AML & KYC Policy

1. Introduction & Commitment

Keeal, Inc., a Delaware corporation, and Keeal UK Ltd (for users in the United Kingdom) operating the Keeal platform are committed to the highest standards of Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) compliance. References to "we," "us," or "our" mean the Keeal legal entity that provides the Service to you (Keeal UK Ltd in the United Kingdom, or Keeal, Inc. elsewhere), unless the context requires otherwise. "Keeal" as a brand name refers to the Service; it does not by itself mean Microxen Inc.. The Keeal product/platform in the United States is built and supported with technology from Microxen Inc. (https://microxen.com). Microxen Inc. is a technology partner only: it is not the party you contract with under these Terms, it is not the merchant of record for customer payments, and customer card statements / Keeal-issued invoices identify Keeal (via Keeal, Inc.), not Microxen Inc.. As a payments platform and merchant of record, we recognize our critical role in preventing the financial system from being used for illicit purposes.

This AML & KYC Policy outlines the procedures and controls we maintain to detect, prevent, and report money laundering, terrorist financing, fraud, and other financial crimes. It applies to all users of the Keeal platform, including contractors, clients, and any other individuals or entities transacting through our Service.

Our compliance program is designed in accordance with applicable laws and regulations in the jurisdictions where we operate, including U.S. federal and state laws (such as the Bank Secrecy Act and USA PATRIOT Act), UK Money Laundering Regulations, and regulations issued by relevant supervisory authorities such as FinCEN.

2. Regulatory Framework

Our AML/KYC program is built to comply with the following laws, regulations, and guidance:

• Bank Secrecy Act (BSA): Requires financial institutions to assist government agencies in detecting and preventing money laundering.
• USA PATRIOT Act: Strengthens measures to prevent, detect, and prosecute international money laundering and terrorist financing.
• FinCEN Regulations: Rules issued by the Financial Crimes Enforcement Network governing anti-money laundering obligations for money services businesses (MSBs) and other payment companies.
• OFAC Sanctions Programs:We comply with all sanctions programs administered by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC).
• State Regulations: We comply with applicable state money transmitter laws and licensing requirements.
• International Standards: We follow guidance from the Financial Action Task Force (FATF) on combating money laundering and terrorist financing.

3. Know Your Customer (KYC)

We are committed to verifying the identity of every user before allowing access to payment processing features. Our Customer Identification Program (CIP) includes the following procedures:

3.1 Individual Verification

For individual users (sole proprietors, freelancers, independent contractors), we collect and verify:

• Full legal name
• Date of birth
• Residential address
• Government-issued photo identification (passport, driver's license, or national ID card)
• Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN) for U.S. persons
• Tax identification number for non-U.S. persons (where applicable)
• Selfie or live photo for biometric identity matching

3.2 Business Verification

For business accounts (LLCs, corporations, partnerships), we additionally collect and verify:

• Legal business name and DBA (if applicable)
• Business address
• Employer Identification Number (EIN) or equivalent tax ID
• Business registration documents (articles of incorporation, certificate of formation, or equivalent)
• Business license (where applicable)
• Beneficial Ownership:Identity and verification of all individuals who own 25% or more of the business, and at least one individual with significant management responsibility (as required by FinCEN's Beneficial Ownership Rule)

3.3 Verification Methods

We use a combination of the following methods to verify identity:

• Document Verification: Automated document authentication using AI-powered systems (via Stripe Identity) to verify the authenticity of submitted ID documents.
• Biometric Matching: Selfie comparison against the photo on the submitted ID document.
• Database Verification: Cross-referencing provided information against government databases, credit bureau data, and commercial databases.
• Address Verification: Validation through utility bills, bank statements, or database matches.

3.4 Enhanced Due Diligence (EDD)

We apply enhanced due diligence for higher-risk users, including those with large transaction volumes, users from higher-risk jurisdictions, politically exposed persons (PEPs), and any user whose activity triggers elevated risk indicators. EDD may include additional documentation requests, more frequent monitoring, source of funds verification, and senior management review.

