AML & Sanctions Policy

1. Purpose and scope

This policy describes how we prevent the use of VexoraGate for money laundering, terrorist financing, sanctions evasion, fraud and other financial crime. It applies to all users, Merchants and transactions, and it is part of our Terms of Service.

2. Our approach: privacy-friendly and risk-based

We collect as little personal data as possible: users sign up with an email address, without identity documents (no KYC at sign-up). Instead of collecting documents from everyone, we focus our controls on transactions and behaviour that show risk, and on the businesses that use our payment gateway.

Privacy-friendly does not mean anonymous. Blockchain transactions are public and traceable, we keep complete records of all activity on the Service, and we act when we see signs of illegal activity.

3. What is not allowed

• depositing, receiving or moving proceeds of crime, including fraud, scams, theft, hacks, ransomware, extortion, darknet markets and corruption;
• using the Service for, or on behalf of, a person, entity or jurisdiction subject to sanctions, or to evade sanctions;
• financing terrorism or the proliferation of weapons of mass destruction;
• structuring transactions to avoid limits or reviews, using other people’s Accounts, or opening multiple Accounts to hide activity;
• operating a business listed as prohibited in our Acceptable Use Policy, or misrepresenting a Merchant’s business during moderation.

4. Controls in place today

• Human review of every withdrawal and payout before it is sent, including a check of the destination and of the history of the funds, followed by on-chain verification of what was sent.
• Merchant moderation: every new Merchant is reviewed (website, goods or services, business model) before payments are enabled; Merchants can be frozen at any time.
• Limits: minimum amounts, rolling 24-hour withdrawal limits per user, rolling 24-hour payout limits per Merchant, invoice minimums and maximums, limits on open withdrawal requests and API rate limits.
• Security locks: withdrawals are locked for 24 hours after password or 2FA changes, payouts for 24 hours after a new payout key; email and 2FA confirmation for every withdrawal.
• Reconciliation: every hour our ledger is compared with on-chain reserves; withdrawals are paused on any mismatch.
• Audit trail: all security-relevant and administrative actions are recorded in an append-only audit log.

5. Sanctions and address screening

We do not provide the Service to persons or entities on sanctions lists of the United Nations, the European Union, the United Kingdom or the United States (OFAC), or to anyone acting for them, and we do not process transfers to or from blockchain addresses that are listed by those authorities.

Today, destination addresses are checked during the manual review of withdrawals and payouts, and deposits or payments we learn are linked to listed or illicit addresses are held. We are introducing automated screening of incoming and outgoing transactions against sanctions lists and lists of addresses linked to illicit activity; when it is active, transactions that match will be held for review automatically.

Token issuers (for example Tether for USDT) can independently freeze addresses on their networks. We are not responsible for such freezes, and funds received from addresses frozen by an issuer may be held.

6. Requests for information

Identity verification is not part of our sign-up. In specific, risk-based cases we may ask a user or Merchant about the origin of particular funds, the purpose of a transaction or the nature of a business, and we may ask for supporting evidence. Providing this information is voluntary, but if it is not provided, or does not resolve the concern, we may decline the transaction and apply the measures in section 7.

7. Holding, freezing and returning funds

If we reasonably suspect that funds are linked to crime or sanctions, or if we receive a valid order from a competent authority or court, we may: delay or refuse the operation; hold the affected funds; freeze the Account or Merchant; return funds to their source where lawful and technically possible (for example to the victim of a proven theft); and report the matter to the competent authorities. Funds are held only as long as reasonably necessary or as required by the authority, and unaffected funds are released once the review is complete.

Where the law allows, we tell the user about the measure. Where the law forbids it (for example during a criminal investigation), we may not be able to.

8. Cooperation with authorities

We cooperate with competent law-enforcement and regulatory authorities. Requests must be sent to [email protected] from an official address and must identify the requesting authority, the legal basis and the specific Accounts, addresses or transactions concerned. We check the validity and proportionality of each request and disclose only the data that is required. We do not provide bulk access to user data.

9. Record keeping

We keep complete records of transactions, balances, reviews, moderation decisions and requests for at least 5 years after the end of the business relationship, or longer where the law requires, as described in our Privacy Policy.

10. Reporting stolen funds or suspicious activity

If you are the victim of a theft or scam and the funds were sent to a VexoraGate address, or if you see suspicious activity, write to [email protected] with the transaction hashes, addresses, amounts, times and, if available, a police report number. We review every report; we can act on funds that are still on the Service, but we cannot reverse blockchain transactions.

11. Changes

We review this policy regularly and update it as our controls and legal requirements develop. The date at the top shows the current version. The English version is the binding version.