Anti-Money-Laundering & KYC Policy

Section 1

Our commitment

DireBit does not tolerate the use of its services for money laundering, terrorist financing, proliferation financing, sanctions evasion or any other financial crime. We operate a risk-based compliance program that is documented in writing, approved by senior management, reviewed at least annually, and applied to every customer without exception.

Section 2

Legal framework

Our program is designed to comply with, among others:

• the Bank Secrecy Act (31 U.S.C. § 5311 et seq.) and its implementing regulations at 31 C.F.R. Chapter X;
• the USA PATRIOT Act, including section 326 (customer identification) and section 352 (AML program requirement);
• the Anti-Money Laundering Act of 2020;
• FinCEN's regulations applicable to money services businesses and to convertible virtual currency, including FIN-2019-G001;
• the economic sanctions programs administered by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC");
• the Washington Uniform Money Services Act (RCW 19.230) and the rules of the Washington State Department of Financial Institutions.

Section 3

The five pillars of our program

Section 4

Customer Identification Program

Before we open an account we collect and verify, at minimum:

• your full legal name;
• your date of birth;
• your residential address (a post office box alone is not acceptable);
• a government-issued identification number — for U.S. persons a Social Security number or individual taxpayer identification number; for non-U.S. persons a passport number and country of issuance, or an equivalent.

We verify this information using documentary methods (an unexpired government-issued photographic identity document, checked for authenticity) and non-documentary methods (comparison against independent data sources, and a liveness check comparing a photograph or short video of you with your identity document).

For business customers we additionally collect formation documents, evidence of good standing, the nature of the business, and identification for each beneficial owner holding 25% or more, together with one individual exercising significant control.

Section 5

Customer due diligence

We build a risk profile for every customer, taking into account jurisdiction, occupation or business type, expected activity, source of funds, product usage and screening results. Each customer is assigned a risk rating that determines how closely the relationship is monitored and how often it is reviewed. Profiles are refreshed periodically and whenever a trigger event occurs, such as a material change in activity, a monitoring alert, or a change in your circumstances.

Section 6

Enhanced due diligence

We apply enhanced due diligence to higher-risk relationships, including politically exposed persons and their close associates, customers connected to higher-risk jurisdictions, customers whose activity is materially inconsistent with their profile, and customers involved in higher-risk business types. Enhanced measures may include documentary evidence of source of funds and source of wealth, senior management approval to open or continue the relationship, tighter limits, and more frequent review.

Section 7

Sanctions screening

We screen every customer, beneficial owner and counterparty at onboarding and on an ongoing basis against OFAC's Specially Designated Nationals and Blocked Persons List, OFAC's Consolidated Sanctions List, and other applicable government lists. We also screen blockchain addresses using analytics tooling to identify exposure to sanctioned entities, darknet markets, ransomware and known theft.

We block property in which a sanctioned person has an interest, reject prohibited transactions, and report blocked and rejected transactions to OFAC within the required timeframes. We do not provide services to customers resident in or located in comprehensively sanctioned jurisdictions, and we use geolocation and other controls to enforce that restriction.

Section 8

Transaction monitoring

Activity is monitored on an ongoing basis against rules and risk indicators designed to surface behavior that may indicate financial crime. Indicators include, among others, structuring of transactions to stay below reporting thresholds, rapid movement of funds with no apparent business purpose, activity inconsistent with the customer's stated profile, exposure to high-risk or sanctioned addresses, use of mixing or tumbling services, patterns consistent with account takeover, and transactions involving third parties.

Alerts are investigated by trained analysts, escalated where warranted, and documented, whether or not a report is ultimately filed.

Section 9

Regulatory reporting

Section 10

The Travel Rule

For transmittals of funds at or above the applicable threshold, we collect, retain and transmit originator and beneficiary information to the next financial institution in the payment chain, as required by 31 C.F.R. § 1010.410(f). This applies to transfers of convertible virtual currency as well as to fiat transfers. We may decline a transfer where the required information is missing, incomplete or cannot be validated, or where the receiving institution cannot receive it securely.

Section 11

Recordkeeping

We retain customer identification records for at least five years after the account is closed, and transaction records, SAR supporting documentation, CTRs and Travel Rule records for at least five years from the relevant date. Records are stored securely, are retrievable on lawful request, and are retained for longer where a legal hold applies. See our Privacy Policy for the full retention schedule.

Section 12

Customers and activity we will not accept

• Anyone who refuses or fails to complete identity verification, or who provides false, altered or stolen documentation.
• Persons appearing on applicable sanctions, debarment or law-enforcement lists, and persons acting on their behalf.
• Residents of, or persons located in, comprehensively sanctioned jurisdictions.
• Shell companies with no demonstrable operating purpose, and anonymous or bearer-share entities.
• Unlicensed money transmitters, unregistered exchanges and unlicensed payment processors.
• Darknet marketplaces, ransomware operators, and businesses trading in unlawful goods or services.
• Customers whose funds derive from, or whose wallet addresses show material exposure to, known criminal activity, mixers or tumblers used to obscure provenance.
• Anyone attempting to use another person's identity, or to evade limits, geographic restrictions or verification controls.

Section 13

What we need from you

• Complete, accurate and current identity information, and prompt notice of any change.
• Genuine, unexpired identity documents belonging to you.
• Honest answers about the purpose of your account, your expected activity, and your source of funds or wealth.
• Use of the account for yourself only. Do not transact on behalf of anyone else, and do not allow anyone else to use your account.
• Funding from and withdrawal to accounts and wallets in your own name.
• A timely response when we ask for additional information. We may restrict your account while a request is outstanding.

Section 14

If we identify a concern

Depending on the circumstances and our legal obligations, we may request further information, apply enhanced monitoring, impose or reduce limits, delay or decline a transaction, freeze or block assets, suspend or close the account, file a report with FinCEN or OFAC, and disclose information to law enforcement or regulators. Where the law requires or permits us to act without notice, we will do so, and we may be prohibited from explaining why.

Section 15

Training and independent testing

All staff receive AML, sanctions and fraud training appropriate to their role, at induction and at least annually, and records of attendance and assessment are retained. The program is subject to periodic independent testing by a qualified party not responsible for its day-to-day operation. Findings are reported to senior management and tracked through to remediation.

Section 16

Compliance contact

Law enforcement requests, regulatory correspondence and compliance questions should be directed to our BSA/AML Compliance Officer: