AML Policy

Updated AML Policy

1. General Provisions Cryptoroyal.exchange (hereinafter — the “Service”) conducts its activities using a risk-based approach in the field of countering money laundering (AML), terrorist financing (CFT), and other illegal activities. This Policy defines:

• the model for assessing the risk of operations (Risk-Score Model);
• the procedure for AML analysis of transactions;
• KYC and SoF procedures;
• the procedure for blocking operations;
• conditions for the return of funds;
• the procedure for escalation of suspicious operations.

2. Risk-Based Model (Risk-Score Model) 2.1 AML Analyzers Used For the analysis of cryptocurrency transactions and addresses, the Service uses licensed blockchain analytics AML tools, including (depending on the network and asset):

• Crystal Blockchain
• AMLBot
• Chainalysis
• Elliptic
• TRM Labs

The analysis results form a quantitative risk indicator (Risk-Score).

2.2 Risk-Score Threshold Levels The risk assessment is based on:

• the source of funds origin
• transactional connections
• affiliation with high-risk categories (sanctions, darknet, ransomware, mixers, etc.)
• geographical factor

The following levels are applied:

If the score exceeds 70%, execution of the application is temporarily blocked until the verification is completed.

3. Preliminary AML Check and User's Conscious Choice Before paying for the application, the user:

• is notified about the AML check of the address and transaction;
• has the opportunity to independently verify the address through public AML analyzers;
• confirms familiarization with the risks via a separate checkbox;
• or selects the option “Did not perform the check — I accept the risks myself”.

A separate AML block is placed on the application creation page with a brief explanation:

• what is being checked;
• what high risk means;
• possible consequences (pause / document request / return).

4. KYC and SoF Procedure In case an elevated risk is identified, the Service has the right to request documents for identification and confirmation of the source of funds. 4.1 Possible documents for KYC:

• passport / ID card
• selfie with the document
• proof of residential address
• video verification (if required)

4.2 Documents for confirming the source of funds (SoF):

• transaction history
• proof of funds origin
• explanation of the economic purpose of the operation

The Service may use licensed solutions for conducting KYC and storing personal data (e.g., SumSub or similar systems).

5. Verification Stages and Timelines

1. Notification of suspension — within 24 hours
2. Submission of documents by the client — up to 3 business days
3. Document review — up to 3 business days

Estimated total review time — up to 6 business days.

6. Refusal to Undergo KYC A client's refusal to provide the requested data is not in itself grounds for indefinite retention of funds. In such cases, two options are possible:

Option 1 — Return of Funds Funds are returned within 10 business days after notification of the inability to continue the application. The following is withheld:

• network fee;
• AML control fee up to 5% of the blocked amount, but not more than 100 USD equivalent.

For bona fide clients whose funds are not confirmed to be linked to illegal activities after verification, only the network fee is withheld.

Option 2 — Official Escalation If there are sufficient grounds to believe that the funds are connected to illegal activities, the information may be forwarded to:

• the financial intelligence unit (FIU);
• authorized government authorities;
• infrastructure partners.

Indefinite retention of funds without return or official escalation is not applied.

7. Return of Funds The return is carried out:

• to the original sender's address;
• or to an address confirmed as part of the KYC procedure.

Return timeframe — 7–10 business days after verification is completed.

8. Ensuring the Legitimacy of Assets In accordance with the BestChange Monitoring Rules, the Service ensures the quality and legitimacy of the transferred assets. For this purpose, the following are used:

• unique (one-time) addresses for each application;
• consolidation of funds on verified wallets;
• interaction with licensed and verified platforms;
• crypto addresses without any negative marks in AML systems.

The Service does not transfer assets with an elevated risk level to clients.

9. Politically Exposed Persons (PEP) Enhanced Due Diligence is applied to PEPs, including:

• additional identification;
• confirmation of the source of funds;
• enhanced monitoring of operations.

10. Prohibited Categories of Clients The Service does not serve:

• persons from sanctioned jurisdictions;
• persons included in sanctions lists of the UN, OFAC, and other bodies;
• clients who refuse to undergo mandatory AML/KYC procedures;
• clients whose funds are confirmed to be linked to illegal activities.

11. AML Responsible Person The Service has appointed an AML/KYC responsible person (in-house or outsourced) who carries out:

• monitoring of operations;
• interaction with AML providers;
• decision-making on cases;
• submission of reports to the FIU if necessary.

12. Personal Data Personal data is processed exclusively for AML/KYC purposes in accordance with applicable legislation.