AML/CFT Policy

PURPOSE

This Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) Policy (the “Policy”) sets forth the comprehensive framework and procedures implemented by SimplyTao Inc., operating the Simplytao.ai platform (the “Platform”, “we”, “us”, or “our”) to detect, prevent, and report money laundering, terrorist financing, and other illicit financial activities on our cryptocurrency trading platform.

The purpose of this Policy is to:

Establish Clear Compliance Standards: Define our commitment to maintaining the highest standards of AML compliance in the cryptocurrency industry, while operating as a Virtual Asset Service Provider (VASP) that is not registered as a Money Service Business (MSB).

Protect Platform Integrity: Safeguard our platform from being used as a vehicle for money laundering, terrorist financing, sanctions evasion, or other financial crimes through robust Know Your Customer (KYC) procedures and transaction monitoring systems.

Guide Operational Procedures: Provide clear, actionable guidelines for our team members, partners, and service providers regarding the identification, assessment, and mitigation of money laundering risks in our day-to-day operations.

Ensure Regulatory Alignment: Demonstrate our proactive approach to AML compliance, even in the absence of direct regulatory obligations, by voluntarily implementing industry best practices and international standards such as FATF recommendations.

Define User Verification Framework: Establish a risk-based approach to customer due diligence that balances user experience with security requirements, implementing tiered KYC levels appropriate to different risk profiles and transaction volumes.

Enable Effective Monitoring: Create systematic procedures for ongoing transaction monitoring, suspicious activity detection, and appropriate escalation protocols to identify and respond to potential illicit activities.

This Policy applies to all employees, contractors and service providers and to all aspects of our operations, including but not limited to user onboarding, transaction processing, and third-party integrations. It is designed to be read in conjunction with our Terms of Service, Privacy Policy, and other operational procedures.

1. INTRODUCTION AND LEGAL STATUS

1.1 Regulatory Basis

Primary statute: Law 23 of 27 April 2015 (Panama) as implemented by Executive Decree 363/2015. Related legislation: Law 48/2003 (Money-Remitters) if SimplyTAO ever handles fiat directly; Law 81/2019 (Data Protection); Law 45/2007 (Consumer Protection). International standards: FATF Recommendation 15 and its 2023 Guidance for Virtual-Asset Service Providers (VASPs).

1.2 Legal Classification

SimplyTao Inc., operating the Simplytao.ai platform, functions as an unregulated Virtual Asset Service Provider (VASP) and does not constitute a Money Service Business (MSB) under applicable law. This distinction is fundamental to understanding our regulatory position and compliance framework.

The platform provides cryptocurrency custody services to its users through a licensed third-party custodian, BitGo Trust Company (“Custodian”), which holds digital asset wallets on behalf of the platform’s customers. The platform operates as a delegating entity that directs the Custodian with respect to the management and staking of customer assets in accordance with applicable service agreements. The decisive regulatory boundary under applicable law is drawn around the receipt, possession, or transmission of fiat money on behalf of customers. At no point does the platform directly receive, hold, or transmit users’ fiat funds, nor does it engage in activities that would constitute money transmission services.

1.3 Separation from Fiat Flows

Simplytao.ai maintains a strict and unequivocal separation from fiat currency flows. The platform does not and will not take control of users’ fiat funds, operate omnibus accounts or settlement accounts in its name, or engage in any activity that would constitute the receipt or transmission of monetary value. All fiat conversions necessary for user transactions are executed exclusively by duly licensed third-party Payment Service Providers (PSPs) acting as principals in their own right.

With respect to digital assets, the platform provides custody services exclusively through its licensed third-party Custodian, BitGo Trust Company. The platform does not itself hold private keys or exercise direct control over user digital asset wallets. All custody arrangements are governed by the terms of the platform’s agreement with the Custodian and are disclosed to users in the platform’s Terms of Service.

1.4 Third-Party Payment Integration Structure

Where our platform integrates third-party payment service providers for fiat conversion, such integration is structured to ensure clear separation from money transmission activities. This architecture ensures that the PSP bears all licensing obligations and regulatory requirements related to fiat handling, while we maintain our status as an unregulated VASP operating solely in the cryptocurrency domain.

1.5 Voluntary Compliance Framework

Notwithstanding our operation outside the traditional financial services regulatory perimeter, we have voluntarily implemented this comprehensive AML/CFT framework. This voluntary adoption reflects our commitment to align with international best practices and Financial Action Task Force (FATF) recommendations, to future-proof our operations against evolving regulatory requirements, to protect our platform’s integrity and reputation, and to demonstrate our unwavering commitment to preventing the platform from being used for money laundering, terrorist financing, or other illicit activities.

2. JURISDICTIONS AND GEOGRAPHIC RESTRICTIONS

2.1 Restricted Jurisdictions

Simplytao.ai maintains strict geographic restrictions in accordance with global AML/CFT standards and best practices. The platform does not provide services to residents or nationals of jurisdictions identified by the Financial Action Task Force (FATF) as presenting elevated money laundering or terrorist financing risks. We maintain a comprehensive list of restricted jurisdictions that is subject to continuous review and updated immediately following each FATF Plenary meeting.

2.2 FATF Restricted Jurisdictions

As of June 2025, the platform categorically prohibits access to users who are residents, nationals, or located in the following FATF-listed jurisdictions: Algeria, Angola, Bolivia, Bulgaria, Burkina Faso, Cameroon, Côte d’Ivoire, Democratic People’s Republic of Korea (North Korea), Democratic Republic of Congo, Haiti, Iran, Kenya, Laos (Lao PDR), Lebanon, Monaco, Mozambique, Myanmar, Namibia, Nepal, Nigeria, South Africa, South Sudan, Syria, Venezuela, Vietnam, Virgin Islands (UK), and Yemen.

The list is reviewed after each FATF Plenary and any UNSC sanctions change.

2.3 Marketing and Solicitation Restrictions

While our services may be accessible from various global jurisdictions, we maintain strict policies regarding marketing and customer solicitation. The platform does not engage in any form of direct marketing, targeted advertising, or active solicitation directed toward residents of the United States of America, residents of European Union member states, or residents of any FATF-restricted jurisdiction.

This restriction encompasses all forms of marketing communications, including but not limited to digital advertising, social media campaigns, affiliate programs targeting these jurisdictions, and participation in conferences or events specifically aimed at these markets.

2.4 Enforcement Mechanisms

The enforcement of geographic restrictions is achieved through multiple overlapping control mechanisms, including but not limited to automated IP geolocation systems that prevent access from restricted jurisdictions, comprehensive KYC verification procedures that screen user nationality and residence during the onboarding process, ongoing monitoring systems that detect changes in user residency or location patterns, and explicit contractual provisions in our Terms of Service that prohibit use by residents of restricted jurisdictions.

Any attempt to circumvent these restrictions through the use of VPNs, proxy servers, or false information constitutes a material breach of our Terms of Service and will result in immediate account termination.

2.5 Updates and Reviews

The list of restricted jurisdictions is subject to continuous monitoring and formal review following each FATF Plenary meeting, whenever significant regulatory changes occur in any jurisdiction that may affect the risk profile of that jurisdiction, and as part of our continuous compliance monitoring process. Any changes to the restricted jurisdictions list are implemented immediately and communicated to affected users. Users attempting to access our platform from restricted jurisdictions will receive clear notification of the restriction and may direct any enquiries to compliance@simplytao.ai.

2.6 Targeted Sanctions Screening

In addition to the jurisdiction-based restrictions set forth in Sections 2.1 through 2.5, the platform maintains a separate and independent layer of targeted sanctions screening applicable to all users and transactions, regardless of the user’s country of residence or nationality.

The platform screens all users against the following sanctions lists and databases at the time of onboarding and on an ongoing basis throughout the customer relationship:

(a) The Specially Designated Nationals and Blocked Persons List (SDN List) maintained by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC);

(b) The Consolidated Sanctions List of the United Nations Security Council (UNSC);

(c) The Consolidated List of Persons, Groups and Entities subject to EU Financial Sanctions, as maintained by the European Commission;

(d) The Denied Persons List and the Entity List maintained by the U.S. Department of Commerce’s Bureau of Industry and Security; and

(e) Any other applicable sanctions lists as determined by the platform’s compliance team from time to time.

The platform does not provide services to, and will immediately suspend and report any account associated with, any individual or entity identified on the above lists. This restriction applies irrespective of whether the user’s country of residence appears on the FATF-restricted jurisdictions list set forth in Section 2.2.

Furthermore, the platform does not provide services to users who are located, organized, ordinarily resident, or established in any country or territory against which the United States maintains comprehensive economic sanctions or an arms embargo, including without limitation Cuba, Iran, North Korea, Sudan, Syria, and the Crimea region of Ukraine (including Sevastopol).

Sanctions screening is performed through the platform’s integrated KYC provider, Sumsub, which conducts automated checks against the above databases at onboarding and in real time upon material changes to user profile or transaction patterns. Any potential match is escalated to the compliance team for manual review prior to account activation or transaction processing.

3. KNOW YOUR CUSTOMER (KYC) FRAMEWORK

3.1 Scope and Application

This KYC framework applies exclusively to individual users of the Simplytao.ai platform. Corporate or institutional access requiring Know Your Business (KYB) procedures is handled on a case-by-case basis through direct communication with our compliance team at compliance@simplytao.ai.

The KYC framework establishes a tiered verification system designed to balance user accessibility with appropriate AML/CFT controls.

Persons under 18 years of age are not permitted to use the Platform.

3.2 KYC Tier Structure

Our platform implements three distinct KYC tiers, each with specific verification requirements and corresponding transaction limits.

Lite-KYC

This entry-level tier requires email verification and mandatory two-factor authentication (2FA) setup. Users must provide basic registration data including full legal name, date of birth, and country of residence. This tier permits cryptocurrency trading and withdrawals up to 10,000 USD equivalent per day. No fiat currency operations are available at this level.

KYC Normal

Standard KYC verification requires successful completion of identity verification through our provider Sumsub, including government-issued photo identification submission and liveness check via facial biometric verification. Upon successful verification, users may withdraw up to 50,000 USD equivalent in cryptocurrency per day and gain access to fiat on-ramp services. Fiat off-ramp services remain unavailable at this tier.

KYC Advanced

The highest verification tier requires completion of all KYC Normal requirements plus submission of proof of address documentation (e.g. utility bill) dated within three months of application. This tier provides daily cryptocurrency withdrawal limits of 200,000 USD equivalent and full access to both fiat on-ramp and off-ramp services.

3.3 Verification Process

The verification process for Lite-KYC is completed entirely within our platform through automated systems. For KYC Normal and KYC Advanced tiers, identity verification is conducted through Sumsub, our integrated third-party KYC provider. Users initiate the verification process through their account dashboard and are redirected to Sumsub’s secure verification portal. All document submissions and biometric data are processed directly by Sumsub, ensuring that sensitive identity information is not stored on our platform infrastructure. Continuous PEP/sanctions screening are performed at onboarding and thereafter.

3.4 Document Requirements and Standards

For KYC Normal and Advanced tiers, identity documents must be valid, unexpired government-issued documents containing photograph, full legal name, date of birth, and document number. Acceptable documents include passports, national identity cards, and driver’s licenses issued by recognized governmental authorities. The liveness check requires users to follow on-screen prompts to capture facial movements, ensuring the person submitting documents matches the photo identification.

For KYC Advanced tier, proof of address documentation must clearly display the user’s full name and residential address, be dated within three months of submission, and originate from recognized sources such as utility providers, financial institutions, government agencies, or telecommunication companies.

