Anti-Money Laundering Policy

Introduction

NovaTrace Ltd. ("NovaTrace") is firmly committed to preventing the use of its platform for money laundering, terrorist financing, proliferation financing, and any other forms of financial crime. This Anti-Money Laundering (AML) Policy outlines the principles, procedures, and controls that NovaTrace has implemented to detect, prevent, and report suspicious activities in compliance with applicable laws and regulations.

This policy applies to all NovaTrace employees, officers, directors, contractors, and agents, as well as all users of the NovaTrace platform. Every team member is responsible for understanding and adhering to the requirements set forth in this policy, and for reporting any suspected violations to the Compliance Department.

NovaTrace takes a risk-based approach to AML compliance, allocating resources proportionate to the identified risks. We continuously evaluate and update our AML program to address emerging risks, regulatory developments, and evolving typologies of financial crime in the cryptocurrency industry.

Legal Framework

NovaTrace's AML program is designed to comply with applicable anti-money laundering and counter-terrorism financing laws and regulations, including but not limited to:

• Financial Action Task Force (FATF) Recommendations: We adhere to the FATF's international standards on combating money laundering, terrorist financing, and proliferation financing, including the updated guidance on virtual asset service providers (VASPs).
• Singapore Payment Services Act (PSA): As a licensed digital payment token service provider in Singapore, we comply with the AML/CFT requirements under the PSA and guidelines issued by the Monetary Authority of Singapore (MAS).
• EU Anti-Money Laundering Directives (AMLD): For our European operations, we comply with the applicable EU AML Directives and the Markets in Crypto-Assets (MiCA) regulation.
• US Bank Secrecy Act (BSA): Where applicable, we comply with the BSA and FinCEN regulations regarding virtual currency business activities.
• Travel Rule: We implement the FATF Travel Rule requirements for the transfer of virtual assets, ensuring that originator and beneficiary information is transmitted with qualifying transactions.

NovaTrace monitors regulatory developments globally and adapts its compliance program accordingly to meet new requirements as they emerge.

KYC Requirements

Know Your Customer (KYC) procedures are a fundamental component of NovaTrace's AML program. All users must complete identity verification before gaining access to trading services. Our KYC process is designed to:

• Verify the identity of each user and confirm they are who they claim to be.
• Assess the risk profile of each user based on their location, trading activity, and other relevant factors.
• Ensure compliance with sanctions lists and politically exposed person (PEP) databases.
• Detect and prevent identity theft, account takeover, and other forms of identity fraud.
• Meet regulatory requirements across all jurisdictions in which NovaTrace operates.

Required Documents

Users are required to provide the following documentation as part of the KYC verification process:

• Government-Issued Photo ID: A valid passport, national identity card, or driver's license. The document must be current (not expired) and clearly legible.
• Proof of Address: A utility bill, bank statement, or government-issued document dated within the last three months, showing your full name and residential address.
• Selfie Verification: A live selfie or video verification to confirm that the person submitting the documents is the same person depicted on the photo ID.
• Source of Funds (if applicable): For higher-risk users or large transactions, NovaTrace may request documentation demonstrating the legitimate source of funds being deposited.

KYC Verification Tiers

NovaTrace implements a tiered verification system that balances user accessibility with regulatory compliance. Higher verification levels provide access to greater trading and withdrawal limits.

NovaTrace reserves the right to request additional documentation or verification at any tier level if deemed necessary based on risk assessment. Failure to provide requested documentation may result in account restrictions or closure.

Customer Due Diligence

NovaTrace applies Customer Due Diligence (CDD) measures proportionate to the risk profile of each user. Our CDD framework includes three levels of scrutiny:

Simplified Due Diligence (SDD)

Applied to low-risk users with limited trading activity and from jurisdictions with robust AML frameworks. SDD involves standard identity verification and periodic monitoring of account activity.

Standard Due Diligence (CDD)

Applied to the majority of users. CDD includes identity verification, address verification, screening against sanctions lists and PEP databases, and ongoing monitoring of transaction patterns. Users are subject to periodic reviews to ensure their information remains current and accurate.

Enhanced Due Diligence (EDD)

Applied to higher-risk users, including:

• Politically Exposed Persons (PEPs) and their close associates or family members.
• Users from jurisdictions identified as high-risk by the FATF or our internal risk assessment.
• Users conducting large or unusual transactions that do not align with their stated profile.
• Users in industries associated with higher money laundering risk.
• Users flagged by our transaction monitoring systems for further investigation.

EDD measures include more extensive background checks, source of funds and source of wealth verification, more frequent account reviews, and senior management approval for onboarding and continued relationship maintenance.

