorist activities. The following Policy
and Procedures outlines the minimum regulatory requirements applicable to The company. Limited (hereinafter The
company.) business operations.
The company. has responsibilities to ensure that the company complies with requisite AML/CTF legislation,
consisting of but not limited to, the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its
relevant by-laws and Guidelines. All employees of the company, including Senior Management have individual
obligations in respect of the prevention of money laundering and terrorist financing. These are taken seriously at
all levels and robust measures are taken to ensure that any efforts to launder the proceeds of criminal activity
through company operations are prevented and reported.
In order to ensure that the company and its employees are not in breach of AML/CTF Act, The company. will:
1. Establish and implement a program intended to ensure their compliance with the provisions of the Proceeds of Crime (Money
Laundering) and Terrorist Financing Act.
2. Appoint an AML/CTF Compliance Officer, who is part of the senior management, and a corresponding AML/CFT support
team.
3. Deliver staff training at all levels on topics such as, but not limited to, the obligations prescribed by the
AML/CTF Act, the types of money laundering and terrorist financing risks that face the company, and the processes
and procedures prescribed by the AML/CTF Program.
4. Operate an independent audit process that validates the undertaken measures and ensures they are following the
AML/CTF Act and other applicable regulations whilst also identifying any points of difficulty or uncertainty.
5. Conduct a risk assessment of the organization, while ensuring that clients and businesses deemed high risk are
given extra examination.
6. Maintain reports, records of anti-money laundering, and counter terrorist financing activities for inspection by
the supervisory authority.
7. Provide a source of communication for all enquiries or questions regarding The Policy and create a reporting
procedure that directs information to the AML/CTF Compliance Officer.
8. Ensures that all suspicious matters, including risks related to money laundering, terrorist financing or other
crimes, are quickly reported to FINTRAC.
9. Ensure that all regulatory reporting, such as transaction and compliance reports, are done in a timely and
comprehensive manner.
10. Examine actions committed by employees that are in breach of company policies and procedures and take corrective
action such as disciplinary action or summary dismissal.
11. Undertake appropriate measures to ensure that Know Your Customer Procedures are applied to all customers.
12. Implement a Sanctions Program that utilizes information from all applicable Sanctions list.
13. Undertake activities to keep records at least five years from the date record was created.
14. This policy will be updated according to the new legislation and regulations. Additionally, the company's entire
compliance procedures will undergo a two-year effectiveness review, the goal of which is to identify the success of
the program and undertake any measures to improve procedures.
When suspicion of money laundering or terrorist financing arises, The company. will ensure that it is dealt
with appropriately, with regards to individual circumstances and the requirements of the relevant legislation.
The company. recognizes that failure to comply with the AML/CTF Act, on its part, or any individual employed by
the company, may result in sanctions being imposed against the company and that these sanctions may include
prosecution, loss of license, fines, confiscation and could affect the ability of its operation.
2. Definitions
| Term | Definition |
|---|---|
| AML/CTF Act | Proceeds of Crime (Money Laundering) and Terrorist Financing Act. |
| AML/CTF Regulations |
|
| FINTRAC | Financial Transactions and Reports Analysis Centre of Canada. |
| The Company | The company. |
| Funds | Assets, economic resources or properties of any value or type, however acquired, whether material or immaterial, movable or immovable, tangible or intangible, along with documents, deeds, transfers, letters of credit and instruments of any form, including digital currencies or electronic or digital systems and bank credits that evidence ownership or interest therein, also all types of commercial papers, securities, or any interest, profit or other income generated from such funds. |
| Financial Institution (FI) | Any conduct as a business one or more of the financial activities or operations, including but not limited to a bank, building society, credit union. |
| Customer | The person whose digital currency or money is exchanged. The company accepts only individuals as customers. |
| Beneficial Owner | Any individual who is entitled (either directly or indirectly) to exercise 25% or more of the voting rights, including a power of veto, or holds the position of senior managing official (or equivalent); any individual who holds the power to appoint or remove the trustees of the trust; any individual that would be entitled on dissolution to 25% or more of the property of the association or registered co-operative. |
| PEP | Politically Exposed Person. |
| Business relationship | Relationship with a continuing nature, which is established between the company and its customers. |
| Shell Bank | A bank that is incorporated or licensed in a country in which it has no physical presence and that is unaffiliated with a regulated financial group that is subject to regulation and supervision. |
| Transaction | Disposition of funds, including depositing, withdrawing, transferring, selling, purchasing, exchanging digital currency for fiat currency or fiat currency for digital currency. |
| KYC Procedure | Know Your Customer Procedure. |
| Due Diligence Measures | The process of obtaining or verifying information on a customer or beneficial owner to enable the company to assess the extent to which the customer exposes it to a range of risks. |
| CDD | Customer Due Diligence. |
| EDD | Enhanced Due Diligence. |
| SDD | Simplified Due Diligence. |
3. Scope of the Policy and Procedures
The Policy is applicable to all employees of the company, including Senior Management.
The AML/CTF Compliance Officer is responsible for overseeing the regulations stipulated in The Policy and is
responsible to implement regular updates when necessary. The Policy is to be updated upon any changes in the
AML/CTF legislation or in the event of any significant changes in the business model of The company.
Senior Management is responsible for ensuring that adequate resources are in place so that the company is able to
comply with all applicable legislation. This includes, but is not limited to, providing an adequate number of
high-qualified staff, adequate training budgets, and providing direct contact between the AML/CTF Compliance
Officer and Senior Management.
All employees are obligated to cooperate with the AML/CTF Compliance Officer and must report any activity that may
arise from their daily activities and are related to the implementation of the AML/CTF legislation.
4. Risk Based Approach
The RBA ensures that before offering a new product, the company will undergo a risk assessment to identify the
potential for the product to be used for the purposes of money laundering and terrorist financing.
