AML/CFT Policy — Traz Global

This Anti-Money Laundering and Countering the Financing of Terrorism Policy sets out how TRAZ GLOBAL LLC identifies, assesses, mitigates, monitors and escalates financial crime risk across its technology, its customers and its financial service providers.

Document Details

The items below are referred to by name throughout this Policy.

Item	Detail
Version	[●]
Effective Date	[●]
Last Review Date	[●]
Next Review Date	[●]
Approved By	[●]
Policy Owner	[●]
AML/CFT Responsible Person	[Name]
Title of the Responsible Person	[Title]
AML/CFT Contact Email	[Email]
Escalation Authority	[Chief Compliance Officer / Management]
High-Risk Approver	[Compliance / Designated Approver]
UBO Threshold	[●]%
Additional Currencies	[Other currencies, if applicable]

Policy Foundations

1. Document Control

This Anti-Money Laundering and Countering the Financing of Terrorism Policy (“AML/CFT Policy” or “Policy”) establishes the AML/CFT framework adopted by TRAZ GLOBAL LLC (“TRAZ” or the “Company”).

The version, dates, approval and ownership of this Policy are recorded in Document Details.

This Policy shall be read together with the Company’s operational procedures, customer onboarding procedures, risk assessment methodology, sanctions procedures, transaction monitoring procedures, information security policies, contractual arrangements with financial service providers, and other applicable internal controls.

This Policy shall be reviewed at least annually and whenever there is a material change to the Company’s business model, products, jurisdictions, customer base, financial service providers, regulatory environment, or risk exposure.

2. Statement of Commitment

TRAZ is committed to preventing its technology, systems, APIs, interfaces, products, services and business relationships from being used to facilitate money laundering, terrorist financing, sanctions evasion, fraud or other financial crimes.

TRAZ operates as a technology and software infrastructure company providing a software layer through which customers may access cross-border payment and remittance capabilities provided by third-party financial service providers.

TRAZ does not itself hold, custody or settle customer funds.

The underlying financial services, including, as applicable, receipt, custody, holding, movement, transmission, conversion and settlement of funds, are performed by third-party providers and/or their underlying regulated financial institutions.

Such providers are responsible for performing the regulated financial activities for which they or their underlying financial institutions hold the applicable licenses, registrations or authorizations.

TRAZ maintains its own risk-based AML/CFT controls in connection with its direct customer relationships, notwithstanding the independent AML/CFT, KYC/KYB, sanctions and transaction monitoring controls performed by its providers.

The use of regulated providers does not eliminate TRAZ’s responsibility to understand its customers, assess the risks associated with its relationships, identify suspicious or unusual activity within the information available to TRAZ, comply with applicable sanctions requirements and cooperate with its providers when financial crime concerns arise.

TRAZ shall not knowingly permit its systems or services to be used to circumvent AML/CFT controls, sanctions restrictions or controls maintained by a financial service provider.

3. Regulatory Framework

TRAZ is organized in the United States and operates through third-party providers that may be subject to financial regulatory requirements in the United States and other jurisdictions.

This Policy is intended to provide a risk-based corporate financial crime compliance framework taking into consideration, where applicable:

the Bank Secrecy Act (“BSA”);
regulations and guidance issued by the Financial Crimes Enforcement Network (“FinCEN”);
economic sanctions administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”);
applicable AML/CFT and sanctions requirements in jurisdictions in which TRAZ or its providers operate;
requirements imposed by TRAZ’s banks, financial service providers and regulated partners;
applicable privacy, data protection, recordkeeping and information security requirements; and
recognized risk-based AML/CFT principles.

The inclusion of a law, regulation or regulatory framework in this Policy does not constitute a representation that TRAZ is subject to every requirement applicable to a bank, Money Services Business (“MSB”), money transmitter or other regulated financial institution.

The regulatory characterization of TRAZ shall depend upon the activities actually performed by the Company.