4. Sanctions Screening

We screen all users against applicable sanctions lists and watchlists at the time of onboarding and on an ongoing basis. Screening includes checks against:

• OFAC Specially Designated Nationals and Blocked Persons List (SDN List)
• OFAC Consolidated Sanctions List
• FinCEN 311 Special Measures and Section 9714 lists
• Politically Exposed Persons (PEP) databases
• Adverse media and negative news databases
• International sanctions lists (UN, EU, UK HMT) where applicable

Users who are identified as sanctioned individuals or entities, or who are located in comprehensively sanctioned countries or regions (currently including Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions of Ukraine), are prohibited from using the Service. We will block or reject transactions and freeze accounts as required by applicable sanctions laws.

5. Transaction Monitoring

We maintain ongoing transaction monitoring systems designed to detect unusual or suspicious activity. Our monitoring program includes:

Automated Monitoring

• Real-time transaction screening against sanctions lists and fraud indicators.
• Automated alerts for transactions exceeding defined thresholds.
• Velocity monitoring (detecting unusual spikes in transaction frequency or volume).
• Pattern analysis to identify structuring (breaking up transactions to avoid reporting thresholds).
• Geographic risk scoring based on transaction origins and destinations.
• Behavioral analysis comparing user activity against established patterns.

Red Flag Indicators

We specifically monitor for the following red flags, including but not limited to:

• Transactions that appear inconsistent with the user's stated business type or expected activity.
• Rapid movement of funds in and out of accounts with no apparent business purpose.
• Multiple accounts linked to the same individual, device, or bank account.
• Transactions involving high-risk jurisdictions.
• Attempts to circumvent transaction limits or verification requirements.
• Use of multiple payment methods to fund a single account or transaction.
• Frequent changes to account information (name, address, bank details).
• Invoices with vague or unusual descriptions of goods or services.
• Transactions with no apparent economic or business rationale.

6. Suspicious Activity Reporting

When we identify known or suspected violations of law or suspicious activity, we will:

• File a Suspicious Activity Report (SAR) with FinCEN within the required timeframe (typically within 30 days of detection).
• Maintain detailed records of all SARs filed, including supporting documentation, for a minimum of 5 years.
• Cooperate fully with law enforcement agencies investigating financial crimes.
• Report transactions exceeding $10,000 (Currency Transaction Reports) where applicable.

Important:Federal law (31 U.S.C. § 5318(g)(2)) prohibits us from notifying any person involved in a transaction that a SAR has been filed. We are legally prohibited from disclosing the existence or contents of a SAR to any unauthorized party, including the subject of the report.

7. Risk-Based Approach

We employ a risk-based approach to AML compliance, allocating resources and applying controls proportionate to the level of risk. Our risk assessment considers:

Customer Risk Factors

• Type of customer (individual, business, legal entity)
• Industry and business type
• Geographic location and countries of operation
• PEP status or connections to PEPs
• Source of funds and wealth
• Account activity history and patterns

Product/Service Risk Factors

• Transaction type (card payments, ACH, cross-border)
• Transaction volume and frequency
• Payment method (credit card vs. bank transfer)
• Cross-border vs. domestic transactions

Geographic Risk Factors

• Countries identified by FATF as having strategic AML/CFT deficiencies
• Countries subject to OFAC sanctions or embargoes
• Countries known for higher levels of corruption or financial crime

8. Record Keeping

We maintain comprehensive records in compliance with BSA and FinCEN requirements:

• Customer Identification Records: All documents and information collected during KYC verification are retained for a minimum of 5 years after account closure.
• Transaction Records: All transaction data, including amounts, parties, dates, and descriptions, are retained for a minimum of 5 years from the date of the transaction.
• SAR Records: Suspicious Activity Reports and all supporting documentation are retained for a minimum of 5 years from the date of filing.
• Correspondence: All communications related to compliance matters, including law enforcement requests, are retained for a minimum of 5 years.
• Training Records: Documentation of employee AML training, including dates, content, and attendance, are retained for the duration of employment plus 5 years.

