AML Policy

INTRODUCTION

We, Purple Pixel Private Limited, ("We", "Us" or "Our") actively endeavor to detect, highlight and report transactions or activities associated with money laundering and the financing of terrorism. We have implemented this Know Your Customer-Anti Money-Laundering Policy ("KYC-AML Policy") to provide a structured mechanism for onboarding Users ("User", "Customer", "You" or "Client") to our platform and for the provision of services. This KYC-AML Policy also outlines the methods and strategies to assess and manage risks associated with each Client and transaction.

We abide by directives from Law Enforcement Agencies and Courts and will comply with their orders relating to reporting suspicious accounts or transactions and sharing identity details, KYC documents, transaction records, and other information of specified users.

This KYC-AML Policy sets out obligations under the:

1. Prevention of Money Laundering Act, 2002 ("PMLA")
2. Prevention of Money Laundering (Maintenance of Records) Rules, 2005 ("PML Rules")
3. Unlawful Activities (Prevention) Act, 1967 ("UAPA")
4. The Weapons of Mass Destruction and Delivery Systems (Prohibition of Unlawful Activities) Act, 2005 ("WMDA")
5. Anti-Money Laundering and Countering the Financing of Terrorism Guidelines For Reporting Entities Providing Services Related To Virtual Digital Assets published by the Financial Intelligence Unit – India ("FIU-IND Guidelines") (Collectively referred to as the "AML Framework")

We reserve the right, at our sole discretion, to modify, amend, add or remove portions of this KYC-AML Policy at any time without prior written notice. It is Your responsibility to review this KYC-AML Policy periodically for updates or changes. Your continued use of the Online Platform following any modification of the KYC-AML Policy will constitute acceptance of this KYC-AML Policy and any changes made to it.

You hereby expressly consent to Our continuous monitoring and collection of information and data related to Your activities on Our Online Platform for the purpose of this KYC-AML Policy and to maintain compliance with the reporting standards required by applicable laws.

DEFINITIONS

1. "Applicable Law" shall mean any applicable statute, law, regulation, ordinance, rule, judgment, order, decree, by-law, approval from concerned authority, government resolution, directive, guideline, policy, requirement, or other circulars or notifications from any competent government or statutory body.

2. "Computer Resource" shall have the same meaning as ascribed to it in Section 2(1)(k) of Information Technology Act, 2000.

3. "Crypto" or "VDA" shall mean and refer to virtual digital assets as defined under Section 2(47A) of the Income Tax Act, 1961.

4. "Customer"/"User"/"You"/"Client" shall mean any Person availing our Services through the Online Platform.

5. "Person" includes— a. an individual, b. a Hindu undivided family, c. a company, d. a firm, e. an association of persons or a body of individuals, whether incorporated or not, f. every artificial juridical person not falling within any of the preceding sub-clauses, and g. any agency, office or branch or entity owned or controlled by any of the above persons mentioned in the preceding sub-clauses.

6. "Client due diligence" or "CDD" means due diligence carried out on a Client. CDD involves identifying the Client and verifying their identity by using reliable, independent sources of documents, data, or information and ascertaining the true beneficial owner of the Client entity.

7. "Cyber security incident" is a real or suspected adverse event in relation to cyber security that violates an explicitly or implicitly applicable security policy resulting in unauthorized access, denial of service or disruption, unauthorized use of Computer Resource for processing or storage of information or changes to data, information without authorization.

8. "Officially Valid Document/OVD" means the passport, the driving license, proof of possession of an Aadhaar Number or the voter's identity card issued by the Election Commission of India.

9. "Politically Exposed Person" (PEP) is a person who is authorized to perform prominent public functions in a country and includes governors of the state, members of Parliament, military officers, senior government and judicial executives, and heads of local bodies such as municipal corporations, among others. You could also qualify as a PEP if You are a family member or a close relative of such an individual.

10. "Provision of Services" or "Services" shall mean any one or more than one of the following: (i) exchange between virtual digital assets and fiat currencies; or/and (ii) exchange between one or more forms of virtual digital assets; or/and (iii) transfer of virtual digital assets; or/and (iv) safekeeping or administration of virtual digital assets or instruments enabling control over virtual digital assets.

