Anti-Money Laundering & KYC Policy

1. Purpose

CipherHQ LLC, doing business as Waaiio (“Waaiio,” “we,” “us,” or “our”), is committed to preventing the use of our platform for money laundering, terrorist financing, fraud, or other financial crimes. This Anti-Money Laundering (“AML”) and Know Your Customer (“KYC”) Policy outlines our procedures for verifying the identity of businesses using our Services and monitoring transactions for suspicious activity.

Waaiio operates across five countries — the United States, Canada, Nigeria, Ghana, and the United Kingdom — and this policy is designed to comply with applicable AML laws in each jurisdiction, including the Bank Secrecy Act (US), Proceeds of Crime (Money Laundering) and Terrorist Financing Act (Canada), the Money Laundering (Prohibition) Act (Nigeria), the Anti-Money Laundering Act (Ghana), and the Proceeds of Crime Act 2002 and Money Laundering Regulations 2017 (UK).

2. KYC Verification Levels

All businesses on Waaiio are assigned a verification level that determines the extent of their platform privileges. Verification levels are:

2.1 Unverified

New accounts before any identity documents are submitted. Unverified businesses can explore the dashboard and configure settings but cannot receive payouts or process live transactions.

2.2 Basic Verification

Requires the business owner’s government-issued photo ID and confirmation of the business name and address. Basic verification unlocks live transactions and payouts up to standard thresholds.

2.3 Standard Verification

Requires all Basic verification documents plus formal business registration documents (see Section 3 for country-specific requirements). Standard verification raises payout limits and enables higher-volume transaction processing.

2.4 Full Verification

Required for businesses processing high transaction volumes or operating in high-risk categories. Includes additional due diligence such as proof of address for beneficial owners, source of funds documentation, and in some cases enhanced screening against sanctions lists and politically exposed persons (PEP) databases.

3. Document Requirements by Country

The following documents are required for Standard and Full verification, depending on the business’s country of operation:

We may request additional documents depending on the nature and volume of transactions. Documents are reviewed within 2 to 5 business days of submission.

4. Transaction Monitoring

Waaiio employs automated and manual monitoring systems to detect and flag suspicious activity on our platform. This includes:

• Unusual transaction volumes or amounts that deviate significantly from a business’s historical pattern
• Rapid or repeated small transactions that may indicate structuring (smurfing)
• Transactions involving high-risk geographies or sanctioned entities
• Mismatches between declared business type and actual transaction patterns
• Multiple failed payment attempts followed by a successful one
• Refund patterns that suggest abuse or money laundering (e.g., large refunds to different accounts than the payer)

Flagged transactions are reviewed by our compliance team. We may contact the business owner for additional information or documentation before clearing the flag.

5. Reporting Obligations

Waaiio is obligated to file Suspicious Activity Reports (SARs) with the relevant authorities when we identify or have reasonable grounds to suspect that a transaction or series of transactions involves proceeds of crime, money laundering, or terrorist financing. Reports are filed with:

• United States: Financial Crimes Enforcement Network (FinCEN)
• Canada: Financial Transactions and Reports Analysis Centre of Canada (FINTRAC)
• Nigeria: Nigerian Financial Intelligence Unit (NFIU)
• Ghana: Financial Intelligence Centre (FIC)
• United Kingdom: National Crime Agency (NCA)

We are prohibited by law from informing the subject of a SAR that a report has been or will be filed (“tipping off”).

6. Payout Controls

To protect the integrity of our platform and comply with AML requirements, we enforce the following payout controls:

• Verification required: Payouts are only available to businesses that have completed at least Basic verification. Higher payout thresholds require Standard or Full verification.
• Cooling period: New accounts are subject to a holding period before their first payout. The duration depends on the verification level and country of operation.
• Velocity limits: We impose daily, weekly, and monthly payout limits based on the business’s verification level and transaction history. Businesses may request limit increases by submitting additional documentation.
• Payout holds: We may place a hold on payouts if suspicious activity is detected, a chargeback or dispute is pending, or additional verification is required.

7. Right to Suspend or Terminate Accounts

Waaiio reserves the right to suspend, restrict, or terminate any account at any time if we reasonably believe:

• The account is being used for money laundering, terrorist financing, fraud, or other illegal activity
• The account holder has provided false, misleading, or incomplete information during verification
• The account holder has failed to provide requested documentation within a reasonable timeframe
• A law enforcement authority or regulatory body has requested or ordered us to do so
• Continued operation of the account poses a risk to our platform, other users, or the public

Account suspension or termination under this section may occur without prior notice. Any funds held at the time of suspension will be retained pending the outcome of any investigation and may be released, returned, or forfeited in accordance with applicable law.

8. Sanctions Screening

We screen business owners and beneficial owners against applicable sanctions lists, including the U.S. Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list, the UK HM Treasury sanctions list, the UN Security Council Consolidated List, and relevant national lists in our countries of operation. Screening is performed at onboarding and periodically thereafter.

9. Record Keeping

We retain KYC documents, transaction records, and any suspicious activity reports for a minimum of 5 years after the business relationship has ended, or longer as required by applicable law. Records are stored securely and access is restricted to authorized compliance personnel.

10. Training and Awareness

All Waaiio employees and contractors who handle customer data, process transactions, or make compliance-related decisions receive regular training on AML requirements, KYC procedures, and suspicious activity identification. Training is updated annually and whenever significant regulatory changes occur.

11. Changes to This Policy

We may update this AML & KYC Policy from time to time to reflect changes in applicable law, regulatory guidance, or our internal procedures. When we make material changes, we will update the “Last updated” date at the top of this page.

12. Contact Us

For questions about our AML & KYC procedures, please contact us:

• Compliance: legal@waaiio.com
• Company: CipherHQ LLC (d/b/a Waaiio)
• Location: United States