AML and KYC policy

In short

• Fundly follows a risk-based approach to preventing money laundering, terrorist financing and sanctions breaches.
• The Instant card uses simplified due diligence with strict limits. The Verified tier requires full identity verification.
• We screen every user against sanctions lists and every deposit with blockchain analytics.
• We do not open accounts without identifying the user, and we do not accept deposits from third parties without checks.
• We report suspicious activity to the authorities as the law requires.

Draft for legal review. Not yet in force.

1. Purpose of this summary

1.1 This is a public summary of the anti-money-laundering (AML), counter-terrorist-financing (CTF) and know-your-customer (KYC) programme operated by [LEGAL ENTITY NAME] ("Fundly") together with its regulated partners [ISSUER NAME], [EMI PARTNER NAME] and [VASP ENTITY NAME]. The full internal policy is confidential and is reviewed by our compliance function and by [REGULATOR] where applicable.

1.2 The programme is designed to meet [AML LEGISLATION] in [JURISDICTION], the requirements of [CARD NETWORK], and the guidance of the Financial Action Task Force.

2. Risk-based approach

2.1 We assess the risk of every customer, product, country and delivery channel. Each customer is assigned a risk rating when they sign up, and the rating is reviewed when their behaviour, tier or circumstances change.

2.2 Higher risk means more checks, lower limits or, where the risk cannot be managed, no service. Lower risk allows lighter checks within limits set by law and by our partners.

3. Simplified due diligence: the Instant card

3.1 The Instant card is offered under the simplified due diligence rules available for low-value, low-risk electronic money products in [JURISDICTION], and under the limits set by [ISSUER NAME].

3.2 Before an Instant card is issued we:

• verify the customer's email address and phone number;
• collect the customer's country of residence and nationality and confirm they are on the supported list;
• screen the customer against sanctions and politically exposed person lists;
• capture device and session information and run fraud checks;
• assign a risk rating.

3.3 Instant cards are subject to a monthly load limit of approximately [PROVIDER LIMIT] EUR equivalent, a per-transaction limit of approximately [PROVIDER LIMIT] EUR, no IBAN account, and no or very limited ATM access. These limits are set by our issuing partner and by regulation, not by marketing choice. They are the reason we can offer the tier with light verification.

3.4 A customer who reaches the limits, triggers a monitoring alert or wants a physical card or an account must complete full customer due diligence.

4. Customer due diligence: the Verified tier

4.1 Before a customer is upgraded to Verified we:

• verify their identity using a government-issued identity document, checked for authenticity through [KYC PROVIDER];
• match the document to the customer with a liveness check and biometric comparison;
• verify their residential address where the law or our partners require it;
• re-screen against sanctions and PEP lists;
• ask about the expected use of the account and, on request, the source of funds and source of wealth.

4.2 We refresh customer information periodically, based on risk, and whenever we have doubts about the information we hold.

5. Enhanced due diligence

5.1 We apply enhanced due diligence when a customer:

• is a politically exposed person, or a family member or close associate of one;
• lives in or has connections to a high-risk country as defined by the FATF or the EU;
• shows deposit patterns that do not match the stated purpose of the account;
• receives funds from addresses linked to mixers, sanctioned entities, darknet markets, ransomware or other high-risk categories;
• reaches volume thresholds set in our internal policy.

5.2 Enhanced due diligence may include senior management approval, source of funds evidence, additional documents and more frequent reviews.

6. Ongoing monitoring

6.1 We monitor accounts and transactions continuously. This includes:

• automated rules and behavioural models on deposits, conversions, card spend and transfers;
• blockchain analytics on every incoming deposit, checking the sending address and its history;
• alerts reviewed by trained compliance staff;
• periodic reviews of customer risk ratings.

6.2 We may pause, hold or return a transaction, request information or restrict an account while a review is carried out. Where the law allows we will explain what we need.

7. Sanctions

7.1 We screen customers, counterparties and blockchain addresses against the sanctions lists of the United Nations, the European Union, the United Kingdom, the United States (OFAC) and [JURISDICTION], and against lists required by our partners. Screening runs at onboarding, on every transaction and whenever lists change.

7.2 We do not provide services to sanctioned persons or to persons in countries subject to comprehensive sanctions.

8. Restricted countries

8.1 Fundly is available only in the countries on our supported list. We do not onboard residents of countries that are subject to comprehensive sanctions, that the FATF has called for countermeasures against, or where our partners do not have permission to operate. The list is reviewed regularly and published at /docs/getting-started/supported-countries.

9. Reporting

9.1 Where we know, suspect or have reasonable grounds to suspect that funds are linked to crime, we file a report with [FINANCIAL INTELLIGENCE UNIT] as required by law. We are not permitted to tell the customer that a report has been made.

9.2 We cooperate with lawful requests from regulators, law enforcement and courts.

10. Record keeping

10.1 We keep identity records, transaction records and the results of our checks for [RETENTION PERIOD] after the end of the customer relationship, typically 5 years, or longer where required by a regulator. Records are stored securely and access is restricted to staff who need it.

11. Training and governance

11.1 All staff receive AML training when they join and at least once a year. Our money laundering reporting officer, [MLRO NAME / TITLE], is responsible for the programme and reports to the board. The programme is audited independently at least annually.

12. What we never do

• We do not open accounts without identifying the user, and we do not offer accounts that cannot be traced to a person.
• We do not accept deposits from third parties on a user's behalf without checks.
• We do not allow users to hold more than one account.
• We do not allow business use on personal accounts.
• We do not market our service as a way to escape verification. Light verification exists for low-value use, within limits, and identity verification unlocks higher limits.

13. Contact

Questions about this summary: compliance@fundly.xyz. Reports of suspected misuse of Fundly: abuse@fundly.xyz.