1. Introduction and Commitment

XAI CRYPTO is firmly committed to preventing its platform from being used for money laundering, terrorist financing, tax evasion, fraud, or any other financial crime. This Anti-Money Laundering (AML) and Know Your Customer (KYC) Policy outlines the procedures and controls we implement to detect, prevent, and report suspicious activity in compliance with applicable international regulations.

We adhere to the recommendations of the Financial Action Task Force (FATF), including the "Travel Rule" for virtual asset service providers, as well as applicable national AML legislation in the jurisdictions where we operate. Our compliance program is regularly reviewed and updated to reflect evolving regulatory requirements and industry best practices.

2. Know Your Customer (KYC) Procedures

All users of XAI CRYPTO are required to complete identity verification before accessing full platform functionality. Our KYC process is designed to verify the identity of each user, assess risk levels, and ensure compliance with applicable regulations.

2.1 Tier 1 — Basic Verification

Required for account creation and limited platform access:

• Full legal name as it appears on government-issued identification
• Date of birth
• Country of residence
• Valid email address and phone number verification

2.2 Tier 2 — Enhanced Verification

Required for deposits, withdrawals, and trading services:

• Government-issued photo identification (passport, national ID card, or driver's license)
• Proof of residential address dated within the last three (3) months (utility bill, bank statement, or government correspondence)
• Selfie verification or biometric liveness check to confirm identity document ownership

2.3 Tier 3 — Enhanced Due Diligence (EDD)

Required for high-value accounts, politically exposed persons (PEPs), and users flagged by our risk assessment system:

• Source of funds documentation (employment records, business ownership proof, investment statements, or inheritance documents)
• Source of wealth documentation demonstrating how assets were accumulated
• Additional identity verification through video call with our compliance team
• Ongoing enhanced monitoring of account activity and transactions

3. Customer Risk Assessment

We apply a risk-based approach to customer due diligence, assessing each user based on the following factors:

• Geographic Risk: Country of residence, nationality, and whether the user is located in or connected to high-risk jurisdictions as identified by FATF or relevant sanctions lists
• Customer Profile Risk: Whether the user is a politically exposed person (PEP), a family member or close associate of a PEP, or a person on any sanctions list
• Product/Service Risk: The types of services used, trading volume, and frequency of transactions
• Transaction Risk: The size, frequency, and nature of deposits and withdrawals, including the use of privacy-enhancing technologies or mixing services

Risk ratings are assigned to each user and reviewed periodically. Users assessed as higher risk are subject to enhanced due diligence measures and more frequent monitoring.

4. Transaction Monitoring

XAI CRYPTO employs automated transaction monitoring systems supplemented by manual review to detect potentially suspicious activity. Our monitoring systems analyze:

• Unusual patterns of deposits and withdrawals, including rapid movement of funds ("pass-through" activity)
• Transactions that are inconsistent with the user's stated source of funds, trading profile, or risk assessment
• Multiple accounts linked to the same identity, device, IP address, or wallet address
• Deposits from or withdrawals to wallet addresses associated with known illicit activities, darknet markets, or sanctioned entities
• Structuring of transactions to avoid reporting thresholds
• Sudden changes in account activity volume or patterns
• Transactions involving privacy coins, mixing services, or tumbling services

5. Suspicious Activity Reporting

When our monitoring systems or personnel identify activity that is potentially suspicious, we follow a structured escalation process:

1. Detection: Automated alerts or manual identification flag potentially suspicious activity for review
2. Investigation: Our compliance team conducts a thorough review of the flagged activity, including analysis of transaction patterns, user profile, and any available contextual information
3. Escalation: If the investigation confirms suspicion, the matter is escalated to the designated compliance officer
4. Reporting: Suspicious Activity Reports (SARs) or equivalent reports are filed with the relevant Financial Intelligence Unit (FIU) or regulatory authority within the required timeframes
5. Action: Depending on the severity and nature of the suspicion, we may suspend the account, restrict transactions, or terminate the user's access to the Platform

In accordance with legal requirements, we do not inform users that a SAR has been or will be filed regarding their account. "Tipping off" is a criminal offense, and all employees are trained on this obligation.

6. Sanctions Screening

All users are screened against international sanctions lists at the time of onboarding and on an ongoing basis. Sanctions screening covers:

• United States OFAC Specially Designated Nationals and Blocked Persons List (SDN List)
• European Union Consolidated Sanctions List
• United Nations Security Council Sanctions List
• UK HM Treasury Financial Sanctions List
• Other applicable national and regional sanctions lists

Users who are identified as sanctioned persons, or who are residents of comprehensively sanctioned jurisdictions, are prohibited from using the Platform. Existing accounts will be immediately frozen if a user is subsequently added to a sanctions list.

7. Blockchain Analytics

We utilize blockchain analytics tools and services to assess the risk associated with cryptocurrency wallet addresses. Incoming deposits are screened for connections to illicit activity, including ransomware payments, darknet marketplace transactions, stolen funds, and sanctioned addresses. Transactions identified as high-risk may be delayed, returned, or reported to relevant authorities. We continuously update our blockchain analytics capabilities to address emerging threats and typologies.

8. Record Keeping

In compliance with applicable AML regulations, XAI CRYPTO maintains comprehensive records including:

• Customer identification and verification documents for a minimum of five (5) years after account closure
• Transaction records, including dates, amounts, wallet addresses, and counterparty information, for a minimum of five (5) years
• Records of all Suspicious Activity Reports filed, along with supporting investigation documentation
• Internal compliance reports, risk assessments, and audit findings
• Training records for all employees involved in AML/KYC compliance

9. Employee Training

All XAI CRYPTO employees, particularly those involved in customer onboarding, compliance, and operations, receive regular training on AML/KYC obligations. Training covers identification of suspicious activity, sanctions compliance, reporting obligations, data protection requirements, and evolving regulatory developments in the cryptocurrency sector. Training is conducted at onboarding and refreshed at least annually, with additional training provided when significant regulatory changes occur.

10. Compliance Program Governance

Our AML/KYC compliance program is overseen by a designated Money Laundering Reporting Officer (MLRO) who is responsible for:

• Maintaining and updating the AML/KYC policy and procedures
• Reviewing and approving Suspicious Activity Reports before filing
• Conducting periodic risk assessments of the business and its customer base
• Liaising with regulatory authorities and law enforcement agencies
• Reporting to senior management and the board of directors on compliance matters
• Ensuring the adequacy and effectiveness of the compliance program through independent audits

11. User Obligations

As a user of XAI CRYPTO, you agree to:

• Provide accurate and truthful information during the KYC verification process
• Promptly update your information if any changes occur
• Cooperate with any requests for additional information or documentation from our compliance team
• Not use the Platform for any illegal purposes, including money laundering, terrorist financing, or sanctions evasion
• Not create multiple accounts, use false identities, or attempt to circumvent KYC requirements
• Not facilitate the use of the Platform by any person who is not authorized to use it

Failure to comply with these obligations may result in account suspension, termination, and reporting to relevant authorities.

12. Contact

For questions regarding our AML/KYC procedures, or to report suspicious activity, please contact our compliance team at compliance@xai.platform.