Anti-money laundering and counter-terrorist financing policy

1. Our commitment

TrustChange, a solution published and operated by TrustChange SARL, does not allow its platform to be used to launder money, finance terrorism or proliferation, or circumvent international sanctions. No customer carries out a real transaction without having been identified, verified and accepted.

This policy is approved by Management, reviewed and re-approved at least annually and upon any material change in our activities or in regulations. This page sets out its principles and forms an integral part of the terms of service.

2. Reference framework

• Regulation No. 01/CEMAC/UMAC/CM of 11 April 2016 on the prevention and suppression of money laundering and the financing of terrorism in Central Africa.
• Recommendations of the Financial Action Task Force (FATF) and GABAC.
• Sanctions regimes of the United Nations, the United States (OFAC) and the European Union, including the crypto wallet addresses designated by OFAC.
• Compliance requirements of Mobile Money operators, payment aggregators and banking partners.

TrustChange is not a licensed payment institution. It nevertheless voluntarily applies standards aligned with those required of financial institutions, and cooperates with its payment partners and the competent authorities.

3. Governance

• Management: approves the policy and risk appetite, and allocates the necessary resources.
• Compliance officer (MLRO): appointed by Management, specialised in AML/CFT, sanctions and data protection. They approve higher-risk files, handle alerts and decide on escalations and reports.
• Product and support teams: apply the controls built into the platform and escalate any anomaly to the compliance officer.

The compliance officer can be reached at contact@trustchange.fr, subject "Compliance".

4. Risk-based approach

Each customer receives a risk classification at onboarding, taking into account the declared profile, the business sector in light of the prohibited and restricted activities, the countries involved, declared and then observed volumes, and screening results (sanctions, politically exposed persons, adverse media).

This classification determines the level of due diligence applied and the frequency of periodic reviews. It is reassessed upon any significant event: change of activity or beneficial owner, abnormal increase in volumes, monitoring alert.

5. Know your customer (KYC)

No real transaction is possible before the verification file is approved, without exception. Depending on the profile, we collect and retain:

• Identification: first and last name, contact details, address, date of birth and, for a legal entity, the company name, RCCM and tax identifier.
• Verified persons: the account holder, its legal representative and, where applicable, the beneficial owners.
• Identity verification: official ID document (front and back), selfie and liveness check, followed by manual review by the compliance team.
• Activity: description, sector, website or public page, expected monthly volumes and purpose of the relationship.
• Supporting documents: registration document for a company, proof of address and, under enhanced due diligence, source of funds and wealth.

Transaction and volume limits depend on the verification level. Anonymous accounts or accounts opened under a fictitious identity are prohibited.

6. Enhanced due diligence

Enhanced due diligence applies in particular to high volumes, sensitive or restricted sectors, politically exposed persons and their close associates, complex ownership structures, high-risk countries and any file showing adverse media:

• evidence of the source of funds and, where necessary, source of wealth;
• approval of the file by the compliance officer;
• limits, reserve or specific conditions;
• closer monitoring and more frequent reviews.

7. Screening: sanctions, PEPs and media

The customer, its legal representative and beneficial owners are screened at onboarding, and periodically where the risk warrants it, against the United Nations, OFAC and European Union sanctions lists, politically exposed person databases and open sources.

• A potential match is reviewed manually and escalated to the compliance officer where necessary.
• A confirmed sanctions match results in refusal or termination of the relationship and the blocking of funds, in accordance with the law.
• A politically exposed person is only accepted under enhanced due diligence, with the compliance officer's approval.

The crypto assets we receive are also screened: before any payout, the address the funds come from is checked against our list of prohibited addresses, which combines:

• the crypto wallet addresses on OFAC's list of sanctioned persons (SDN list), across all networks;
• the addresses whose funds have been frozen by a stablecoin issuer, notably Tether for USDT on the TRON network (fraud, hacking, sanctions);
• the addresses flagged by our compliance team or by the authorities.

These lists are updated automatically several times a day from the official publications; an address removed by its source is removed from our list in the same way.

• Origin address on the list: no payout is made, the funds are blocked and the file is reviewed by the compliance officer, who decides on the next steps (termination of the relationship, report to the authorities).
• Origin address that cannot be determined: the transaction awaits a manual check before any payout.
• We may refuse to send crypto assets to an address on the list.

8. Transaction monitoring

Flows are monitored through a combination of automated controls and human review:

• limits per verification level and grade, frequency caps;
• anomaly alerts: unusual volumes, sudden spikes, split transactions, inconsistency with the declared activity;
• regular reconciliation with operators and payment partners;
• review of alerts by the compliance officer, with a recorded decision.

9. Escalation, measures and cooperation

Any suspicious activity is escalated to the compliance officer, who may suspend or block an account, hold funds during the review, request supporting documents or terminate the relationship.

TrustChange informs its payment partners of facts that warrant it and responds to requests from the competent authorities. Informing the customer concerned of a report or investigation is prohibited where the law so provides.

10. Record keeping

Identification and due diligence documents, as well as transaction data, are kept for the whole duration of the relationship and for five (5) years after it ends, and remain available to authorised authorities. How these data are protected is described in the privacy policy.

11. Training, controls and review

• Training: an annual AML/CFT training programme is being implemented for the relevant teams.
• Internal control: the compliance officer carries out regular reviews of files, alerts and the effectiveness of controls.
• Independent review: an external review of the framework is planned, then repeated at regular intervals.

12. What we expect from customers

• Provide accurate and complete information, and promptly notify us of any change: activity, directors, beneficial owners, contact details.
• Respond to our requests for supporting documents within the time allowed.
• Use the service only for its own declared activity, never for an undeclared third party.
• Comply with its own legal, tax and sector-specific obligations.

Failure to meet these obligations may lead to the measures set out in the terms of service and in the prohibited and restricted activities.