AML/CFT Policy

This Anti-Money Laundering and Counter-Terrorism Financing (AML/CFT) Policy outlines OrbChain's commitment to preventing the use of its payment infrastructure for money laundering, terrorism financing, and other financial crimes.

1. Purpose and Scope

OrbChain operates a cryptocurrency payment gateway that enables merchants to accept crypto payments from their customers. This policy establishes the controls, procedures, and monitoring systems that OrbChain maintains to detect, prevent, and report suspicious activity in accordance with international AML/CFT standards.

This policy applies to all OrbChain operations, employees, contractors, and merchant accounts.

2. Risk-Based Approach

OrbChain adopts a risk-based approach to AML/CFT compliance, proportionate to the nature and scale of our services:

• OrbChain provides payment processing infrastructure — we facilitate the transfer of cryptocurrency between end users and merchants.
• We do not hold custody of merchant funds long-term. Funds are processed and forwarded to merchant-controlled wallets.
• On-chain transactions processed through OrbChain (Bitcoin, Ethereum, Tron, Litecoin, Dogecoin, Solana, BNB Smart Chain, Polygon, and their respective stablecoins) occur on public blockchains and are inherently traceable — every such transaction has an immutable, publicly auditable record.
• Lightning Network payments (BTC_LN) use onion-routed off-chain HTLCs. Only channel open and close transactions appear on the Bitcoin base chain; individual payment hops and amounts between our node and counterparties are private by protocol design. Our AML controls for Lightning rely on node-pubkey and payee-domain screening rather than address-level blockchain analytics (see §6).
• Our risk assessment considers factors including transaction volume, geographic risk, merchant type, payment rail, and transaction patterns.

3. Merchant Due Diligence

3.1 Standard Due Diligence

All merchants undergo the following verification at account creation:

• Email verification — merchants must confirm ownership of a valid email address before activating their account.
• IP screening — registration and login IP addresses are checked against GeoIP databases to enforce geographic restrictions on sanctioned jurisdictions.
• Sanctions screening — merchant-provided information is screened against applicable sanctions lists at the time of account creation.

3.2 Enhanced Due Diligence

Merchants that meet certain thresholds are subject to enhanced monitoring measures:

• High-volume merchants — accounts processing significant volumes are flagged for enhanced transaction pattern analysis.
• Velocity checks — rapid increases in transaction volume or frequency trigger automated review.
• Pattern analysis — unusual patterns such as consistent round-number transactions, rapid cycling of funds, or structuring indicators are flagged for manual review.

OrbChain reserves the right to request additional information from merchants subject to enhanced due diligence, and to restrict or suspend account functionality pending satisfactory completion of the review.

3.3 Politically Exposed Persons (PEP) Screening

At account creation and on any subsequent material change to merchant ownership, directorship, or authorized signatories, OrbChain screens beneficial owners and authorized signatories against Politically Exposed Persons (PEP) databases and adverse-media sources (Refinitiv World-Check, ComplyAdvantage, or equivalent commercial provider).

Confirmed PEP matches trigger Enhanced Due Diligence including:

• Senior management (MLRO) approval before account activation.
• Documented source of wealth and source of funds for the underlying business.
• Ongoing enhanced transaction monitoring with quarterly review.
• Re-screening on a rolling 12-month cadence to capture status changes.

3.4 Source of Funds and Source of Wealth

Merchants meeting the Enhanced Due Diligence threshold (§3.2), classified as higher-risk by sector (online gambling, money services, high-risk cross-border activity), or matched against PEP screening (§3.3) must provide:

• Documented source of funds for the business operation (capital injection records, prior trading history, or equivalent).
• Where applicable: gaming licence, financial-services licence, or other sector-specific regulatory authorisation.
• Corporate structure documentation including all Ultimate Beneficial Owners (UBOs) holding 10% or greater interest, directly or indirectly.
• Bank reference letter or equivalent for the corporate entity, where reasonably available.
• For high-volume merchants: most recent audited or accountant-prepared financial statements.

OrbChain reserves the right to decline merchant onboarding where source of funds cannot be satisfactorily established, and to suspend ongoing accounts where post-onboarding evidence calls source of funds into question.

4. Transaction Monitoring

OrbChain maintains automated transaction monitoring systems that continuously analyze payment activity across the platform. Monitored indicators include:

• Volume anomalies — unusually high transaction volumes relative to the merchant's historical baseline.
• Velocity anomalies — rapid successive transactions within short time windows that may indicate structuring or automated abuse.
• Sanctioned address screening — for on-chain rails, all incoming and outgoing blockchain addresses are screened against the OFAC Specially Designated Nationals (SDN) list and other applicable sanctions lists at ingest and at payout submission.
• Lightning counterparty screening — for Lightning payouts, the destination is a BOLT11 invoice or a Lightning Address. We screen the payee node public key against published lists of sanctioned or high-risk LN operators, and we screen the domain portion of Lightning Addresses (LUD-16) against sanctions / abuse domain lists before resolving LNURL. Lightning Network protocol design does not expose a single on-chain "sender address" for the hops we route through, so the control point sits at the edges (issuer and payee) rather than at every hop.
• Known-bad address databases — addresses associated with known scams, ransomware, darknet markets, or other illicit activity are flagged.
• Cross-merchant patterns — detection of related activity across multiple merchant accounts that may indicate coordinated misuse.

4.1 Transaction Thresholds and FATF Travel Rule

The following monetary thresholds govern transaction monitoring decisions:

• Single transaction ≥ USD 1,000 — recorded with full counterparty metadata to the extent technically available on the payment rail. This is the FATF "Travel Rule" threshold.
• Single transaction ≥ USD 10,000 — automated review queue; MLRO sign-off required before settlement of an unusual transaction at this threshold.
• Aggregate merchant activity ≥ USD 100,000 in any 30-day window — Enhanced Due Diligence review triggered per §3.2.
• Suspicious patterns at any value — internal Suspicious Activity Report (SAR) investigation regardless of monetary threshold.

OrbChain implements the FATF Travel Rule (FATF Recommendation 16) for crypto-asset transfers of USD 1,000 or more by recording originator and beneficiary information to the extent technically available on the payment rail:

• On-chain transfers — the public blockchain transaction reference (including originator and recipient addresses, value, timestamp, and block height) is retained as the immutable record. Merchant-provided counterparty identifiers (where collected by the merchant) are stored alongside.
• Lightning Network — payment hash, payee node pubkey, decoded BOLT11 metadata (where present), and merchant-provided counterparty identifiers are retained.
• Inter-VASP transfers — where the counterparty is identifiable as another Virtual Asset Service Provider, OrbChain participates in industry Travel Rule messaging protocols (e.g. TRP, TRISA, Sumsub Travel Rule) where technically feasible and reciprocally supported.

5. Sanctioned Jurisdictions

Enforcement mechanisms include:

• GeoIP filtering — access to the OrbChain dashboard and API is blocked from IP addresses originating in restricted jurisdictions.
• Ongoing monitoring — accounts that subsequently show indicators of accessing the Service from restricted jurisdictions may be suspended.
• VPN/proxy detection — OrbChain employs measures to detect and block access through VPNs, proxies, and anonymization services originating from restricted jurisdictions.

6. Sanctioned Addresses & Lightning Counterparties

Blockchain addresses listed on the OFAC SDN list or other applicable sanctions lists are blocked from receiving payouts from OrbChain. Specifically:

• Payout requests to sanctioned on-chain addresses are automatically rejected.
• Incoming payments originating from sanctioned on-chain addresses are flagged and the associated merchant account is suspended pending review.
• The sanctions address database is updated regularly to reflect the latest designations.

For the Lightning Network rail, because individual payment hops are not represented as on-chain addresses, equivalent controls apply at the identifiable edges of the transaction:

• Payee node public key — for raw BOLT11 payouts, the decoded payee pubkey is screened against our Lightning sanctions / high-risk operator list before the payment is initiated.
• Lightning Address domain — for LUD-16 ("[email protected]") payouts, the domain is screened against sanctions and abuse lists; if blocked, we do not contact the LNURL endpoint.
• Channel counterparties — nodes we open direct Lightning channels with are subject to the same sanctions / high-risk screening before the channel-open transaction broadcasts.

OrbChain acknowledges that Lightning's onion-routed hops mean we cannot individually sanction-screen every intermediary node on a payment path; this is an intrinsic protocol limitation shared by all Lightning participants. Our controls focus on the two points at which sanctioning is technically feasible — invoice issuer and explicit payee — and on continuous monitoring of suspicious velocity / volume patterns per §4.

7. Suspicious Activity Handling

When suspicious activity is detected through automated monitoring or manual review, OrbChain follows these procedures:

1. Account freeze — the merchant account is temporarily suspended to prevent further transactions while the investigation is ongoing.
2. Internal investigation — the compliance function reviews all relevant transaction data, account history, and available information to assess the nature and severity of the suspicious activity.
3. Merchant notification — where legally permitted, the merchant is notified of the account restriction and may be asked to provide additional information.
4. Resolution — based on the investigation findings, the account may be reinstated, permanently terminated, or reported to relevant authorities.
5. Law enforcement cooperation — OrbChain will cooperate with law enforcement agencies upon receipt of valid legal process (court orders, subpoenas, or equivalent legal instruments).

OrbChain reserves the right to file suspicious activity reports with relevant authorities where required or appropriate.