TRAZ shall periodically reassess its regulatory position, particularly before implementing any material change under which the Company would directly receive, hold, custody, transmit or settle customer funds or otherwise assume a regulated financial function.

4. Purpose and Scope

The purpose of this Policy is to establish minimum standards for identifying, assessing, mitigating, monitoring and escalating money laundering, terrorist financing, sanctions and related financial crime risks.

This Policy applies, as relevant, to:

TRAZ’s direct customers;
business customers;
individual customers, where applicable;
Ultimate Beneficial Owners (“UBOs”);
directors and control persons;
authorized representatives and signatories;
relevant counterparties;
financial service providers;
critical service providers;
employees, officers, contractors and consultants;
products and services offered through TRAZ’s technology;
APIs and integrations controlled by TRAZ; and
transactions and activity visible to TRAZ through its systems.

TRAZ’s customer base is primarily business-to-business (“B2B”), although individual customers may be accepted where supported by the applicable product and provider.

TRAZ currently supports or facilitates services involving currencies including:

USD;
EUR;
BRL; and
the Additional Currencies listed in Document Details, if any.

The countries and payment corridors supported by TRAZ shall be maintained in a separate approved list and shall be subject to risk assessment.

Operating Model and Governance

5. Operating Model and Responsibility Boundaries

5.1 Technology Layer

TRAZ operates as a software and technology layer connecting customers with third-party providers.

TRAZ does not operate as the custodian or settlement institution for customer funds.

The provider and/or its underlying regulated financial institution is responsible for the regulated financial infrastructure associated with the relevant service.

TRAZ may collect customer information and documentation and transmit relevant information to its providers to support onboarding, compliance and service delivery.

Providers may conduct their own independent onboarding, KYC/KYB, sanctions screening, risk assessment and transaction monitoring in accordance with their legal, regulatory and internal requirements.

TRAZ’s controls are complementary to, and do not replace, the controls maintained by its providers.

5.2 Responsibility Matrix

Function	TRAZ	Provider / Regulated Financial Institution
Software/API infrastructure	Responsible	Integration as applicable
Customer relationship	Direct relationship where applicable	Relationship as required by provider
Customer onboarding	Yes	Independent/provider onboarding
KYC/KYB	TRAZ control	Independent provider control
UBO identification	TRAZ control	Provider requirements
Sanctions screening	TRAZ control	Independent provider control
PEP screening	TRAZ control	Independent provider control
Customer risk assessment	TRAZ control	Provider risk assessment
Expected activity	Collected/evaluated by TRAZ	As required by provider
Source of funds	Risk-based	As required by provider
Custody/holding of funds	No	Provider
Movement of funds	No	Provider
Settlement	No	Provider
Regulated financial activity	Not assumed by TRAZ unless appropriately authorized	Provider / underlying regulated institution
Transaction monitoring	Activity/data available to TRAZ	Financial transaction monitoring within provider infrastructure
Investigation	TRAZ investigates/escalates matters identified within its systems	Provider performs investigation under its framework
Blocking/restriction	Technical/customer restrictions within TRAZ’s control	Financial/regulatory restrictions within provider’s control
SAR/STR/regulatory reporting	Where legally applicable; otherwise escalation/cooperation	Provider where legally responsible
Recordkeeping	Records controlled by TRAZ	Provider’s regulatory records

The precise division of responsibilities may vary by provider and product and shall be documented contractually or through an internal responsibility matrix.

6. AML/CFT Governance

6.1 Management Responsibility

TRAZ’s management shall maintain appropriate oversight of the Company’s AML/CFT framework.

Management shall ensure that appropriate resources, personnel, systems and authority are made available to implement controls proportionate to the Company’s size, complexity and financial crime risk.

6.2 AML/CFT Responsible Person

TRAZ shall designate an individual responsible for coordinating the AML/CFT framework.

The AML/CFT Responsible Person, their title and the AML/CFT Contact Email are identified in Document Details.

