Anti-Money Laundering (AML) and Know Your Customer (KYC) Policy

1. Purpose

The purpose of this Anti-Money Laundering (AML) and Know Your Customer (KYC) policy is to outline Bullfy Limited (No. 2025-00353)'s commitment to preventing money laundering, terrorist financing, fraud, and other financial crimes in compliance with applicable legal and regulatory requirements.

This policy is further designed to ensure that all users of our platform are properly identified, transactions are monitored for suspicious activities, and the integrity of our services is upheld. By implementing robust AML and KYC procedures, we aim to foster a secure and transparent environment for all users and stakeholders.

2. Introduction

At Bullfy Limited, we are dedicated to adhering strictly to international trade standards, complying with all relevant legislation to combat money laundering and counter-terrorism financing. Our Compliance Department monitors compliance with these requirements, ensuring all processes meet FATF recommendations and internal AML/KYC standards. This policy is mandatory for all employees, officers, directors, and third-party agents of the company involved in financial transactions, customer onboarding, and account management.

3. Risk-Based Approach

We adopt a Risk-Based Approach (RBA) to identify and assess the risk level of each client and transaction. Higher-risk customers or transactions are subject to enhanced due diligence. We continuously monitor risk levels and adapt our controls accordingly.

4. Customer Identification(KYC)

We perform due diligence on all customers before initiating any business relationship, which includes:

• Collecting and verifying personal identification documents (e.g., passport, national ID).
• Verifying proof of address (e.g., utility bills, bank statements).
• Assessing the purpose and nature of the business relationship.
• Conducting ongoing monitoring of the business relationship.

For corporate clients, we additionally verify:

• Certificate of incorporation or business registration.
• Details of directors and beneficial owners.
• Corporate structure and source of funds.

5. Customer Due Diligence (CDD)

We apply three levels of due diligence:

• Standard Due Diligence – For low to medium risk customers.
• Simplified Due Diligence – Where risk is minimal and regulations permit.
• Enhanced Due Diligence (EDD) – For high-risk customers, including politically exposed persons (PEPs) and clients from high-risk jurisdictions.

6. Monitoring Transactions

We implement systems for:

• Monitoring transactions in real-time and post-execution.
• Identifying unusual or suspicious patterns.
• Flagging large or rapid transfers, especially those not aligned with the customer’s profile.
• Recording all transactions and correspondence for at least five (5) years.

7. Reporting Suspicious Activity

Our staff is trained to identify and report any suspicious behavior or activity to the Compliance Officer. Reports may include:

• Inconsistent customer behavior.
• Unusual transaction volumes or types.
• Attempts to avoid reporting thresholds.

Suspicious activity reports (SARs) will be filed with the relevant regulatory authorities, as required by law.

8. Record Keeping

We maintain comprehensive records of:

• Customer identification and verification documents.
• Account files and business correspondence.
• Transaction records.

All records are kept securely for a minimum of five (5) years after the business relationship ends or the transaction is completed.

9. Staff Training

We provide AML/KYC training to all employees and agents, including:

• Identification of money laundering risks.
• Customer onboarding and verification procedures.
• Reporting mechanisms and compliance obligations.

Training is updated regularly to reflect changes in regulation and emerging threats.

10. Data Privacy and Security

All customer data collected during AML/KYC procedures is stored securely and handled in accordance with data protection laws. Access is restricted to authorized personnel only.

11. Policy Review

This policy will be reviewed annually or as needed to reflect changes in law, regulation, or the company’s risk profile. Amendments will be communicated to all stakeholders.

‍