KYC & Anti-Money Laundering (AML) Policy

01. Introduction & Corporate Identity

This KYC & Anti-Money Laundering (AML) Policy ("Policy") sets out the customer due diligence (CDD), sanctions screening, and anti-money laundering / counter-terrorism financing (AML/CTF) procedures applied by KHODSHIMA SUMN ASSIST LTD ("Company", "we", "us", or "our"), a private limited company incorporated in England and Wales under company registration number 17435961, with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX.

While the Company is not a regulated financial institution under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 ("MLR 2017"), it voluntarily adopts AML/CTF best practices to satisfy the compliance requirements of our payment service providers (Stripe and Airwallex), to protect the integrity of our business, and to prevent our services from being used as a vehicle for financial crime.

02. Risk-Based Approach & Regulatory Framework

The Company applies a risk-based approach to customer due diligence, proportionate to the nature of one-time IT engineering services. The following regulatory and standards frameworks inform this Policy:

• Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017): While not formally regulated under MLR 2017, the Company adopts its principles as best practice;
• Proceeds of Crime Act 2002 (POCA): The Company will not knowingly facilitate the acquisition, possession, or use of proceeds of criminal conduct;
• Terrorism Act 2000 & 2003: The Company will not knowingly facilitate the raising or movement of funds for terrorism purposes;
• UK Office of Financial Sanctions Implementation (OFSI): Compliance with all UK financial sanctions regimes;
• Payment Provider Requirements: Stripe and Airwallex each maintain their own AML/KYC standards that the Company must satisfy as a merchant, including prohibited business categories and sanctions screening obligations.

03. Customer Due Diligence (CDD) Procedures

The Company applies tiered customer due diligence based on transaction value and risk indicators:

CDD data is collected and processed in accordance with our Privacy Policy under the lawful basis of legitimate interests (UK GDPR Art. 6(1)(f)) — preventing fraud and financial crime — and legal compliance (Art. 6(1)(c)) where statutory obligations apply.

04. Sanctions Screening

The Company conducts sanctions screening against the following lists before accepting any Order and periodically during active engagements:

• OFSI Consolidated List: UK financial sanctions targets maintained by HM Treasury;
• UN Consolidated Sanctions List: United Nations Security Council sanctions;
• EU Restrictive Measures (Sanctions) List: European Union sanctions regimes;
• US OFAC SDN List: Specially Designated Nationals and Blocked Persons, for USD transactions or US nexus;
• UK Sanctioned Jurisdictions: Comprehensive screening against clients located in or operating from sanctioned jurisdictions, including the Russian Federation, Belarus, Iran, North Korea, Syria, Cuba, and occupied territories of Ukraine.

Screening is conducted using the Client's name, company name, billing address, IP geolocation, and payment metadata. Where a potential match is identified:

1. The Order is placed on hold pending manual review;
2. The Company attempts to verify whether the match is a true positive or false positive;
3. If a true positive is confirmed, the Order is refused, any active license is terminated, and the transaction is reported to the relevant UK authorities;
4. No refund is issued in cases of confirmed sanctions violations. Funds may be subject to seizure by HM Treasury.

05. Prohibited Activities & High-Risk Categories

In addition to sanctions screening, the Company refuses to provide services to clients engaged in the following prohibited or high-risk activities, consistent with Stripe and Airwallex acceptable use policies:

• Financial Services: Banking, payment processing, lending, insurance, investment platforms, or any FCA-regulated activity;
• Cryptocurrency: Exchanges, wallets, ICO/IDO, DeFi, mining pools, token issuance;
• Gambling: Casinos, sports betting, lotteries, gaming platforms;
• Adult Content: Adult entertainment hosting, distribution, monetisation infrastructure;
• Illegal Activities: Money laundering, terrorism financing, drug trafficking, human trafficking, arms trafficking, child exploitation;
• Infrastructure Abuse: Spam operations, botnets, DDoS services, credential stuffing platforms, malware distribution;
• Sanctions Evasion: Any attempt to circumvent UK, UN, EU, or US sanctions through shell companies, proxies, or false documentation.

Where the Company discovers, after payment, that a client is engaged in prohibited activities, the Company will cease all work, terminate the license, and report the matter to the relevant authorities and payment providers. See Section 11 of our Terms & Conditions for the full prohibited activities list.

06. Suspicious Activity Reporting

Where the Company identifies activity that gives rise to knowledge or suspicion of money laundering or terrorism financing, it will:

1. Internal Escalation: The matter is escalated to the Company's compliance officer for review;
2. SAR Filing: Where appropriate, a Suspicious Activity Report (SAR) is filed with the National Crime Agency (NCA) under Part 7 of the Proceeds of Crime Act 2002 (POCA) or Part 3 of the Terrorism Act 2000;
3. Defence Request: Where the Company intends to proceed with or refuse a transaction, it may seek a Defence Against Money Laundering (DAML) from the NCA;
4. Transaction Hold: The relevant transaction is placed on hold pending NCA response where a SAR has been filed;
5. Confidentiality: The Client is not informed that a SAR has been filed. Tipping off is a criminal offence under s.333A POCA and s.19A Terrorism Act 2000.

07. Record Keeping & Data Retention

The Company retains CDD and transaction records in accordance with statutory requirements and our Privacy Policy:

• Transaction & Billing Records: 6 years from the end of the relevant UK financial year, in accordance with the Taxes Management Act 1970 and HMRC requirements;
• CDD Verification Records: Retained for 5 years from the end of the business relationship, consistent with MLR 2017 best practice;
• Sanctions Screening Results: Retained for 5 years from the date of screening;
• SAR Filings & Correspondence: Retained for 5 years from the date of filing;
• Server Diagnostic Data: Retained for a maximum of 60 days (matching the Warranty Period), then permanently deleted.

All records are stored in encrypted volumes and access is restricted to authorised personnel on a need-to-know basis. Data is processed under UK GDPR lawful bases as set out in our Privacy Policy.

08. Staff Awareness & Internal Controls

The Company maintains internal controls to ensure effective AML/CTF compliance:

• Compliance Officer: A designated compliance officer is responsible for AML/CTF procedures, sanctions screening oversight, and SAR filings;
• Training: All personnel involved in client engagement, payment processing, or service delivery receive AML/CTF awareness training appropriate to their role;
• Segregation of Duties: Payment processing, service delivery, and compliance review are performed by different individuals where practicable;
• Annual Review: This Policy and associated procedures are reviewed at least annually, or sooner if triggered by regulatory changes, payment provider updates, or identified control deficiencies.

09. Policy Amendments & Related Documents

This Policy may be updated to reflect changes in regulatory requirements, payment provider standards, or identified risk patterns. Amendments are published on this page with an updated revision date.

This Policy should be read in conjunction with:

• Terms & Conditions of Service — contractual obligations and prohibited activities;
• Privacy Policy — data protection and lawful bases for CDD processing;
• Refund & Cancellation Policy — refund implications of sanctions-related Order refusal;
• Compliance & Standards Overview — comprehensive compliance framework.