The Risk Assessment should provide the company with all necessary information to identify any risks of money
laundering and terrorist financing the company faces. The Risk Assessment is tailored specific to the company
insofar that the volume is appropriate to the size of the company, the type of business the company conducts, the
geographic area where business is conducted, the profile of its customers, and regulatory requirements, are all
considered. The Risk Assessment should provide the company with information regarding any residual risk.
The RBA identifies two types of risks: inherent and residual. Inherent risks are the risks that exist before
control measures are implemented, on the other hand, residual risks are the risks that exist after controls have
been put into place. When risks are identified through the RBA, each risk is classified into one of these two
categories.
The next component of the RBA is mitigation of the risks identified in the Risk Assessment. The mitigation of
these risks is done on three levels.
The first line of defense is the employee that interacts with the customer. Communicating properly designed Know
Your Customer (hereinafter "KYC") processes to all the employees that interact with customers is a key element in
establishing the first line of defense. The Customer Due Diligence (CDD) process intends to identify where
enhanced due diligence and simplified due diligence needs to be performed.
The second line of defense are the AML specific employees. AML specific employees have relevant anti money
laundering training. This includes, but is not limited to, thorough training of this Policy, FINTRAC specific
training, PCMLTFA legislation and regulations training, and general anti-fraud training. Moreover, AML employees
are required to train the rest of the employees in the company, including the senior management, in regard to AML
procedures.
The third line of defense in the company is the Internal Audit. Independent audits of the AML system will assess
all activities that are performed by AML dedicated Employees, including but not limited to the internal
regulations, reporting training, record keeping, transaction monitoring and software used.
Risk Based Approach Cycle
The company. follows the RBA cycle that has been laid out by FINTRAC. The company engages in the following to meet
the cycle's requirements.
The company. begins by assessing the organization for any risks that exist related to products, delivery channels,
geographical issues, new technologies, certain clients and business relationships, the activities of foreign
affiliates, and any other relevant factors.
This risk assessment begins by The company. introspectively looking at the entire business operation. When a risk
is identified, the organization will record such risk, label the severity of the risk, the reason why the risk is
concerning, and an action plan to minimize the risk.
During this process the company is also determining and managing its risk tolerance. The company operates a
cryptocurrency exchange, which inherently brings risk given the ill perceived idea that cryptocurrency is
untraceable. Therefore, The company. operates with a risk tolerance that is more sensitive. The company. will
then evaluate the residual risks that have been mitigated. If the residual risks exceed the risk tolerance for the
company, a new action plan will need to be implemented to further mitigate the risk.
This process will be continuously audited and reviewed by The company. to ensure that new risks are identified,
action items are continuing to mitigate risks, and the overall system is working.
5. Money Laundering and Terrorist Financing
Definitions of Money Laundering and Terrorist Financing. Money laundering is the process of converting the
proceeds of illegal activities into funds that originate from seemingly legal sources without identifying their
true source, nature or ownership. Money Laundering involves the process of legalizing assets that originated from
criminal activities by incorporating them into legitimate channels of the financial system.
Terrorist financing includes providing or collecting funds or other assets by any means, directly or indirectly,
with the unlawful intention that they should be used, or in the knowledge that they are to be used in full or in
part, to carry out a terrorist act, to be used by a terrorist organization, or by an individual. The purpose of
financing terrorism is to arouse fear or fulfill certain political goals.
Terrorism financing may include financing from legitimate sources, such as loans, salaries, profit from business,
donations from or to Non-Profit Organizations, personal donations or humanitarian organizations. Individuals may
also use funds that are illegally obtained from criminal activities.
6. Differences between Money Laundering and Terrorist Financing
The main differences between money laundering and terrorist financing are presented in the table below:
| Money Laundering | Terrorist Financing | |
|---|---|---|
| Motivation | Profit | Ideology |
| Source of funds | From criminal activity. |
|
| Channels | Formal financial system. | Non-formal financial system. |
| Focus on detection | Suspicious transactions, not typical for the financial status of the customer or the expected activity. | Suspicious connections, seemingly non connected transactions that can lead to connected persons. |
| Amounts | Huge amount, usually structured to avoid the reporting limits. | Small amount, under the reporting threshold. |
7. Stages of Money Laundering
For the offense of money laundering to happen, a predicate offense that generates funds is required. The money
laundering process includes three stages: placement, layering and integration.
Predicate offense
Predicate offense includes all types of crimes where illegal funds are generated.
Placement
In this stage the purpose is to enter the "dirty" funds into the financial system, through either
financial institutions or non-financial institutions that carry out certain financial activities.
This phase can involve a series of transactions such as:
Purchase of gambling chips or placing bets.
Purchase of cryptocurrency through ATMs.
Scattering large sums of cash in small quantities.
Purchasing foreign money with the funds.
Repayment of loans or credit cards.
Co-mingling dirty funds with a legitimate cash in a business; and
Buying valuable items.
Layering
Layering includes numerous financial transactions in order to separate illegally obtained funds from their
source. In this stage the money launderer will send the funds across numerous different channels and entities. The
goal of this stage is to cover any trace, source, or ownership of the assets. Essentially, efforts to conceal the
funds from the original crime.
This stage includes:
Frequent transactions and frequent use of wire transfers.
Depositing funds that are quickly withdrawn.
Purchase and sale of valuable assets, monetary instruments, and digital assets.
Rapid exchange of currencies, where the deposit and outflow appear to be similar in aggregate value and timeframe.
Integration
The last stage of the money laundering process is integration, where the illegal funds are
integrated into the financial system as legal. The third phase places funds into the traditional economy, which
appears to have been derived from legal economic activity. At this stage of the money laundering process, it is
very difficult to distinguish illegal assets from legal assets. Money launderers can invest these funds into real
estate, luxury goods, or any type of business that they want.
8. Measures for Preventing Money Laundering and Terrorist Financing
AML/CTF Compliance Officer.
