Anti-Money Laundering (AML) Policy

1. Customer Risk

• The nature of the customer relationship (e.g., individual vs. business account, domestic vs. international).
• The volume, frequency, and value of transactions initiated by the customer.
• Verification status (whether the customer has passed Know Your Customer (KYC) and Enhanced Due Diligence (EDD) checks).
• Presence on watchlists, including OFAC's Specially Designated Nationals (SDN) List and FinCEN's 314(a) List.
• Customers with previous Suspicious Activity Reports (SARS) filed against them.

2. Geographic Risk

• Countries where customers, merchants, or payment recipients are located.
• Transactions involving high-risk jurisdictions as designated by the FATF (e.g., Iran, North Korea, Syria, Russia, and other sanctioned nations).
• Transactions involving U.S. government embargoed nations and entities under OFAC sanctions.
• Cross-border transactions, particularly those to non-cooperative tax jurisdictions or regions are known for financial secrecy.

3. Product and Service Risk

• Risks associated with the payment aggregation model, where multiple merchants use the company's platform for processing payments.
• Cross-border remittances and cryptocurrency-related transactions, which are often targeted for ML/TF.
• Digital wallets, prepaid cards, and alternative payment methods, which may present higher anonymity risks.
• Transactions involving high-risk industries such as gambling, adult services, cash-intensive businesses, and shell companies.

4. Transaction Risk

• The size and frequency of transactions (e.g., unusually large, round-figure, or structured payments that may indicate money laundering).
• Complexity of transactions, including multiple intermediaries or payments routed through offshore accounts.
• Unusual behavior, such as a customer attempting to process transactions just below reporting thresholds (structuring or smurfing).
• Payments to or from unknown third parties or those inconsistent with a customer's transaction history.

1. Low-Risk Customers

• Individuals or businesses that have undergone full Customer Due Diligence (CDD) and verification.
• Domestic transactions with transparent and predictable transaction patterns.
• Customers with a consistent transactional history and no prior suspicious activity.
• Entities operating in low-risk industries, such as salaried professionals, local retailers, or regulated financial institutions.

2. Medium-Risk Customers

• Customers with moderate transaction volumes or occasional high-value transactions.
• Businesses operating in moderate-risk industries (e.g., e-commerce, software services, hospitality).
• Cross-border transactions involving non-high-risk jurisdictions.
• Customers flagged for minor inconsistencies during KYC verification but not presenting immediate AML concerns.
• Transactions involving multiple third parties but remaining within expected industry norms.

3. High-Risk Customers

• Politically Exposed Persons (PEPs), their close associates, and family members.
• Customers or businesses with transactions originating from or routed through high-risk jurisdictions.
• Entities operating in cash-intensive or high-risk industries (e.g., cryptocurrency exchanges, casinos, real estate, money services businesses (MSBs), and shell companies).
• Customers with frequent large transactions or activity inconsistent with their declared business purpose.
• Merchants with previous suspicious activity reports (SARS) filed against them.
• Customers using anonymizing tools (e.g., VPNs, proxies) or suspicious payment methods.

Individual Customers:

• Full name, date of birth, and government-issued ID (e.g., passport, driver's license).
• Proof of residential address (e.g., utility bill, bank statement).
• Employment details or declared business purpose.
• Source of funds (SOF) and source of wealth (SOW) verification (if applicable for medium/high-risk customers).
• Screening against OFAC's SDN List, FinCEN 314(a) List, and other global sanctions/watchlists.

Corporate Merchants:

• Business name, Employer Identification Number (EIN), and incorporation documents.
• Articles of incorporation, business license, and corporate governance documents.
• Ultimate Beneficial Owner (UBO) identification - Any individual holding 25% or more ownership must be verified.
• Verification of directors and authorized signatories.
• Industry risk classification - Companies operating in high-risk industries (e.g., cryptocurrency, gambling, cash-intensive businesses, remittance services, shell companies) undergo additional scrutiny.

KYC information is collected and validated using third-party verification services, government databases, and document authentication tools such as Veriff and sanctions.io.

EDD Triggers:

• Customers identified as Politically Exposed Persons (PEPs) or having close ties to a PEP.
• Transactions involving high-risk jurisdictions as designated by FATF and OFAC.
• Business entities with complex ownership structures that obscure beneficial ownership.
• Customers with inconsistent transactional behavior or prior suspicious activity reports (SARS).

EDD Procedures:

• In-depth verification of ownership structures - Corporate entities must provide full disclosure of their shareholders and business activities.
• Detailed review of source of funds (SOF) and source of wealth (SOW) - High-risk customers must provide supporting documentation (e.g., tax returns, business financials, bank statements).
• Heightened screening for negative media and regulatory actions - Customers undergo adverse media checks for financial crime exposure.
• Ongoing monitoring with periodic risk reassessment High-risk accounts are reviewed more frequently to detect emerging risks.
• Senior management approval - Onboarding of high-risk clients requires explicit approval from Buffon Services LLC's Compliance Officer or MLRO.