The responsible person shall have sufficient authority to:

request customer information;
request enhanced due diligence;
investigate compliance alerts;
approve or escalate high-risk relationships;
recommend restrictions or termination;
communicate with financial service providers;
escalate material matters to management; and
maintain the AML/CFT framework.

6.3 Escalation

Material AML/CFT matters shall be escalated to:

the AML/CFT Responsible Person;
the Escalation Authority;
legal counsel, where necessary;
the relevant financial service provider; and
authorities, where TRAZ has an applicable legal reporting obligation.

Risk Assessment

7. Risk-Based Approach

TRAZ applies a risk-based approach to AML/CFT.

Customers shall be assessed considering relevant risk factors including:

Customer Risk

Factors may include:

legal form;
business activity;
industry;
ownership structure;
transparency;
customer type;
financial profile;
expected transaction activity; and
history with TRAZ.

Geographic Risk

TRAZ shall consider:

country of incorporation;
country of residence;
operating countries;
source and destination countries;
sanctions exposure;
jurisdictions identified as presenting material AML/CFT deficiencies; and
unusual or unexplained geographic exposure.

Ownership Risk

Factors may include:

complex ownership;
difficulty identifying UBOs;
nominee arrangements;
trusts or similar structures;
multiple layers of legal entities;
high-risk jurisdictions;
PEP ownership/control; and
inconsistencies in ownership information.

Product and Transaction Risk

Factors may include:

cross-border activity;
currencies;
transaction volumes;
transaction frequency;
expected counterparties;
unusual payment corridors;
third-party payments; and
significant deviations from expected activity.

Provider Risk

TRAZ shall consider:

regulatory status;
jurisdiction;
services provided;
AML/CFT framework;
sanctions controls;
outsourcing/sub-provider structure; and
material regulatory or reputational concerns.

8. Customer Risk Classification

Customers shall be assigned a risk classification using TRAZ’s approved Customer Risk Assessment methodology.

Risk classifications shall ordinarily include:

Classification	Description
Low risk	Customers presenting limited financial crime risk based on their ownership, business, geography and expected activity.
Medium risk	Customers presenting additional risk factors requiring increased monitoring or additional information.
High risk	Customers presenting material financial crime risk requiring Enhanced Due Diligence (“EDD”) and approval by the High-Risk Approver.

The assessment may consider:

customer/business risk;
geographic risk;
ownership risk;
PEP exposure;
sanctions exposure;
adverse media;
industry risk;
expected activity;
source of funds;
transaction behavior; and
other relevant risk indicators.

A risk score shall not override sanctions restrictions or material compliance concerns.

Customer Due Diligence and Screening

9. Customer Due Diligence — CDD

TRAZ shall perform Customer Due Diligence before establishing a customer relationship, subject to the procedures applicable to the relevant product.

TRAZ shall seek to:

identify the customer;
verify the customer’s identity using reliable information;
understand the nature and purpose of the relationship;
identify relevant UBOs;
understand the customer’s business or occupation;
establish expected activity;
perform sanctions and PEP screening;
assess geographic exposure;
evaluate source of funds where appropriate;
determine the customer’s initial risk classification; and
provide required information to the applicable provider.

No customer shall be activated where required information cannot be satisfactorily obtained or verified, subject to approved procedures.

10. Business Customer — KYB

For legal entities, TRAZ shall obtain information proportionate to risk, which may include:

full legal name;
trade name / DBA;
entity type;
jurisdiction of incorporation;
registration number;
incorporation date;
registered address;
principal business address;
tax identification information where applicable;
website;
description of business activities;
products/services;
countries of operation;
expected transaction activity;
expected transaction volumes;
expected payment corridors;
purpose of the relationship;
directors;
authorized representatives;
ownership structure;
UBO information;
source of funds, where appropriate;
financial information, where appropriate; and
supporting corporate documentation.

TRAZ may use reliable independent sources and specialized verification providers to validate customer information.