The company acknowledges the risk of being used in the process of money laundering and terrorist financing.
Therefore, the Manager appoints an AML/CTF Compliance Officer, who is responsible for identifying, assessing and
mitigating the risk that rises from money laundering and terrorist financing.
The AML/CTF Compliance Officer is responsible for ensuring that The Policy is implemented. All company matters
involving money laundering will be referred to the AML/CTF Compliance Officer for consideration and investigation.
This also includes such matters as consent to trade, the procedures for dealing with customers who may fall into
the category of politically exposed person (PEP), individuals subject to sanctions, individuals in which a
business relationship will increase the risk of money laundering and/or terrorist financing or may even expose the
company to the risk of regulatory fines.
The company. has a clearly laid down structure for reporting any suspicious activity regarding AML/CTF. It is the
AML/CTF Compliance Officer's responsibility to consider, investigate, and report such matters in a timely and
prescribed manner.
The roles and responsibilities of the AML/CTF Compliance Officer are as follows:
Identifying and monitoring alerts generated on customers' transactions.
Reporting of suspicious activity to FINTRAC.
Identifying trends and system weaknesses which may expose the company or its operators to risk of abuse by criminals.
Conducting training awareness programs for all company employees, including senior management.
Managing, monitoring, and auditing the effectiveness of all AML/CTF policies and procedures.
Awareness of all current and relevant AML/CTF legislation, processes, and guidance.
Ensuring that all guidance and information from the Regulatory Authorities is received, understood, and implemented within the company's procedures.
Managing the processes used to identify individuals affected by sanctions.
Preparing and presenting periodic reports, which show changes to the AML/CTF processes or legislation, and the typologies of cases considered and reported by staff.
Managing and coordinating regulatory examinations.
Communicating with the Board of Directors regarding any risks that have been identified.
Acting as a liaison with 3rd Party Suppliers.
If the necessary preventive measures are delegated to another financial institution, the AML/CTF Compliance Officer
will oversee that system to ensure that all measures are considered by that financial institution. This includes,
but is not limited to, sanctions, due diligence, identification and verification of the customers, identifying the
purpose and nature of business relationship, and monitoring of transactions. The Manager of the company has the
authority to delegate these processes, after being provided with the opinion of the AML/CTF Compliance Officer.
The company should be confident in the third-party provider's ability to meet compliance standards, especially if
the third party carries out CDD. In any case, The AML/CTF Compliance Officer and the Board of Directors retain
ultimate responsibility.
For efficient operations of the AML/CTF Compliance Officer, the company ensures at least the following conditions:
independence of the AML/CTF Compliance Officer;
direct access to electronic databases and timely access to all information;
establishing direct communication with the Board of Directors;
resources for training.
For a person to be appointed as AML/CTF Compliance Officer, the company ensures that the person appointed meets high professional and ethical standards such as:
has not been convicted of offenses against property, public finances, payment operations, public office, public order, or against humanity and international law;
has relevant education, professional knowledge, and experience in the field of money laundering and terrorism financing;
has good knowledge of the entity's business and business processes;
has the necessary authority and access to resources in order to implement an effective compliance program and make any desired changes;
understands the business sector's requirements under the PCMLTFA and associated Regulations;
The appointed AML/CTF Compliance Officer is a member of the Senior Management of the company.
9. Employee Due Diligence Procedure
The Employee Due Diligence Procedure sets the principles for adequate screening of potential employee Candidates.
The AML/CTF Compliance Officer is responsible for overseeing the process of employing individuals that may misuse
company services for money laundering and/or terrorist financing activities.
Employees that are involved in monetary transactions, the onboarding of clients, and all employees on managerial
level in the company, are subject to appropriate screening before signing employment agreements.
The social media presence of employees will also be checked on a regular basis to confirm that the employee is not
living beyond their means or engaging in activity that may facilitate money laundering or terrorist financing.
This procedure is also applied when employees are promoted, in particular when that promotion could allow the
employee to facilitate money laundering or terrorist financing.
An employee that breaches the provisions of The Policy may be subject to one or more of the following activities:
retraining of the company's AML training program, with specific attention to the area of the breach;
reassigning to a working position that does not present a risk of money laundering or terrorist financing;
dismissing and terminating the employment agreement.
The Manager of the company has the right to decide which action shall be undertaken if an employee breaches the
provisions of this Policy and Procedures.
10. AML/CTF Training Procedure
The company provides training to all its employees including the members of Senior Management. All employees are
trained on anti-money laundering and terrorist financing procedures and regulations. The training is used to
increase all employees' knowledge and raise awareness of the subject. Training is performed at least on an annual
basis and is conducted by the AML/CTF Compliance Officer or third parties, with relevant knowledge of the prevention
of money laundering and terrorist financing, that have been approved by the AML/CTF Compliance Officer.
The training may be conducted in-class or online. The vast majority of The company. employees operate remotely,
thus this training is likely to be performed online.
The topics that should be presented for all employees during the training sessions are as follows:
introduction to the concepts of money laundering and terrorist financing;
legislation, guidelines, and international standards used for the prevention of money laundering and terrorist financing;
the stages of money laundering;
money laundering schemes;
how to prevent nefarious actors from using the company for money laundering and terrorist financing;
information regarding the companies KYC and verification measures for establishing a business relationship;
risk types of Customers, countries of payment and product;
activities related to money laundering and terrorist financing;
examples of cases for money laundering and terrorist financing.
This list is non exhaustive and can be changed from time to time as needed. The topics for training are subject to
change as new information and typologies for misusing The company. for money laundering and terrorist financing
come to light. In addition, since one of the training's purposes is for employees to implement these regulations
into their daily work processes, the training is updated upon changes in the relevant regulations.
The training for Senior Management includes but is not limited to:
introduction to the concepts of money laundering and terrorist financing;
legislation, guidelines, and international standards used for the prevention of money laundering and terrorist
financing;
how to prevent nefarious actors from using the company for money laundering and terrorist financing;
risk types of customers, countries, and products;
activities related to money laundering and terrorist financing;
examples of cases for money laundering and terrorist financing.
