KYC & AML Policy

1.  Regulatory framework and scope2.  Definitions and key terms3.  Risk-based approach4.  Customer Due Diligence (CDD)5.  Enhanced Due Diligence (EDD)6.  Simplified Due Diligence (SDD)7.  Politically Exposed Persons (PEPs)8.  Sanctions screening9.  Payment screening — Cards and bank transfers10. Transaction monitoring11. Suspicious Activity Reports (SARs)12. Record keeping13. Staff training and awareness14. Governance and oversight15. Tipping-off prohibition16. Changes to this policy17. Contact us

1. Regulatory framework and scope

Gradio Safety LTD is a company registered in England and Wales (Company No. 17456330). As a provider of IT consulting, software publishing, data processing, and hosting services that accepts payments from clients, we are subject to the following legal and regulatory framework:

• Proceeds of Crime Act 2002 (POCA): The primary UK legislation defining money laundering offences and establishing the suspicious activity reporting regime.
• Terrorism Act 2000 (TACT): Creates offences related to terrorist financing and requires reporting of suspected terrorist financing.
• Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017): The UK's implementation of the EU's 4th and 5th Anti-Money Laundering Directives. Sets out CDD, record-keeping, and reporting requirements.
• Sanctions and Anti-Money Laundering Act 2018 (SAMLA): Provides the legal framework for UK sanctions implementation post-Brexit.
• The Money Laundering and Terrorist Financing (Amendment) Regulations 2019: Extends MLR 2017 to include enhanced requirements for cryptoasset businesses and art market participants.
• JMLSG Guidance: Joint Money Laundering Steering Group guidance, which provides sector-specific AML guidance that we follow as best practice.
• OFAC (US Treasury Office of Foreign Assets Control): US sanctions list screened for all international transactions.
• UN Consolidated Sanctions List and EU Restrictive Measures: Screened for all clients and transactions regardless of jurisdiction.
• UK HM Treasury (HMT) Consolidated List of Financial Sanctions Targets: The primary UK sanctions list we screen against.

This policy applies to all directors, employees, contractors, and business partners of Gradio Safety LTD who are involved in client onboarding, payment processing, transaction monitoring, or record-keeping. It covers all services we provide and all payment channels we accept, including card payments and international transfers.

2. Definitions and key terms

3. Risk-based approach

We adopt a risk-based approach to AML compliance, as required by Regulation 18 of MLR 2017. This means we allocate resources and apply controls proportional to the level of risk identified. Our risk assessment considers the following factors:

Each new client is assigned a risk rating (low, medium, or high) during onboarding. The rating determines the level of due diligence applied (CDD, EDD, or SDD) and the frequency of ongoing monitoring. Risk ratings are reviewed at least annually or when a significant change occurs.

4. Customer Due Diligence (CDD)

We conduct CDD on all new clients before establishing a business relationship or processing any payment, in accordance with Regulations 28–31 of MLR 2017. CDD consists of four steps:

4.1 Identity verification — individual clients

For individual clients (sole traders, freelancers, personal clients), we collect and verify:

• Full legal name
• Date of birth
• Residential address
• Government-issued photo ID (passport, national ID card, or driving licence)
• Proof of address (utility bill, bank statement, or council tax bill dated within the last 3 months)

Identity is verified through a combination of document review and electronic verification. For card payments, automated fraud prevention and identity verification systems provide an additional layer of verification through cardholder name matching, AVS (Address Verification System), and 3D Secure authentication.

4.2 Identity verification — corporate clients

For corporate clients (companies, partnerships, trusts), we collect and verify:

• Full registered company name and registration number
• Registered office address
• Country of incorporation and date of incorporation
• Company structure and ownership chart (for entities with complex structures)
• Identification of all directors and authorised signatories
• Identification of Ultimate Beneficial Owners (UBOs) with 25% or more ownership or control
• Memorandum and Articles of Association (or equivalent constitutional documents)
• Certificate of Incorporation (or equivalent registration certificate)

For UK companies, we verify registration details through Companies House. For non-UK companies, we verify through the equivalent national registry or through a reputable commercial database.

4.3 Purpose and nature of the relationship

We document the purpose of the business relationship, the services requested, the expected transaction volume and value, and the source of funds. This information is recorded in the client file and reviewed as part of ongoing monitoring.

4.4 Ongoing CDD

CDD is not a one-time event. We refresh client identity information and risk assessments at the following intervals:

5. Enhanced Due Diligence (EDD)

EDD is applied when a client or transaction is identified as high risk, in accordance with Regulation 33 of MLR 2017. EDD includes all standard CDD measures plus the following additional steps:

• Senior management approval: The MLRO or a director must approve the establishment or continuation of the business relationship.
• Source of funds and source of wealth verification: We obtain and verify documentation showing the origin of the client's funds and the source of their overall wealth. This may include bank statements, tax returns, audited accounts, or sale contracts.
• Enhanced ongoing monitoring: Transactions are reviewed more frequently, and any deviation from the expected pattern triggers an investigation.
• Additional identity verification: We may require additional forms of identification or use enhanced electronic verification services.
• Adverse media screening: We conduct searches for negative news or adverse media coverage related to the client, their directors, or UBOs.

EDD is mandatory in the following situations:

• The client or transaction is connected to a high-risk third country as identified by FATF or the European Commission
• The client is a Politically Exposed Person (PEP) or a close associate/family member of a PEP
• The transaction is complex, unusually large, or has no apparent economic or legal purpose
• The payment method is cryptocurrency, cash, or a third-party payment
• The client is based in or operating from a sanctioned or high-risk jurisdiction

6. Simplified Due Diligence (SDD)

In limited circumstances, we may apply SDD in accordance with Regulation 37 of MLR 2017. SDD reduces the level of identity verification required, but does not eliminate it entirely. SDD may be applied when:

• The client is a UK or EU listed company subject to disclosure obligations
• The client is a public authority or state-owned entity in the UK or EEA
• The transaction is a one-off payment under €150 (e.g., a single consultation)
• The client is a financial institution subject to AML obligations in the UK, EEA, or a FATF-aligned jurisdiction

Even when SDD is applied, we still monitor transactions for suspicious patterns and retain the right to escalate to CDD or EDD at any time.

7. Politically Exposed Persons (PEPs)

A PEP is an individual who is or has been entrusted with a prominent public function, as defined by MLR 2017 and the JMLSG Guidance. PEP status applies for at least 12 months after the individual ceases to hold the public function. The following categories are considered PEPs:

• Heads of state, heads of government, ministers, and deputy or assistant ministers
• Members of parliament or similar legislative bodies
• Members of the governing bodies of political parties
• Judges of supreme courts, constitutional courts, or other high-level judicial bodies
• Ambassadors, chargés d'affaires, and high-ranking officers in the armed forces
• Members of the management bodies of international organisations (UN, World Bank, IMF, etc.)
• Family members: spouses, partners, children, and parents of PEPs
• Close associates: individuals known to have joint beneficial ownership or close business relationships with PEPs

When a client, director, or UBO is identified as a PEP, we apply EDD and obtain senior management approval before establishing or continuing the business relationship. We also conduct enhanced ongoing monitoring and document the source of wealth and source of funds for all transactions.

PEP screening is conducted using commercial PEP databases and supplemented by manual research. Screening is repeated at each CDD refresh and when adverse media alerts are triggered.

8. Sanctions screening

We screen all clients, UBOs, directors, and payment recipients against the following sanctions lists before establishing a business relationship and before processing any payment:

Sanctions screening is conducted at onboarding and repeated at each CDD refresh. Real-time screening is performed on all payments processed through our payment channels (see Section 9). We also conduct ad-hoc screening when sanctions lists are updated or when geopolitical events trigger new designations.

9. Payment screening — Cards and bank transfers

We accept payments through regulated payment gateways and banking institutions, each with their own AML and sanctions screening capabilities. We leverage these capabilities as part of our layered AML controls, but we do not rely on them exclusively. Our own KYC and screening procedures are conducted independently.

9.1 Card payments screening

Card payments are processed through PCI-DSS Level 1 compliant gateway infrastructure. The following screening is conducted as part of payment processing:

• Sanctions List screening: Card gateways screen cardholders against OFAC, EU, and UK sanctions lists in real time. If a match is found, the payment is blocked immediately.
• Automated fraud detection: Machine learning risk algorithms assess the fraud risk of each transaction based on card metadata, IP address, device fingerprint, and behavioural patterns. High-risk transactions are blocked or require 3D Secure authentication.
• Address Verification System (AVS) and CVV checks: Verification that the billing address and CVV provided match the card issuer's records.
• 3D Secure (3DS): Strong Customer Authentication (SCA) under PSD2 regulations is strictly enforced.
• Card network screening: Visa, Mastercard, and Amex conduct continuous sanctions and fraud screening at the network level.

When a payment is flagged as high-risk or potentially fraudulent, we receive an alert and investigate. We may request additional documentation from the client, delay service delivery until clearance, or refund and decline the engagement.

9.2 Bank transfers screening

Bank transfers are processed through regulated banking and electronic money institutions in the UK and Europe. The following screening applies:

• Sanctions screening: Incoming transfers are screened against UN, EU, UK HMT, and OFAC sanctions lists in real time.
• PEP screening: Originating account holders are screened against PEP databases under statutory banking obligations.
• Transaction monitoring: Transfers are monitored for unusual structuring, high velocity, or anomalous routing.
• Beneficiary verification: Confirmation of payee and matching account details.
• Country risk assessment: Automatic restriction of payments originating from high-risk or FATF-blacklisted jurisdictions.

When a transfer is flagged, funds may be held pending verification. We do not commence services until payments have fully cleared.

9.3 Our additional payment controls

In addition to gateway-level screening, we apply the following internal controls:

• Name matching: We verify that the payer name on the payment confirmation matches the client name in our records. Mismatches trigger an investigation.
• Threshold alerts: Payments over €1,000 are reviewed manually. Payments over €5,000 require MLRO approval before services are delivered.
• Structuring detection: We monitor for multiple payments from the same client that appear designed to stay below reporting thresholds.
• Third-party payment prohibition: We do not accept payments from third parties (someone other than the contracting client). Unverified third-party payments are refunded.
• Cash prohibition: We do not accept cash payments under any circumstances. All payments must be processed through verified card or banking channels.
• Cryptocurrency prohibition: We do not accept cryptocurrency payments at this time.

10. Transaction monitoring

We monitor all client transactions on an ongoing basis, as required by Regulation 28(11) of MLR 2017. Monitoring is risk-based — the frequency and depth of monitoring depends on the client's risk rating:

10.1 Red flags

The following are examples of red flags that trigger further investigation:

• Payments from a different country than the client's registered address
• Multiple payments from different cards or accounts for the same service
• Payments that are significantly larger or smaller than the agreed scope
• Requests for refunds to a different account than the original payment
• Reluctance to provide identity documents or beneficial ownership information
• Requests for services that have no apparent business purpose
• Sudden changes in payment patterns or transaction volume
• Payments from or to jurisdictions with no connection to the client's business
• Use of multiple entities or shell companies to make payments
• Pressure to complete transactions quickly without normal due diligence

11. Suspicious Activity Reports (SARs)

Where we know or suspect that a client or transaction is involved in money laundering, terrorist financing, or other financial crime, we file a Suspicious Activity Report (SAR) with the National Crime Agency (NCA), as required by Part 7 of POCA and Part 3 of TACT.

11.1 Internal reporting process

• Any staff member who suspects money laundering or terrorist financing must report it immediately to the MLRO using the internal reporting form.
• The MLRO reviews the report, conducts additional investigation if necessary, and decides whether to file a SAR with the NCA.
• If the MLRO decides to file a SAR, it is submitted through the NCA's SAR Online portal.
• If the MLRO decides not to file a SAR, the reasoning is documented and retained in the client file.
• The MLRO may also request a Defence Against Money Laundering (DAML) from the NCA if we need to proceed with a specific transaction.

11.2 NCA contact details

• SAR Online portal: https://www.nationalcrimeagency.gov.uk
• UK Financial Intelligence Unit (UKFIU) helpline: 020 7238 8282 (for urgent DAML requests)

12. Record keeping

We maintain records of all KYC and AML activities in accordance with Regulation 40 of MLR 2017. Records are stored securely with access restricted to authorised personnel only.

13. Staff training and awareness

All staff and contractors receive AML training appropriate to their role, in accordance with Regulation 24 of MLR 2017. Training is conducted as follows:

• Induction training: All new staff receive AML training within 30 days of joining. This covers POCA, TACT, MLR 2017, CDD/EDD procedures, red flags, SARs, and the tipping-off prohibition.
• Annual refresher training: All staff complete annual AML refresher training, updated to reflect changes in legislation, regulatory guidance, and emerging typologies.
• Role-specific training: Staff involved in client onboarding, payment processing, or transaction monitoring receive additional training on sanctions screening, PEP identification, and risk assessment.
• MLRO training: The MLRO receives specialised training on SAR filing, NCA procedures, and DAML requests, updated annually.
• Ad-hoc briefings: When significant regulatory changes occur or new sanctions are imposed, the MLRO issues a briefing to all relevant staff.

Training completion is recorded and retained for 5 years. Failure to complete training may result in disciplinary action.

14. Governance and oversight

The MLRO conducts an annual AML risk assessment of the business and reports the findings to the Board. The report includes: the number of clients onboarded, risk ratings assigned, SARs filed, sanctions screening results, training completion rates, and any policy or procedure updates needed.

15. Tipping-off prohibition

Under Section 333A of POCA and Section 19A of TACT, it is a criminal offence to disclose to a client or any third party that a SAR has been or is about to be filed with the NCA, or that an investigation is being conducted. This is known as "tipping-off".

16. Changes to this policy

We review this KYC and AML Policy at least annually and update it when there are changes to applicable laws, regulations, or our business model. Material changes are approved by the Board and communicated to all staff. The latest version is always published on this page with the effective date.

17. Contact us

For questions about this KYC and AML Policy, or to report a suspicion, contact:

• MLRO: info@gradiosafetyltd.com (subject line: "MLRO — Confidential")
• General enquiries: info@gradiosafetyltd.com
• Company: Gradio Safety LTD, Company No. 17456330, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

v2.0  2026-08-28  Full rewrite — added MLR 2017, POCA, TACT, JMLSG, CDD/EDD/SDD, PEP screening, sanctions table, payment screening, SARs, governance, tipping-offv1.0  2026-08-27  Initial KYC & AML Policy