Anti-money laundering (AML) and know-your-customer (KYC) policy
Approved by: Managing Directors Board
1. Purpose and scope
This policy establishes the Anti-Money Laundering (AML) and Know Your Customer (KYC) compliance framework of International Finance Bank LTD (IFB). It ensures adherence to national and international regulations, including but not limited to:
- EU AML Directives (5AMLD, 6AMLD) and, from 10 July 2027, the Anti-Money Laundering Regulation (EU) 2024/1624
- The anti-money laundering legislation of Anjouan, Union of the Comoros, including the Money Laundering (Prevention) Act 008/2005
- Financial Action Task Force (FATF) Recommendations
- Relevant Swiss, Liechtenstein, and international standards
The policy applies to all employees, officers, consultants, intermediaries, and service providers acting on behalf of IFB.
2. Objectives
The objectives of this policy are to:
- Prevent the misuse of the Company’s infrastructure for financial crime.
- Identify and verify clients’ identities through a risk-sensitive approach.
- Monitor, investigate, and report suspicious activity.
- Establish a defensible audit trail for regulators and counterparties.
- Uphold a zero-tolerance culture toward money laundering and terrorism financing.
3. Customer due diligence (CDD)
IFB shall categorise clients into three main types: natural persons, legal entities, and intermediaries (e.g., fiduciaries, agents, nominee directors). The following CDD obligations apply:
- Basic CDD: identity documents, purpose of the relationship.
- Enhanced CDD: applicable to high-risk clients, requires source of funds (SoF), source of wealth (SoW), and enhanced monitoring.
- Ongoing CDD: real-time and periodic reviews based on risk rating.
4. Know your customer (KYC) program
The KYC Program shall include:
- Collection and validation of identity documents (e.g., passport, utility bills)
- Verification of ownership and control (e.g., UBO declarations, share registries)
- Use of external verification services (IDNow, World-Check, Refinitiv)
- Screening against international sanctions and PEP databases
- Video onboarding through a compliance Zoom videoconference and wallet attribution in the case of crypto exposure
5. Risk-based approach (RBA)
Clients shall be assessed on a risk-weighted basis. Risk scoring will consider:
- Jurisdiction of incorporation/residence
- Nature of business activity
- Volume and frequency of transactions
- Public exposure (PEP status)
- Involvement of cryptoassets or offshore structures
6. Enhanced due diligence (EDD)
EDD will be applied to:
- Politically Exposed Persons (PEPs)
- High-risk geographies (as per FATF/EU lists)
- Complex ownership structures (e.g., foundations, trusts)
- Crypto-heavy entities or non-custodial wallet users
EDD measures include in-depth SoF/SoW verification, compliance interviews, board-level approval, and periodic external audits.
7. Monitoring and reporting
The company shall:
- Monitor transaction flows for inconsistency or deviation from expected behaviour.
- Flag anomalies such as structuring, layering, or transactions involving high-risk addresses.
- File suspicious activity reports (SARs) with the competent financial intelligence unit without delay.
- Retain a record of all escalations, investigations, and reports.
8. Recordkeeping
IFB will maintain records for a minimum of 5 years. These include:
- KYC files and supporting documentation
- Transaction logs and compliance notes
- Internal approvals and communications
- External audit reports and correspondence
9. Training and awareness
All staff shall undergo:
- Initial AML/KYC training upon hiring
- Annual refresher courses covering updates in regulation, typologies, and enforcement
- Ad-hoc training following regulatory changes or internal incidents
10. Governance and oversight
The Managing Director has appointed:
- A Money Laundering Reporting Officer (MLRO)
- A Compliance Officer
These individuals shall be responsible for day-to-day implementation, audits, staff training, and regulatory engagement.
With RegMantle
Annex A: Client Risk Scoring Matrix
IFB employs a multi-factor scoring system to evaluate the risk level of each client. Scores determine the intensity of due diligence and monitoring.
| Risk factor | Low (1) | Medium (2) | High (3) | Score |
|---|---|---|---|---|
| Jurisdiction | EU/EEA, FATF whitelist | Non-EU FATF member | FATF blacklisted / high-risk third country | [1–3] |
| Client type | Natural person, EU resident | Legal entity, known structure | Trust/Foundation or Nominee | [1–3] |
| Transaction volume | < €50,000/year | €50,000 – €250,000 | > €250,000 | [1–3] |
| Source of funds | Salary, bank transfer | Crypto, brokerage | Unverifiable / cash-intensive | [1–3] |
| PEP exposure | None | Indirect/associate | Direct / senior official | [1–3] |
| Business activity | Low-risk (e.g. consulting) | Medium (e.g. trading) | High-risk (e.g. crypto / cash) | [1–3] |
Total risk score = sum of all individual scores (range: 6 to 18). 6–9: low risk · 10–13: medium risk · 14–18: high risk (EDD required).
