AML/CFT Policy
Introduction Shipfinex FZCO (‘Shipfinex’) is dedicated to adhering to the highest standards of Anti-Money Laundering (AML) and Counter Financing of Terrorism (CFT) compliance. This policy establishes a comprehensive framework, procedures, and responsibilities designed to prevent, detect, and report activities related to money laundering and terrorist financing. Shipfinex operates in full compliance with all applicable AML/CFT laws and regulations, including those mandated by the Virtual Assets Regulatory Authority (VARA) and other relevant regulatory bodies, ensuring a secure and transparent operational environment for all stakeholders.
Key Definitions
Anti-Money Laundering (AML): Policies, procedures, and controls designed to prevent and detect money laundering activities.
Counter Financing of Terrorism (CFT): Measures to prevent and combat the financing of terrorism.
Customer Due Diligence (CDD): Procedures to identify and verify the identity of customers.
Enhanced Due Diligence (EDD): Additional scrutiny applied to higher-risk customers or transactions.
Politically Exposed Persons (PEPs): Individuals who are or have been entrusted with prominent public functions and their immediate family members and close associates.
Suspicious Transaction Report (STR): A report made by financial institutions about suspicious or potentially suspicious activity.
Money Laundering Reporting Officer (MLRO): An individual appointed to oversee and ensure compliance with AML/CFT regulations.
Principles, Objectives and Scope The purpose of this policy is to establish the principles and procedures that Shipfinex FZCO follows to detect, prevent, and report money laundering and terrorist financing activities. This policy applies to all employees, officers, directors, and third parties acting on behalf of Shipfinex. It ensures compliance with all applicable AML/CFT laws and regulations, including those set by the Virtual Assets Regulatory Authority (VARA). The policy is regularly reviewed and audited for effectiveness, with the MLRO responsible for maintaining and updating it as needed.
This policy is developed in line with the requirements stipulated in the VARA Compliance and Risk Management Rulebook, Part III.
Roles and Responsibilities To ensure the effective implementation and oversight of the Anti-Money Laundering (AML) and Counter Financing of Terrorism (CFT) policy, Shipfinex has clearly defined roles and responsibilities for all levels of the organisation. These roles are essential in maintaining compliance with all applicable AML/CFT laws and regulations, particularly those outlined by the Virtual Assets Regulatory Authority (VARA).
Board of Directors
Ensure that the AML/CFT policy is effectively implemented across all levels of the organisation.
Provide strategic oversight and support to the Money Laundering Reporting Officer (MLRO).
Review and approve the AML/CFT policy on an annual basis, ensuring it remains up-to-date with regulatory changes and best practices.
Senior Management
Assist the MLRO in implementing the AML/CFT program by ensuring that adequate resources are allocated to compliance efforts.
Promote a strong culture of compliance within the organisation by setting the tone from the top.
Ensure that all employees are aware of and adhere to the AML/CFT policies and procedures.
Money Laundering Reporting Officer (MLRO)
Oversee the implementation and effectiveness of the AML/CFT program, ensuring all operations comply with relevant regulations.
Ensure the Board and staff receive proper training on AML/CFT laws, particularly those relevant to Virtual Asset (VA) activities.
Develop and implement AML/CFT policies and procedures in line with regulatory guidelines.
Conduct risk assessments and update policies to address identified AML/CFT risks.
Monitor and report suspicious transactions, ensuring compliance with Federal AML/CFT laws.
Take corrective actions in response to non-compliance and report regularly to the Board on the effectiveness of AML/CFT measures.
Provide quarterly reports to the Board, including summaries of anonymity-enhanced transactions, and ensure these reports are available to VARA upon request.
Conduct internal audits to assess the effectiveness of AML/CFT systems and controls.
Remain accountable for all AML/CFT activities, even if delegated, ensuring full compliance with outsourcing management requirements.
When appointing a Money Laundering Reporting Officer (MLRO), Shipfinex ensures that the individual has at least two years of experience in handling AML/CFT matters and is deemed a Fit and Proper Person for the role. The appointment is reviewed annually to confirm the MLRO's continued capability to perform all relevant duties effectively. Shipfinex acknowledges VARA's authority to request evidence of these qualifications and considers compliance with the applicable regulations as a critical factor in maintaining the MLRO's Fit and Proper status.
Compliance Department
Conduct comprehensive customer due diligence and ongoing monitoring to ensure compliance with AML/CFT regulations.
Investigate any suspicious activities and file Suspicious Activity Reports (SARs) as required.
Maintain detailed records of all AML/CFT activities, ensuring they are easily accessible for regulatory review.
All Employees
Adhere to the AML/CFT policies and procedures outlined by Shipfinex.
Report any suspicious activities or transactions to the MLRO promptly.
Participate actively in all AML/CFT training programs to stay informed on compliance requirements.
These roles and responsibilities ensure that Shipfinex’s AML/CFT policy is effectively implemented, maintained, and continuously improved to meet the evolving regulatory landscape.
AML/CFT Governance and Regulatory Framework
Shipfinex is committed to a robust Anti-Money Laundering (AML) and Counter Financing of Terrorism (CFT) framework, ensuring compliance with all relevant laws and regulations. This policy outlines the governance structure and regulatory framework guiding Shipfinex’s efforts to detect, prevent, and report money laundering and terrorist financing activities.
Governance Structure: The governance of Shipfinex’s AML/CFT program is overseen by the Board of Directors and Senior Management, who ensure the effectiveness of the internal control system. The Money Laundering Reporting Officer (MLRO) plays a central role in implementing AML/CFT controls, reporting to senior management, and conducting regular audits and training.
Regulatory Framework: Shipfinex’s AML/CFT policy aligns with the following laws and regulations:
Federal AML-CFT Laws
FATF Standards and Reviews:
12-Month Review of the Revised FATF Standards on Virtual Assets and VASPs (June 2020).
Second 12-Month Review of the Revised FATF Standards on Virtual Assets and VASPs (July 2021).
Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs (October 2021).
International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation (March 2022).
Cabinet Resolution No. 74 of 2020: Related to the Terrorist List System and the Implementation of Security Council Resolutions.
