AML and KYC Policy

1.What this policy covers

ZeroFive operates zerofive, a custodial crypto payment service established in Hong Kong. This policy describes the controls we use against money laundering, terrorist financing and sanctions breaches. We apply them as company policy. Where a law applies to a particular merchant, customer or transfer, that law governs.

It is part of the Terms of Service at /terms and works with the Prohibited Businesses policy at /prohibited. The Privacy Policy at /privacy explains how we handle the personal data these controls use. It applies to merchants, the people who own, control or act for them, their team members, and the customers and supporters who pay them through zerofive.

2.Knowing our merchants

To open an account, we ask for your name, your store's name and a verified email address. You also confirm that your business is not on the prohibited list and that you are not a sanctioned person. We may ask for more at any time, including before or after you take live payments:

• The business's legal name, registration number, registered and trading addresses, website and a description of what it sells and to whom.
• The people who own or control it, such as anyone holding 25% or more of its shares or voting rights, and the person who opened the account. For each, a full name, date of birth, nationality and residential address, with an identity document where we ask for one.
• Evidence of the business, such as a certificate of incorporation, and any licence its activity needs.
• The volumes it expects, the countries its customers are in and where its money comes from.

We may check what you give us against independent sources, and limit, suspend or close an account until a review is complete. Giving false information, or hiding who owns or controls a business, is grounds for closing the account.

Keep this information current. Tell us at [email protected] when the business's owners, activity, licences or customer countries change. If we ask for identity or company documents, we will tell you how to send them. Do not send them by email unless we say so.

3.Higher-risk merchants

We look more closely at merchants whose activity, ownership, location or payment patterns carry more risk. For them we are more likely to ask for the information above, review their activity more often and limit what they can do until we are satisfied. This includes:

• Gambling, casinos, sports betting, lotteries and prize competitions. These do not need our approval under /prohibited, but we may ask for the operator's licence, the markets it covers, and how it keeps out players under the legal age and players in markets where its offer is illegal. We may limit the countries, amounts or payment flows we support.
• Adult content and adult entertainment, on the same basis.
• Activities that need our written approval under /prohibited, such as exchanges, money transmission, financial services, marketplaces and fundraising.
• Businesses linked to higher-risk countries, with complex or opaque ownership, or whose activity does not fit what they told us.

Merchants are responsible for checking their own customers where the law requires it. A gambling operator's player checks, for example, remain its own obligation. Our checks do not replace them.

4.Sanctions screening and blocked locations

We screen the wallet addresses involved in live transfers:

• Against the crypto addresses on the US Office of Foreign Assets Control (OFAC) Specially Designated Nationals list, from a public copy of that list we update daily.
• Against token issuer restrictions, including Tether and Circle blacklists and frozen token status, for the stablecoins where issuers publish them.
• Against our own list of restricted addresses, including wallets that have sent flagged funds before.

For an incoming payment, we screen the sending address we can identify. For Bitcoin-family coins, that is the first input of the transaction. For an outgoing transfer, we screen the destination when the transfer is requested. The UN and EU sanctions lists rarely name wallet addresses. Where we learn that a wallet belongs to a sanctioned person, we add it to our own list.

We also screen names against the consolidated sanctions lists of the UN Security Council, the European Union and OFAC, which we update daily:

• Merchants: the store's name and the names of its team members, within minutes of an account being opened or a name or member changing, and again whenever a list's contents change.
• Customers who pay a merchant: before a live payment is credited, the customer name the merchant gives us or that a customer enters when tipping, and the country the customer or the merchant gives for them. If there is a name to check and our copy of a list is missing, or is more than three days old without the list's publisher showing that it is still the latest version (and in any case once it is 14 days old), the payment waits until it can be screened.

Names are matched in full, ignoring case, accents, punctuation, word order and legal forms such as Ltd or LLC. Vessels and aircraft on the lists are not matched against names. A match on a store's own name suspends the store until we review it. A match on a team member's name, or on a one-word name, is reviewed without suspending the store first. A match on a customer holds the payment.

