Anti-Money Laundering, Counter-Terrorist Financing and Know-Your-Customer Policy

Last updated: 18 August 2026. Version 2.0.

1. About this Policy

ALPPAY (“we”, “us”, “the Company”) operates a crypto payment gateway for merchants and their customers. ALPPAY is a registered virtual asset service provider and an obliged institution under the applicable anti-money laundering legislation.

ALPPAY has zero tolerance for money laundering, terrorist financing, sanctions evasion, fraud and any other illicit use of its services. This Policy explains, in summary form, how we meet our anti-money laundering and counter-terrorist financing (AML/CTF) obligations. It is addressed to our merchants and their customers, partners, banking and payment counterparties, regulators and other stakeholders. It is an overview of our internal AML/CTF programme, not the full set of internal procedures, which are confidential.

This Policy forms an integral part of the ALPPAY Terms of Use and the Merchant Terms of Use. By using our services you confirm that you have read and accepted it.

2. Legal and regulatory framework

ALPPAY is an obliged institution under the applicable anti-money laundering and counter-terrorist financing legislation. We also comply with the applicable international framework, including Directive (EU) 2015/849 as amended, Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets (the “Travel Rule”), applicable sanctions legislation, and the FATF Recommendations. We are preparing for the application of Regulation (EU) 2024/1624 (the EU AML Regulation) from its date of application.

We submit the reports required by law to the competent financial intelligence unit (the “FIU”), which also exercises control over obliged institutions’ compliance with the AML legislation. We cooperate with the FIU, the prosecution service, courts and other competent authorities.

3. Key definitions

Money laundering means the conversion or transfer of property derived from criminal activity in order to conceal its illicit origin; the concealment of the true nature, source, location, disposition, movement or ownership of such property; the acquisition, possession or use of such property; and participation in, association with, or aiding any of the above.

Terrorist financing means the provision or collection of funds, by any means, directly or indirectly, with the intention or knowledge that they are to be used to carry out terrorist offences.

4. Governance

ALPPAY’s AML/CTF programme is approved by the Company’s management board. In accordance with the applicable AML legislation, a member of senior management is responsible for the implementation of AML/CTF obligations, and an appointed AML Compliance Officer is responsible for day-to-day compliance, reporting to the FIU and cooperation with authorities. Internal procedures are reviewed at least annually and whenever the law, our products or our risk profile change. Employees can report AML/CTF concerns confidentially and anonymously through an internal whistleblowing channel.

5. Risk-based approach

We maintain an enterprise-wide AML/CTF risk assessment covering customer risk, geographical risk, product and service risk, delivery-channel risk and blockchain-specific risk. Every merchant is assigned a risk rating at onboarding, which is reviewed on an ongoing basis. The intensity of our due diligence, monitoring and review is proportional to the assessed risk.

6. Customer due diligence (KYB / KYC)

Merchants

ALPPAY provides its acceptance services to legal entities. Before a business relationship is established we:

• identify and verify the merchant using reliable and independent sources (registry extracts, incorporation documents, proof of registered address);
• identify and verify the persons authorised to represent the merchant;
• identify and verify the beneficial owners (natural persons who ultimately own or control the merchant, including through a shareholding of 25% or more or through other means of control);
• establish the purpose and intended nature of the business relationship, the merchant’s business model, website(s), products and the markets served, and, where required, the merchant’s own licences or authorisations;
• screen the merchant, its representatives and beneficial owners against sanctions, politically exposed person (PEP) and adverse-media sources;
• where the risk warrants it, obtain information on the source of funds and source of wealth.

Payers

ALPPAY does not open accounts for merchants’ customers. However, depending on the transaction amount, the risk profile and legal requirements, a payer may be asked to complete identity verification before a payment is credited (see the Merchant Terms of Use, “ALPPAY ID”).

Ongoing due diligence

We monitor business relationships on an ongoing basis, refresh customer information periodically and whenever a trigger event occurs (change of ownership, change of business model, unusual activity, adverse information), and re-screen against sanctions and PEP lists. If due diligence cannot be completed, we do not establish, or we terminate, the business relationship.

Simplified and enhanced due diligence

Simplified measures may be applied where the risk is demonstrably low. Enhanced due diligence is applied in higher-risk situations, including business relationships involving PEPs, high-risk third countries identified by the European Commission or the FATF, complex or opaque ownership structures, restricted business categories and unusual transaction patterns. Enhanced measures include senior-management approval of the relationship, source-of-funds and source-of-wealth verification, enhanced transaction monitoring and more frequent reviews.

7. Sanctions compliance

We screen merchants, their representatives and beneficial owners, transaction counterparties and blockchain addresses against the consolidated EU sanctions list, the UN Security Council lists, the US OFAC lists, the UK OFSI list and applicable national sanctions lists. Screening is performed at onboarding, on an ongoing basis and at the transaction level. Confirmed matches are escalated to the AML Compliance Officer, funds are frozen where required, and the relevant authorities are notified. We do not provide services to sanctioned persons or to persons located in comprehensively sanctioned or otherwise restricted jurisdictions.

8. Blockchain transaction monitoring

Every incoming and outgoing crypto-asset transaction processed through ALPPAY is screened using blockchain analytics before it is credited or released. Screening assesses the originating and destination addresses and the transaction history for exposure to, among others, sanctioned addresses, darknet markets, ransomware, hacks and theft, scams and fraud, mixing and tumbling services, unlicensed gambling and other high-risk categories. Each transaction receives a risk score and a risk level (low, medium, high, very high). Addresses may be re-screened after a transaction has been processed; where new risk information becomes available, we may take the measures described below retrospectively.

Depending on the outcome:

• Low risk – the payment is credited in the normal course.
• Medium risk – the payment may be credited subject to additional checks or enhanced monitoring.
• High or very high risk – the payment is placed on hold and is not credited to the merchant’s balance. The case is reviewed by our compliance team, which may (a) release the funds after review; (b) request information or documents from the merchant and/or the payer, including on the identity of the payer and the source of the funds; (c) return the funds to the originating address, or to another address demonstrated to be controlled by the payer, net of network fees, where this is lawful and technically possible; or (d) freeze the funds and report to the FIU or other competent authorities where required by law. Frozen funds are not released or returned until the competent authority permits it.

Outgoing withdrawals and settlements are likewise screened, and transfers to high-risk or sanctioned addresses are declined. ALPPAY does not support anonymity-enhanced coins and does not process transactions routed through mixing or tumbling services.

Where the law prohibits it (the “tipping-off” prohibition), we are unable to disclose the reasons for a hold, freeze or report. Where enabled for a merchant, AML screening results are visible in the merchant panel.

9. Travel Rule

For transfers of crypto-assets, ALPPAY collects, holds and – where the counterparty is a crypto-asset service provider – transmits the originator and beneficiary information required by Regulation (EU) 2023/1113. For transfers to or from self-hosted addresses exceeding EUR 1,000, we take additional measures to assess whether the address is owned or controlled by our customer. Transfers that lack the required information may be delayed, rejected or returned.

10. Prohibited and restricted activities

ALPPAY does not provide services to businesses that, among other things, deal in illegal goods or services, operate fraudulent or Ponzi schemes, operate darknet marketplaces or mixing services, provide gambling or financial services without the required licence, infringe sanctions, or are located in restricted jurisdictions. Certain business categories are restricted and may only be onboarded after enhanced due diligence and on additional conditions. The full lists of prohibited uses and restricted businesses are set out in the Merchant Terms of Use.

11. Reporting and cooperation with authorities

We report suspicious transactions and activity to the FIU without undue delay and within the statutory deadlines, submit above-threshold transaction reports as required by the applicable AML legislation, comply with FIU and prosecutor demands to suspend transactions or block accounts, and respond to lawful requests from law enforcement, courts, supervisory authorities and other financial intelligence units. Employees are prohibited from informing customers or third parties that a report has been made or that an investigation is under way.

12. Record keeping

We retain customer identification and verification data, transaction records, screening results and case documentation for at least five years from the end of the business relationship or the date of the transaction, and for longer where required by a competent authority. Records are stored securely, used only for AML/CTF and related legal purposes and processed in accordance with our Privacy Policy.

13. Training

All employees complete AML/CTF training on joining the Company and at least annually thereafter, with additional training when the law or our procedures change. Training is documented and tested. Staff in compliance, onboarding, support and finance receive role-specific training.

14. What this means for merchants

• Onboarding includes verification of your company, its representatives and beneficial owners; incomplete documentation delays go-live.
• Every payment you receive through ALPPAY is screened. High-risk payments are held and not credited until reviewed; some may be returned to the payer or frozen.
• We may ask you for information about a payer or a transaction. Prompt cooperation shortens review times.
• Please inform your customers that payments are subject to AML screening and may be delayed or returned.
• Do not attempt to circumvent screening (for example by splitting payments or using intermediary wallets); doing so is a breach of the Merchant Terms of Use.

15. Review of this Policy

This Policy is reviewed at least annually and updated whenever required by changes in law, regulatory guidance or our business. The current version is always available on this page.

16. Contact

Questions about this Policy, and requests from competent authorities, should be directed to our Telegram support group. Requests from authorities should reference the legal basis of the request.