Real-Time Transaction Monitoring:

• Automated AML monitoring systems analyze transaction patterns for unusual activity.
• Transactions are flagged based on predefined risk indicators, such as rapid movement of funds, structuring, round-dollar transactions, and transactions to high-risk regions.
• Transactions are screened against OFAC and global sanctions lists in real-time.

Periodic Account Reviews:

• High-risk accounts are subject to frequent audits and reviews to identify potential discrepancies or suspicious behavior.
• Dormant or irregularly used accounts are re-evaluated to ensure continued compliance with AML policies.
• Customers whose risk profiles change over time (e.g., involvement in new high-risk business activities) may be subject to additional scrutiny.

By implementing CDD, EDD, and Ongoing Monitoring, Buffon Services LLC ensures regulatory compliance, reduces exposure to financial crime, and strengthens its AML risk management framework.

Key Monitoring Indicators:

• Rapid movement of funds between accounts - Transactions that lack a legitimate business purpose.
• High-volume transactions inconsistent with customer profiles - Significant deviations from expected behavior based on KYC data.
• Transactions involving high-risk jurisdictions - Payments linked to OFAC-sanctioned countries, FATF high-risk jurisdictions, or regions known for illicit financial activity.
• Structuring and layering attempts - Transactions deliberately structured to evade regulatory thresholds (e.g., multiple small cash deposits under the reporting limit).
• Unusual frequency of large or round-dollar transactions - Especially when there is no clear economic rationale.
• Transactions involving cryptocurrency or cash-intensive businesses - Higher risk of untraceable financial flows.

Automated vs. Manual Reviews:

• Automated systems flag transactions based on pre-configured AML rules and red flag indicators.
• Compliance analysts manually review flagged transactions to determine if further investigation is required.
• High-risk transactions are escalated for additional scrutiny or Suspicious Activity Report (SAR) filing.

Filing Requirements for SARS:

• SARS must be filed within 30 calendar days from the date suspicious activity is detected.
• If additional details are needed for the investigation, the company may take up to 60 days to file, provided that evidence gathering is ongoing.
• All SARS must be kept confidential - Disclosing a SAR filing to the subject of the report is strictly prohibited under BSA and USA PATRIOT Act regulations.

Criteria for Filing SARS:

• Transactions inconsistent with customer profiles - Activities that do not align with a customer's declared business operations or financial capacity.
• Structuring or attempts to evade reporting thresholds - Splitting large transactions to avoid detection.
• Unusual patterns of large or rapid fund transfers - Especially those routed through multiple jurisdictions or involving high-risk industries.
• Use of multiple accounts without logical explanation - Opening and closing accounts frequently without clear economic rationale.
• Transactions linked to sanctioned individuals or entities - Matches found in OFAC's Specially Designated Nationals (SDN) List.

Escalation and Internal Reporting:

• Employees must immediately escalate any suspicious activity to the Compliance Officer or Money Laundering Reporting Officer (MLRO).
• Compliance teams conduct an internal review before determining whether an SAR filing is necessary.
• Law enforcement cooperation - SARS may be shared with relevant U.S. authorities, including FinCEN, FBI, OFAC, and the Department of Justice (DOJ), when required.

Customer and Merchant Screening:

All individuals and entities are screened against the following OFAC-maintained lists:

• Specially Designated Nationals (SDN) List - Identifies individuals, businesses, and organizations prohibited from conducting financial transactions in the U.S.
• Sectoral Sanctions Identifications (SSI) List - Includes entities subject to specific restrictions under sectoral sanctions programs.
• Consolidated Sanctions List - A comprehensive list containing all OFAC sanctions programs, including the Non-SDN Palestinian Legislative Council (NS-PLC) List and Foreign Sanctions Evaders (FSE) List.

Real-Time Transaction Screening:

• All transactions are screened in real-time using automated compliance software.
• Transactions that match sanctioned persons, entities, or jurisdictions are immediately flagged for review.
• Geo-blocking measures are applied to prevent payments to or from sanctioned countries (e.g., North Korea, Iran, Syria, and Russia's sanctioned regions).

Blocking Transactions:

• Transactions involving Specially Designated Nationals (SDNs) or entities subject to comprehensive OFAC sanctions are blocked immediately.
• Funds related to blocked transactions are held in a designated blocked account as required by OFAC regulations.

Rejecting Transactions:

• Transactions that violate OFAC regulations but do not require blocking (e.g., certain sectoral sanctions restrictions) are rejected and returned to the sender.