11. Individual Customer — KYC

Where TRAZ supports individual customers, information may include:

full legal name;
date of birth;
residential address;
nationality;
government-issued identification;
identification number;
contact information;
occupation;
purpose of relationship;
expected activity; and
source of funds where appropriate.

The specific information collected shall be determined according to applicable risk, product and provider requirements.

12. Ultimate Beneficial Ownership

TRAZ shall identify the natural persons who ultimately own or control a legal entity customer according to its approved UBO methodology and applicable requirements.

Unless another threshold is required by applicable law or provider requirements, TRAZ shall use the UBO Threshold set out in Document Details.

TRAZ shall also identify persons exercising significant control even where an ownership threshold is not met.

UBOs shall be subject to appropriate:

identity verification;
sanctions screening;
PEP screening;
adverse media screening where applicable; and
risk assessment.

TRAZ shall not establish or continue a relationship where beneficial ownership cannot be reasonably understood or verified, unless approved under an applicable exception procedure and legally permissible.

13. Sanctions Screening

TRAZ shall maintain risk-based controls designed to prevent prohibited dealings involving sanctioned persons, entities, countries or activities.

Screening may include, as applicable:

OFAC sanctions lists;
United Nations sanctions lists;
applicable European Union sanctions lists;
applicable United Kingdom sanctions lists;
other national sanctions lists relevant to the customer, transaction, provider or jurisdiction; and
provider-required lists.

TRAZ shall screen relevant persons including:

customers;
UBOs;
directors/control persons;
authorized representatives;
relevant counterparties; and
other persons where appropriate.

A potential name match shall not automatically be treated as a confirmed sanctions match.

Potential matches shall be reviewed using available identifiers, including:

full name;
aliases;
date of birth;
nationality;
address;
entity registration information;
ownership/control information; and
other available identifiers.

Potential or confirmed sanctions matches shall be escalated immediately in accordance with TRAZ procedures.

TRAZ shall cooperate with its provider when a transaction or customer requires blocking, rejection, restriction or other action under the provider’s sanctions obligations.

14. Politically Exposed Persons — PEP

TRAZ shall screen relevant natural persons for Politically Exposed Person (“PEP”) exposure.

A PEP relationship shall not automatically be prohibited solely because of PEP status.

Where material PEP exposure is identified, TRAZ shall apply risk-based controls that may include:

Enhanced Due Diligence;
confirmation of role and jurisdiction;
source of funds;
source of wealth where appropriate;
senior Compliance approval;
increased monitoring; and
periodic review.

Family members and close associates may be considered where relevant under TRAZ’s screening methodology or provider requirements.

15. Adverse Media

TRAZ may conduct adverse media screening as part of CDD, EDD, periodic review or investigations.

As a standard approach, adverse media searches should generally consider information published during the preceding three (3) years.

Older information may be considered where materially relevant, including matters involving:

money laundering;
terrorist financing;
fraud;
corruption or bribery;
sanctions evasion;
organized crime;
financial crime;
regulatory enforcement;
serious criminal convictions; or
other conduct materially relevant to the customer’s current risk.

Adverse media shall be evaluated based on credibility, relevance, recency and status.

An allegation shall not be treated as equivalent to a conviction, regulatory finding or final judicial decision.

Enhanced Due Diligence and Expected Activity

16. Enhanced Due Diligence — EDD

TRAZ shall apply EDD where elevated risks are identified.

EDD triggers may include:

PEP exposure;
high-risk jurisdiction;
complex or opaque ownership;
inability to easily establish source of funds;
unusual expected activity;
high-risk business activity;
material adverse media;
significant inconsistencies in customer information;
unusually high expected volumes;
unexplained third-party activity;
provider request;
unusual cross-border activity; or
other material AML/CFT concerns.

EDD may include:

additional corporate documents;
additional identity verification;
ownership documentation;
financial statements;
bank statements;
source of funds evidence;
source of wealth information;
contracts/invoices;
business rationale;
explanation of payment corridors;
additional adverse media research;
management approval; and
increased monitoring.