UAE Executive Office for Control & Non-Proliferation (EOCN) Guidance (March 2022): On Counter Proliferation Financing for FIs, DNFBPs, and VASPs.
EOCN’s Local Terrorist List: As may be amended from time to time.
Other Applicable Laws and Regulations: As promulgated by VARA, UAE federal bodies, FATF, or the Middle East and North Africa Financial Action Task Force.
Risk-Based Approach (RBA): Shipfinex employs a risk-based approach to allocate resources efficiently, focusing on higher-risk areas. This includes:
Prohibiting transactions under anonymous or fictitious names.
Complying with directives for implementing UN Security Council Resolutions related to the suppression and combating of terrorism, terrorist financing, and the proliferation of weapons of mass destruction and its financing, along with compliance with all other applicable laws, regulatory requirements, and guidelines related to economic sanctions.
Maintaining comprehensive transaction records, whether local or international, for regulatory review.
Ensuring compliance with all AML/CFT requirements as stipulated by relevant authorities.
Screening and Monitoring Procedures: Shipfinex has implemented screening procedures for clients, UBOs, Virtual Asset transactions, and VA Wallet addresses, which are further detailed in this policy. These procedures aim to:
Identify potential illicit activities and adverse information.
Alert operations and compliance teams to impose relevant restrictions and conduct further investigations when necessary.
Third-Party Validation: All AML/CFT policies and procedures are attested by a competent third party and submitted to VARA during the licensing process.
This comprehensive governance and regulatory framework ensures that Shipfinex remains compliant with all applicable AML/CFT laws and regulations, thereby safeguarding the integrity of its operations in the virtual asset sector
Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) Shipfinex's Customer Due Diligence (CDD) process is integral to identifying and verifying the identity of clients to prevent the misuse of its platform for money laundering, terrorist financing, or other illicit activities. This process is conducted using a risk-based approach and is essential before establishing any business relationship or executing transactions.
Components of CDD:
Client Identification and Verification (ID&V):
Collection and Verification: Shipfinex gathers and verifies client identities using reliable sources, such as government-issued IDs, passports, or electronic verification methods. This includes identifying Ultimate Beneficial Owners (UBOs) and understanding the ownership and control structure.
Sanctions and PEP Screening: All clients and related parties are screened against domestic and international sanctions lists, as well as checked for Politically Exposed Persons (PEPs). Approval from the MLRO and senior management is required before engaging with PEPs.
Know Your Client (KYC):
Information Gathering: Collect detailed information on the client’s business activity, ownership structure, country of operation, source of wealth (SoW), and source of funds (SoF). This helps build a comprehensive client profile.
Purpose Determination: Understand the intended purpose of the business relationship and ensure it aligns with the client’s declared intentions.
Enhanced Due Diligence (EDD):
Application for High-Risk Clients: EDD is implemented for high-risk clients, involving more rigorous verification processes, including additional documentary evidence, frequent reviews, and enhanced transaction monitoring.
In-Depth Verification: For high-risk clients, verify the source of wealth, funds, and address through additional documentation and internet searches to corroborate the client's transaction profile.
Ongoing Monitoring and Review:
Continuous Monitoring: Regular monitoring of all transactions ensures they align with the client’s profile and declared activity. This is particularly stringent for high-risk clients.
Periodic and Event-Driven Reviews: Shipfinex conducts periodic reviews of client risk profiles, with high-risk clients undergoing more frequent assessments. Event-driven reviews are triggered by significant changes in the client’s circumstances, such as a surge in transaction volume or new jurisdiction involvement.
Client Exit Process:
Termination Procedures: If CDD cannot be completed or if identified risks cannot be mitigated, Shipfinex terminates the business relationship. Clients are added to an internal blacklist to prevent re-onboarding.
Customer Due Diligence
Shipfinex’s CDD process is critical for verifying customer identities and assessing associated risks, ensuring compliance with AML/CFT regulations. The CDD measures are mandatory and must be undertaken in various circumstances, ensuring that all business relationships and transactions are appropriately scrutinised.
Circumstances Requiring CDD:
Establishing a Business Relationship: CDD is mandatory when initiating a business relationship with a client for services related to Virtual Asset (VA) activities. This includes collecting and verifying customer information to ensure compliance with AML/CFT requirements.
Occasional Transactions: CDD must be performed when executing occasional transactions on behalf of a client, where the transaction amount equals or exceeds AED 3,500. This applies whether the transaction is a single occurrence or part of several linked transactions.
Suspicious Transaction Instructions: If a client instructs Shipfinex to handle a potential suspicious transaction, CDD measures must be applied to assess and mitigate any associated risks.
Doubts About Previously Obtained Information: CDD must be re-conducted if there are doubts about the veracity or adequacy of previously collected client identification information. This ensures that all data is accurate and up-to-date.
High-Risk Transactions: Any transaction involving high-risk clients, as characterised under the Federal AML-CFT Laws, requires the application of CDD measures to ensure that the risks are effectively managed
Ongoing Supervision of Business Relationships:
Transaction Auditing: Shipfinex audits all transactions throughout the business relationship to ensure consistency with the client's profile and risk assessment. This includes verifying the source of funds and ensuring that the transaction aligns with the client's declared activities.
Periodic Review of Records: Regular reviews of client records, particularly for high-risk clients, are mandatory to ensure that all CDD-related documents, data, and information remain current and relevant. This ongoing review helps in maintaining the accuracy of the client’s risk profile.
If Shipfinex is unable to complete an appropriate CDD, the company will not establish or maintain a business relationship or execute any transactions for that client. If third parties are relied upon to perform CDD, Shipfinex remains responsible for ensuring that the process complies with all relevant rules and directives.
Shipfinex cannot engage with or retain clients that fall outside its risk appetite. This includes clients involved in criminal activities, those on sanctions lists, those transacting with sanctioned entities, and those engaged in high-risk or illegal activities. Clients who refuse to provide necessary data for identity verification or economic profile creation without valid justification are also deemed unacceptable.
Shipfinex does not:
Establish or maintain relationships with shell banks.
Hold anonymous or false-name accounts.
Engage with clients whose ownership or control structures prevent identification of beneficial owners.
Prohibited clients include:
Known criminals or those strongly suspected of financial crimes.
Clients on UN, UAE, US, UK, and EU sanctions lists.
Entities involved with sanctioned entities, Darknet transactions, or high-risk countries.
Clients engaged in activities posing unacceptable reputational risks.
Complex structures where beneficial ownership cannot be determined.
Clients demanding anonymity or providing fictitious names.
Entities linked to controversial or illegal activities like arms dealing, drug trafficking, or deforestation.
The Identification and Verification (ID&V) process at Shipfinex is crucial for gathering and verifying client information to prevent money laundering (ML), terrorist financing (TF), and proliferation financing (PF). This process ensures that the client's identity is confirmed using reliable, independent sources, forming the basis for creating an accurate economic profile and enabling the early detection of suspicious transactions.
ID&V Components
For Individual Customers:
For Legal Entities:
If any entity claims to act on behalf of a client, Shipfinex ensures that the entity is authorised to do so and verifies its identity according to the established procedures. Shipfinex also seeks to fully understand the intended purpose and nature of the business relationship with the client, gathering necessary information to support this understanding. For business clients or those providing services to other clientele, Shipfinex thoroughly examines the client's business nature, ownership, and control structure, including identifying Ultimate Beneficial Owners (UBOs) and any Decentralised Autonomous Organizations (DAOs) involved, to ensure full compliance with Federal AML-CFT Laws.
Enhanced Due DiligenceEnhanced Due Diligence (EDD) is a critical process applied by Shipfinex to manage the elevated risks associated with high-risk customers, transactions, and jurisdictions. This process involves more thorough investigation, verification, and ongoing monitoring, ensuring that potential financial crimes are effectively mitigated.
Application of EDD:
Politically Exposed Persons (PEPs): Individuals with significant public roles, their families, and close associates.
Customers from High-Risk Jurisdictions: Clients from regions with a high risk of corruption or financial crime.
Complex or Unusually Large Transactions: Transactions that are atypical or complex in nature.
High-Risk Transactions: Any transaction deemed high-risk due to its nature, size, or the involved parties.
EDD Procedures:
Additional Information Collection: Shipfinex collects extensive information on the customer and their Ultimate Beneficial Owners (UBOs), ensuring a thorough understanding of the client’s background.
Frequent and In-Depth Monitoring: High-risk clients and transactions are subject to more frequent and detailed monitoring to identify any suspicious activity.
Additional Risk Mitigation Controls: Specific controls are implemented based on the client’s and transaction’s risk profile, further mitigating potential financial crimes.
Verification of Source of Wealth and Funds: The client’s source of wealth and funds is rigorously verified through documentary evidence to confirm legitimacy.
Address Verification: The client’s address is verified using reliable documentation to ensure accuracy.
Internet Searches and Adverse Media Checks: Comprehensive internet searches and adverse media checks are conducted to validate the client’s activities and assess the business operations of the client and any controlling individuals.
Enhanced Identity Verification: High-risk individuals are required to provide additional identification documents, such as a passport and a national identity card, along with proof of address.
MLRO/CO Involvement: The Money Laundering Reporting Officer (MLRO) and Compliance Officer (CO) is directly involved in the EDD process, overseeing the onboarding of high-risk clients, approving high-risk transactions, and ensuring all EDD measures are implemented effectively. The MLRO ensures continuous monitoring and review, escalating any issues to senior management as necessary.
Ongoing Risk Assessment: Continuous re-evaluation of the client’s risk profile and transactions is conducted to identify and address any emerging risks promptly.
Shipfinex’s EDD process is designed to manage the elevated risks associated with high-risk clients, transactions, and jurisdictions. With direct involvement from the MLRO and CO, this process provides an additional layer of protection, ensuring robust compliance with AML/CFT regulations and safeguarding the integrity of Shipfinex’s operations.
AML/CFT Business Risk Assessment
Shipfinex's business model revolves around the trading of Marine Asset Tokens (MAT), which tokenizes ownership in maritime assets, providing a unique opportunity in the digital asset space. Due to the innovative nature of these transactions, Shipfinex has implemented a thorough AML/CFT Business Risk Assessment. This assessment is designed to identify, evaluate, and mitigate potential financial crime risks, ensuring all activities are compliant with stringent regulatory standards.
Assessment Overview:
Virtual Assets:
Risk Focus: The use of Virtual Assets, particularly Anonymity-Enhanced Cryptocurrencies, carries significant risks due to their potential misuse in illicit activities and the inherent difficulty in tracing such transactions.
Mitigation: Shipfinex has instituted a strict prohibition on the use of Anonymity-Enhanced Cryptocurrencies within its platform. This ensures that all transactions conducted through Shipfinex are transparent, traceable, and in compliance with regulatory requirements.
Virtual Asset Related Products/Services:
Risk Focus: Products and services that facilitate anonymity-enhanced transactions are at a higher risk of being exploited for money laundering or terrorist financing.
Mitigation: Shipfinex not only applies stringent controls, including enhanced Customer Due Diligence (CDD) for clients using these services, but also strictly monitors and prohibits any such products or services that cannot be adequately controlled. Each project listed on Shipfinex's platform undergoes detailed CDD and Enhanced Due Diligence (EDD) before being approved, ensuring robust risk management.
Business and Professional Practices:
Risk Focus: The complex ecosystem of stakeholders involved in Shipfinex’s operations, including shipowners, investors, and third-party service providers, poses risks related to AML/CFT compliance.
Mitigation: Shipfinex conducts continuous risk assessments and monitoring of all business partners. This is coupled with comprehensive KYC procedures, ensuring that all entities involved meet AML/CFT standards. Each MAT project is carefully vetted through detailed CDD/EDD processes before being listed on the platform.
Technology Associated with VA Activities:
Risk Focus: The evolving nature of virtual asset technologies, including VA Wallet addresses and transaction methods, introduces challenges in maintaining effective AML/CFT oversight.
Mitigation: Shipfinex utilises advanced distributed ledger analytics and other investigative tools to monitor and screen transactions. The performance and capabilities of these tools are reviewed regularly, at least annually or as needed when new technologies or privacy features are introduced. All reviews are documented, and the results are made available to the Virtual Assets Regulatory Authority (VARA) upon request, ensuring full transparency and compliance.
Shipfinex's AML/CFT Business Risk Assessment is meticulously tailored to address the specific risks inherent in its operations, particularly those related to the trading of Marine Asset Tokens (MAT). By prohibiting high-risk virtual assets, implementing rigorous controls, and ensuring that every project undergoes thorough due diligence before listing, Shipfinex ensures robust compliance with regulatory requirements. This comprehensive approach not only mitigates financial crime risks but also reinforces Shipfinex's commitment to maintaining the highest standards of integrity and trust in the virtual asset industry.
Customer Risk Assessment Methodology
Shipfinex’s Customer Risk Assessment (CRA) methodology is meticulously designed to identify, assess, and manage the risks associated with customers, particularly in the context of Anti-Money Laundering (AML) and Counter Financing of Terrorism (CFT) compliance. This methodology ensures that Shipfinex effectively mitigates potential risks by categorising customers based on their risk profiles and implementing tailored due diligence, enhanced due diligence, ongoing monitoring, and screening measures, particularly for virtual asset-related risks.
Risk Categorization:
Low-Risk Customers:
Definition: Customers who present minimal risk, typically based on factors such as stable geographic location, straightforward transaction history, and low-risk business nature.
Due Diligence: Standard Customer Due Diligence (CDD) is applied, involving basic identity verification and background checks.
Medium-Risk Customers:
Definition: Customers with a moderate risk level, often due to involvement in industries with a higher likelihood of money laundering or transactions that sometimes involve high-risk regions.
Due Diligence: Enhanced CDD is conducted, with additional scrutiny on the customer’s business activities, financial transactions, and sources of funds.
High-Risk Customers:
Definition: Customers who pose a significant risk, typically those operating in high-risk jurisdictions, dealing with Anonymity-Enhanced Cryptocurrencies, or having complex corporate structures.
Due Diligence: Enhanced Due Diligence (EDD) is required, which includes in-depth verification, frequent monitoring, and senior management approval. Continuous transaction monitoring and more frequent periodic reviews are mandatory for such customers.
Assessment Criteria:
Geographic Risk:
Assessment: The customer’s country of residence or operation is assessed, focusing on regions with high levels of corruption, financial crime, or sanctions.
Customer Type:
Assessment: The type of customer (individual, corporate, financial institution) is identified, with particular attention given to Politically Exposed Persons (PEPs) and their associates.
Nature of Business:
Assessment: The customer’s business activities are evaluated, especially if they operate in sectors prone to money laundering or terrorist financing, such as gambling, arms trading, or high-value goods dealing.
Transaction Patterns:
Assessment: The customer’s transaction patterns are analysed, including frequency, volume, and any unusual or complex transactions that might indicate potential money laundering or terrorist financing activities.
Source of Funds/Wealth:
Verification: The legitimacy of the customer’s source of funds and wealth is verified, particularly in high-risk cases where the source may be obscure or involve significant cash transactions.
Ongoing Monitoring and Review:
Continuous Monitoring:
Monitoring: All customers are subject to ongoing monitoring to detect and report suspicious activities. Real-time transaction screening is conducted using advanced analytics tools, particularly for virtual asset-related risks.
Periodic Review:
Review: Customer risk profiles are reviewed periodically to ensure that the risk categorization remains accurate. High-risk customers undergo more frequent reviews, quarterly, depending on the level of risk.
Trigger-Based Review:
Re-Assessment: A re-assessment of the customer’s risk profile is triggered by significant changes in their behaviour, such as a sudden increase in transaction volume, engagement in new types of transactions, or associations with new jurisdictions.
Decision-Making Process:
Risk Assessment Outcome:
Classification: Based on the assessment, customers are classified into low, medium, or high-risk categories, which dictate the level of due diligence and ongoing monitoring required.
Senior Management Involvement:
Approval: High-risk customers and any exceptions to standard procedures require approval from senior management, ensuring that all potential risks are thoroughly considered and managed.
Documentation and Record Keeping:
Records: Detailed records of all customer risk assessments, due diligence processes, and decision-making rationales are maintained securely. These records are readily available for regulatory audits and internal reviews.
Shipfinex’s Customer Risk Assessment methodology is a critical component of its overall AML/CFT framework. By systematically assessing and categorising customers based on their risk profile and implementing rigorous ongoing monitoring, Shipfinex ensures that appropriate measures are in place to mitigate potential financial crime risks. This proactive approach not only protects the company but also enhances its reputation as a responsible player in the virtual asset industry, particularly in managing the risks associated with virtual assets.
Screening Procedures
Shipfinex implements stringent screening procedures to identify and manage risks associated with Politically Exposed Persons (PEPs), sanctions, and adverse media. These procedures are integral to maintaining compliance with AML/CFT regulations and protecting the platform from financial crimes.
Screening for Politically Exposed Persons (PEPs)
Objective: To identify and mitigate risks associated with clients who are PEPs or closely associated with PEPs, due to their potential exposure to corruption and financial crimes.
Procedures:
Identification:
Shipfinex screens all clients and related parties against a comprehensive PEP list during onboarding and continuously throughout the business relationship.
Relationships identified as involving PEPs are subject to Enhanced Due Diligence (EDD).
Approval Process: Before establishing a business relationship with a PEP, approval from the Money Laundering Reporting Officer (MLRO) and senior management is required.
Monitoring: PEPs are subject to ongoing monitoring, with periodic reviews to detect any changes in their risk profile or involvement in suspicious activities.
Sanctions Screening
Objective: To prevent engagement with clients or transactions linked to sanctioned entities, individuals, or jurisdictions, ensuring compliance with international and domestic sanctions regimes, including those specifically relevant to the UAE and virtual assets.
Procedures:
Initial Screening:
Clients and related parties are screened against global sanctions lists, including those issued by:
United Nations (UN)
United Arab Emirates (UAE) Federal Sanctions List
United States (OFAC) Specially Designated Nationals List
United Kingdom (HM Treasury) Sanctions List
European Union (EU) Sanctions List
UAE Executive Office for Control & Non-Proliferation (EOCN) list
Other applicable lists specific to Virtual Assets as per VARA guidelines
Ongoing Screening:
Continuous monitoring is performed to detect any changes in the sanctions status of clients or related parties. Positive matches or alerts are escalated to the MLRO for further investigation.
Transaction Screening:
Transactions are screened to ensure they do not involve sanctioned entities, individuals, or jurisdictions. Any flagged transactions undergo further review and require MLRO approval before processing.
Adverse Media Screening
Objective: To identify and assess risks associated with negative media coverage of clients or related parties, which could indicate involvement in financial crimes or other illegal activities.
Initial Screening: During onboarding, Shipfinex conducts adverse media checks using reliable databases and news sources to identify any negative information associated with the client or their business operations.
Ongoing Monitoring: Regular adverse media screenings are conducted to detect any new or emerging risks. This includes monitoring traditional media and online platforms for relevant news.
Risk Assessment and Action: If adverse media is identified, the client’s risk profile is reassessed. Depending on the severity of the information, the case may be escalated to the MLRO, and additional due diligence measures may be implemented, or the business relationship may be terminated.
Shipfinex’s comprehensive screening procedures for PEPs, sanctions, and adverse media are essential for effective risk management and compliance with global AML/CFT regulations. These procedures ensure that high-risk clients and transactions are identified early, enabling Shipfinex to take appropriate measures to safeguard the platform's integrity and reputation.
Transaction Monitoring and Suspicious Transaction Reporting Procedures
Transaction monitoring is integral to Shipfinex’s AML/CFT strategy, aimed at detecting suspicious activities early and ensuring regulatory compliance.
Transaction Monitoring Procedures
Continuous Monitoring:
Objective: Monitor transactions and client activities in real-time to detect any unusual or suspicious behaviour.
Methods: Utilise advanced analytics tools tailored to Shipfinex’s specific Virtual Asset (VA) activities and client risk profiles.
No Tipping-Off: Ensure monitoring is discreet to prevent alerting clients to potential investigations.
Indicator Updates: Regularly update risk indicators based on emerging threats and changing client behaviours and to identify possible Suspicious Transactions.
Risk-Based Screening:
Focus: Shipfinex screens transactions for specific risks, including:
Large or complex transactions
Transactions involving high-risk jurisdictions
PEP-related transactions
Anonymity-enhanced cryptocurrencies
Rapid fund transfers across accounts or borders
Transactions not aligned with the client’s usual activity profile
FATF Recommendations: Shipfinex aligns its screening process with FATF guidelines, looking for red flags like structured transactions, use of intermediaries, and involvement with sanctioned entities.
Internal Thresholds:
Objective: Set specific internal thresholds for each risk category to trigger alerts during transaction monitoring.
Thresholds:
Thresholds for Low-Risk Transactions:
Single transaction amount: ≥ $10,000 USD equivalent in virtual assets
Daily cumulative transactions: ≥ $25,000 USD equivalent
Weekly cumulative transactions: ≥ $50,000 USD equivalent
Monthly cumulative transactions: ≥ $100,000 USD equivalent
Unusual transaction patterns: 3x deviation from typical transaction volume or frequency
Thresholds for Medium-Risk Transactions:
Single transaction amount: ≥ $5,000 USD equivalent in virtual assets
Daily cumulative transactions: ≥ $15,000 USD equivalent
Weekly cumulative transactions: ≥ $30,000 USD equivalent
Monthly cumulative transactions: ≥ $60,000 USD equivalent
Unusual transaction patterns: 2x deviation from typical transaction volume or frequency
Transactions involving medium-risk jurisdictions
Thresholds for High-Risk Transactions:
Single transaction amount: ≥ $1,000 USD equivalent in virtual assets
Daily cumulative transactions: ≥ $5,000 USD equivalent
Weekly cumulative transactions: ≥ $10,000 USD equivalent
Monthly cumulative transactions: ≥ $20,000 USD equivalent
Any unusual transaction patterns
Transactions involving high-risk jurisdictions or PEPs
Rapid transfers across multiple accounts or borders
Review and Adjustment: These thresholds should be regularly reviewed and adjusted based on evolving risk factors and regulatory changes.
Documentation and Approval:
Objective: Ensure that all transaction monitoring methods and indicators, including thresholds, are documented, approved by Senior Management, and periodically reviewed for effectiveness.
High-Risk Transactions:
Enhanced Monitoring: Apply Enhanced Due Diligence (EDD) measures and increased scrutiny to high-risk transactions to mitigate financial crime risks.
Suspicious Transaction Reporting (STR)
Shipfinex employs robust methods tailored to its specific Virtual Asset (VA) activities and business relationships to continuously monitor and identify any suspicious transactions. These methods are carefully designed to ensure that no “tipping-off” or similar offence occurs, maintaining the confidentiality and integrity of the investigation process. All identified suspicious transactions must be promptly reported to the Money Laundering Reporting Officer (MLRO), ensuring compliance with regulatory requirements. Furthermore, these methods are documented, approved by Senior Management, and regularly reviewed and updated to maintain their effectiveness.
Identification of Suspicious Transactions:
Criteria: Transactions are flagged as suspicious based on predefined indicators such as unusual transaction patterns, involvement with high-risk jurisdictions, or links to PEPs.
Immediate Reporting to MLRO:
Process: Any employee detecting a suspicious transaction must report it immediately to the Money Laundering Reporting Officer (MLRO).
MLRO Responsibilities:
Reporting: The MLRO reports suspicious transactions to the UAE Financial Intelligence Unit (FIU) and Virtual Assets Regulatory Authority (VARA) via the GoAML platform or any other means approved by the UAE FIU and/or VARA.
Timely Response and actions: The MLRO must respond promptly to any additional information requests from the UAE FIU and/or VARA, ensuring that these requests are addressed within forty-eight (48) hours. Additionally, the MLRO must undertake any further actions as required by the UAE FIU and/or VARA within the specified timeframes mentioned in such requests.
Coordination: If the MLRO is not the same individual as the Compliance Officer (CO), the MLRO must immediately report to the CO that a Suspicious Transaction Report (STR) has been made, provided that this does not constitute "tipping-off" or a similar offence under applicable laws or regulations.
Documentation and Compliance:
Record Keeping: Maintain thorough documentation of all STRs and related communications, ensuring records are secure and available for audits or inspections.
Regular Review: The MLRO must regularly review the effectiveness of the STR process to ensure compliance with AML/CFT regulations.
Shipfinex’s transaction monitoring and suspicious transaction reporting procedures provide a robust defence against financial crime. By screening for specific risks, aligning with FATF recommendations, and ensuring timely reporting, Shipfinex upholds high compliance standards and safeguards the integrity of its platform.
Technology and Information Oversight for AML/CFT
Given the sophisticated nature of the services provided by Shipfinex and the complexity of the assets transacted, the company leverages a range of advanced tools and technologies to ensure robust AML/CFT compliance. These tools are vital in identifying, mitigating, and preventing financial crimes within the rapidly evolving virtual assets landscape.
Onboarding and Transaction Monitoring: Shipfinex utilises a variety of tools, including distributed ledger analytics and other investigative capabilities, to monitor and screen transactions effectively. These tools are designed to detect potential financial crimes by analysing transactions and client behaviour. During ongoing monitoring, Shipfinex ensures alignment with the FATF Report Virtual Assets Red Flags Indicators of Money Laundering and Terrorist Financing (September 2020). The monitoring system is designed with specific scenarios and thresholds to closely monitor clients' interactions with their virtual asset (VA) activities.
Performance Review and Assurance: To maintain the highest standards of oversight, Shipfinex conducts at least annual reviews of the performance and capabilities of its technical solutions providers. These reviews are also performed on an ad hoc basis, particularly when new privacy features are introduced in the native blockchain of specific virtual assets. Additionally, Shipfinex seeks assurances from service providers to ensure that their surveillance capabilities remain comprehensive, especially concerning the virtual assets available on Shipfinex's platform.
Ongoing Monitoring and Documentation: Shipfinex diligently reviews and documents the performance and functionality of its distributed ledger analytics tools, which are critical for ongoing monitoring. These documented reviews not only support internal oversight but are also available for review by the Virtual Assets Regulatory Authority (VARA) upon request, ensuring full regulatory transparency.
Responsibilities: The IT and compliance teams are tasked with overseeing the effectiveness of these AML/CFT systems. They are also responsible for ensuring the protection of customer data and maintaining robust business continuity plans to safeguard against disruptions in AML/CFT operations.
This comprehensive approach to technology and information oversight underscores Shipfinex's commitment to maintaining a secure and compliant environment in the virtual asset sector, ensuring that all AML/CFT requirements are rigorously met.
Details regarding the third-party service providers utilised for all types of screenings, monitoring, and transaction monitoring are provided separately. These service providers are carefully vetted to ensure they meet stringent compliance standards and are effective in detecting and managing risks related to PEPs, sanctions, adverse media, and suspicious transactions.
Anonymity Enhanced Tokens
Shipfinex strictly prohibits the facilitation of anonymity-enhanced transactions. This includes any transactions involving technologies or tools designed to obscure the origin, destination, or ownership of Virtual Assets. Prohibited activities include
Transactions involving privacy coins, such as Monero or other similar Virtual Assets.
The use of mixers, tumblers, or similar mechanisms to anonymize transactions.
Shipfinex has implemented robust transaction monitoring systems capable of identifying and blocking any attempted anonymity-enhanced transactions. Any flagged activities will be reviewed by the compliance team and rejected. Staff and board members will be trained on identifying and escalating potential anonymity-enhanced activities, ensuring that all transactions align with regulatory and internal compliance requirements. Regular reviews and audits will be conducted to ensure adherence to these prohibitions, and any breaches will be addressed through appropriate corrective actions and reporting procedures.
FATF Travel Rule
Shipfinex acknowledges its commitment to ensuring compliance with the FATF Travel Rule by diligently collecting and transmitting the required information with wire transfers and other qualifying transactions. This demonstrates Shipfinex’s dedication to upholding international regulatory standards and preventing financial crimes.
The steps for compliance with the FATF Travel Rule include:
Information Collection and Verification:
Originator Information: Collect and verify the originator's name, account number or VA wallet address, and residential or business address for transfers exceeding AED 3,500.
Beneficiary Information: Collect and verify the beneficiary's name and account number or VA wallet address for transfers exceeding AED 3,500.
Use reliable and independent sources for verification.
Use of External Service Provider:
Engage a reputable external service provider to screen wallets and entities involved in virtual asset transfers.
Ensure the service provider has robust capabilities to identify high-risk wallets and entities, including those on global sanctions lists, PEP lists, and adverse media sources.
Risk-Based Due Diligence:
Conduct risk-based due diligence on counterparties and classify them based on their AML/CFT risk profiles.
Perform enhanced due diligence for high-risk counterparties and transactions.
Handling High-Risk Transactions:
Identify and flag high-risk transactions, including those involving unhosted VA wallets and anonymity-enhanced transactions.
Implement specific procedures for managing high-risk transactions, including additional verification steps and senior management approval.
Reporting and Record-Keeping:
Maintain detailed records of originator and beneficiary information for a minimum of five years.
Ensure timely and accurate reporting of information to VARA and other appropriate authorities upon request.
Shipfinex complies with the FATF Travel Rule by carefully considering the risks associated with deposits, withdrawals, transactions involving non-obliged entities, and anonymity-enhanced activities. While Shipfinex is dedicated to implementing the Travel Rule whenever feasible, it acknowledges that some jurisdictions may not mandate this rule (the “sunrise issue”). In such instances, Shipfinex endeavours to obtain the necessary information following best practices and regulatory guidelines. The detailed assessment, implementation plan, and information about the technical solution provider are outlined separately in the Travel Rule Implementation Plan.
Shipfinex will adhere to the FATF Travel Rule by ensuring that all applicable laws, regulations, and guidelines related to Virtual Asset transactions are implemented and followed. This includes monitoring for any transaction or series of transactions designed to circumvent regulatory thresholds intended to bypass the Travel Rule requirements.
To meet this obligation, Shipfinex will:
Maintain robust transaction monitoring systems to identify and flag any patterns or activities that suggest an attempt to structure transactions to avoid compliance with Travel Rule requirements.
Conduct enhanced reviews for transactions near regulatory thresholds and escalate any suspicious activities for further investigation.
Implement training programs for compliance staff to ensure they can recognize and respond to such behavior effectively.
Regularly update policies and procedures to align with evolving FATF recommendations and applicable local or international laws.
By establishing these controls, Shipfinex ensures its ability to prevent, detect, and mitigate any attempts to bypass Travel Rule requirements.
Reporting on Compliance with the Travel Rule
Shipfinex will maintain comprehensive records and mechanisms to report on its compliance with the Travel Rule and the effectiveness of its policies and controls as required by the relevant regulatory authorities. To facilitate compliance reporting:
Shipfinex will document all measures taken to implement the Travel Rule, including systems, processes, and controls used to monitor, detect, and report relevant information.
Internal audits will be conducted periodically to assess the effectiveness of Travel Rule compliance measures, with findings recorded and made available for regulatory review.
Detailed compliance reports will be generated upon request, covering key areas such as:
The volume of transactions subject to the Travel Rule.
The number of transactions flagged or rejected due to non-compliance.
Any updates to the policies and controls implemented to enhance compliance with the Travel Rule.
Shipfinex will ensure that all reporting requirements can be met promptly and will maintain open communication with regulatory authorities to address any compliance-related inquiries.
Reporting, Escalation, and Ongoing Monitoring To ensure robust compliance with AML/CFT policies, Shipfinex has implemented a comprehensive monitoring framework. This framework includes a compliance monitoring plan that details the scope, frequency, and methods of monitoring, utilising both automated systems and manual reviews. Regular internal audits assess the effectiveness of the AML/CFT program, with findings documented and action plans developed to address any deficiencies. Compliance activities and findings are reported to relevant regulatory authorities, with meticulous record-keeping.
For reporting and escalation, Shipfinex has established clear channels to manage AML/CFT-related issues. These methods may include:
Internal Reporting: Use designated email addresses [email : [email protected]] for reporting AML/CFT concerns.
Escalation: Serious issues should be escalated through defined channels, such as direct reporting to the MLRO, Compliance Officer, or senior management on these emails. [email : [email protected] and email [email protected] ].
External Reporting: Issues are escalated to external authorities, such as the UAE Financial Intelligence Unit (FIU) or the Virtual Assets Regulatory Authority (VARA), as required.
Issue Resolution:
Investigation and Resolution Process: Develop a clear process for investigating and resolving reported AML/CFT issues. This process should involve thorough investigation, documentation of findings, and resolution outcomes for each reported issue.
Documentation: Ensure that the resolution process and outcomes are fully documented and stored securely for future reference and audits.
Corrective Actions: Implement corrective actions to address the root cause of identified issues, preventing recurrence, and continuously improving the AML/CFT framework.
Record-Keeping and Disclosure Requirements Record-keeping is a vital component of Shipfinex’s AML/CFT compliance framework, ensuring that all necessary documents and data are securely maintained and readily accessible for regulatory inspection. This section outlines the procedures for record maintenance, retention, and documentation standards, which are crucial for demonstrating compliance with legal and regulatory obligations.
Record Maintenance:
Keep records of customer identification documents, transaction details, risk assessments, and SARs.
Ensure records are stored securely to prevent unauthorised access and ensure data integrity.
Transaction details, including date, time, value, and type of Virtual Asset involved.
Originator and beneficiary information gathered through KYC/AML processes.
Supporting documentation, including customer communications and compliance monitoring logs.
Internal reviews, approvals, and escalations related to transaction monitoring
Retention Period:
Retain records for a minimum of eight (8) years from the date of the transaction or the end of the business relationship, whichever is longer.
Ensure records are readily accessible for inspection by regulatory authorities.
Documentation Standards:
Maintain clear and organised records to facilitate easy retrieval and review.
Use standardised forms and templates for record-keeping to ensure consistency.
For detailed information on record-keeping practices, refer to the Record Management and Retention Policy.
Shipfinex is committed to ensuring transparency and compliance with regulatory disclosure requirements regarding its AML/CFT policies and procedures. This includes informing clients about the AML/CFT measures in place and their role in compliance, as well as how their data will be used and protected. The AML/CFT policy is published on Shipfinex’s website for public access and is regularly updated to reflect regulatory changes and best practices. Additionally, Shipfinex ensures timely and accurate reporting of AML/CFT activities to VARA, maintaining a record of all disclosures made to the authority.
Shipfinex will ensure that any changes are communicated to the relevant authorities promptly. Shipfinex will ensure the complete set of AML-CFT policies and procedures, including measures for identifying and mitigating risks, transaction monitoring processes, and reporting mechanisms are detailed and provided. Furthermore, any subsequent updates to these policies, which will be reviewed, approved, and submitted no later than twenty-one (21) calendar days after the changes are implemented.
Shipfinex will maintain a centralized record of all submitted policies and procedures, including approval documentation and submission confirmations. The Compliance Officer will oversee this process to ensure accuracy and timely submissions.
Training Requirements Shipfinex is committed to ensuring that all personnel, from new hires to senior management, are thoroughly trained to recognize and combat financial crimes. The organisation’s comprehensive AML/CFT training program equips employees with the knowledge and skills necessary to maintain compliance and protect against money laundering, terrorist financing, and other financial crimes.
Training Program: Training is mandatory for all employees, including Directors, and must be completed within 30 calendar days of joining Shipfinex, followed by annual refreshers. The training program, designed and updated by the MLRO, is tailored to Shipfinex’s operations, addressing the specific risks associated with the company's services and clients.
Enhanced Training Content: The training program covers a wide range of topics essential for effective financial crime prevention:
Applicable Laws and Regulations: Detailed instruction on UAE laws, VARA Rules, and directives related to financial crime.
Understanding Financial Crimes: Comprehensive coverage of various types of financial crimes, including money laundering, terrorist financing, and anti-bribery and corruption practices.
Identification and Reporting: In-depth guidance on recognizing suspicious activities, understanding the types of transactions that may raise red flags, and knowing the proper procedures for reporting these to the MLRO.
Avoiding Tipping-Off: Training on how to handle sensitive information to ensure that potential suspects are not alerted during investigations.
Prevailing Techniques and Trends: Regular updates on the latest trends and methods in financial crime to ensure that all staff are aware of emerging risks.
Roles and Responsibilities: Clear definition of the roles and responsibilities of all employees, including the MLRO and Deputy MLRO, in combating financial crime.
System Controls and Compliance: Training on Shipfinex’s internal systems, control measures, and any recent changes, ensuring that all employees are equipped to use these tools effectively.
Client Due Diligence: Detailed procedures for client identification, ongoing due diligence, and transaction scrutiny to ensure compliance with AML/CFT standards.
Ongoing and Role-Specific Training: Training sessions are conducted regularly to keep employees up-to-date with changes in regulations, industry best practices, and the organisation’s internal procedures. Role-specific training ensures that employees in high-risk positions receive more intensive and targeted education, enabling them to manage and mitigate the specific risks they encounter.
Training Records: All training sessions are meticulously documented, including attendance and assessment results. These records are reviewed annually to ensure the training program remains effective, relevant, and aligned with the organisation’s evolving AML/CFT strategies.
By implementing this comprehensive and dynamic training program, Shipfinex ensures that all personnel are well-prepared to prevent financial crime and maintain the highest standards of regulatory compliance.
Periodic Reviews and Audits To maintain the integrity and effectiveness of Shipfinex's AML/CFT program, regular reviews and audits are essential. These processes ensure that the program remains current, aligns with regulatory changes, and addresses emerging risks effectively.
Annual Reviews:
The MLRO conducts an annual review of the AML/CFT policy to ensure it reflects the latest regulations, emerging risks, and industry best practices.
Necessary updates are made to maintain the policy’s relevance and effectiveness.
Ongoing Reviews:
Continuous reviews are conducted to align the AML/CFT program with any changes in regulations, international standards, and emerging financial crime threats.
The program is updated regularly to ensure compliance with evolving requirements.
Internal Audits:
Regular internal audits are performed to assess the AML/CFT program's overall effectiveness, focusing on transaction monitoring, customer due diligence, and reporting procedures.
External Audits:
Independent external auditors are engaged to provide an unbiased assessment of the AML/CFT program, identifying areas for improvement.
Findings from these audits are used to make necessary enhancements to the program.
Continuous Improvement:
An action plan is developed to address any deficiencies identified during reviews and audits.
Corrective actions are promptly implemented, and their effectiveness is closely monitored to ensure continuous improvement of the AML/CFT framework.
This structured approach ensures that Shipfinex's AML/CFT program remains robust, compliant, and responsive to the evolving financial crime landscape.
Appendix 1: Templates and Forms
Customer Due Diligence (CDD) Form
Enhanced Due Diligence (EDD) Form
Suspicious Transaction Report (STR) Form
Transaction Monitoring Alert Review Form
Appendix 2: Examples of Potential Scenarios
Scenario 1: Suspicious Transaction Detected
Steps for Resolution:
Transaction flagged by the monitoring system due to unusual activity.
Compliance team reviews the transaction and conducts an initial investigation.
If suspicion is confirmed, the MLRO is notified, and a detailed investigation is conducted.
MLRO decides whether to file a Suspicious Transaction Report (STR) with the relevant authorities.
STR is filed, and the transaction is documented in the compliance records.
Continuous monitoring of the customer’s account for further suspicious activity.
Scenario 2: Customer Identified as PEP
Steps for Resolution:
Customer screened and identified as a Politically Exposed Person (PEP).
Enhanced Due Diligence (EDD) is conducted, including verification of source of funds and wealth.
Senior management approval obtained before establishing or continuing the business relationship.
Implement additional monitoring measures for the customer’s transactions.
Document all findings and decisions related to the PEP.
Scenario 3: Breach of AML/CFT Policy
Steps for Resolution:
Employee reports a potential breach of the AML/CFT policy.
MLRO conducts an investigation to determine the nature and extent of the breach.
Findings are documented, and a report is prepared for senior management and the board.
Corrective actions are implemented to address the breach and prevent recurrence.
Training sessions are conducted to reinforce AML/CFT procedures and raise awareness among staff.
Monitor the effectiveness of the corrective actions and make adjustments as necessary.
Scenario 4: High-Risk Jurisdiction Transaction
Steps for Resolution:
Transactions involving a customer from a high-risk jurisdiction are flagged by the monitoring system.
Conduct Enhanced Due Diligence (EDD) to verify the legitimacy of the transaction.
Obtain additional information on the source of funds and the purpose of the transaction.
Senior management approval is required before processing the transaction.
Document all steps taken during the investigation and the rationale for the decision.
Continue to monitor transactions involving high-risk jurisdictions closely.
Scenario 5: Data Breach Affecting AML/CFT Records
Steps for Resolution:
Immediately report the data breach to the MLRO and IT department.
Conduct an investigation to determine the extent of the breach and affected records.
Notify regulatory authorities and affected customers if required by law.
Implement measures to contain the breach and prevent further unauthorised access.
Review and strengthen data security protocols to mitigate future risks.
Document the incident and actions taken to resolve it.
Scenario 6: Unusual Customer Behaviour
Steps for Resolution:
Front-line staff notice unusual behaviour or transactions from a customer.
Report the observations to the MLRO for further investigation.
The MLRO conducts a review of the customer’s account and transaction history.
Determine if the behaviour is consistent with money laundering or terrorist financing indicators.
If suspicious, file a Suspicious Transaction Report (STR) with the relevant authorities.
Continue to monitor the customer’s activities and document all findings.
Scenario 7: Incomplete Customer Information
Steps for Resolution:
During the customer onboarding process, incomplete or inconsistent information is identified.
Contact the customer to request the missing information or clarification.
Verify the additional information provided using reliable, independent sources.
If the customer fails to provide the required information, consider the risk and decide on the relationship.
Document the steps taken to obtain the information and the final decision.
Ensure ongoing monitoring to detect any further issues with customer information.