AML Policy
MUFIN LIMITED AML/KYC Policy
Anti-Money Laundering, Counter-Terrorist Financing and Customer Identification Policy
Version: V1.0
Company: MUFIN LIMITED
Place of Registration: New Zealand
NZBN: 9429053202314
Scope of Application: MUFIN LIMITED and its operations, products, customer onboarding, fund deposits and withdrawals, transactions, and third-party service arrangements
Approved by: Board of Directors
1. Purpose of the Document
This policy sets out the minimum requirements for MUFIN LIMITED (hereinafter referred to as the "Company" or "Mufin") in respect of customer identification, customer due diligence, ongoing monitoring, suspicious activity reporting, sanctions screening, record-keeping, employee training, and compliance governance.
This policy aims to:
1. Prevent the company from being used for money laundering, terrorist financing, fraud, sanctions evasion, market abuse, or other financial criminal activities.
2. Establish a risk-based approach and apply proportionate control measures to different customers, products, regions, sources of funds, and transaction behaviors.
3. Support the Company in fulfilling its compliance obligations under New Zealand's AML/CFT framework, and meeting the due diligence requirements of correspondent banks, broker-dealers, custodians, payment institutions, and other third parties.
4. Provide unified operating standards for account opening, KYC, transaction monitoring, suspicious activity escalation, and record-keeping.
This policy is an internal compliance document of the Company and does not constitute legal advice. The Company should continuously update it based on its actual business model, regulatory status, opinions of competent authorities, and advice from external legal/compliance advisors.
2. Regulatory Basis and Reference Framework
This policy is formulated with reference to the following laws and regulatory frameworks:
1. New Zealand Anti-Money Laundering and Countering Financing of Terrorism Act 2009.
2. New Zealand AML/CFT Regulations, Exemptions, Codes of Practice and relevant supervisory authority guidance.
3. New Zealand Police Financial Intelligence Unit (FIU) requirements on suspicious activity reporting and goAML submission.
4. AML/CFT guidelines issued by the Department of Internal Affairs (DIA), Financial Markets Authority (FMA), and Reserve Bank of New Zealand within their respective regulatory scopes.
5. Financial Action Task Force (FATF) international standards on the risk-based approach, customer due diligence, beneficial owner identification, politically exposed persons, and virtual asset-related risks.
6. Sanctions, counter-terrorism, anti-fraud, privacy, and data protection requirements of New Zealand and applicable jurisdictions.
See reference links in Appendix F of this document.
3. Scope of Application
This policy applies to the following activities directly or indirectly provided, supported, or arranged by the Company:
1. Customer account opening and registration, identity authentication, risk assessment, and account status management.
2. Display, trading, transfer of positions, deposits and withdrawals, foreign exchange, bank card binding, and order processing related to investments, securities, funds, crypto assets, or other financial products.
3. Inflow and outflow of customer funds, internal transfers, receipts and payments via third-party accounts, and fiat currency and digital asset-related deposits and withdrawals.
4. Cooperation with banks, securities firms, custodians, payment institutions, KYC service providers, sanctions/PEP screening service providers, cloud service providers, and other outsourcing parties.
5. Directors, senior management, employees, contractors, and persons who handle customer or transaction data on behalf of the Company.
If a transaction is ultimately executed by a licensed third party, the Company shall still conduct risk assessments on the parts of the process under its control, including customer acquisition, information collection, instruction transmission, fund routing, data retention, and escalation of anomalies.
4. Compliance Governance
4.1 Board Responsibilities
The Board of Directors bears ultimate responsibility for the company's AML/CFT compliance framework. The Board of Directors shall:
1. Approve AML/KYC policies, risk assessments, and compliance procedures.
2. Appoint an AML/CFT Officer with appropriate qualifications, authority, and independence.
3. Ensure that the Company has sufficient personnel, systems, budget and external professional support to perform AML/CFT controls.
4. At least annually review AML/CFT risk assessments, significant events, suspicious activities, training completion, audit findings, and remediation progress.
5. Supervise high-risk business, major new products, major outsourcing arrangements, and high-risk customer acceptance decisions.
4.2 AML/CFT Officer
The AML/CFT Officer is responsible for day-to-day execution and supervision, including:
1. Maintain the company's AML/KYC policies, procedures, forms, risk scoring models, and monitoring rules.
2. Approve high-risk customers, EDD results, account restriction removals, and significant anomaly handling.
3. Conduct sanctions, PEP, adverse media, and customer background screening.
4. Receive internal escalations of suspicious activity and determine whether to file a Suspicious Activity Report (SAR) with the FIU.
5. Maintain training, audit, recordkeeping, and remediation ledgers.
6. Submit periodic AML/CFT reports to the Board of Directors.
4.3 Three Lines of Defense
First line of defense: Business, operations, customer service, and product teams are responsible for collecting customer information, identifying anomalies, executing system blocks, and escalating.
Second line of defense: The compliance team is responsible for policies, approvals, monitoring rules, investigations, reporting, and training.
Third line of defense: Internal audit, external audit, or independent compliance consultants are responsible for regularly assessing the effectiveness of the system.
5. Risk-Based Approach
The Company adopts a risk-based approach to determine the depth of due diligence, approval hierarchy, and monitoring frequency based on customers, products, services, channels, jurisdictions, sources of funds, transaction behavior, and reliance on third parties.
5.1 Risk Assessment Dimensions
Customer risk:
1. Natural persons, legal persons, trusts, funds, nominee arrangements, or complex equity structures.
2. PEPs, PEP relatives, or close associates.
3. High-net-worth, cash-intensive, cross-border operating, non-face-to-face account opening, or customers with incomplete information.
4. Regulated financial institutions, listed companies, government agencies, and other low-risk customers.
Product and service risks:
1. Securities, crypto assets, cross-border position transfers, foreign exchange, deposits, withdrawals, third-party payments, and rapid movement of funds.
2. Functions that can be used for value transfer, anonymization, layering transactions, or concealment of the source of funds.
3. New products, new regions, new channels, or highly automated services.
Regional risk:
1. FATF high-risk or enhanced monitoring jurisdictions.
2. High-risk regions for sanctions, terrorist financing, corruption, tax evasion, fraud, capital controls, or financial crimes.
3. Situations where the customer's place of residence, place of registration, place of business, tax residency, location of bank accounts, and source of funds are inconsistent.
Channel risks:
1. Non-face-to-face account opening, electronic identification verification, remote signing, and third-party customer acquisition.
2. Materials submitted by intermediaries, introducers, affiliated platforms, or third-party agents.
3. IP address, device, phone number, email address, or bank account is inconsistent with the information declared by the customer.
Transaction risk:
1. High-frequency fund movements, short-term buying and selling, rapid transfer-out, and no apparent economic purpose.
2. Depositing or withdrawing funds using a third-party account.
3. Mismatched with the customer's occupation, income, source of wealth, investment experience, or risk tolerance.
4. Involving digital asset wallets, mixers, high-risk exchanges, or unexplained on-chain sources.
5.2 Risk Level
The Company classifies customers into low risk, standard risk, and high risk.
Low-risk customers typically include: regulated financial institutions, listed companies, government agencies, and customers with complete information and simple and transparent transaction behavior.
Standard-risk customers typically include: ordinary individual or corporate customers with complete information, reasonable sources of funds, transaction behavior consistent with the customer profile, and no high-risk factors triggered.
High-risk customers include but are not limited to:
1. PEP, PEP relatives or close associates.
2. Customers from or involving high-risk jurisdictions.
3. Complex equity, trust, nominee, or structures where the ultimate beneficial owner cannot be clearly identified.
4. Insufficient explanation of source of funds, source of wealth, purpose of transaction, or funds flow.
5. Negative news, sanctions hits, law enforcement investigations, significant fraud or market abuse risks.
6. Involvement of large-value, frequent, abnormal, third-party, or digital asset-related fund flows.
5.3 Risk Review Frequency
Low-risk customers: at least once every 36 months.
Standard-risk customers: at least once every 24 months.
High-risk customers: at least once every 12 months, and more frequently when necessary.
Trigger event review: immediate review upon changes in customer profile, changes in control rights, abnormal transactions, sanctions/PEP hits, negative news, significant deposits or withdrawals, activation of new product permissions, or changes in regulatory requirements.
6. Customer Due Diligence and KYC
6.1 Pre-Account Opening Principles
The Company shall complete appropriate CDD before establishing a business relationship, permitting transactions, accepting funds, or executing material instructions. Except where legally permitted exceptions apply, customers for whom KYC or EDD has not been completed shall not be allowed to trade, deposit, withdraw, transfer positions, or access high-risk functionalities.
6.2 Natural Person Customers
The Company shall collect and verify the following information:
1. Legal name, former name, date of birth, nationality, residential address, contact information.
2. Valid identification documents, such as a passport, national ID card, driver's license, or other acceptable documents.
3. Proof of address, such as bank statements, utility bills, government documents, or other reliable source documents.
4. Occupation, employer/business type, source of income, expected source of funds, and source of wealth.
5. Tax residency status, CRS/FATCA information (if applicable).
6. Investment experience, risk tolerance, product suitability, or risk assessment results.
7. Bank account or payment account information, and confirmation that the account name is consistent with the customer's identity.
6.3 Corporate Customers
The Company shall collect and verify the following information:
1. Company name, registration number, place of registration, registered address, business address, date of establishment, and company type.
2. Certificate of Incorporation, Articles of Association, Certificate of Good Standing, Company Particulars Report, or equivalent documents.
3. Identity information of directors, authorized signatories, senior management, and controllers.
4. Shareholding structure chart, traced through to the natural person ultimate beneficial owner.
5. Name, date of birth, nationality, residential address, shareholding ratio, control method, and identity proof of the ultimate beneficial owner.
6. Business model, main products, customer base, source of income, intended account usage, expected monthly fund flow, and transaction frequency.
7. Board resolutions for account opening, powers of attorney, signing authority, and account operating authority.
8. Tax residency, CRS/FATCA forms (if applicable).
6.4 Ultimate Beneficial Owner Identification
The company shall identify and verify natural persons who directly or indirectly own, control, or benefit from the customer. Typically includes:
1. A natural person who directly or indirectly holds 25% or more of the equity interests.
2. A natural person who exercises actual control over the customer through voting rights, agreements, appointment of directors, or other means.
3. If the above persons cannot be identified, the natural person(s) responsible for senior management control shall be identified, and the basis for such determination shall be recorded.
Complex structures, cross-border holdings, trusts, funds, nominee arrangements, or nominee arrangements should trigger EDD.
6.5 Trusts, Funds, and Similar Arrangements
For trusts, funds, partnerships, or similar arrangements, the Company shall identify and verify:
1. Settlor, Trustee, Protector, Investment Manager, Authorised Person.
2. Known beneficiary or beneficiary category.
3. Ultimate Controller, Signatory, and Person Authorized to Give Instructions.
4. Trust deed, fund documents, management agreement, authorization documents, and source of funds.
5. Fund flows, account purposes, and beneficial arrangements related to Mufin usage scenarios.
7. Enhanced Due Diligence (EDD)
7.1 EDD Triggering Scenarios
EDD must be performed in the following circumstances:
1. The customer or ultimate beneficial owner is a PEP, a PEP family member, or a close associate.
2. The customer, controller, counterparty, source of funds, or destination of funds involves a high-risk jurisdiction.
3. The customer structure is complex, involving trusts, nominee arrangements, multi-layer cross-border shareholding, or unexplained control arrangements.
4. The source of funds or source of wealth is unclear, or does not match the customer's profile.
5. Sanctions, terrorist financing, negative news, fraud, market abuse, or criminal investigation risks arise.
6. Use of third-party accounts, frequent rapid inflows and outflows of funds, and large or unusual digital asset-related deposits and withdrawals.
7. Customer refuses to provide information, provides contradictory information, information is suspected to be forged, or cannot be independently verified.
7.2 EDD Measures
EDD may include:
1. Obtain and verify source of wealth and source of funds documentation, such as bank statements, payslips, tax returns, audit reports, dividend distributions, proof of asset sales, investment income proof, inheritance or gift documents.
2. Request more detailed business explanations, transaction purposes, fund flow paths, counterparty backgrounds, and anticipated activities.
3. Conduct additional screening on directors, UBOs, authorized persons, related entities, and major counterparties.
4. Obtain approval from senior management or the board of directors.
5. Increase the frequency of transaction monitoring and review.
6. Set transaction limits, deposit/withdrawal restrictions, manual review, or delayed processing.
7. Refuse account opening, suspend accounts, terminate relationships, or file SARs when necessary.
7.3 PEP Management
PEP customers must undergo EDD and obtain senior management approval before establishing or continuing a business relationship. The Company shall:
1. Identify whether the customer, ultimate beneficial owner(s), signatory(ies), and controller(s) are PEPs.
2. Identify PEP relatives and close associates.
3. Verify the source of wealth and source of funds.
4. Conduct ongoing enhanced monitoring of PEP customers.
8. Sanctions, Terrorist Financing, Negative News, and Name Screening
The company should conduct screening at the following points:
1. Before account opening.
2. When there are changes to customer information, control rights, authorized persons, or fund flows.
3. Conduct daily or system-capability-dependent list update screening for existing customers.
4. Prior to processing each high-risk deposit, withdrawal, position transfer, third-party payment, or unusual transaction.
Screening subjects include customers, directors, UBOs, authorized persons, controllers, payers, payees, transaction counterparties, bank accounts, digital asset wallets, and other relevant parties.
The screening list shall at least include:
1. New Zealand sanctions and terrorist designations.
2. United Nations Security Council sanctions.
3. Apply other sanctions lists required by correspondent banks, securities brokers, or custodians.
4. PEP databases, adverse media, enforcement notices, and regulatory penalty information.
In the event of a true hit or an unresolvable potential hit, the Company shall immediately suspend the relevant transaction, escalate to the AML/CFT Officer for review, and take freezing, rejection, termination, reporting, or other measures as required by law.
9. Account Opening and Approval Process
9.1 Standard Process
1. The customer submits account opening documents and declarations.
2. The system or operations team completes the completeness check of materials.
3. Identity, address, corporate documents, UBO, authorization documents, and bank account have been verified.
4. Complete screening for sanctions, PEP, negative news, and high-risk jurisdictions.
5. Generate customer risk levels based on the risk scoring model.
6. Standard-risk customers are approved by Operations/Compliance in accordance with the authorization matrix.
7. High-risk customers are approved by the AML/CFT Officer, and submitted to the Board of Directors or senior management for approval when necessary.
8. Approve and activate the corresponding functions after approval, and retain complete KYC approval records.
9.2 Circumstances Where Account Opening or Services Must Be Refused
The Company shall not establish or continue a business relationship:
1. The customer refuses to provide necessary KYC/EDD information.
2. The company is unable to reasonably identify the customer, ultimate beneficial owner, or actual controller.
3. The customer or relevant party is a sanctions target, or there is an unresolvable sanctions/terrorist financing risk.
4. The Company reasonably suspects document forgery, account opening under a false name, fraud, money laundering, terrorist financing, or regulatory evasion.
5. The customer's business purpose, source of funds, or transaction behavior is obviously illegal or inexplicable.
6. Refusal is required by laws, regulatory authorities, correspondent banks, securities dealers, custodians, or the Company's risk policies.
10. Ongoing Monitoring
10.1 Ongoing Updating of Customer Information
The Company shall ensure that customer KYC information is accurate, complete, and up-to-date. Re-KYC shall be triggered in the following circumstances:
1. Changes in customer name, address, nationality, tax residency status, or contact information.
2. Changes in directors, UBOs, shareholding structure, authorized persons, business address, or business model of corporate customers.
3. Changes in bank accounts, payment accounts, digital asset wallets, or fund flows.
4. Customer applies for higher-risk products, limits, or features.
5. Abnormal transactions, negative news, list hits, or third-party due diligence requirements are identified.
10.2 Transaction Monitoring
The Company shall monitor transactions based on customer profiles and expected activities, with a focus on:
1. Full or majority withdrawal shortly after deposit.
2. Source of funds is inconsistent with the customer's occupation, income, business scale, or source of wealth.
3. Multiple customers share the same phone number, email address, device, IP address, physical address, bank account, or digital asset wallet.
4. Frequent deposits to or withdrawals from third-party accounts.
5. Frequent order cancellations, matched orders, abnormal transaction prices, and trading without obvious investment purpose.
6. Cross-border fund flows to high-risk regions or are inconsistent with the purpose stated by the customer.
7. Involves high-risk digital asset addresses, mixers, darknet, tokens with abnormal market capitalization, or unregulated trading platforms.
8. The customer evades questions, urges the transaction to be expedited, refuses to explain the source of funds, or provides contradictory explanations.
10.3 Account Restrictions
During the investigation, the Company may take the following measures based on the level of risk:
1. Suspend account opening approval.
2. Suspend deposits, withdrawals, position transfers, trading, or access to specific products.
3. Reduce the limit or require manual review.
4. Request for supplementary KYC/EDD documents.
5. Termination of business relationship.
When taking restrictive measures, care should be taken not to disclose to the customer any information that may indicate a SAR has been filed or is intended to be filed.
11. Suspicious Activity Report (SAR)
11.1 Internal Escalation
If staff discover or suspect risks of money laundering, terrorist financing, sanctions evasion, fraud, tax evasion, market abuse, or other criminal activities, they shall immediately escalate to the AML/CFT Officer. Staff shall not discuss suspicious activity determinations with customers on their own initiative or advise customers on how to evade monitoring.
Internal escalation records shall include:
1. Customer name, account, related parties, and transaction information.
2. Suspicious reasons, triggering rules, factual basis, and timeline.
3. Collected documents, chat records, transaction records, and system logs.
4. Restrictive measures that have been taken or are recommended.
11.2 SAR Determination and Filing
The AML/CFT Officer shall assess whether there is a reasonable basis for filing a SAR. If the reporting threshold is met, the SAR shall be filed through the channel designated by the FIU, and records of the filing, the basis for determination, and subsequent handling shall be retained.
The Company shall ensure that SARs are filed within applicable time limits. Matters involving terrorist financing, sanctions, or immediate risks shall be prioritized, and external legal/compliance advice shall be sought where necessary.
11.3 Prohibition on Tipping Off
No employee shall disclose to a customer, counterparty, or unrelated third party that the Company has filed, is considering filing, or may file a SAR, nor shall they disclose investigation contents or regulatory communications.
12. Cash, Cash Flow, and Third-Party Account Policy
The Company generally does not accept cash or anonymous funds.
Clients should use accounts in their own name for deposits and withdrawals. Corporate clients should use accounts in the company's name. Third-party payments are generally prohibited unless approved by the AML/CFT Officer and the following steps are completed:
1. Identify and verify the identity of third parties.
2. Explain the relationship between the third party and the customer, and the reason for payment.
3. Verify the source and legality of funds.
4. Assess whether nominee holding, money laundering, fraud, tax evasion, sanctions evasion, or fund ownership disputes exist.
5. Complete the record and set up ongoing monitoring.
Digital asset-related fund flows should, within the company's capabilities, undergo wallet address screening, on-chain risk scoring, exchange risk assessment, and review of source explanations.
13. Outsourcing and Third-Party Dependencies
The Company may use third-party service providers to support KYC, identity verification, sanctions/PEP screening, transaction monitoring, cloud storage, payments, custody, or broker-dealer execution, but shall not fully transfer ultimate AML/CFT responsibility to such third parties.
The Company shall conduct due diligence on outsourcing providers, including:
1. Qualifications, regulatory status, reputation, and service capabilities.
2. Data security, privacy protection, access control, and business continuity.
3. Service Scope, Boundaries of Responsibility, SLA, Audit Rights, and Data Access Rights.
4. Whether KYC, screening, transactions, and logging can be provided in a timely manner.
5. Termination Arrangements and Data Migration/Deletion Arrangements.
Outsourcing arrangements should be formalized in written agreements and reviewed periodically.
