AML & KYC Policy

01Purpose

File.Business provides financial services that fall within the scope of US anti-money-laundering (AML) and counter-terrorism financing (CFT) regulation, including the Bank Secrecy Act (BSA), the USA PATRIOT Act, and regulations administered by FinCEN, OFAC, and applicable state regulators. This Policy describes our AML and Know Your Customer (KYC) program, which is designed to prevent the use of our Services for money laundering, terrorist financing, sanctions evasion, fraud, or other financial crimes.

02AML Compliance Officer

File.Business appoints a Chief Compliance Officer (CCO) responsible for the design, implementation, and ongoing maintenance of the AML program. The CCO reports directly to the Board of Directors and may be contacted at [email protected].

03Customer due diligence & KYC

Before activating financial services (banking, lending, payments above thresholds), we collect and verify:

• Full legal name of the entity
• Date of formation and jurisdiction
• EIN or equivalent tax identifier
• Principal business address (physical, not a PO Box)
• Beneficial owners with 25% or greater ownership
• Controlling individuals (CEO, CFO, COO, GC, similar)
• Government-issued ID and date of birth for each beneficial owner and controller
• Nature and purpose of the business relationship
• Anticipated transaction volume and types

We verify identity through a combination of document verification, knowledge-based authentication, and cross-reference against third-party data sources. Enhanced Due Diligence (EDD) applies to higher-risk customers, including those operating in elevated-risk industries (money services, gaming, marijuana-related businesses) or with significant cash activity.

04Sanctions screening

We screen customers and counterparties against:

• US OFAC Specially Designated Nationals (SDN) List
• OFAC Sectoral Sanctions Identification (SSI) and Foreign Sanctions Evaders (FSE) Lists
• EU Consolidated Sanctions List
• UK HM Treasury Consolidated List
• UN Security Council Consolidated List
• Politically Exposed Persons (PEP) databases

Screening is performed at onboarding, when material changes occur, and continuously through automated re-screening.

05Transaction monitoring & SAR filing

We monitor transactions for indicators of suspicious activity, including unusual size, frequency, structuring, geography, or pattern. When we identify suspicious activity that meets the regulatory threshold, we file a Suspicious Activity Report (SAR) with FinCEN within the required time frame (30 days, extendable to 60 days where additional time is needed to identify a subject).

SAR filings and the existence of SARs are strictly confidential under federal law. We do not notify the affected customer.

06Recordkeeping

We retain AML records (KYC documentation, screening results, transaction monitoring outputs, SAR records) for a minimum of 5 years from account closure or transaction date, in accordance with 31 CFR § 1020.430.

07Employee training

All employees receive AML training at onboarding and annually thereafter. Employees in higher-risk functions (compliance, operations, customer service) receive additional, role-specific training. Training covers identification of suspicious activity, sanctions, OFAC, internal escalation procedures, and the consequences of non-compliance.

08Independent audit

The AML program is independently audited at least annually by a qualified third party. The most recent audit reports are available to regulators and to enterprise customers under NDA.

09Customer obligations

Customers represent and warrant that:

• The business is not engaged in any activity that violates US, EU, UK, or UN sanctions
• The funds used through the Services are derived from lawful sources
• Information provided during onboarding is accurate and complete
• The Customer will update us within 30 days of any material change to ownership, control, or business activities
• The Customer will cooperate with reasonable requests for additional information

We may suspend or terminate accounts that fail to satisfy AML/KYC requirements.