The list is non exhaustive and can be changed from time to time as needed. The topics for the training are subject
to change as new information and typologies for misusing the company for money laundering and terrorist
financing come to light.
Records for all training events will be held by the AML/CTF Compliance Officer, through a list of attendees, dates
of the training, and topics included.
11. Independent Audit
The company. will perform audits on the AML system, to monitor the processes, procedures, policies, and overall
activities undertaken to comply with the AML/CTF legislation. Accordingly, the AML audit is performed on an annual
basis.
The company will elect an independent audit function to test the effectiveness and adequacy of the measures
undertaken to comply with the relevant legislation. The audit function reports directly to the Manager of the
company.
At a minimum, the annual audit includes the following:
evaluation of internal policies and procedures related to AML/CTF, to determine compliance with the applicable legislation;
Review of the internal controls, related to money laundering and terrorist financing prevention, that are performed by the company;
review of the adequacy of the AML/CTF Risk Assessment;
transaction testing, with particular emphasis on high-risk transactions;
review of the actions prescribed by The Policy (ex. training, regular reporting, filed STRs, KYC, reporting to the Senior Management, etc.);
review of the sanctions program;
tracking of previously identified deficiencies and corrective measures taken for all findings that arise from the regular annual audit.
A report will be issued with the findings of the independent audit and will be presented to the manager of the
company.
The AML/CTF Compliance Officer is responsible for preparing an Action Plan, which includes all the findings of the
audit and the implementation deadlines for measures to improve processes, controls, policies, and procedures in the
company. The company should keep all records related to the performed audits.
12. Know Your Customer Procedure
Know Your Customer (KYC) procedures are the processes used to obtain and verify customer identities. The company
performs KYC verification on all individuals that create an account.
The primary goal of KYC procedures is to prevent the Company from being used in the process of money laundering,
terrorist financing, or other illegal activities. The company's KYC procedures have been created in
accordance with the requirements of Money Services Businesses as laid out by FINTRAC.
For every individual that creates an account with this company, the following information is collected:
A current government issued photo identification that indicates the person's legal name as well as a unique identifying number included in the document.
A utility bill or bank statement, in the name of the holder of the government issued ID, that confirms residential address.
The company. only accepts individuals (natural persons) as customers. All customers are subject to
appropriate levels of due diligence, using the risk-based approach that the Company has established.
Prior to establishing a business relationship with a customer, The company. identifies the customers that
represent an unacceptable risk related to money laundering and terrorist financing. The following categories of
customers are deemed high risk and a business relationship will not be established:
Individuals with expired personal identification documents.
Customers that are listed on the Consolidated Canadian Autonomous Sanctions List, including customers listed on
OFAC, European Union, FATF, and UN Security Council sanctions lists.
Customers whose identity cannot be verified.
Customers that request anonymity and refuse to provide identification information.
Customers that derive from the list of non-acceptable countries.
Customers whose beneficiary cannot be identified.
All customers, before entering into business relationships with the Company, are screened against all available
sanctions lists. An example of a KYC questionnaire is set in Appendix 4 and may be amended from time to time.
13. Customer Due Diligence
The company. adopts a risk-based approach for Customer Due Diligence as it understands that not all customers
present the same level of risk. The company performs Customer Due Diligence before the business relationship is
established.
The company. performs identity verification on all customers. This ensures protection against money laundering,
terrorist financing, and other crimes. The company. requires verification regardless of the amount of the
transaction.
Customer Due Diligence measures also apply at other appropriate times to existing customers on a risk-sensitive
basis. The company. engages in ongoing monitoring of customer transactions and addresses to ensure that the
customer's source of funds, or their outgoing transactions, are not in relation to any known nefarious actors or
entities, or have been linked to crime in any fashion.
We apply these measures on a risk-sensitive basis depending on the type of customer, the level of business,
deposit withdrawals amount, and the nature and source of the funds. Certain situations present a greater risk of
money laundering or terrorist financing. Higher risk customers (for example PEPs) will be subject to a higher
degree of due diligence (EDD).
We require a government-issued photo identification document to verify the identity of an individual. The company
accepts only documents that are:
authentic, valid, and current;
issued by a federal, provincial or territorial government (or by a foreign government if it is equivalent to a
Canadian document);
indicates the person's name;
includes a photo of the person;
includes a unique identifying number;
matches the name and appearance of the person being identified.
For individuals, the following information is collected:
full legal name;
residential Address;
Date of Birth;
copy of a government-issued photo identification document that matches client's information;
picture of the client's face that matches the provided Government's ID;
Date of Verification;
Email Address.
When a deposit into an individual's The company. account occurs, bank account information or a credit card number
will be collected.
In the course of establishing a business relationship with a customer, The company. undertakes relevant measures to
identify the beneficiary of the customer, if there are any.
The company. prohibits the use of third parties in conducting transactions, ensuring direct engagement with our
clients to mitigate risks and maintain the integrity of our AML policies.
14. Enhanced Due Diligence
Enhanced due diligence (EDD) occurs if the customer is categorized as High-Risk. Some countries are suspected to be
at a higher risk for money laundering activities and customers that have connections, whether business or residence
related, with these countries are automatically deemed High-Risk.
Customers that are considered to be High-Risk Customers by default are the following:
Politically Exposed Customers (PEPs);
Customers deriving from High-Risk Countries;
Customers that are employed in Cash based businesses;
Sellers of luxury goods and works of art;
Lawyers and Notaries, i.e. Gatekeepers.
Customers may be required to provide documents that verify the source of funds/wealth. The use of information
provided by third party intelligence service providers shall be used to consider the continuance or termination of
the business relationship with the customer and may in some cases result in the appropriate disclosure of such
information/intelligence to the appropriate regulatory authorities. In any case, EDD is performed if a customer
raises suspicion in any manner or meets the "red flag" requirements as outlined in Appendix 3.