9. Prohibited Activities & Restricted Users

The following activities are strictly prohibited on the Keeal platform:

• Money laundering or any activity designed to disguise the origin of illicit funds.
• Terrorist financing or providing material support to designated terrorist organizations.
• Sanctions evasion or transactions with sanctioned individuals, entities, or countries.
• Fraud, including identity theft, stolen payment credentials, or fabricated transactions.
• Structuring transactions to avoid reporting thresholds ("smurfing").
• Processing payments for illegal goods, services, or activities.
• Operating as an unlicensed money transmitter or payment processor.
• Creating accounts using false, stolen, or synthetic identities.
• Processing transactions on behalf of undisclosed third parties ("layering").
• Selling physical goods, dropshipping tangible products, or using Keeal for in-person / physical product or service fulfillment (Keeal is digital-only).

The following categories of users are restricted or prohibited from using the Service:

• Individuals or entities on any OFAC sanctions list.
• Residents of comprehensively sanctioned jurisdictions.
• Shell companies with no legitimate business purpose.
• Individuals under the age of 18.
• Users who have previously been terminated for AML violations.
• Anonymous or bearer-share entities.
• Businesses selling physical goods or otherwise outside Keeal's digital-only scope.

See also Restricted & Prohibited Businesses for industry categories Keeal does not support, and Supported & restricted countries for sanctioned jurisdictions and country eligibility.

10. Enforcement Actions

When we identify violations of this policy or applicable law, we may take any or all of the following actions:

• Account Suspension:Immediately suspend the user's account and block all transactions pending investigation.
• Fund Freezing: Place a hold on all funds in the account as required by law or as necessary to prevent further illicit activity.
• Account Termination: Permanently close the account and prohibit the user from creating new accounts.
• Regulatory Reporting: File SARs and/or other required reports with FinCEN, OFAC, or other relevant authorities.
• Law Enforcement Referral: Report suspected criminal activity to appropriate law enforcement agencies.
• Civil Action: Pursue legal remedies to recover losses or damages.

11. Employee Training

All Keeal employees and contractors with access to customer data or involvement in compliance functions receive:

• Initial AML/KYC training upon hire, covering the basics of money laundering, terrorist financing, sanctions compliance, and our internal policies.
• Annual refresher training on regulatory updates, new typologies, and emerging risks.
• Role-specific training for compliance, risk management, and customer-facing teams.
• Training on how to identify and escalate suspicious activity.

12. Compliance Officer

Keeal has designated a Chief Compliance Officer (CCO) responsible for:

• Overseeing the implementation and effectiveness of the AML/KYC compliance program.
• Ensuring timely filing of SARs and other regulatory reports.
• Coordinating with law enforcement and regulatory agencies.
• Conducting regular reviews and updates to this policy.
• Overseeing employee training and awareness programs.
• Reporting to senior management and the board of directors on compliance matters.

13. Independent Audits

Our AML/KYC compliance program is subject to periodic independent review and testing to evaluate its effectiveness. These reviews assess the adequacy of our policies, procedures, and internal controls, and identify areas for improvement. Findings are reported to senior management and acted upon promptly.

14. Your Obligations

As a user of the Keeal platform, you agree to:

• Provide accurate, complete, and truthful information during registration and verification.
• Promptly update your information if any details change.
• Respond to requests for additional verification or documentation in a timely manner.
• Not use the Service for any prohibited purpose as described in this policy or our Terms of Service.
• Not assist or facilitate others in using the Service for money laundering, terrorist financing, or other illegal activities.
• Cooperate with any investigation or information request related to compliance matters.

Failure to comply with these obligations may result in account suspension, fund freezing, account termination, and/or reporting to relevant authorities.

15. Updates to This Policy

We review and update this AML & KYC Policy regularly to reflect changes in applicable laws, regulations, and industry best practices. Material changes will be reflected in the "Last updated" date at the top of this page. Continued use of the Service after updates constitutes acceptance of the revised policy.

16. Contact

If you have questions about this policy, need to report suspicious activity, or have compliance-related inquiries, please contact us: