AML CFT and proliferation financing policy

Version 1.0 | 16 October 2026

These policies describe the proposed Vanuatu services of AYOV CAPITAL MANAGEMENT LTD. Licensing applications are being prepared; no licence grant is represented. The responsible provider must be identified in the accepted service agreement. Publishing these policies does not change the operator of an existing service.

2 AML CFT and proliferation financing policy

AYOV prohibits use of its services for money laundering, terrorism financing, proliferation financing or evasion of lawful restrictions. Before launch and at least annually, Compliance must document an enterprise risk assessment covering clients, beneficial owners, countries, products, assets, custody, delivery channels, fiat routes, wallet technologies and outsourced services. A new product, country, chain or provider requires assessment before activation. Each identified risk must have a control, owner, residual rating and review date.

Onboarding must establish legal identity, existence, registered address, business, authority to act, ownership and control, expected activity, professional-client eligibility, and the purpose of the relationship. Obtain reliable independent evidence and resolve inconsistencies. Trace ownership through intermediate entities to the relevant natural persons and verify controllers under applicable rules. Trusts and similar arrangements require identification of relevant parties and control powers. Do not accept nominee structures without understanding who ultimately owns or controls them.

Verify authorised signatories and permitted instruction channels. Establish source of funds, wealth and underlying assets proportionate to risk. A bank statement, allocation letter or token balance alone is not conclusive evidence of lawful origin or unencumbered ownership. Check supporting transactions, agreements, issuing parties and inconsistencies. Record the reason for accepting the evidence. Do not treat a CUSIP, appraisal, report hash or oracle price as proof of available cash or custody.

Screen clients, beneficial owners, controllers, signatories, intermediaries and material counterparties for sanctions and politically exposed person status. PEP relationships and other high-risk cases require enhanced due diligence and documented senior approval before acceptance. Apply enhanced checks to complex unexplained structures, high-risk geography, third-party funding, rapid pass-through flows, inconsistent wealth, fraud indicators and material opaque on-chain exposure. Nationality alone is not a complete risk assessment.

The onboarding decision must state risk rating, evidence reviewed, permitted products and wallets, limits, approvers and next review. As an internal baseline, review high-risk relationships at least every six months and other active relationships at least annually; perform an earlier review after changes in ownership, sanctions, activity or adverse information. These are AYOV control frequencies, not a statement of statutory deadlines.

No anonymous or fictitious-name relationship may be opened. If required due diligence cannot be completed, do not activate the service. Escalate whether refusal, restriction, termination and suspicious reporting are required. Do not return potentially restricted property or notify a client of a suspicion without MLRO assessment.

3 Transaction monitoring and transfer information

Before executing a fiat or token instruction, Operations must match it to the client's expected activity, verified authority, product limits and approved wallet or bank profile. Verify beneficiary details through a previously established channel when details change. Record payer, payee, amount, currency or token, chain, addresses, purpose, timestamps, fees, approvals and expected settlement evidence.

Monitoring must identify patterns as well as single transactions. Relevant indicators include unexplained splitting, rapid mint-transfer-redemption cycles, incompatible transaction size, unrelated third-party payments, sanctions exposure, mixer or high-risk service links, repeated failed authentication, sudden wallet changes and activity inconsistent with the asset's economic purpose. Analytics findings require documented interpretation; an automated score alone is not a final decision.

For virtual-asset transfers, assess the counterparty VASP, its jurisdiction and controls, and the applicable Travel Rule information requirements. Obtain and validate required originator and beneficiary information before execution, transmit it securely through an agreed channel and keep it separate from public blockchain data. Do not put identity documents or bank information into transaction calldata. Missing mandatory information requires hold or rejection and escalation, subject to applicable law. Record the decision and follow-up.

For a self-hosted wallet, establish the customer's relationship to it, ownership or control evidence where appropriate, purpose and risk. Use an approved message-signing or equivalent verification process; never request a seed phrase. A wallet signature proves control of a key, not identity or lawful source. Check chain and full address, not merely a shortened label.

Operations must reconcile pending, confirmed, failed and replaced transactions. A signed instruction, API acknowledgement, evidence commitment or custodian hash is not a successful transfer. Confirm the network, successful receipt and relevant token event, and apply the approved confirmation threshold. Independently confirm fiat settlement through the actual account/provider record.

4 Suspicious activity and external reporting

Any staff member who identifies suspicion must make a confidential internal report to the MLRO immediately, preserving facts, records, addresses, amounts and the reason for concern. Suspicion need not be proven. Staff must not alert the customer or obstruct an investigation. The MLRO records assessment, any need for further lawful enquiries, transaction restrictions, reporting decision and rationale.

The MLRO must make required reports to VFIU through the authorised reporting mechanism within the applicable legal timeframe and document acknowledgement. Mandatory threshold, international-transfer and other reporting obligations must be included in a reporting calendar with verified thresholds, deadlines and designated deputies before launch. No threshold or reporting exemption is inferred from this manual.

Material control failures or incidents must also be assessed for VFSC notification and other legal obligations. A report to one authority does not automatically satisfy another obligation. Reporting decisions and information subject to confidentiality or tipping-off restrictions must have restricted access. Record any lawful instruction to freeze, continue, stop or disclose activity and verify the authority of the requesting party.