Each match is reviewed by a person and either cleared as a false positive or confirmed. While a match is open or confirmed, the payment it concerns is not released, the store's held payments are not released, the store is not restored and its payouts that need our approval are not approved. Confirming a match on a merchant suspends it and returns any payout not yet sent to our review queue. We report confirmed matches to the competent authorities, such as OFAC or the authority of the relevant EU member state, within the time the law requires, and keep a record of each report.

We do not serve people or businesses located in Cuba, Iran, North Korea, Russia or Belarus, or in Crimea, Sevastopol, Donetsk or Luhansk, and we block connections through Tor, which cannot be located. We may restrict other countries or regions. We identify location from network signals, which can be wrong or hidden; you must not disguise your location.

A flagged incoming payment is held without credit while we review it. A flagged outgoing transfer is refused. Where a match is confirmed, a declined payment is left at the receiving address without being credited, swept or returned, subject to applicable law and any required authorisation. The Terms of Service explain this handling in full.

5.Transaction monitoring

We automatically watch for patterns that can indicate money laundering or misuse of a store, and hold payouts for review when we see them:

• Money that passes straight through a store: incoming payments followed quickly by payouts to other wallets, including over a longer period.
• Balance top-ups that are quickly sent on to other wallets.
• Payouts to many new destinations.

Live payments worth US$1,000 or more, including smaller payments from the same sender or into the same address within a few hours that add up to that amount, wait through an additional screening period after confirmation. During a store's first 30 days of live payments, each payment waits before it can leave the platform. The Terms of Service give the current periods.

Alerts and held payments are reviewed by a person. We may also review a store's activity manually, for example where its volumes or customers do not fit what it told us. We may ask the merchant to explain a transaction or show where the money came from, hold payouts while we review it, or restrict the store.

6.Suspicious activity

Where we know or suspect that funds are linked to crime or terrorist financing, we report it to the relevant authority as soon as practicable. In Hong Kong, that is the Joint Financial Intelligence Unit. We cooperate with lawful requests from law enforcement and regulators.

The law may prohibit us from telling anyone that we have made a report or that an investigation is under way. We may therefore be unable to explain a hold, a restriction or a closure. That silence is not a finding that anyone committed an offence.

We may hold funds, refuse transfers, or restrict, suspend or close an account while we investigate or when the authorities direct us to. Released funds go only where the law allows.

7.The Travel Rule

Some countries require crypto service providers to exchange information about the sender and recipient of a transfer, known as the Travel Rule. We do not currently exchange this information with other providers. If a transfer you ask for would require it, we may ask you for the sender's or recipient's details, or refuse the transfer.

8.Record keeping

We keep account records, transaction records, a record of each screening decision (what was checked, against which versions of the lists, and the outcome), screening matches and how they were decided and reported, review notes and the information and documents merchants give us during a review. Our retention schedule is: payment, transaction and account records, including merchant verification, screening and review records, for seven years after the account closes, which meets Hong Kong's record-keeping requirements for business and anti-money-laundering records; complaint records for three years after the complaint is closed; server logs for up to 90 days. An investigation, a request from an authority or a legal claim can require us to keep relevant records longer.

Closing an account does not erase these records. We protect them with the measures in the Privacy Policy at /privacy and use them only for the purposes it describes and to meet our legal obligations.

9.What we need from merchants

• Give us accurate information about your business and the people behind it, and keep it current.
• Answer our requests for information or evidence promptly. We may restrict your account until you do.
• Do not process payments for an undisclosed or unapproved business, help anyone evade these controls, or split payments to avoid review.
• Comply with the anti-money-laundering and sanctions laws that apply to your own business, including checks on your own customers where required.

We review this policy as the law, our services and the risks we see change, and publish material changes here with a new effective date. Questions about it, or a request to review a restriction, go to [email protected].