17. Source of Funds and Source of Wealth

Source of Funds (“SOF”) shall be assessed on a risk-sensitive basis.

TRAZ may request evidence regarding the origin of funds where warranted by the customer’s risk, expected activity, transaction behavior, provider requirements or other relevant factors.

Source of Wealth (“SOW”) may be requested for high-risk customers, PEPs, UBOs or other circumstances where understanding the origin of overall wealth is relevant to the risk assessment.

Supporting evidence may include, where appropriate:

bank statements;
financial statements;
tax documentation;
contracts;
invoices;
sale agreements;
investment records; and
other reliable evidence.

18. Expected Activity

During onboarding, TRAZ shall establish an expected activity profile appropriate to the customer.

The profile may include:

expected monthly volume;
expected transaction count;
typical transaction amount;
maximum expected transaction amount;
expected currencies;
origin countries;
destination countries;
expected counterparties;
business purpose; and
nature of underlying transactions.

Expected activity shall provide a baseline for ongoing monitoring.

Monitoring, Investigation and Reporting

19. Transaction and Activity Monitoring

TRAZ shall monitor customer activity using information reasonably available through its systems.

TRAZ’s monitoring is complementary to the transaction monitoring conducted by the provider responsible for the underlying financial infrastructure.

TRAZ shall not represent that it performs monitoring over information that is not available to it.

Monitoring may identify:

activity inconsistent with expected volumes;
sudden increases in activity;
unusual transaction velocity;
unusual geographic patterns;
unexplained counterparties;
third-party transactions;
transactions involving high-risk or sanctioned jurisdictions;
structuring or splitting of transactions to avoid limits, thresholds or controls;
funds moving in and out rapidly with no apparent business purpose;
round-amount or repetitive transactions inconsistent with the customer’s profile;
frequent or unexplained changes of beneficiaries, counterparties or payment corridors;
activity inconsistent with the customer’s declared business;
exposure of digital asset transactions to high-risk addresses or services, where applicable;
indicators of fraud or account takeover; and
other red flags defined in TRAZ’s monitoring procedures.

Monitoring may combine automated rules, manual review and information received from providers.

Monitoring rules, scenarios and thresholds shall be documented in TRAZ’s procedures, calibrated to its customer base and reviewed periodically. They shall not be disclosed to customers.

20. Blockchain Analytics

Where a product involves digital assets, TRAZ and/or its providers shall use blockchain analytics tools to assess wallet addresses and transactions.

Analytics may identify exposure to:

sanctioned addresses or entities;
stolen or hacked assets;
fraud and scams;
ransomware;
darknet markets;
mixers or tumblers;
unlicensed or high-risk exchanges and services; and
other illicit activity.

Exposure identified by analytics shall be assessed according to its severity, directness and amount, and may result in additional due diligence, rejection of the instruction, restriction of the customer or escalation to the provider.

Direct exposure to a sanctioned address shall be treated as a potential sanctions match under Section 13.

21. Alert Review and Investigation

Alerts generated by monitoring, screening, analytics, provider notifications, employee reports or other sources shall be reviewed by personnel with appropriate training.

Reviews shall be performed without undue delay and prioritized by risk.

An investigation may include:

review of the customer profile, expected activity and history;
review of the transactions and counterparties involved;
requests for information or supporting documentation;
additional screening and adverse media research; and
consultation with the relevant provider.

Each review shall be documented, including the information considered, the conclusion reached and its rationale.

Possible outcomes include:

closure of the alert with documented rationale;
update of the customer’s risk classification or expected activity;
Enhanced Due Diligence;
restriction of Platform functionality;
escalation to the provider;
exit of the relationship; and
reporting, where TRAZ has a legal obligation to report.

22. Suspicious Activity Reporting

Where TRAZ is subject to a legal obligation to report suspicious activity to a competent authority, TRAZ shall file the required report within the applicable deadline, under the coordination of the AML/CFT Responsible Person.