11. "Suspicious Transaction" means a transaction, including an attempted transaction on the Platform, whether or not made using fiat currency, which under Our sole discretion: a. gives rise to a reasonable ground of suspicion that it may involve proceeds of a crime/an offence, regardless of the value involved; or b. appears to be made in circumstances of unusual or unjustified complexity or in contravention of any Applicable Law; or c. appears to have no economic rationale or bona fide purpose; or d. gives rise to a reasonable ground of suspicion that it may involve financing activities relating to terrorism. Terrorism includes transactions involving funds suspected to be linked or related to or to be used for terrorism, terrorist acts, or by a terrorist, terrorist organization, or those who finance or are attempting to finance terrorism.

CUSTOMER IDENTIFICATION AND VERIFICATION

We have implemented robust procedures to ensure we know with whom we are conducting business. Our identity verification process requires Users to provide reliable, independent source documents, data or information (e.g., national ID, international passport, bank statement, utility bill).

For such purposes, We reserve the right to collect User's identification information and take the following steps:

1. Document Verification: Any Indian resident can open an Account with Us by providing the following documents:

   • Permanent Account Number (PAN) given by Income Tax Authorities
   • Documents for identification and proof of residence (only OVDs)
   • Live selfie from the camera
   • Other KYC documents as required to conduct CDD measures

2. Verification Process: We utilize DigiLocker for secure verification of identification documents and to ensure the authenticity of government-issued IDs. This integration provides secure access to authentic digital documents, reducing the risk of fraudulent submissions during the KYC process.

3. Additional Verification: We will, ourselves or through any third party, verify the information submitted by the Customers through technology tools and/or through any other independent source of information before onboarding a customer. Users will be required to verify their email address and mobile number through one-time password (OTP).

4. Account Activation: The User's Account with Us will only be made operational for the User to avail our Services when such documents and information as mentioned above are provided by the User to Our satisfaction.

5. Post-KYC Requirements: Post the account opening process, the User would be required to add and verify their bank account/UPI ID for making INR deposits/withdrawals.

RISK MANAGEMENT AND ASSESSMENT

We follow a risk-based approach to categorize Users under low, medium, and high-risk categories, based on assessment and risk perception. This approach ensures our preventative measures are commensurate with identified risks, allowing resources to be allocated efficiently with the greatest risks receiving the highest attention.

We prepare the profile of the customer which should contain User's information relating to the customer's identity and other factors to determine the risk involved on the basis of parameters including but not limited to:

1. Social/financial status
2. The nature, scale, diversity and complexity of their business
3. Deposits from multiple bank accounts or UPI IDs
4. Withdrawals to multiple bank accounts
5. Very frequent deposits or withdrawals
6. Deposits and withdrawals without performing any trades
7. Adverse media screening
8. Politically exposed person screening
9. The number of customers already identified as high risk
10. The jurisdictions the entity is exposed to, especially jurisdictions with relatively higher levels of corruption or organized crime, and/or deficient AML/CFT controls and listed by RBI or FATF

No User shall be informed of the risk category they are assigned, and no such confidential information shall be disclosed to the User which can tip them off to evade transacting. We also re-verify KYC details at regular intervals, at least annually, depending on our risk assessment and classification of the Customer.

SANCTIONS AND PEP SCREENING

We use HyperVerge platform, a reputable third-party service provider, for enhanced PEP and AML screening of our users. This technology helps identify politically exposed persons and individuals on sanction lists to ensure compliance with global regulations.

For blockchain address screening, we utilize Chainalysis to monitor and evaluate the risk associated with digital wallet addresses. This screening occurs:

1. During the onboarding process when users register their wallet addresses
2. When reviewing any suspicious transaction patterns
3. Through periodic re-screening of all wallet addresses in our database

We will put any deposit or withdrawal requests on hold or block any such requests if the digital wallet involved is indicated as high risk in the sanction screening tool used by Us.

ENHANCED DUE DILIGENCE (EDD)

If we identify any risk in the transaction undertaken depicting complex or unusual patterns which have no apparent economic or lawful purpose or risk associated with an account with Us which might be due to User's background or association with PEPs, We shall undertake Enhanced Due Diligence ("EDD").

Steps under EDD shall include but will not be limited to:

1. Submission of additional information and documentation by User e.g., bank statements or other financial records for verifying the source of funds
2. Undertake additional background checks and research to validate the true identity of a User
3. Seeking clarification justification relating to a particular transaction or series of transactions or other User activities
4. Implement application of additional measures to know the customer's source of funds like gathering information from publicly available sources or otherwise
5. We may call or email to the user seeking further details of the source of the funds of the customer
6. Conducting in-person visits, if required

DEPOSIT / WITHDRAWAL POLICY

Crypto Deposits

You understand and undertake that you can only deposit VDAs which are owned by You as the beneficial owner to your digital wallet on our Online Platforms. You represent that the account or wallet address used to deposit Digital Assets on Our Online Platform belongs to you and is under your exclusive control and ownership. You will be required to submit a self-declaration in this regard.

