AML & Sanctions Policy

Last updated: October 2026

This policy is provided by Qyptro Inc., a company incorporated in the Republic of Panama, registered with the Public Registry of Panama, Mercantile Section, under number 155783590, with its registered office at Bloc Office Hub, Fifth Floor, Santa Maria Business District, Costa del Este, Panama City, Republic of Panama ("Qyptro", "we", "us").

1. Commitment

Qyptro is committed to preventing money laundering, terrorist financing and sanctions evasion, and maintains a risk-based compliance programme proportionate to its business.

2. Merchant due diligence

We verify each Merchant's identity, ownership structure, beneficial owners, business model and source of funds before providing the Services, and apply enhanced due diligence to higher-risk relationships.

3. Transaction monitoring (KYT)

Every deposit and withdrawal is screened using blockchain analytics and internal risk rules covering, among others:

• sanctioned entities and jurisdictions;
• darknet markets;
• stolen funds and proceeds of hacks;
• mixers and other obfuscation services;
• scams and fraud;
• illicit gambling;
• high-risk or unregulated VASPs;
• direct and indirect exposure to the above.

Depending on the risk score, a transaction is processed automatically, escalated for manual review, held, or handled under our sanctions procedure.

4. Sanctions screening

Merchants, their beneficial owners, directors, authorised persons and wallet addresses are screened against, at a minimum, the following lists:

• U.S. Treasury OFAC Specially Designated Nationals (SDN) and other OFAC lists;
• United Nations Security Council Consolidated List;
• European Union Consolidated Financial Sanctions List;
• UK HM Treasury (OFSI) Consolidated List;
• lists issued by the competent authorities of the Republic of Panama.

We do not provide services to sanctioned persons or entities, to wallets attributed to them, or for transactions intended to evade sanctions.

5. Prohibited jurisdictions

We do not onboard merchants that are incorporated, resident or operating in, and do not process transactions connected with:

• Iran, North Korea (DPRK), Syria and Cuba;
• the Crimea region, the so-called DNR and LNR, and the non-government-controlled parts of the Zaporizhzhia and Kherson regions of Ukraine;
• the United States of America: we do not serve entities incorporated, resident or operating in the USA, or owned or controlled by U.S. citizens or residents;
• jurisdictions subject to a FATF "call for action";
• any other jurisdiction subject to comprehensive sanctions under the lists above, or that we otherwise consider unacceptable under our risk appetite.

This list is reviewed regularly and may be updated as sanctions regimes and FATF statements change.

6. Prohibited businesses

We do not onboard merchants involved in, and do not process payments related to:

• illegal goods or services of any kind;
• narcotics, controlled substances and drug paraphernalia;
• weapons, ammunition and explosives;
• unlicensed gambling, betting or lotteries;
• unlicensed financial, money-transmission or virtual-asset services;
• mixers, tumblers and other anonymity-enhancing services;
• pyramid, Ponzi or high-yield investment schemes;
• counterfeit goods and intellectual-property infringement;
• child sexual abuse material or any exploitation of minors;
• terrorism, extremism or violence;
• shell banks or entities without a verifiable business purpose.

Higher-risk but lawful activities may be accepted only after enhanced due diligence and management approval.

7. Travel Rule

For transfers to and from other virtual asset service providers, we collect, verify and exchange originator and beneficiary information where required by the FATF Travel Rule and applicable law, and may request this information from merchants and their customers.

8. Reporting and law enforcement

Where required, we report suspicious activity to the competent authorities and may freeze, hold or decline transactions without prior notice. We respond to lawful requests from law enforcement and regulatory authorities, which may be sent to compliance@qyptro.com.

9. Record keeping

KYC/KYB documents, transaction history, wallet screening results and compliance decisions are retained for the period required by applicable law, contractual obligations and internal policy.

10. Rejection and return of funds

Where a transaction is unacceptable after AML review, it may be rejected or suspended. Where operationally and legally possible, assets may be returned to the original sending address after the required checks; network and reasonable operational costs may be deducted. Returns to a different address require enhanced verification.

11. Review

This policy is reviewed periodically and updated to reflect changes in law, partner requirements and our risk exposure.

12. Contact

Compliance and AML enquiries: compliance@qyptro.com