Where the provider or its underlying regulated institution is the entity legally responsible for reporting, TRAZ shall escalate the relevant facts and supporting information to the provider without undue delay and cooperate with the provider’s investigation.

TRAZ shall not represent that it files Suspicious Activity Reports (“SARs”) or Suspicious Transaction Reports (“STRs”) in circumstances where it has no legal obligation or authority to do so.

The decision to report or escalate, and its rationale, shall be documented.

23. Confidentiality and No Tipping-Off

Personnel must not disclose to a customer or to any third party that an investigation, escalation or report is being considered, has been made or is underway, except where permitted by law.

Information about SARs, STRs and provider escalations shall be restricted to personnel with a need to know.

Communications with customers during a review shall be limited to requests for information and shall not reveal the reasons for the review where this could compromise an investigation or breach applicable law.

Restrictions and Prohibitions

24. Restrictions, Blocking and Exit

Where warranted by risk, TRAZ may apply controls within its own systems, including:

declining to transmit an instruction to a provider;
restricting Platform functionality;
suspending access or credentials; and
terminating the customer relationship.

Blocking, freezing, holding or returning funds or assets held by a provider are actions of the provider under its own compliance program and applicable law. TRAZ shall cooperate with the provider but shall not claim authority over funds or assets outside its possession or control.

A relationship shall be exited where:

a sanctions match is confirmed and dealings are prohibited;
the customer refuses or fails to provide required information;
the risk cannot be mitigated to an acceptable level;
the customer has provided false or misleading information; or
the provider requires it.

Exited customers shall be flagged to prevent re-onboarding without the approval of the AML/CFT Responsible Person.

25. Prohibited Customers and Activities

TRAZ shall not establish or maintain relationships with:

persons or entities subject to applicable sanctions where dealings are prohibited;
shell banks;
anonymous customers or customers using fictitious names;
customers whose beneficial ownership cannot be reasonably understood or verified;
money services businesses, payment processors or virtual asset service providers operating without a required license or registration;
customers offering undisclosed nested financial services through their TRAZ relationship; and
customers engaged in illegal activity.

TRAZ shall maintain a separate list of prohibited and restricted industries, updated to reflect provider requirements and risk assessments.

26. High-Risk and Prohibited Jurisdictions

TRAZ shall maintain an approved list of prohibited and high-risk jurisdictions, considering:

jurisdictions subject to comprehensive sanctions;
jurisdictions identified by the Financial Action Task Force (“FATF”) as subject to a call for action or to increased monitoring;
provider restrictions; and
other credible assessments of AML/CFT, corruption and terrorism risk.

Relationships and transactions involving prohibited jurisdictions shall not be accepted. Those involving high-risk jurisdictions shall be subject to Enhanced Due Diligence.

The list shall be reviewed at least annually and whenever a relevant list or provider requirement changes.

Ongoing Oversight

27. Ongoing Due Diligence and Periodic Review

Customer information shall be kept up to date through periodic and event-driven reviews.

Periodic reviews shall be performed at least as follows:

Risk classification	Periodic review
High risk	Every year
Medium risk	Every two (2) years
Low risk	Every three (3) years

An event-driven review shall be performed when:

a material change in ownership, control or business activity is identified;
activity deviates materially from expected activity;
a new sanctions, PEP or adverse media hit is identified;
a provider requests it; or
other information indicates a change in risk.

Sanctions screening of customers, UBOs and other relevant persons shall be repeated when screening lists are updated, according to TRAZ procedures.

28. Financial Service Provider Oversight

Before engaging a financial service provider, TRAZ shall perform due diligence considering the provider risk factors in Section 7, including:

licenses, registrations and regulatory status;
AML/CFT and sanctions program;
ownership and management;
regulatory history and adverse media; and
sub-providers and underlying regulated institutions.

The division of AML/CFT responsibilities with each provider shall be documented contractually or in an internal responsibility matrix, consistent with Section 5.

