AML & CTF Policy

Policy Statement

CryptoBitPesa ("the Company") is committed to the highest standards of Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) compliance. We will not knowingly facilitate, participate in, or support money laundering, terrorist financing, or any other financial crime.

This policy applies to all users, employees, contractors, and agents of CryptoBitPesa. Compliance with this policy is mandatory and non-negotiable.

The Company will:

• Verify the identity of all customers before providing services.
• Monitor transactions for suspicious activity on an ongoing basis.
• Report suspicious transactions to the Financial Reporting Centre (FRC) as required by law.
• Refuse to process transactions that appear to involve proceeds of crime.
• Cooperate fully with law enforcement and regulatory investigations.
• Maintain records of all customer identification and transactions for a minimum of 7 years.

Legal Framework

This policy is governed by and complies with the following Kenyan legislation and regulations:

• Proceeds of Crime and Anti-Money Laundering Act (POCAMLA), Cap 59B — the primary AML legislation in Kenya.
• Prevention of Terrorism Act (PTA), Cap 59G — prohibiting financing of terrorism.
• Financial Reporting Centre Act (FRCA), Cap 59F — establishing reporting obligations.
• Kenya Data Protection Act, 2019 — governing the processing of personal data collected for AML purposes.
• Financial Action Task Force (FATF) Recommendations — international AML standards adopted by Kenya.

Definitions

• Money Laundering: The process of making illegally obtained funds appear legitimate by passing them through a complex sequence of banking transfers or commercial transactions.
• Terrorist Financing: The provision of funds or financial services to support terrorist activities.
• KYC (Know Your Customer): The process of verifying the identity of customers and assessing the risks they present.
• CDD (Customer Due Diligence): The measures taken to identify and verify customers and understand the nature of their business.
• EDD (Enhanced Due Diligence): Additional scrutiny applied to higher-risk customers.
• PEP (Politically Exposed Person): An individual who holds or has held a prominent public position, or a close associate or family member of such a person.
• Suspicious Transaction: Any transaction that gives reasonable grounds to suspect it involves proceeds of crime or terrorist financing.
• STR (Suspicious Transaction Report): A formal report submitted to the Financial Reporting Centre.

Customer Due Diligence (CDD)

We apply Customer Due Diligence measures to all users at account opening and on an ongoing basis. CDD involves:

• Identifying and verifying the customer's identity using reliable, independent source documents.
• Understanding the nature and purpose of the customer's use of our platform.
• Assessing the risk profile of the customer.
• Conducting ongoing monitoring of the business relationship and transactions.

CDD must be completed before a customer can make deposits or withdrawals above threshold amounts. We reserve the right to refuse or terminate a business relationship if CDD requirements cannot be met.

Know Your Customer (KYC)

All users must complete KYC verification to access full platform features. The KYC process requires:

• Proof of Identity: Kenya National Identity Card (front and back) or valid Passport.
• Facial Verification: A clear selfie or photograph matching the ID document.
• Phone Verification: M-Pesa registered phone number in the user's name.

For higher-risk customers, we may additionally require:

• Proof of address (utility bill, bank statement dated within 3 months).
• Source of funds declaration.
• Employment or business verification documents.

Enhanced Due Diligence (EDD)

Enhanced Due Diligence is applied to customers who present a higher risk of money laundering or terrorist financing. EDD is mandatory for:

• Politically Exposed Persons (PEPs) — including current and former government officials, senior executives of state-owned enterprises, and their family members or close associates.
• High-Value Transactions — individual transactions or cumulative monthly transactions exceeding KES 1,000,000.
• Non-Resident Users — users transacting from jurisdictions with elevated AML risk.
• Unusual Transaction Patterns — users flagged by our transaction monitoring systems.

EDD measures include obtaining additional documentation, verifying the source of funds and wealth, and applying increased transaction monitoring. We reserve the right to restrict or terminate accounts that cannot satisfy EDD requirements.

Transaction Monitoring

We monitor all transactions on our platform for indicators of suspicious activity. Our monitoring focuses on:

• Unusual transaction volumes or frequencies inconsistent with a user's stated activity.
• Multiple rapid deposits and withdrawals with no investment activity.
• Transactions structured to avoid reporting thresholds (structuring/smurfing).
• Transfers to or from high-risk jurisdictions.
• Inconsistency between declared income and transaction volumes.
• Use of the platform by multiple people using a single account.
• Requests to transfer funds to third parties unrelated to the user's stated purpose.

When suspicious patterns are detected, we will escalate to our Compliance Officer for further investigation and, where required, file a Suspicious Transaction Report (STR) with the Financial Reporting Centre.

Suspicious Activity Reporting

Under POCAMLA and the FRCA, we are legally required to report suspicious transactions to the Financial Reporting Centre (FRC) of Kenya. We will file an STR when:

• We know or suspect that a transaction involves proceeds of crime.
• We know or suspect that a transaction is related to terrorist financing.
• A customer refuses to provide KYC information without reasonable explanation.
• A transaction has no apparent lawful purpose.

All STR filings are handled confidentially by our Compliance Officer. Users must not attempt to influence or interfere with our reporting obligations.

Prohibited Persons & Sanctions Screening

We screen all users against applicable sanctions lists and will not provide services to:

• Individuals or entities on the UN Security Council Consolidated Sanctions List.
• Individuals or entities on the Kenya Sanctions List.
• Individuals or entities designated as terrorists under the Prevention of Terrorism Act.
• Individuals convicted of money laundering or financial crimes.
• Entities from FATF-designated high-risk or non-cooperative jurisdictions.

If a match is found against a sanctions list, we will immediately freeze the account, decline to process transactions, and notify the relevant authorities as required by law.

Record Keeping

We maintain the following records for a minimum of 7 years as required by POCAMLA:

• All customer identification and KYC documents.
• All transaction records including deposits, withdrawals, transfers, and investments.
• All STRs filed with the FRC and related correspondence.
• Records of CDD and EDD measures applied.
• Staff AML training records.

Records are stored securely and made available to regulatory authorities upon lawful request.

Staff Training

All staff and contractors who handle customer data or transactions receive regular training on:

• How to identify suspicious transactions and red flags.
• KYC and CDD procedures.
• Legal obligations under POCAMLA and the FRCA.
• The tipping-off prohibition.
• How to escalate concerns to the Compliance Officer.

AML training is conducted at onboarding and refreshed at least annually or when significant regulatory changes occur.

Compliance Officer & Reporting

CryptoBitPesa has appointed a Compliance Officer responsible for overseeing AML/CTF compliance, handling STR filings, and liaising with the Financial Reporting Centre and other regulatory authorities.

If you have concerns about suspicious activity, or if you are a third party with a legitimate legal request, contact our Compliance Officer:

This policy is reviewed annually or whenever significant regulatory changes occur. The current version supersedes all previous versions.