KYC Policy
Know Your Customer · Safeguarding Financial Security

2. What is KYC

KYC (Know Your Customer) is the process by which a business verifies the identity of its clients, assesses their risk profile, and understands the nature of their business. KYC is a core component of AML and CTF compliance frameworks and a fundamental requirement of global financial regulators.

KYC typically consists of three core elements:

• Customer Identification Program (CIP): Collecting and verifying basic identity information.
• Customer Due Diligence (CDD): Gaining a deeper understanding of the client's business, source of funds, and purpose of transactions.
• Ongoing Monitoring: Continuously monitoring client transactions and business relationships to promptly detect suspicious activities.

3. Customer Identification

Before establishing any business relationship, we require clients to provide and verify the following identification information:

• Individuals: Full name, date of birth, nationality, residential address, contact details, and a valid government-issued ID (e.g., passport, driver's license).
• Corporate Clients: Legal name, registration number, registered address, business scope, beneficial owner information, incorporation documents, and identity proof of authorized representatives.
• Beneficial Owners: Identify and verify natural persons who directly or indirectly hold more than 25% of the company's equity or exercise actual control.
• Politically Exposed Persons (PEPs): Special identification and enhanced due diligence for PEPs, their family members, and close associates.

All identity verification documents must be valid, legible originals or certified copies.

4. Customer Due Diligence

After basic identification, we conduct varying degrees of due diligence based on the client's risk level:

• Standard Due Diligence (SDD): Applied to low-risk clients, including identity verification, understanding business nature, and assessing expected transaction patterns.
• Enhanced Due Diligence (EDD): Applied to high-risk clients (e.g., those from high-risk jurisdictions, complex ownership structures, high-risk industries), involving deeper background checks, source of funds verification, and beneficial owner penetration.
• Simplified Due Diligence (SDD): In certain low-risk circumstances, verification procedures may be reasonably simplified, provided there is a documented rationale.

5. Risk Rating

We adopt a risk‑based approach to classify clients. Risk ratings consider the following factors:

• Client Type: Inherent risk of different entity types – individuals, corporations, trusts, foundations, etc.
• Geographic Location: Money‑laundering / terrorist‑financing risk level of the client's country or region.
• Business Nature: Industry, business model, and transaction characteristics.
• Transaction Behaviour: Transaction volume, frequency, patterns, and anomalies.
• PEP Status: Whether the client is a PEP or associated with one.

Based on the assessment, clients are classified as low, medium, or high risk, and subject to corresponding monitoring and management measures.

6. Ongoing Monitoring

KYC is not a one‑time process but a continuing obligation throughout the entire client relationship lifecycle:

• Transaction Monitoring: Real‑time monitoring of client transactions to identify any unusual or suspicious activity.
• Periodic Reviews: Regularly update client information and risk assessments based on risk level – at least annually for low‑risk clients and at least semi‑annually for high‑risk clients.
• Trigger‑based Reviews: Re‑perform due diligence promptly when significant changes occur (e.g., ownership changes, business model shifts).
• Sanctions Screening: Regularly screen client information against global sanctions and watchlists.

7. Data Privacy and Protection

We strictly comply with data protection laws and regulations to ensure the security and privacy of client information:

• Client identity information is used solely for legitimate KYC/AML purposes and not for any other commercial use.
• Information is stored in encrypted, secure environments to prevent unauthorized access, disclosure, or loss.
• Disclosure of client information to third parties occurs only as required by law or with client consent.
• Clients have the right to access their personal data held by us and to request correction of inaccurate information.
• We adhere to the requirements of the U.S. Privacy Act, GDPR, and other international privacy regulations.

8. Record Keeping

We strictly maintain all KYC‑related records in accordance with legal requirements:

• Client identity verification records – kept for at least 5 years.
• Due diligence documents and risk assessment reports – kept for at least 5 years.
• Transaction records – kept for at least 5 years.
• Suspicious transaction reports and related investigation files – kept for at least 5 years.
• All records are traceable, complete, authentic, and readily accessible.

9. Employee Training

We are committed to ensuring that all employees fully understand KYC obligations and procedures through continuous training and education:

• New employees receive basic KYC and AML training upon onboarding.
• Front‑line and customer‑facing staff receive specialized client identification training.
• Compliance and risk management personnel receive enhanced professional training.
• Training content is regularly updated to reflect the latest regulatory requirements and industry best practices.
• Internal sharing and case studies enhance overall compliance awareness.

10. Third‑Party Management

We require all business partners, agents, consultants, and suppliers to adhere to KYC and AML compliance standards equivalent to our own:

• Conduct KYC/AML compliance assessments of third parties before establishing business relationships.
• Obtain written commitments from third parties to comply with applicable laws and this policy.
• Include KYC/AML compliance clauses and audit rights in contracts.
• Regularly review and monitor third‑party compliance performance.
• Implement enhanced monitoring measures for high‑risk third parties.

11. Consequences of Non‑Compliance

Individuals or entities that violate this policy will face serious consequences, including but not limited to:

• Employees: Disciplinary action – including warnings, suspension, demotion, dismissal, and, where applicable, referral to judicial authorities.
• Third Parties: Contract termination, disqualification, claims for damages, and, where applicable, reporting to regulatory authorities.
• The Company: Fines, reputational damage, and other legal liabilities resulting from non‑compliance.

We reserve the right to conduct internal investigations into any suspected violations and to take legal action when necessary.

12. Policy Review and Updates

This policy will be regularly reviewed and updated to ensure it remains aligned with the latest laws, regulations, regulatory requirements, and industry best practices. Material revisions will be communicated internally and published on our website.

We encourage employees and business partners to periodically review this policy to stay informed of current KYC compliance requirements.