TRAZ shall respond promptly to provider requests for information, cooperate with provider investigations and notify the provider of material compliance concerns.

Providers shall be reviewed periodically and whenever material regulatory or reputational concerns arise.

29. Third-Party Payments and Nested Activity

Payments to or from persons other than the customer increase financial crime risk.

Where third-party payments are permitted by the product and provider, TRAZ shall seek to understand:

the payer and the beneficiary;
the relationship between the parties;
the purpose of the payment; and
the economic rationale.

Customers shall not use their relationship to provide payment processing, money transmission or other financial services to their own customers without TRAZ’s prior written approval and appropriate due diligence on the nested activity.

30. New Products, Corridors and Providers

Before launching a new product, feature, currency, payment corridor, digital asset, blockchain network or provider, TRAZ shall assess the associated financial crime risks and confirm that appropriate controls are in place.

The assessment shall be documented and approved by the AML/CFT Responsible Person.

Where a change would lead TRAZ to directly receive, hold, custody, transmit or settle customer funds, TRAZ shall first reassess its regulatory position under Section 3.

Records, Training and Program Review

31. Recordkeeping

TRAZ shall retain the records it controls, including:

customer identification and verification records;
KYC/KYB and UBO documentation;
risk assessments;
screening results and match reviews;
expected activity profiles;
transaction and activity data available to TRAZ;
alerts, investigations and their outcomes;
escalations to providers and regulatory reports;
training records; and
approvals of exceptions and high-risk relationships.

Records shall be retained for at least five (5) years after the end of the customer relationship or the date of the transaction, whichever is later, or longer where required by law or by a provider.

Records shall be stored securely, protected against unauthorized access and retrievable in a timely manner when requested by a provider or a competent authority.

32. Training

Employees, officers, contractors and consultants whose functions are relevant to AML/CFT shall receive training when they join TRAZ and at least annually.

Training shall be proportionate to each role and may cover:

this Policy and related procedures;
money laundering, terrorist financing and sanctions evasion typologies;
red flags relevant to TRAZ’s products, customers and corridors;
digital asset risks, where relevant;
escalation and no tipping-off obligations; and
the division of responsibilities with providers.

Completion of training shall be recorded.

33. Personnel and Internal Reporting

TRAZ shall apply appropriate screening to personnel in roles relevant to AML/CFT, subject to applicable law.

Personnel must report any known or suspected breach of this Policy, or any suspicious activity, to the AML/CFT Responsible Person without delay.

TRAZ shall not retaliate against personnel who report concerns in good faith.

Failure to comply with this Policy may result in disciplinary action, up to and including termination of employment or engagement.

34. Independent Review

The effectiveness of the AML/CFT framework shall be tested periodically by a person, internal or external, who is independent of the functions being reviewed.

The frequency of the review shall be proportionate to TRAZ’s risk, and a review shall also be performed whenever required by a provider or applicable law.

Findings shall be reported to management, and remediation shall be tracked until completion.

35. Information Security and Data Protection

Personal data collected for AML/CFT purposes shall be processed in accordance with TRAZ’s Privacy Policy, its information security policies and applicable data protection laws.

Access to customer compliance information shall be restricted according to role and need to know.

Information shall be shared with providers and competent authorities only to the extent necessary for onboarding, compliance, service delivery or compliance with legal obligations.

36. Exceptions

Exceptions to this Policy shall be requested in writing, justified by risk, time-limited where appropriate and approved by the AML/CFT Responsible Person and the Escalation Authority.

No exception may be granted in relation to sanctions prohibitions or where it would breach applicable law or provider requirements.

Approved exceptions shall be recorded and reviewed periodically.

37. Policy Review and Approval

The Policy Owner shall review this Policy at least annually and whenever one of the changes described in Section 1 occurs.

Changes shall be approved by the person identified under Approved By in Document Details and communicated to relevant personnel.

The Version, Effective Date, Last Review Date and Next Review Date in Document Details shall be updated with each approved revision.