Anti-Money Laundering Policy

Purpose and scope

Turi Ventures LLC requires a risk-based program to prevent TuriPay from being used to conceal criminal proceeds, finance terrorism, facilitate fraud, or evade financial controls. This policy applies to managers, employees, contractors, relevant agents, and activities performed for the company. Requirements must be proportionate to each product, customer type, jurisdiction, payment method, and delivery channel.

Governance and accountability

Management must designate a suitably qualified compliance owner with authority to review activity, stop affected transactions, escalate concerns, and obtain independent advice. Management retains responsibility for approving the program, providing resources, resolving material issues, and reviewing its effectiveness. Sales or revenue targets must not override compliance decisions. Responsibilities shared with a provider must be documented; outsourcing does not remove the company’s own obligations.

Customer due diligence

Before a restricted product is activated, the responsible team must establish the customer’s identity, purpose of use, expected activity, and relevant country connections. Business relationships require verification of the entity, authorized representatives, and beneficial ownership and control where applicable. Identity verification must follow the Customer Onboarding Policy and any additional product-provider requirements.

Enhanced review is required when risk warrants it, including material inconsistencies, complex ownership, unusual funding, higher-risk geographic exposure, politically exposed persons, or credible adverse information. Additional checks may address source of funds, source of wealth, relationship purpose, and senior approval. Political exposure or an unverified media match is not, by itself, proof of wrongdoing.

Transaction monitoring and investigation

Monitoring must consider activity across accounts and products, not only single transactions. Relevant indicators include unexplained changes in volume, rapid movement without an apparent legitimate purpose, third-party funding inconsistencies, fragmented activity intended to avoid controls, unusual recipient patterns, and digital asset exposure inconsistent with the customer profile. Alerts require documented investigation, an assigned owner, and a recorded disposition. The public policy does not disclose detection thresholds or investigative methods.

Digital asset funding

Supported digital asset deposits must be assessed against the permitted asset, network, customer profile, and available transaction-risk information. A blockchain transaction hash or provider callback alone must not be treated as final evidence that a customer balance should be credited. Confirmations, verification, reconciliation, and any required investigation must complete. Suspect deposits must not be automatically refunded to a different wallet or forwarded to another party to bypass review.

Escalation, reporting, and confidentiality

Staff must promptly escalate suspected financial crime to the compliance owner and preserve relevant records. The responsible reporting entity must evaluate and submit any legally required suspicious activity or other financial-crime report within the applicable deadline. The company must cooperate through lawful channels with competent authorities and providers. Where suspicious-activity reporting confidentiality applies, its existence, content, or contemplated filing must not be disclosed to a customer or unauthorized person. Lawful customer explanations must avoid tipping off.

Restrictions, review, and exit

Risk controls may include additional information requests, lower limits, a temporary hold, rejection, restriction of a product, or termination of a relationship where lawful and proportionate. Decisions must distinguish unresolved identity issues, suspected crime, and confirmed sanctions obligations. Customer money must be handled under the relevant provider agreement and applicable law; suspicion alone does not authorize confiscation. False positives and new evidence require reassessment.

Records and privacy

The company requires a documented retention schedule for identification evidence, risk assessments, investigation records, transaction information, training, and reviews. Applicable Bank Secrecy Act records must be retained for their required periods, generally at least five years where the relevant rule applies. Sanctions records follow the longer applicable OFAC rules described in the OFAC Sanctions Policy. Legal holds override ordinary deletion. Access must be limited, logged where appropriate, and consistent with applicable privacy duties.

Training, independent review, and change

Relevant staff must receive role-specific training before performing controlled activities and periodic refreshers thereafter. The program must receive risk-appropriate independent testing by a person who is not responsible for the tested controls. Material findings require corrective action, ownership, due dates, and validation. Management must review this policy at least annually and when products, providers, risks, or legal requirements change.

Contact

Questions or concerns may be directed to support@turipay.com with the subject “Compliance concern.” Do not email identity documents, full card details, passwords, or verification codes. Sensitive evidence must be requested through an approved secure channel.