AML/KYC Policy

This document provides an overview of the Anti-Money Laundering (AML) and Know Your Customer (KYC) policy standards, describing the methods used to prevent money laundering activities when working with our clients. The purpose of the AML/KYC policy is to prevent the use of Ebitok, intentionally or unintentionally, by criminal elements for money laundering activities. The policy also prescribes making reasonable efforts to determine the true identity and beneficial owner of accounts, the source of funds, the nature of the client's business, the reasonableness of account transactions in connection with the client's business, etc., which, in turn, helps us competently analyze risks. We strive to protect our clients from fraudulent activities in the field of crypto assets. Ebitok applies a consistent approach to implementing the latest recommendations and revised guidelines of FATF, the European Parliament, and regulatory bodies of the financial industry in general. Our compliance policy aims to identify funds involved in illegal activities, as well as to protect the funds of our clients who have become victims of hacks, ransomware, and other malicious software. The current toolkit designed to combat money laundering and its consequences consists of regulatory acts combined with the latest developments in software designed to track suspicious transactions in real time. Our AML/KYC policies, procedures, and internal controls are designed to ensure compliance with all current regulations and will be regularly reviewed and updated to ensure compliance of relevant policies, procedures, and internal controls with changes in regulations.

The policy consists of the following sections:

1

Customer Identification Procedure (CIP)

2

Documentation

3

Anti-Money Laundering Compliance Officer

4

Transaction Monitoring

5

Cooperation with Law Enforcement

CIP applies to transactions that our assessment system deems suspicious. We collect certain identification information about each client who undergoes CIP.

The identification procedure includes the following steps:

1

Request for identification data;

1.1

Full name;

1.2

Date of birth (for individuals);

1.3

Residential address (for individuals) or principal place of business, office, or other physical location;

1.4

For individuals only – a valid government-issued ID confirming citizenship or residence and having a photograph, such as a driver's license or passport;

1.5

For legal entities – documents confirming the existence of a legal entity, such as a certified charter, business license, partnership agreement, or other verifying document;

2

Verification of the received information for originality and accuracy. The client must ensure that the information provided is accurate, complete, and timely updated. If there are grounds to believe that the information provided by the client is incorrect, false, outdated, or incomplete, we reserve the right to send the client a notice requiring correction and supplementation of identification information. Depending on the circumstances, Ebitok may blacklist an existing account and terminate services for that client.

3

Verification of information. We will continue verification based on the collected information to determine the true identity of our clients, using procedures based on the risk assessment of our service provider Sum & Substance Ltd, verifying the completeness and accuracy of the received information for client identification. A check is also carried out for the presence of the client in lists of citizens related to criminal activity and other lists of persons subject to sanctions. We will verify the information within a reasonable time, depending on the nature of the account and the level of transaction risk. We may request additional time for verification, limiting transactions and the client's account. If we discover suspicious information indicating possible money laundering, terrorist financing, or other suspicious activity, we may file a report in the form of SAR/STR in accordance with the legislative framework.

4

Client notification We notify clients that their transactions may be subject to AML/KYC checks. This information is detailed in our Terms of Use, and each client is required to familiarize themselves with these Terms before starting transactions.

5

Checks performed by third parties We may rely on CIP checks performed by an exchange or trading platform for any client, in case of the reasonableness of this decision by the exchange or trading platform. In this case, the client is also notified of the circumstances of this kind.

Documentation

1

We will document our verification, including all identifying information provided by the client, the methods used, and the results of the verification, as well as the resolution of any discrepancies identified during the verification process.

2

According to Sum Substance documentation, all client data obtained during the KYC procedure is encrypted and stored on Amazon servers, in accordance with GDPR regulations, located in the European zone.

3

All documentation may be provided to competent authorities upon request.

AML Compliance Officer

1

The Anti-Money Laundering Compliance Officer is an authorized Ebitok employee responsible for implementing and effectively monitoring the application of the AML/KYC policy. The AML Compliance Officer monitors and modernizes all aspects of Ebitok's anti-money laundering and terrorist financing activities.

2

Contact with the Anti-Money Laundering Compliance Officer regarding this Policy is carried out through support@Ebitok.com

Transaction Monitoring

1

Ongoing monitoring is an important element of effective KYC procedures. It allows us to distinguish between normal client activity and suspicious activity that requires attention.

Self-service AML wallet check

1

The service provides the client with the option to perform an AML check of the crypto address independently, before sending funds and creating an order. Currently this check is available via the external monitoring platform https://www.bestchange.ru/report/. The "AML Check" button is placed in the site header and in the main menu.

2

If the client does not use this option and does not verify the wallet through AML before creating an order, the client accepts all subsequent AML-related risks — including fund holds, additional checks, processing delays, or refund procedures.

3

By ticking the consent checkbox when creating an order, the client confirms that they have been informed of the AML check option and accepts the consequences of declining it.

Transaction Monitoring and Risk-Score

The service monitors transactions using AML analyzers, partner data, open sources, and third-party information. Each operation is evaluated under the Risk-Score model:

Low Risk — the operation is processed automatically;
Medium Risk — an additional check may be required;
High Risk — the transaction is suspended (AML Hold);
Very High Risk — enhanced due diligence, the transaction is suspended (AML Hold).

Important: risk across categories is NOT summed — each category is evaluated separately by its share (%).

Very High Risk

Enforcement Action

VERY HIGH · >0% · BLOCK & KYC

Fraudulent Exchange

VERY HIGH · >0% · BLOCK & KYC

Terrorist Financing

VERY HIGH · >0% · BLOCK & KYC

Child Abuse / Human Trafficking

VERY HIGH · >0% · BLOCK & KYC

Processing rule

If any share of risk (>0%) is detected under any of the listed categories, the transaction is automatically treated as critical and placed under enhanced due diligence.