INR Deposits

Users are only allowed to deposit INR using their linked bank accounts and no other bank account or payment method can be used to deposit INR.

Withdrawal Process

We follow a strict procedure while processing any withdrawal requests from the customer to ensure that the funds are sent only to their originating source and beneficial owner. We will review all withdrawal requests from customers and verify that the funds are being withdrawn to the Linked bank account or same wallet address which was used to deposit VDAs.

In case there is a difference in the details of bank account / wallet address used at the time of deposit and provided in the withdrawal request, further details and clarifications will be required to ensure that withdrawal is being sent to the originating source or to a digital wallet under the control and ownership of the User.

TRAVEL RULE COMPLIANCE

To comply with the Travel Rule requirements, wherein the originator information needs to be shared with the counterparty exchange in case of withdrawal of VDA by the User, We shall reach out to the User to obtain additional information, in line with the AML Framework.

We will require and capture at least the following details of the originator and the beneficiary:

1. Originator's name and PAN number or National identity number
2. Originator's wallet address
3. Originator's verified address as per KYC
4. Beneficiary's Name and wallet address
5. Beneficiary's verified address (through KYC process), unless the beneficiary is the same as the originator or the Beneficiary's wallet is hosted with a FIU registered VASP

RECORD KEEPING

We shall collect and maintain records, in the form of books or stored in a computer, of Your identity proof along with all documents and information provided by You and of all the transactions undertaken by You on the Platform, as required under the Applicable Laws/good industry practices.

We shall maintain and report to Authorities, the records of:

1. The KYC details, documents, and data of all Users who open a User Account on the Platform
2. The KYC details, documents, and data of all Users who undertake a transaction on the Platform
3. Your transactions on the Platform

User's CDD records and documents (including transactions) will be kept for at least 5 years after the business relationship has ended. We shall make available the identification records and transaction data to the authorities upon request.

EMPLOYEE TRAINING

Adequate screening mechanisms as an integral part of our personnel recruitment/hiring process shall be put in place to ensure high standards and equal and fair opportunity when hiring employees.

Employee training programs are put in place so that the members of concerned staff are adequately trained in KYC/AML/CFT policy. The training covers key aspects of identifying suspicious transactions, using our screening tools (Chainalysis, DigiLocker, and HyperVerge), understanding regulatory requirements, and following internal protocols.

The focus of the training is tailored for different roles - frontline staff, compliance staff, risk management staff, audit staff, and staff dealing with new customers. The front desk staff is trained to handle issues arising from a lack of customer education. The AML training frequency is every 6 months.

SUSPICIOUS TRANSACTION REPORTING

We maintain robust internal systems that monitor transactions through data analysis for risk assessment and suspicious activity detection. Our systems perform various compliance tasks including capturing data, filtering transactions, record-keeping, investigation management, and statutory reporting.

We will ensure that transactions of suspicious nature are reported to the proper law enforcement through our designated Compliance Officer. When there are suspicions of money laundering or financing of activities relating to terrorism or where there are doubts about the adequacy or veracity of previously obtained User identification data, We shall review the due diligence measures including reverifying the User's identity, and shall request additional information.

On the basis of monitoring activities conducted by Us as described under this Policy, User's access to the Platform shall be suspended / blocked or terminated as decided by Us under Our sole discretion.

COMPLIANCE OFFICER

We have designated a Compliance Officer whose duty is to ensure the effective implementation and enforcement of the AML/KYC Policy. It is the Compliance Officer's responsibility to supervise all aspects of Our anti-money laundering and counter-terrorist financing efforts, including but not limited to:

1. Collecting Users' identification information
2. Establishing and updating internal policies and procedures for compliance
3. Monitoring transactions and investigating any significant deviations from normal activity
4. Implementing a records management system for appropriate storage and retrieval of documents
5. Updating risk assessment regularly
6. Providing law enforcement with information as required under the applicable laws and regulations

The Compliance Officer is entitled to interact with law enforcement agencies involved in prevention of money laundering, terrorist financing and other illegal activity.

CONCLUDING PROVISIONS

We have made every effort to ensure that this Policy adheres to the applicable laws. The invalidity or unenforceability of any part of this Policy shall not prejudice or affect the validity or enforceability of the remainder of this Policy. This Policy does not apply to any information other than the information collected by Us through the Platform.