Annex B: Suspicious Activity Report (SAR) Template
This template shall be used internally to record and report suspicious transactions or behaviours.
- Reporting Officer: _________________________
- Date of Report: ___________________________
- Client ID / Name: __________________________
- Nature of Suspicion (tick one or more):
□ Structuring / Smurfing
□ Unusual transaction pattern
□ Inconsistent source of funds
□ Use of privacy coins or mixers
□ Involvement of high-risk country
□ Refusal to provide KYC/EDD
- Description of Activity: ________________________
• Risk Level: □ Low □ Medium □ High
• External Notification Required: □ Yes □ No
• If Yes, Report sent to: FIU / Other: __________
• Date of Submission: ___________________________
• Supporting Documents Attached: □ Yes □ No
• Signature of MLRO: ____________________________
Annex C: Crypto Wallet Attribution and Tracing
To comply with FATF Recommendation 16 (“Travel Rule”) and MONEYVAL peer review expectations, IFB performs attribution, tracing, and analysis of all digital wallets used in significant client transactions.
Key Procedures:
- Ownership Verification – Wallets must be linked to the client via signed message, a test transaction or another verifiable proof of control.
- Blockchain Analytics – Use of Chainalysis, TRM Labs, or equivalent to assess wallet risk scores, historical flows, and exposure to illicit services.
- Travel Rule Data – IFB records originator and beneficiary information, wallet addresses and timestamps for crypto-asset transfers as required by Regulation (EU) 2023/1113, which applies between providers without a minimum threshold; transfers above EUR 1,000 to or from self-hosted wallets require verification that the wallet is owned or controlled by the client.
- Cold Wallet Controls – Where applicable, IFB ensures that assets are transferred to whitelisted or white-labeled wallets only.
- Ongoing Re-Attribution – Re-verification is triggered by changes in wallet activity, offboarding, or compliance alerts.
All wallet-related data is stored for a minimum of 5 years in accordance with GDPR and AML recordkeeping obligations.
Know-your-payee (KYP) policy
Approved by: Managing Directors Board
1. Purpose and applicability
This Know Your Payee (KYP) Policy outlines the procedures implemented by IFB to ensure that all outgoing payments, disbursements, and transfers are made to legitimate, verified, and compliant beneficiaries. The policy aims to mitigate risks associated with sanctions evasion, fraud, terrorist financing, and other illicit activity.
This policy applies to all payments made by IFB, including but not limited to:
- Vendor and contractor disbursements
- Client refunds and commissions
- Crypto-to-fiat or fiat-to-crypto settlements
- Third-party fund instructions on behalf of clients
2. Key objectives
- Prevent disbursements to blacklisted or sanctioned entities
- Ensure payee identity is validated prior to fund release
- Verify the legitimacy of the payee’s business and banking details
- Maintain a defensible audit trail of payment verification
- Flag high-risk beneficiaries for enhanced due diligence (EDD)
3. Kyp due diligence process
The following elements must be verified before executing a payment to a third party:
- Identity of Payee: Full name or legal entity name, verified via documentation.
- Banking or Wallet Details: Bank name, SWIFT/BIC code, IBAN or crypto wallet address, verified with supporting documents.
- Sanctions Screening: Payee checked against EU, UN, OFAC, and other applicable lists.
- Business Justification: Payment purpose confirmed with invoice, contract, or payment instruction signed by authorised personnel.
4. High-risk indicators
Payments to the following categories are subject to enhanced scrutiny:
- Beneficiaries located in blacklisted or high-risk jurisdictions
- Use of private or unregulated wallets for crypto settlements
- Shell companies or entities without operational websites or references
- Requests to change payee shortly before payment
- Use of intermediaries or third-party payment accounts without clear justification
5. Payee Verification Methods
Depending on the risk classification, IFB shall use one or more of the following verification methods:
- Bank confirmation letters or account ownership certificates
- Wallet verification via signed message or blockchain attribution
- Video call confirmation (for individuals or new entities)
- Reverse lookup via World-Check, Refinitiv, and sanctioned entity databases
6. Recordkeeping and audit
All KYP checks must be documented and stored with the relevant payment file. IFB maintains these records for a minimum of 5 years. Internal audits will verify the integrity and completeness of KYP checks semi-annually.
7. Roles and responsibilities
- The Finance Department is responsible for executing KYP checks before releasing payments.
- The Compliance Officer supervises adherence to the KYP framework and investigates any anomalies.
- The MLRO must be consulted for any high-risk or suspicious payees.