Transaction Monitoring

NovaTrace employs sophisticated transaction monitoring systems to detect potentially suspicious activities in real time. Our monitoring framework includes both automated and manual components:

Automated Monitoring

• Rule-Based Detection: Automated rules flag transactions that meet predefined criteria, such as transactions exceeding certain thresholds, rapid movement of funds, or patterns consistent with known money laundering typologies.
• Blockchain Analytics: We utilize leading blockchain analytics tools to trace the origin and destination of cryptocurrency transactions, identify connections to sanctioned wallets, darknet markets, mixers, and other high-risk services.
• Behavioral Analytics: Machine learning models analyze user behavior patterns to detect anomalies that may indicate suspicious activity, such as unusual trading patterns, sudden changes in transaction volume, or activity inconsistent with the user's profile.
• Risk Scoring: Each transaction and user is assigned a dynamic risk score based on multiple factors, including transaction amount, counterparty risk, geographic risk, and behavioral patterns.

Manual Review

Transactions flagged by automated systems are reviewed by trained compliance analysts who evaluate the context and determine whether a Suspicious Activity Report (SAR) should be filed. Analysts consider all available information, including the user's profile, transaction history, and any explanations provided by the user.

Monitored Activities

Our monitoring systems specifically watch for the following red flags:

• Structuring transactions to avoid reporting thresholds.
• Rapid deposits followed by immediate withdrawals to different wallets.
• Transactions involving privacy coins, mixing services, or anonymization tools.
• Transactions to or from wallets associated with darknet markets, ransomware, or scam operations.
• Deposits from multiple unrelated sources into a single account.
• Unusual trading patterns that may indicate wash trading or market manipulation.
• Users accessing accounts from IP addresses in restricted jurisdictions using VPNs or proxies.

Suspicious Activity Reporting

NovaTrace is committed to filing Suspicious Activity Reports (SARs) and Suspicious Transaction Reports (STRs) with the appropriate Financial Intelligence Units (FIUs) when suspicious activity is detected or suspected.

Reporting Obligations: When our monitoring systems or staff identify activity that may involve money laundering, terrorist financing, or other financial crimes, a SAR is filed with the relevant authorities within the timeframes prescribed by applicable law (typically within 15 business days of detection).

Tipping Off Prohibition: NovaTrace is prohibited by law from informing users that a SAR has been filed or that their account is under investigation for suspicious activity. Employees who disclose the existence or content of a SAR to unauthorized persons may face criminal penalties.

Internal Reporting: All NovaTrace employees are required to report any suspicious activity they observe to the Compliance Department through our internal reporting system. Employees can also report concerns through a confidential whistleblower channel. NovaTrace has a strict non-retaliation policy for employees who report suspected violations in good faith.

Cooperation with Authorities: NovaTrace fully cooperates with law enforcement agencies, regulatory authorities, and Financial Intelligence Units in their investigations. We respond promptly to lawful requests for information, including subpoenas, court orders, and regulatory inquiries.

Sanctions Screening

NovaTrace maintains a comprehensive sanctions compliance program to ensure that we do not provide services to sanctioned individuals, entities, or jurisdictions:

• Onboarding Screening: All new users are screened against global sanctions lists during the account registration process. Users who match or closely match entries on sanctions lists are subject to enhanced review before account approval.
• Ongoing Screening: User data is continuously rescreened against updated sanctions lists. When sanctions lists are updated, all existing users are rescreened within 24 hours.
• Sanctions Lists: We screen against multiple sanctions lists, including the US OFAC SDN List, the EU Consolidated Sanctions List, the UN Security Council Sanctions List, the UK HM Treasury Sanctions List, and other applicable national and regional sanctions programs.
• Wallet Screening: Cryptocurrency wallet addresses are screened against databases of known sanctioned wallets using blockchain analytics tools. Transactions to or from sanctioned wallets are automatically blocked.
• Jurisdiction Blocking: IP-based geoblocking and additional controls are implemented to prevent access from comprehensively sanctioned jurisdictions.

Any confirmed matches against sanctions lists result in immediate account freezing and reporting to the relevant authorities. False positive matches are documented and resolved through a structured review process.

Record Keeping

NovaTrace maintains comprehensive records of all user information and transactions in compliance with applicable regulatory requirements:

• User Identity Records: Copies of all KYC documentation, verification results, and due diligence assessments are retained for a minimum of 5 years after the end of the business relationship or the completion of an occasional transaction.
• Transaction Records: Complete records of all transactions conducted on the platform, including trade history, deposits, withdrawals, wallet addresses, and timestamps, are retained for a minimum of 7 years from the date of each transaction.
• Suspicious Activity Records: All SARs filed, internal investigation reports, and supporting documentation are retained for a minimum of 7 years from the date of filing.
• Communication Records: Records of all communications with users related to AML compliance, including verification requests, account restriction notices, and compliance-related inquiries, are retained for 5 years.
• Training Records: Records of all AML training completed by employees, including training materials, attendance records, and assessment results, are retained for 5 years.

All records are stored securely with appropriate access controls and encryption. Records are made available to regulatory authorities and law enforcement agencies upon lawful request.

Staff Training

NovaTrace recognizes that an effective AML program depends on well-trained employees who understand their compliance obligations. Our training program includes:

• Onboarding Training: All new employees receive comprehensive AML/CFT training within their first two weeks of employment. This training covers the fundamentals of money laundering and terrorist financing, NovaTrace's AML policies and procedures, and employees' reporting obligations.
• Annual Refresher Training: All employees receive annual refresher training that covers updates to AML regulations, new money laundering typologies, changes to NovaTrace's policies and procedures, and case studies of suspicious activity specific to the cryptocurrency industry.
• Role-Specific Training: Employees in compliance, customer support, and other high-exposure roles receive additional specialized training tailored to their specific responsibilities and the types of suspicious activity they are most likely to encounter.
• Senior Management Briefings: Senior management and board members receive regular briefings on AML compliance matters, including regulatory developments, risk assessments, program effectiveness, and notable enforcement actions in the industry.

Training effectiveness is assessed through regular testing, and employees who do not meet minimum competency standards are required to complete additional training. Training records are maintained for audit and regulatory review purposes.

Compliance Program

NovaTrace's AML compliance program is overseen by a dedicated Chief Compliance Officer (CCO) who reports directly to the Board of Directors. The compliance program includes the following components:

Governance Structure

• Chief Compliance Officer: Responsible for the overall design, implementation, and effectiveness of the AML program. The CCO has the authority and resources necessary to fulfill these responsibilities independently.
• Compliance Team: A dedicated team of compliance analysts, investigators, and regulatory affairs specialists who manage day-to-day compliance operations.
• Money Laundering Reporting Officer (MLRO): Designated officer responsible for receiving internal suspicious activity reports and filing SARs with the relevant FIU.
• Board Oversight: The Board of Directors receives quarterly reports on AML compliance matters and approves the annual compliance program and risk assessment.

Risk Assessment

NovaTrace conducts a comprehensive enterprise-wide risk assessment at least annually. This assessment evaluates the money laundering and terrorist financing risks associated with our products, services, user base, geographic exposure, and distribution channels. The results of the risk assessment inform our compliance policies, procedures, and resource allocation.

Independent Audit

The AML program is subject to independent audit at least annually by qualified external auditors. The audit evaluates the design and effectiveness of our AML controls, identifies gaps or weaknesses, and provides recommendations for improvement. Audit findings are reported to the Board of Directors and addressed through a formal remediation plan.

Regulatory Engagement

NovaTrace maintains open and transparent relationships with regulatory authorities in all jurisdictions where we operate. We participate in industry working groups, respond promptly to regulatory inquiries, and proactively engage with regulators on emerging compliance challenges in the cryptocurrency industry.

Enforcement & Penalties

NovaTrace takes violations of this AML Policy seriously. The following enforcement measures may be applied when violations are detected:

User Enforcement

• Account Restrictions: Users who fail to comply with KYC requirements or whose accounts are flagged for suspicious activity may have their accounts restricted, including suspension of trading, deposits, and withdrawal capabilities.
• Account Freezing: In cases where there is a reasonable suspicion of money laundering, terrorist financing, or other financial crime, NovaTrace may freeze user accounts and associated assets pending investigation. Account freezes may also be imposed at the direction of law enforcement or regulatory authorities.
• Account Termination: Users found to have violated this AML Policy or engaged in financial crime will have their accounts permanently terminated. Remaining assets may be frozen and reported to the relevant authorities.
• Law Enforcement Referral: Confirmed cases of money laundering, terrorist financing, or other financial crime will be reported to law enforcement agencies and relevant regulatory authorities for investigation and prosecution.

Employee Enforcement

• Employees who fail to comply with AML policies and procedures, fail to report suspicious activity, or facilitate money laundering may face disciplinary action up to and including termination of employment.
• Employees who knowingly participate in or facilitate financial crime may be subject to criminal prosecution in addition to employment termination.
• NovaTrace has a strict non-retaliation policy that protects employees who report suspected violations in good faith from any form of retaliation.

Contact the Compliance Department

NovaTrace is committed to maintaining the highest standards of AML compliance and to playing its part in protecting the integrity of the global financial system. We continuously invest in our compliance infrastructure, technology, and people to stay ahead of evolving threats and regulatory expectations.