AML / CFT Policy

1. Purpose and scope

This Policy applies to our website applications, customer onboarding, ongoing monitoring, USDC settlements, balance funding, card / BIN usage related to advertising spend, and support operations.

All customers, applicants, team members acting on a customer’s behalf, and relevant partners are expected to cooperate with our AML/CFT controls. Refusal to provide required information, or provision of false or misleading information, may result in declined access, suspension, or termination of Services.

2. Regulatory approach

RePay applies a risk-based AML/CFT program appropriate to its business model: private, application-only access for professional media-buying teams; simplified verification where permitted; and heightened scrutiny where risk indicators are present.

We design controls to align with internationally recognized AML/CFT principles (including customer due diligence, ongoing monitoring, sanctions screening, record-keeping, and suspicious-activity escalation). Exact licensing and local regulatory status of the operating entity will be reflected in our legal disclosures once finalized.

3. Customer due diligence (CDD)

Before granting access or processing material funding activity, we perform due diligence commensurate with risk. Depending on the case, this may include:

• Collecting identity and contact details of the applicant and, where relevant, the business / team.
• Understanding the intended use of the Services (platforms, verticals, budget profile, account ownership model).
• Simplified verification and minimal data collection for lower-risk professional clients, subject to eligibility.
• Enhanced due diligence (“EDD”) where higher risk is identified (e.g. unusual volumes, inconsistent profile, adverse media, complex structures, or sanctions-adjacent exposure).
• Verifying that the applicant is a genuine performance / advertising operator and not using the Service as a general-purpose cash-out or obfuscation channel.

4. Prohibited and restricted activity

We do not knowingly provide Services for activity that involves money laundering, terrorist financing, sanctions evasion, fraud, or other unlawful conduct. Without limitation, the following are prohibited:

• Using RePay to layer, conceal, or convert proceeds of crime.
• Funding accounts or campaigns on behalf of undisclosed third parties in a way that obscures the true beneficiary (“mule” or nominee misuse).
• Transactions involving sanctioned persons, entities, vessels, or jurisdictions where prohibited.
• Willful circumvention of advertising-platform rules in a manner that constitutes fraud or illegal activity under applicable law.
• Providing forged documents, synthetic identities, or false declarations during onboarding or reviews.

5. Advertising verticals vs financial crime

RePay may commercially support performance-marketing verticals (including certain grey niches) where funding advertising spend is the stated purpose. Commercial eligibility for a vertical does not waive AML/CFT obligations. Customers remain solely responsible for the legality of their advertising content and for compliance with platform rules and applicable law in every jurisdiction where they operate.

6. Sanctions and watchlist screening

We screen customers and, where appropriate, related parties against applicable sanctions and watchlists. We will not onboard or continue serving parties that are sanctioned or that present an unacceptable sanctions risk. Screening may be repeated on a periodic or event-driven basis.

7. Transaction and activity monitoring

We monitor funding and usage patterns for indicators of unusual or suspicious activity, including but not limited to:

• Activity inconsistent with the declared budget, vertical, or business profile.
• Rapid, unexplained changes in volume or counterparties.
• Attempts to evade limits, verification, or review questions.
• Indicators of account takeover, shared credential abuse, or structuring.
• Links to known fraud typologies or adverse intelligence.

Where concerns arise, we may request additional information, delay processing, restrict features, or terminate the relationship.

8. Source of funds and crypto settlements

Settlements are typically made in USDC. We may request information or evidence regarding the source of funds / source of wealth where risk warrants it. Customers must not fund accounts with proceeds of unlawful activity. Blockchain transactions may be analyzed for exposure to illicit or high-risk sources; we may refuse, delay, or return funds where risk cannot be mitigated.

9. Suspicious activity reporting

Where we know, suspect, or have reasonable grounds to suspect money laundering, terrorist financing, or related criminal activity, we may file reports with competent authorities as required or permitted by law. We do not tip off customers about such reports where doing so is prohibited. We may freeze, suspend, or terminate Services and retain funds where legally required or necessary to manage risk.

10. Record-keeping

We retain CDD information, transaction records, screening results, and related compliance materials for the period required by applicable law and our internal retention schedule, and in any event long enough to demonstrate an effective AML/CFT program and to respond to lawful inquiries.

11. Roles and training

AML/CFT responsibilities are assigned to designated personnel. Relevant staff receive training appropriate to their roles on identifying red flags, handling CDD/EDD, and escalating concerns. Senior management oversees the effectiveness of the program and resource allocation.

12. Partners and outsourcing

Where we use third-party providers (for example KYC tooling, blockchain analytics, hosting, or payment infrastructure), we perform appropriate due diligence and require contractual safeguards consistent with this Policy. Ultimate responsibility for our AML/CFT program remains with RePay.

13. Customer cooperation

Customers must promptly provide accurate information and documents requested for CDD, EDD, source-of-funds checks, or ongoing reviews. Failure to cooperate within requested timeframes may lead to restricted functionality, suspension, or closure of the account.

14. Updates

We may update this AML/CFT Policy to reflect changes in law, risk, products, or controls. The “Last updated” date indicates the latest revision. Material updates may be communicated via the website, dashboard, or your support channel.

15. Contact

For compliance-related inquiries, use the contact form on our website or the support channel provided during onboarding. Formal legal entity, registered address, and compliance contact details will be published here when available.