3.5 Verification Timelines

Standard processing times for KYC verification are immediate for Lite-KYC upon email confirmation and 2FA setup, 24–48 hours for KYC Normal following successful Sumsub submission, and 48–72 hours for KYC Advanced after all documentation is received. These timelines may be extended in cases requiring manual review or additional documentation. Users receive automated notifications of their verification status through email and platform notifications.

3.6 Data Processing and Privacy

All personal data collected during the KYC process is processed in accordance with applicable data protection laws and our Privacy Policy. For Lite-KYC, basic registration data is stored on our secure servers. For KYC Normal and Advanced tiers, Sumsub acts as our data processor, maintaining identity verification data under strict contractual obligations ensuring appropriate technical and organizational security measures. Personal data is retained for the duration required by applicable AML/CFT regulations, typically five years from the termination of the business relationship.

3.7 Sumsub Integration

Sumsub serves as our exclusive provider for KYC Normal and Advanced tier verifications. The integration operates through API connections that redirect users to Sumsub’s verification platform, where all identity document processing and biometric verification occurs. Sumsub maintains compliance with global data protection regulations including GDPR and implements bank-level security measures.

3.8 Ongoing Monitoring and Reverification

KYC verification status is subject to periodic review based on account activity and risk indicators. Circumstances that may trigger reverification requirements include, but are not limited to, expiration of identity documents on file, material changes in transaction patterns or volumes, receipt of adverse information through monitoring systems, or changes in regulatory requirements affecting verification standards. Users are provided reasonable notice to complete reverification procedures, with account limitations applied if verification is not completed within specified timeframes.

4. PAYMENT GATEWAY INTEGRATION

4.1 Overview

Simplytao.ai integrates licensed third-party payment service providers (PSPs) to facilitate fiat currency transactions while maintaining our status as an unregulated VASP. At no point does SimplyTAO receive, hold, or transmit fiat funds; all fiat currency operations, including both on-ramp and off-ramp services, are conducted exclusively through these licensed PSPs, ensuring that our platform never directly handles, controls, or takes possession of user fiat funds.

4.2 Fiat Transaction Architecture

Our payment gateway architecture is specifically designed to maintain complete separation between our platform operations and fiat currency handling. When users initiate fiat deposits or withdrawals, they are establishing a direct contractual relationship with the licensed PSP. The platform serves solely as a technological interface facilitating the connection between users and PSPs, without participating in the movement or custody of fiat funds.

4.3 Geographic PSP Allocation

The specific payment service provider available to each user is determined by multiple factors including the user’s jurisdiction of residence, the currency of transaction, local regulatory requirements, and the PSP’s licensed operating territories. The platform automatically routes users to the appropriate PSP based on their verified location and ensures that only properly licensed providers are available for each jurisdiction.

4.4 On-Ramp Services

Fiat on-ramp services are available to users who have completed KYC Normal or KYC Advanced verification. The on-ramp process operates through direct integration with our PSP partners, whereby users initiate deposit requests through our platform interface and are redirected to the PSP’s secure payment processing environment. The PSP independently verifies the user’s payment method, processes the fiat transaction under their regulatory licenses, and upon successful completion, notifies our platform to credit the corresponding cryptocurrency value to the user’s account.

4.5 Off-Ramp Services

Fiat off-ramp services are exclusively available to users who have completed KYC Advanced verification. The off-ramp process requires users to register their bank account details directly with the PSP through a secure verification process. Upon withdrawal request, our platform releases the cryptocurrency equivalent, and the PSP independently processes the fiat disbursement to the user’s verified bank account under their regulatory framework and compliance procedures.

4.6 PSP Compliance and Monitoring

All integrated payment service providers maintain appropriate money transmission licenses in their operating jurisdictions and are subject to regulatory oversight by relevant financial authorities. Our platform conducts initial and ongoing due diligence on PSP partners to ensure continued compliance with applicable regulations.

4.7 Transaction Limits and Controls

While our platform establishes cryptocurrency transaction limits based on KYC tiers, fiat transaction limits are independently determined and enforced by our PSP partners based on their regulatory requirements and risk policies. Users may be subject to additional verification requirements imposed by PSPs for large transactions or based on risk indicators identified in the PSP’s monitoring systems.

4.8 Data Sharing and Privacy

Information sharing between our platform and PSP partners is governed by strict data processing agreements that limit data use to specific purposes necessary for transaction processing and regulatory compliance. PSPs maintain independent privacy policies and users are directed to review these policies when establishing relationships with PSP services.

5. RECORD KEEPING

5.1 Transaction Data Storage

Simplytao.ai maintains all user transaction data, including trading history, deposits, withdrawals, and account activities, in our secure internal databases. These records are protected through encryption, access controls, and regular backup procedures to ensure data integrity and availability. Transaction records are retained indefinitely until potential cessation of platform operations. Users may request and export comprehensive transaction histories for their accounts at any time through their account dashboard for personal record-keeping, tax reporting, or audit purposes.

5.2 KYC Documentation Storage

All customer identification documents, including government-issued IDs, proof of address, biometric data, and any other sensitive KYC-related information, are exclusively stored and managed by our KYC provider, Sumsub. Simplytao.ai does not store copies of identity documents on our servers. Sumsub maintains full responsibility for the security, retention, and compliant handling of all KYC documentation in accordance with applicable data protection regulations and their certified security standards. Any requests regarding KYC document access, correction, or deletion are processed through Sumsub’s established procedures while maintaining coordination with our compliance team.

6. TERMS OF SERVICE – AML/KYC PROVISIONS

6.1 User Obligations

By accessing the Simplytao.ai platform, users agree to comply with all KYC requirements appropriate to their chosen service tier and provide accurate, complete, and current information during registration and verification processes. Users must promptly update any changes to their personal information and respond to periodic reverification requests. Any attempt to circumvent KYC procedures, provide false information, or create multiple accounts to avoid verification requirements constitutes a material breach of our Terms of Service.

6.2 Platform Rights and Enforcement

The platform reserves the right to suspend or terminate accounts that fail to complete required KYC verification within specified timeframes, refuse or restrict services based on AML/CFT risk assessments, freeze accounts and associated funds pending investigation of suspicious activities, and request additional documentation or information at any time to maintain compliance standards. Users acknowledge that the platform may share their information with authorized third parties including KYC providers, blockchain analytics services, and lawful authorities when required.

6.3 Consequences of Non-Compliance

Failure to comply with KYC requirements or violation of AML-related provisions results in immediate account restrictions proportionate to the compliance failure. This may include trading suspension, withdrawal limitations, complete account termination, and reporting to relevant authorities where required. Funds associated with accounts under investigation may be frozen until satisfactory resolution of compliance concerns.

7. TRAINING AND POLICY MAINTENANCE

7.1 Team Training

Simplytao.ai maintains a comprehensive AML/CFT training program for all team members involved in platform operations, customer support, and compliance functions. Training covers identification of suspicious activities, understanding of KYC procedures, awareness of current money laundering and terrorist financing typologies, and proper escalation procedures. Team members receive regular training updates to ensure continued awareness of evolving risks and regulatory developments in the cryptocurrency sector. Attendance logs and test results are retained for five (5) years.

7.2 Policy Updates and Maintenance

This AML/CFT Policy is subject to regular review and updates to reflect changes in regulatory landscapes, emerging threats, and operational improvements. Our compliance team, with support from specialized law offices and external legal counsel, is responsible for monitoring relevant developments and implementing necessary policy amendments. All policy updates are communicated to relevant team members and, where appropriate, to platform users through official channels. The policy maintenance process ensures our AML/CFT framework remains current and effective in addressing the dynamic nature of cryptocurrency-related financial crime risks. The Board reviews and approves this Policy at least annually or upon material change (new product, market, or law).