8. Record Keeping

In accordance with international AML/CFT standards, OrbChain maintains the following records:

• Transaction records — full details of all payments and payouts processed through the platform, retained for a minimum of 5 years from the date of the transaction.
• Account records — merchant registration data, API key issuance/revocation history, and account activity logs, retained for 5 years after account closure.
• Investigation records — documentation of all suspicious activity reviews, including the outcome and any actions taken, retained for 5 years.
• Correspondence — relevant communications with merchants regarding compliance matters, retained for 5 years.

Records are stored securely with encryption at rest and access-controlled on a need-to-know basis.

9. Compliance Function

OrbChain maintains a designated compliance function responsible for:

• Overseeing the implementation and effectiveness of this AML/CFT policy
• Reviewing and resolving flagged transactions and suspicious activity reports
• Maintaining relationships with relevant regulatory bodies and law enforcement
• Ensuring the organization remains current with evolving AML/CFT regulations and best practices
• Reporting to senior management on compliance matters

For compliance inquiries, contact: [email protected]

9.1 Money Laundering Reporting Officer (MLRO)

OrbChain has designated a Money Laundering Reporting Officer (MLRO) with explicit, named accountability for the AML/CFT programme. The current MLRO is identified to regulators and supervisory authorities under separate cover; the MLRO's direct contact channel is [email protected].

The MLRO is responsible for:

• Reviewing and acting on internal Suspicious Activity Reports (SARs).
• Submitting external SARs to the relevant Financial Intelligence Unit (FIU) where required by applicable law.
• Maintaining and reviewing the AML/CFT training programme (§10).
• Approving exceptions to standard customer due diligence and PEP onboarding.
• Serving as primary contact for regulatory and law enforcement inquiries.
• Reporting at least annually to the Board / sole Director on the effectiveness of the AML/CFT programme.

The MLRO reports directly to the Board / sole Director of OrbChain and has unrestricted access to all merchant records, transaction data, and personnel necessary to fulfil this function. Where OrbChain engages an external compliance advisor or fractional MLRO service to supplement in-house capability, that engagement is documented and the external advisor's credentials are made available to regulators on request.

10. Staff Training

Every OrbChain officer, employee, and contractor with access to merchant data, transaction systems, or compliance functions completes:

• Initial AML/CFT training upon onboarding, covering the fundamentals of money laundering and terrorism financing, red flags, sanctions screening, and reporting obligations.
• Annual refresher training on evolving typologies, regulatory updates, sanctions list changes, and OrbChain-specific procedures.
• Role-specific training for personnel with compliance duties — investigation procedures, sanctions screening tools, Travel Rule mechanics, and SAR drafting.

The MLRO is responsible for delivering or commissioning this training and for maintaining training records as part of our compliance documentation. Training records identify the individual, training date, content covered, and assessment outcome where applicable.

11. Policy Review and Updates

This AML/CFT policy is reviewed annually by the compliance function and updated as necessary to reflect:

• Changes in applicable laws and regulations
• New money laundering and terrorism financing typologies
• Updates to sanctions lists and restricted jurisdictions
• Findings from internal audits and compliance reviews
• Industry best practices and guidance from relevant bodies (FATF, etc.)

Material updates to this policy will be published on this page with an updated review date.

11.1 Independent Audit

OrbChain commissions an independent third-party audit of its AML/CFT programme at least once every 24 months. The audit covers:

• Effectiveness of merchant onboarding due diligence (§3).
• Operation of transaction monitoring controls and Travel Rule compliance (§4).
• Sanctions screening accuracy and currency of underlying lists (§5–6).
• Quality and completeness of SAR investigations and recordkeeping (§7–8).
• MLRO independence and resource adequacy (§9.1).
• Staff training records (§10).

Audit reports and management responses are retained per §8 and shared with regulators, supervisors, and exchange counterparties upon valid request.

11.2 Whistleblower Protection

Any OrbChain personnel, contractor, merchant, or external party may report suspected misconduct, AML/CFT failures, sanctions evasion, or unethical conduct directly to the MLRO at [email protected] or, if the concern relates to the MLRO themselves, to the Board / sole Director at [email protected].

OrbChain commits to:

• Treating all good-faith reports as confidential.
• Prohibiting retaliation against any whistleblower who reports in good faith.
• Investigating reports promptly and documenting outcomes per §8.
• Cooperating with external regulatory or law-enforcement investigations where applicable.

12. Contact

For questions about this AML/CFT Policy, or to report suspicious activity, contact:

• General compliance: [email protected]
• MLRO (Money Laundering Reporting Officer): [email protected]
• Whistleblower / Board channel: [email protected]

Regulatory and law-enforcement requests should be directed to the MLRO with appropriate legal process attached.