Payments associated with entities on the Sectoral Sanctions Identifications (SSI) List may be restricted but not necessarily blocked, depending on the transaction type.

OFAC Reporting:

• Blocked or rejected transactions must be reported to OFAC within 10 business days.
• An annual report of blocked property must be submitted to OFAC by September 30 each year.
• Detailed records of all blocked and rejected transactions are maintained for at least five years as per OFAC recordkeeping requirements.

Buffon Services LLC remains committed to strict adherence to OFAC regulations to prevent financial crime, regulatory violations, and reputational risks. The company continuously updates screening protocols to reflect new sanctions developments, ensuring full compliance with U.S. economic and trade sanctions laws.

Verification of Business Legitimacy:

• Obtain and verify incorporation documents, EIN, and business licenses.
• Confirm the physical existence of the business (e.g., office address, operational facilities).
• Review the merchant's business model to identify potential high-risk activities.

Owner and Key Management Screening:

• Identify and verify the Ultimate Beneficial Owners (UBOs) holding 25% or more ownership.
• Conduct background checks on directors and key management personnel.
• Screen individuals and entities against OFAC sanctions lists and PEP databases.

Site Visits and Background Checks:

• Conduct physical or virtual site visits for high-risk merchants to confirm operational legitimacy.
• Perform adverse media checks to identify any negative news or reputational risks.
• Verify business relationships with banks and payment service providers (PSPs).

AML/CTF Compliance Review:

• Assess the merchant's AML/CTF program, including internal controls and reporting mechanisms.
• Review prior compliance history, including regulatory fines or enforcement actions.
• Ensure the merchant has KYC procedures in place for its customers.

Due Diligence on Third-Party Processors and Partners:

• Verify the registration, licensing, and financial standing of third-party providers.
• Conduct screening against global sanctions lists, adverse media, and legal records.
• Assess the third party's AML/CTF policies, transaction monitoring controls, and reporting procedures.

Contractual Obligations for Compliance:

• Ensure contracts include AML/CTF and sanctions compliance clauses.
• Require third-party service providers to comply with U.S. AML regulations (e.g., BSA, FinCEN requirements).
• Establish clear roles and responsibilities for detecting and reporting suspicious transactions.

Periodic Compliance Audits of Third-Party Vendors:

• Mandate regular audits and compliance assessments for critical third-party partners.
• Require access to transaction records and compliance reports for oversight.

The records retained include:

Customer Due Diligence (CDD) and Know Your Customer (KYC) Records:

• Customer identification documents (e.g., passports, driver's licenses, national IDs).
• Proof of address documents (e.g., utility bills, bank statements).
• Customer risk assessments and due diligence reports.
• Ultimate Beneficial Owner (UBO) information for corporate clients.

Transaction Records:

• Transaction details (e.g., sender/receiver names, account details, transaction amounts, timestamps).
• Payment methods used (e.g., wire transfers, credit cards, digital wallets).
• Foreign exchange rates applied, if applicable.
• Transaction monitoring alerts and investigations.

Suspicious Activity Reports (SARS) and OFAC Compliance Records:

• Filed SARS and related investigative documents.
• Records of blocked or rejected transactions due to OFAC sanctions.
• Correspondence with regulatory agencies regarding compliance matters.

Internal and External Communication Records:

• Correspondence with customers, regulators, financial institutions, and law enforcement agencies.
• Internal emails and memos related to compliance and risk management.
• Meeting minutes of compliance and risk committees.

Digital and Physical Storage:

• Electronic records are stored in encrypted databases with access controls.
• Paper records (if applicable) are kept in secure, access-controlled locations.
• Backup systems ensure redundancy and disaster recovery capabilities.

Access Control Measures:

• Role-based access controls (RBAC) restrict access to compliance and audit personnel.
• Audit logs track all access to sensitive records to prevent unauthorized changes.
• Multi-factor authentication (MFA) is required for system access.

Monitoring of Financial Transactions:

• Real-time logging of all transactions and user activity within the system.
• Identification of discrepancies, anomalies, and unauthorized changes.

Regulatory Compliance Audits:

• Regular internal audits to assess the effectiveness of AML/CTF controls.
• Third-party audits and regulatory reviews to ensure compliance with FinCEN and OFAC requirements.

Audit Logs for Suspicious Activity Reports (SARS):

• Logs of SAR filings, including timestamps and compliance officer actions.
• Review of past SARS for patterns or emerging financial crime risks.

By maintaining a comprehensive recordkeeping and audit trail system, Buffon Services LLC ensures regulatory compliance, operational integrity, and effective risk management while providing a solid foundation for investigations and financial crime prevention.