In the verification stage, an electronic check of the information provided by the customer, using data from
multiple sources and across time, is completed. In certain high-risk situations, it may be necessary to consider and
assess the customer's source of funds and level of legitimate income, (i.e., their occupation). In these situations,
a pay stub, letter from their employer, or a bank statement will be accepted. This will assist in establishing if
it is in line with their known profile or if there is a reason for suspicion.
Additional Risk-based Information:
1. Source of funds/Source of Virtual Currency;
2. Tax Related Documents;
3. Employment Agreement.
In accordance with the applicable regulations, an additional personal identification document issued by an official
governmental body may be required. Also, for providing information regarding the customers' financial status and
source of funds, an Employment Agreement or Pay Stub will be accepted. Other documents and information from
reliable and independent sources can also be used in certain situations. If there are any doubts about the truth of
the provided documents, notarization will be demanded.
The information and documents obtained from customers that are considered as high-risk shall be updated at least
annually.
Politically Exposed Persons (PEP) and Heads of International Organization (HIO) Records.
Under Canada's AML/CTF legislation, a PEP is an individual, both foreign or domestic, who holds a prominent public
position or function in a government body or an international organization. PEPs are considered to be potentially
higher risk due to their position and potential access to wealth and resources. The company acknowledges that not
all PEP customers necessarily present a high risk of money laundering or terrorist financing, but as a risk
mitigation measure, the company categorizes all PEPs as High-risk Customers and will perform EDD measures on them.
A domestic PEP is considered to be a person who, at a given time, holds or has held one of the following positions
in the previous five years:
1. Governor General, lieutenant governor or head of government;
2. Member of the Senate or House of Commons or Member of a legislature of a province;
3. Deputy Minister or equivalent rank;
4. Ambassador, or Attaché or counselor of an Ambassador;
5. military officer with a rank of general or above;
6. president of a corporation that is wholly owned directly by His Majesty in right of Canada or a province;
7. head of a government agency;
8. judge of an Appellate Court in a province, the Federal Court of Appeal or the Supreme Court of Canada;
9. leader or president of a political party represented in a legislature;
10. holder of any prescribed office or position; or
11. mayor, reeve or other similar chief officer of a municipal or local government.
A foreign PEP is considered to be a person who holds or has held one of the following offices or positions in or on
behalf of a foreign state:
1. head of state or head of government;
2. member of the executive council of government or member of a legislature;
3. deputy minister or equivalent rank;
4. ambassador, or attaché or counselor of an ambassador;
5. military officer with a rank of general or above;
6. president of a state-owned company or a state-owned bank;
7. head of a government agency;
8. judge of a supreme court, constitutional court or other court of last resort;
9. leader or president of a political party represented in a legislature;
10. holder of any prescribed office or position.
Also, a family member of a politically exposed person shall include any individual who is related to a politically
exposed person as:
1. their spouse or common-law partner;
2. their child;
3. their mother or father;
4. the mother or father of their spouse or common-law partner; or
5. a child of their mother or father.
A close associate of a politically exposed person shall include any natural person who is known to have joint
beneficial ownership of a legal entity or legal arrangement or who is in a close business relationship with a
politically exposed person, or who has a beneficial ownership of a legal entity or legal arrangement which is known
to have been set up for the de facto benefit of a politically exposed person.
For all confirmed foreign PEPs, their family members, or close associates, and for all high-risk domestic PEP and
HIOs, their family members, or close associates, the following records will be kept and filed:
The office or position of the PEP or HIO (head of international organization).
The name of the organization or institution of the PEP or HIO.
The source of the funds/source of Virtual Currency, which were used for the transaction.
Source of Wealth.
The date it is determined the individual to be a PEP, HIO, their family member or close associate.
The date when the business relationship started or was reviewed.
15. Travel Rule Requirements
Since The company. is a registered Money Service Business engaging in the transfer of currencies, The company.
abides by the Travel Rule requirements, set out by FINTRAC, in its KYC verification procedure.
The company., for every currency transfer, collects information regarding:
the name, address and the account number or other reference number (if any) of the person or entity who requested the transfer (originator information);
and the name, address and the account number or other reference number (if any) of the beneficiary.
If The company. receives an electronic funds transfer without the aforementioned information, the company will
take reasonable steps to obtain the information. These steps include:
contacting the individual that sent the transaction;
analyzing all company records to see if any information on the sending individual is in company hands;
contacting the sending individual's bank to obtain information if an EFT was sent.
While The company. is engaging in measures to locate the required information, the transaction will be suspended. If
The company. is able to obtain the required information to comply with the travel rule, the transaction will be
accepted, and the information will be stored for future use. However, if The company. is unable to receive the
necessary information, the transaction will be rejected.
16. Risk Profiling and Customer Categorization
Conducting individualized risk assessments of all customers is an essential part of the AML program and is
necessary to prevent nefarious individuals from using the company for money laundering and terrorist financing
purposes. As part of the risk-based approach, the company carries out a risk assessment on each customer by
considering the following issues:
attribution data associated with addresses that send/receive funds with customer;
countries associated with the customer;
classifying the customer based on high volume, low volume, regular and occasional transactions;
duration of the business relationship with the customer;
the type of payment methods used by the customers;
identifying the customers that hold public positions, leading to higher possibility of corruption.
The customers of The company. are categorized in four risk profiles:
customers that represent unacceptable risk;
high risk customers;
medium risk customers;
low risk customers.
Customers deemed to present unacceptable risk will be denied a business relationship with The company. Customers
with high risk are to undergo Enhanced Due Diligence procedures. While customers deemed medium and low risk will
undergo traditional due diligence procedures. Customers deemed to be high risk will be required to update their
information at least every 2 years.
An example of a risk assessment is a part of The Policy and can be found in Appendix 1. The company will use this
risk assessment to determine what profile each customer fits into. Such profiles may be updated as new information
comes to light.
17. Transaction, Payment Type and Product Assessment
The company. accepts deposits via bank transfers and debit cards. Therefore, any risk from these types of
transactions is also assessed by other financial institutions. However, the company undertakes its own measures to
assess the risk imposed by certain types of payment methods.
The company. allows individuals to exchange electronically deposited fiat currencies for digital currencies. Using
the platform of the company, the customers can:
Buy currency
Sell currency
Exchange currency
All transactions above $10,000 CAD are subject to extra scrutiny. If an individual completes such a transaction,
The company. will be required to show proof of the source of the funds. If the customer is unable to provide proof,
the transaction will not be processed. In all circumstances The company. does not accept cash as a deposit or
provide cash for withdrawals.
18. Geographic Risk Analysis
The company accepts customers both from Canada and abroad. Therefore, in order to mitigate the geographic risk
that arises from providing services to customers who are not residents of Canada, the company maintains a list of
countries generally identified as high-risk. The list is non-exhaustive and is subject to ongoing changes. The
AML/CTF Compliance Officer is responsible for updating and maintaining the list.
The list of countries is prepared with regards to the lists of countries and territories imposed by the Canadian
authorities, FATF, IMF, EU, US Department of Treasury etc.
In any case, the company does not operate with individuals and entities deriving from or having connections to
Iran, the Democratic Republic of North Korea and Myanmar. If an individual's funds come from one of these
countries, the business relationship will be terminated. For customers from the acceptable, but high-risk,
countries stated on the list, EDD measures apply.
The list of countries is a part of The Policy and can be found in Appendix 2.
19. Sanctions Screening
Governments and financial authorities issue sanctions lists from time to time for the purpose of maintaining
international peace, security, respecting human rights, democracy, and rule of law.
Sanctions lists cover natural persons and/or legal entities that are, or have been involved in criminal activities
including money laundering and terrorist financing. Usually, sanctions lists cover illegal activities such as
narcotics trafficking, proliferation of weapons, tax offenses, money laundering, terrorist financing or terrorism.
Sanctions imposed by Canada on specific countries, organizations, or individuals vary and can encompass a variety
of measures, including restricting or prohibiting trade, financial transactions or other economic activity between
Canada and the target state; or the seizure or freezing of property situated in Canada.
Economic sanctions are a way to financially isolate a targeted person or entity. Sanctions generally fall into one
of the following categories:
targeted sanctions – imposed at specifically named individual;
sectoral sanctions – imposed at some sector of the economy;
comprehensive sanctions – that prohibit direct/indirect trading, brokering, financing against some goods, technology, or services.
Financial measures must be undertaken to correctly follow the issued sanctions lists. Sanctions lists are issued
from various institutions and governmental bodies. The company. uses including but not limited to sanctions lists
imposed by:
Consolidated Canadian Autonomous Sanctions List;
OFAC;
European Union;
FATF.
The company. understands that sanctions need to be implemented both at onboarding and in transaction monitoring.
The company. screens all customers across available sanctions lists prior to account setup.
In all cases that may or involve a customer that is subject to sanctions regime, the AML/CTF Compliance Officer has
the authorization to stop the transaction, delay its conduction, or refuse a transaction from being performed. If a
person that is subject to sanctions requests to establish a business relationship with the company, the AML/CTF
Compliance officer will make a Suspicious Transaction Report to FINTRAC as prescribed in the Regulatory Reporting
Procedure.
The AML/CTF Compliance Officer will ensure that the provided sanctions lists are comprehensive and updated on
regular bases.
20. Business Relationship Requirements
When a user creates an account with The company., a business relationship has been established. To meet the
FINTRAC KYC requirements, The company. engages in the following practices in all business relationships:
keeping a record of the nature of the business dealings;
Keeping a record of information that would be helpful to anticipate the types of transactions and activities the
client may conduct.
These records must be kept for at least 5 years after the creation of the records. The business relationship ends
5 years after the day the last account of the client was closed.
21. Transaction Monitoring and Reporting Procedure
There are two instances when transactions are reported: regular transaction reporting and suspicious transaction
reporting:
Suspicious Transaction or Attempted Transaction Report (STR).
A suspicious transaction report (STR) is a type of report that must be submitted to FINTRAC if there are reasonable
grounds to suspect that a financial transaction that occurs, or is attempted, is related to the commission or the
attempted commission of a money laundering or terrorist financing offense.
Pursuant to subsection 9(2) of the Proceeds of Crime (Money Laundering) and Terrorist Financing Suspicious
Transaction Reporting Regulations, "the person or entity shall send the report to the Centre as soon as practicable
after they have taken measures that enable them to establish that there are reasonable grounds to suspect that the
transaction or attempted transaction is related to the commission of a money laundering offense or a terrorist
activity financing offense."
For any situation where there are reasonable grounds to suspect that the transaction or attempted transaction is
related to a money laundering or terrorist financing offense, all employees are obliged to notify the AML/CTF
Compliance Officer immediately.
A suspicious activity is defined as activity that is inconsistent with a customer's known, legitimate activities.
Therefore, the first key to the recognition is having enough information about the customer and the customer's
normal expected activities to recognize when a transaction, or series of transactions, is unusual. Not all
transactions that are unusual are considered as suspicious.
All employees that have suspicion that a customer is making transactions or performing an activity in relation to
money laundering or terrorist financing have an obligation to report such to the AML/CTF Compliance officer.
A suspicious activity will often be an activity that is inconsistent with a customer's known, legitimate
activities. The company pays special attention to transactions with attribution data that suggests involvement with
nefarious actors or mixers, unusual large transactions, and all unusual patterns of transactions. The nature and
purpose of such transactions is examined and documented by the AML/CTF Compliance Officer.
Once the AML/CTF Compliance Officer has determined reasonable grounds to suspect that a transaction is related to a
money laundering offense or a terrorist activity financing offense, a suspicious transaction report must be sent to
FINTRAC as soon as practicable.
All employees are forbidden to inform anyone, including the client, about the contents of a suspicious transaction
report or even that The company. have made such a report.
The Suspicious Transaction Report contains, including but not limited to, the following information:
identity of the customer;
type and number of the Identification Document;
type, time, and place of the transaction;
size, destination, and origin of the funds;
explanation for the suspicion;
explanation of the transaction or activity.
In any case, the STR should be accompanied with all available information of the customer and the transaction or
activity that is reported.
Circumstances under which the transaction is categorized as unusual and suspicious are prescribed in Appendix 3.
The list of "red flags'' is updated and inexhaustible. Upon consideration of the AML/CTF Compliance officer, a
transaction or an activity can be reported even if no "red flags" contained in Appendix 3 are identified.
22. Transaction Reporting
The company. has the responsibility to report certain transactions performed by its customers on a regular basis.
Electronic Fund transfer report.
An Electronic Fund transfer report must be submitted to FINTRAC when The company. receives electronic funds in an
amount equivalent to $10,000 CAD or more in the course of a single transaction, electronic transfer, when it
receives two or more transfers, that total the equivalent of $10,000 CAD or more within a consecutive 24-hour
window, by or on behalf of the same person or entity, or for the same beneficiary.
Electronic fund transfer Transaction Reports are submitted to FINTRAC within five working days after the day the
amount is received.
Once a report has been sent to FINTRAC, a copy MUST be retained by the company and filed, in accordance with record
keeping requirements.
23. Terrorist Property Report
The company. is required to submit a Terrorist Property Report (TPR) to FINTRAC as per s.83.1 of the Criminal Code.
Property in this sense is deemed to be anything that is owned or controlled by a person or entity. This includes
cash, virtual currency, accounts, real estate, and insurance policies, amongst others.
The company. will immediately submit a TPR to FINTRAC when the company is required to make a disclosure. The
company. utilizes blockchain forensic software which provides attribution data for cryptocurrency addresses. This
data will allow The company. to identify if a client is completing transactions or storing funds in relation to a
terrorist group or terrorist activity.
In the TPR, The company. will disclose the individual and the existence of property in the possession of control
that the company has reason to believe is in their control. The company. follows the guidance of Regulations
Implementing the United Nations Resolutions on the Suppression of Terrorism for determining when "reasonable
grounds" have been met, which deems reasonable grounds to believe that the individual:
has carried out, attempted to carry out, participated in or facilitated the carrying out of a terrorist activity;
is controlled directly or indirectly by any such individual or entity;
or is acting on behalf of, or at the direction of, or in association with any such individual or entity.
Where there are economic sanctions, The company. is required to prohibit or restrict activities in accordance with
the legal requirements. In some cases, The company. may be required to freeze property, in addition to making
reports to various government and law agencies.
24. Record Keeping Requirements
The employees involved in the onboarding process will document the verification procedure, including all
identifying information provided by a customer, the methods used, the results of verification, and the resolution
of any discrepancies identified in the verification process. The company. will keep records containing a
description of any document that is provided to verify a customer's identity, noting the type of document, any
identification number contained in the document, the place of issuance, and if any, the date of issuance and
expiration date.
The company. will also keep records containing a description of the result of each discovered substantive
discrepancy when verifying the identifying information obtained.
The company. will keep records of all transactions performed by its customers.
The company. will retain records of all identification information for at least five (5) years after the account has
been closed. Additionally, The company. will retain records regarding customer identity verification for at least
five (5) years after the record is made. Upon expiry of the retention period, the company will delete personal data,
unless otherwise provided for by other relevant rules and regulations which shall determine under which
circumstances the company may or shall further retain data.
If a customer is linked to a suspicion of money laundering or terrorist financing, the company will keep the
customer's records for at least ten (10) years after the potential suspicion was identified.
All documents and records related to the AML Audit, internal policies and procedures, and records for training,
will be kept by the company for at least ten (10) years.
Additionally, The company. maintains records in a fashion where any records requested by FINTRAC can be provided
within 30 days of request for examination.
25. Ministerial Directives
The Minister of Finance may issue directives that require reporting entities to apply countermeasures to
transactions coming from or going to designated foreign jurisdictions or entities and recommend the introduction
of regulations to restrict reporting entities from entering into a financial transaction coming from or going to
designated foreign jurisdictions or entities.
Reporting Entities, such as The company., will be notified by FINTRAC in the case of any new directives that have
been issued. This Policy will be updated whenever a new directive has been issued.
Currently, there are three directives in force that apply to The company. The company. restricts all transactions
from the countries identified in these directives.
Islamic Republic of Iran
This directive requires all MSBs to treat all financial transactions outbound from Iran as high-risk. As such, The
company. has determined that such transactions present an unacceptable risk for the organization, and all
transactions have been restricted.
In the event an individual tries to complete an outbound transaction from Iran, a requisite STR will be produced to
FINTRAC.
Democratic People's Republic of Korea
This directive requires all MSBs to treat all financial transactions outbound from North Korea as high risk. As
such, The company. has determined that such transactions present an unacceptable risk for the organization, and all
transactions have been restricted.
26. AML Compliance Process and Reporting Confidentiality
All measures that are undertaken for the prevention of money laundering and terrorist financing are subject to
confidentiality. In that manner, all employees of the company, including Senior Management, shall not disclose to
customers, or any other third-party, information that measures for the prevention of money laundering and
terrorist financing have been undertaken. This includes, but is not limited to, enhanced due diligence, Suspicious
Transactions Reporting, or that an investigation concerning money laundering or other crimes is in process.
A person commits an offense if they disclose that an investigation into allegations that an offense has been
committed is being contemplated or is being carried out, as this disclosure is likely to prejudice the investigation
and the information on which the disclosure is based on.
27. Penalties for Non-Compliance
Non-compliance with The company.'s policies subjects individuals and internal entities to stringent penalties.
These penalties are tiered according to the severity of the non-compliance, ranging from internal disciplinary
actions, such as warnings or suspension of account privileges, to financial penalties, including fines determined by
the extent of the regulatory breach. Severe violations may lead to termination of services and reporting to
regulatory authorities, potentially resulting in legal action.
Continuous monitoring ensures adherence, with regular updates to compliance training and awareness programs to
mitigate future risks. Non-compliance affecting the company's compliance status may also trigger comprehensive
audits to reassess risk management strategies and compliance frameworks.
28. Final Provisions
1. This Policy and Procedures enter into force on the day it is approved by the Manager of The company.
2. All employees of the company are obliged with the provisions of this Policy and Procedures.
3. All Appendices are an integral part of The Policy.
4. This Policy is reviewed and updated no less than on an annual basis, and if needed more often.
Appendix 1 – Example of Customer Risk Assessment
| Unacceptable risk | 3 points | 2 points | 1 point | |
|---|---|---|---|---|
| First and Last Name | Found on sanctions lists | / | / | / |
| Name of Company | / | / | / | / |
| Date of birth (for individual) | <18 | 18 – 25 | 26 – 36 | >36 |
| Residential address/Registered Address | ||||
| Country of origin/incorporation | Countries and territories categorized as non-acceptable as in Appendix 2 | Jurisdictions with strategic deficiencies in accordance to Countries and territories categorized as High risk as in Appendix 2 | All other Countries | Canada |
| State of origin/incorporation | ||||
| City | / | / | / | / |
| Phone number/Contact | / | Differs from country of nationality/residence | / | / |
| Occupation | Non-permitted activities in accordance with legislation. | NGOs, Off-shore companies, licensed casinos and gambling, companies that produce weapons. | Student | Companies from the private sector not already identified in higher risk categories or restricted by legislation (trade, finance, IT, manufacturing, healthcare etc.) |
| PEP/RCA/Family Member, Consulting companies, Lawyers, Notaries, Sellers of luxury goods and works of art, Customers that are employed in Cash based businesses, Customers deriving from High-Risk Countries. | Automatically set as High-risk customer. |
| RBA Determination | Points |
|---|---|
| No Business Relationship | Unacceptable Risk in any category |
| High Risk | 9–15 |
| Medium Risk | 4–8 |
| Low Risk | 0–3 |
Appendix 2 - List of Non-acceptable and High-risk Countries
Countries and territories categorized as high risk jurisdictions subject to a call for action:
1. Democratic People's Republic of Korea (DPKR/ North Korea).
2. Iran.
3. Myanmar.
Jurisdictions Under Increased Monitoring (High Risk):
1. Bulgaria
2. Burkina Faso
3. Cameroon
4. Democratic Republic of the Congo
5. Croatia
6. Haiti
7. Jamaica
8. Kenia
9. Mali
10. Mozambique
11. Namibia
12. Nigeria
13. Philippines
14. Senegal
15. South Africa
16. South Sudan
17. Surya
18. Tanzania
19. Turkiye
20. Vietnam
21. Yemen
22. Eritrea
23. Belarus
24. Central African Republic
25. Iraq
26. Lebanon
27. Libya
28. Nicaragua
29. Somalia
30. Venezuela
31. Zimbabwe
32. Andorra
33. Anguilla
34. Antigua and Barbuda
35. Bahamas
36. Belize
37. Bermuda
38. British Virgin Islands
39. Cooks Island
40. Jersey
41. Guernsey
42. Costa Rica
43. Cyprus
44. Dominika
45. Grenada
46. Mauritius
47. Marshall Islands
48. Russia
49. Bahrain
50. Macau
51. Malta
52. Monaco
53. Cayman Islands
54. Liechtenstein
55. Montserrat
56. Niue
57. Panama
58. Palau
59. Samoa
60. Seychelles
61. St. Kitts and Nevis
62. St. Lucia
63. St. Vincent and Grenadines
64. Turks and Caicos Islands
65. Vanuatu
66. Albania
67. Botswana
68. Cambodia
69. Ghana
70. Jamaica
71. Marocco
72. Nicaragua
73. Pakistan
74. Senegal
75. People's Republic of China
76. Ukraine
77. Myanmar.
Appendix 3 - List of Suspicion Indicators - Red Flags.
The list of suspicion indicators is non-exhaustive and subject to improvements and amendments. The list provides
guidelines for the AML/CTF Compliance Officer in the process of deciding whether the transaction or activity can
be categorized as suspicious.
1. There is information that the transaction is made in connection with Darkweb;
2. A customer or a counterparty involved in the transaction is found on List of sanctions;
3. Adverse media is found on the customer;
4. The customer does not provide adequate documents for identification and verification;
5. The customer is critical or has questions regarding the reporting procedures or AML procedures and policies of the company;
6. There is doubt about the veracity of the provided KYC information;
7. Customer derives from high-risk country;
8. Transactions are made from or to high-risk country;
9. There is doubt about the origin of fiat or virtual currency deposited on customers' accounts;
10. The customer requests to send funds overseas;
11. Virtual currency is deposited from an exchange registered in high-risk country or non-registered exchange;
12. New customers make large transactions, not in accordance with its economic profile;
13. Rapid movement of funds;
14. Customers requesting and insisting to deposit or withdraw cash;
15. Immediate request for withdrawing digital currency to wallet address outside the company or different wallet addresses;
16. Complex transactions with no legal or economical purpose.
Appendix 4 – KYC Questionnaire Individual/ Beneficiary
| Full Legal Name |
| Place of Residence |
| Government Issued ID Number |
| Nationality |
| Date of Birth |
| Primary Occupation |
| Sanction Check |
| PEP Check |