14. Record Keeping
The Company shall maintain records sufficient to demonstrate its compliance with AML/KYC obligations, including:
1. Customer identity, address, company documents, UBO, authorization documents, and verification results.
2. Risk scoring, approval records, EDD documents, and management approval.
3. Sanctions, PEP, negative news, and high-risk jurisdiction screening results.
4. Transaction records, capital flow records, orders, deposits and withdrawals, position transfers, and communication records.
5. Internal suspicious activity escalation, SAR determination, SAR filing records, and subsequent handling.
6. Training, audit, remediation, and board reporting records.
Records shall be retained for at least 5 years after the end of a business relationship or the completion of a transaction, or for the longer period required by applicable laws, regulatory requirements, or partner institutions. Records shall be kept secure, complete, retrievable, and protected against unauthorized access, alteration, or deletion.
15. Data Protection and Confidentiality
The Company shall comply with applicable privacy and data protection requirements when handling customers' personal information and sensitive data. The Company shall:
1. Only collect necessary information for legitimate and compliant purposes, account opening, trading, risk control, and regulatory purposes.
2. Control employee access rights and authorize based on the principle of minimum necessity for each position.
3. Implement encryption, access logs, and secure storage for identity documents, proof of address, bank accounts, tax information, and transaction data.
4. Confirm legal basis, contractual arrangements, and security measures before sharing data with third parties.
5. Establish emergency procedures for data leaks, misdelivery, unauthorized access, or system attacks.
16. Employee Training
All employees involved in customers, transactions, funds, products, operations, customer service, technology, and management should receive AML/KYC training. The training should at least include:
1. AML/CFT Basic Obligations and Company Policies.
2. KYC, CDD, EDD, PEP, sanctions, and adverse media screening processes.
3. Transaction monitoring red flags, digital asset risks, third-party payment risks, and fraud identification.
4. Internal Escalation, SAR, Confidentiality Prohibition, and Record Retention.
5. Data Protection, Information Security, and Customer Communication Boundaries.
New employees should complete training as soon as possible after onboarding. Existing employees should receive refresher training at least annually. The company should retain training materials, attendance records, quizzes, and make-up training records.
17. Independent Audit and Policy Review
The Company shall conduct independent audits of its AML/CFT risk assessment and compliance procedures on a regular basis. The audit scope shall include:
1. Whether the risk assessment covers actual business, customers, products, regions, and channels.
2. Whether the quality and approval of KYC/EDD documents comply with policies.
3. Whether sanctions/PEP screening, transaction monitoring, SAR determination, and recordkeeping are effective.
4. Whether the outsourcing party, system permissions, data security, and training records are adequate.
5. Whether past remediation items have been completed.
The Company shall update this Policy in a timely manner based on business changes, regulatory changes, audit findings, material events, or requirements of partner institutions. Regardless of whether any changes have occurred, this Policy shall be reviewed at least once every 12 months.
18. AML Assessment Before Product and Feature Launch
Before any new product, new region, new asset class, new payment method, new transfer process, new partner, or major system change goes live, an AML/CFT risk assessment shall be completed. The assessment should answer:
1. Whether the feature changes the flow of funds, flow of assets, transaction speed, or customer anonymity.
2. Whether it involves high-risk areas, digital assets, third-party payments, or cross-border transfers.
3. Whether new KYC fields, EDD triggering conditions, limit restrictions, or monitoring rules need to be added.
4. Whether it is necessary to update customer disclosures, risk warnings, terms of service, or privacy notices.
5. Whether approval is required from the Board of Directors, AML/CFT Officer, external advisors, or partner institutions.
No features that may significantly increase AML/CFT risks may be launched without confirmation by the AML/CFT Officer.
19. Discipline and Violation Handling
If an employee violates this policy, intentionally circumvents KYC, ignores suspicious activity, discloses SAR information, tampers with records, or fails to escalate risk matters as required, the Company may take measures including training, warnings, access restrictions, disciplinary action, termination, and reporting to regulatory or law enforcement authorities.
Appendix A: KYC Document Checklist
Natural Person Customers:
1. Valid identification document.
2. Proof of address.
3. Contact information and tax residency information.
4. Description of occupation, source of income, source of wealth, and source of funds.
5. Bank account proof.
6. Risk Assessment and Product Suitability Questionnaire.
7. PEP/Sanctions/Negative News Screening Results.
Corporate Customers:
1. Certificate of Incorporation, Company Particulars Report, Articles of Association or equivalent documents.
2. List of Directors, Authorized Persons, and Senior Management.
3. Shareholding structure chart and UBO identity information.
4. Board resolutions, powers of attorney, and signing authority.
5. Proof of actual business address.
6. Description of business model, products, major customers, revenue sources, and account purposes.
7. Expected monthly incoming funds, outgoing funds, currencies, number of transactions, and transaction products.
8. Bank account proof.
9. CRS/FATCA forms (if applicable).
10. PEP/sanctions/negative news screening results.
Appendix B: Risk Scoring Recommendations
Each item is scored 0, 1, 2, or 3. The higher the total score, the higher the risk.
Customer type: Individual 1; ordinary company 1; complex company/trust/fund 3.
Regional risk: Low risk 0; general cross-border 1; high-risk or sanctions-related 3.
PEP risk: None 0; potential association 2; PEP/family member/close associate 3.
Source of funds: Clear and documented 0; requires additional explanation 1; unclear or contradictory 3.
Product risk: Ordinary holding 1; frequent trading/cross-border transfer 2; digital assets or third-party payment 3.
Channel risk: Face-to-face or strong verification 0; non-face-to-face 1; third-party referral/agent 2.
Negative information: None 0; minor or explainable 1; significant negative/investigation/penalty 3.
Recommended classification: 0–5 points as low risk; 6–11 points as standard risk; 12 points and above as high risk. Any confirmed sanctions hit, inability to identify UBO, or significant suspicious activity should be escalated directly, regardless of the total score.
Appendix C: Transaction Monitoring Red Flags
1. The customer deposits funds and quickly transfers them out or moves positions without a clear investment purpose.
2. Multiple small-amount transactions used to circumvent limits or manual review.
3. Transaction behavior is inconsistent with the customer's income, occupation, investment experience, or account purpose.
4. Frequent deposits from third-party accounts or requests to withdraw funds to unrelated accounts.
5. Multiple accounts using the same device, IP, address, bank card, or contact information.
6. The customer refuses to explain the source of funds or provides contradictory information.
7. Large sums of funds originate from high-risk regions, unregulated platforms, or digital asset wallets that are difficult to explain.
8. The customer uses suspected forged documents, stolen identity, or impersonation to open an account.
9. The customer is unusually sensitive to compliance issues and requests to bypass KYC or expedite processing.
10. The customer has significant negative news related to fraud, tax evasion, market manipulation, money laundering, or regulatory penalties.
Appendix D: Internal SAR Escalation Form Fields
1. Submitter, department, date, and time.
2. Customer name, account number, and customer risk level.
3. Involves transaction number, amount, currency, time, payer, and payee.
4. Suspicious Facts and Reasons.
5. Obtained documents and system evidence.
6. Customer explanation and its credibility.
7. Temporary restrictive measures have been taken.
8. AML/CFT Officer determination.
9. Whether an SAR was filed, date of filing, and reference number.
10. Follow-up Actions and Closure Date.
Appendix E: Board Approval Record
This policy has been reviewed and approved by the Board of Directors of MUFIN LIMITED.
Appendix F: Regulatory Reference Links
1. New Zealand legislation: Anti-Money Laundering and Countering Financing of Terrorism Act 2009
https://www.legislation.govt.nz/act/public/2009/0035/latest/whole.html
2. Department of Internal Affairs AML/CFT guidance
https://www.dia.govt.nz/AML-CFT
3. Financial Markets Authority AML/CFT information
https://www.fma.govt.nz/business/services/amlcft/
4. New Zealand Police Financial Intelligence Unit and goAML
https://www.police.govt.nz/advice-services/businesses-and-organisations/fiu
5. New Zealand Ministry of Foreign Affairs and Trade sanctions
https://www.mfat.govt.nz/en/peace-rights-and-security/sanctions/
6. FATF Recommendations
https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html