UEX.US Inc. Anti-Money Laundering (AML) and Know Your Customer (KYC) Policy

1. Introduction

UEX.US Inc. (“UEX” or “the Company”) is a financial services company headquartered in Sheridan, Wyoming, USA. The Company is registered as a Money Services Business (MSB) with the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN). UEX currently operates as an MSB, facilitating fiat currency transactions for its customers through third-party licensed banking and payment service providers rather than holding fiat funds in direct custody. This Anti-Money Laundering (AML) and Know Your Customer (KYC) Policy (the “Policy”) is a formal document that outlines UEX’s comprehensive compliance program designed to prevent the Company’s services from being used for money laundering, terrorist financing, or other illicit activities. UEX is committed to maintaining the highest standards of compliance with all applicable laws and regulations, including the Bank Secrecy Act (BSA), USA PATRIOT Act, FinCEN regulations, and the recommendations of the Financial Action Task Force (FATF).As UEX plans to expand its services, the Company intends to obtain state Money Transmitter Licenses (MTLs) in applicable jurisdictions. This Policy is written to not only meet current federal MSB requirements but also to align with the more stringent expectations of state regulators and financial partners, thereby laying a strong foundation for future licensed money transmission activities. The Policy is drafted in a clear, formal, and professional manner suitable for presentation to regulators, banking institutions, and compliance partners.

2. Purpose and Scope

Purpose: The purpose of this Policy is to ensure that UEX has an effective AML/CFT (Countering the Financing of Terrorism) program and robust KYC procedures in place that fully comply with U.S. legal requirements and international best practices. An effective AML program is one that is reasonably designed to prevent UEX from being used to facilitate money laundering or terrorist financing​.

This Policy sets forth the standards, procedures, and controls that UEX follows to detect and report suspicious activities, verify customer identities, and manage associated risks. Scope: This Policy applies to all aspects of UEX.US Inc.’s operations and to all officers, directors, employees, and affiliates of the Company. It covers all products and services offered by UEX, all customer types (individual and business), and all jurisdictions in which the Company operates. The Policy also extends to any third-party service providers or partners (such as the external financial institutions handling fiat funds on UEX’s behalf) to the extent they perform functions for or with UEX that impact compliance. UEX requires that such partners maintain AML programs consistent with this Policy and applicable law. All employees and relevant contractors must adhere to the procedures and controls outlined herein. Failure to comply with this Policy may result in disciplinary action and potential legal consequences.

3. Regulatory Framework

UEX’s AML/KYC program is designed to comply with all applicable U.S. laws and regulations, as well as to align with global standards. Key components of the regulatory framework influencing this Policy include:

• Bank Secrecy Act (BSA) of 1970 and Amendments: The BSA and its implementing regulations (31 C.F.R. Chapter X) form the cornerstone of U.S. AML requirements. As an MSB, UEX must implement a written AML program and maintain certain records and reports under the BSA. Federal regulation 31 C.F.R. §1022.210 specifically requires MSBs to develop and maintain an effective AML compliance program commensurate with the Company’s risk profile​.
• The BSA, as amended by subsequent laws (including the USA PATRIOT Act), mandates reporting of large cash transactions and suspicious activities, as well as recordkeeping to create financial transparency.
• USA PATRIOT Act of 2001: The PATRIOT Act expanded and reinforced AML laws in the U.S. Section 326 of the PATRIOT Act, for example, introduced customer identification requirements (CIP) for financial institutions. While CIP rules formally apply to banks and certain other institutions, UEX voluntarily adheres to these customer identification standards as a matter of best practice. The PATRIOT Act also requires financial institutions to implement procedures to check government watchlists, such as the Office of Foreign Assets Control (OFAC) sanctions list​.
• UEX complies with PATRIOT Act provisions by conducting thorough identity verification, information sharing with regulators/law enforcement under Sections 314(a) and (b) when applicable, and enhancing due diligence for certain accounts and transactions (e.g., foreign correspondent accounts, although UEX may not directly offer these, the principles are observed).
• FinCEN Regulations and Guidance: As a FinCEN-registered MSB, UEX follows all FinCEN rules and guidance relevant to money transmitters and MSBs. This includes the requirement to file Currency Transaction Reports (CTRs) for cash transactions over $10,000​
• and Suspicious Activity Reports (SARs) for any suspicious transactions meeting or exceeding regulatory thresholds​.
• FinCEN guidance also requires MSBs to incorporate the “four pillars” (or “five pillars,” including Customer Due Diligence) of AML compliance: (1) a designated compliance officer, (2) written internal policies and controls, (3) ongoing AML training for staff, (4) independent review of the program​, and (5) procedures for customer due diligence including understanding the nature and purpose of customer relationships (as per FinCEN’s CDD Final Rule​). This Policy addresses each of these pillars in detail.
• Financial Action Task Force (FATF) Recommendations: FATF is an inter-governmental body that sets international standards for AML/CFT. UEX strives to align its program with FATF’s 40 Recommendations. In particular, FATF emphasizes a Risk-Based Approach (RBA) to AML, meaning resources and scrutiny should be commensurate with the level of risk​
• FATF Recommendation 10 (Customer Due Diligence) and Recommendation 12 (which deals with Politically Exposed Persons) are reflected in our policies on CDD, EDD, and PEP handling. FATF guidance requires additional measures for PEPs and other high-risk situations​, which UEX has incorporated. Although FATF standards do not have the force of law, they inform UEX’s practices, especially as we anticipate future operations in multiple jurisdictions. State Regulations and Licensing (Future MTLs): Currently, UEX leverages its relationship with third-party licensed money transmitters and banking partners to facilitate fiat transactions. These partners hold the necessary state licenses to transmit money and hold customer funds, while UEX provides the platform and customer interface. UEX acknowledges that each U.S. state may have its own Money Transmitter License requirements and oversight (for example, state regulators often expect AML policies, surety bonds, net worth requirements, etc.​). As part of UEX’s future expansion strategy, the Company will apply for its own MTLs in relevant states. This Policy is forward-looking and intended to meet those state-level AML obligations from the outset. The Policy will be reviewed and updated as needed to ensure compliance with any specific conditions of state licenses once obtained. In the interim, UEX ensures that its activities under partner licenses adhere to both federal and relevant state AML standards, and we perform due diligence on our partners’ compliance programs to confirm they meet or exceed the requirements in this Policy.

By adhering to this robust regulatory framework, UEX demonstrates its commitment to preventing financial crime and protecting the integrity of the financial system. This Policy will be made available to all relevant stakeholders and will serve as a key document during regulatory examinations, banking partner due diligence reviews, and audits.

4. Risk-Based Approach to AML Compliance

UEX.US Inc. employs a Risk-Based Approach (RBA) to AML compliance, as recommended by both FinCEN and FATF. A risk-based approach means that the Company identifies and assesses the specific money laundering and terrorist financing risks it faces, and then designs its AML program to ensure that higher-risk customers or activities receive enhanced scrutiny and controls, while lower-risk relationships are managed with appropriate but proportionate measures​.

This approach allows UEX to allocate compliance resources efficiently and effectively, focusing on areas that pose the greatest threat.Key elements of UEX’s risk-based approach include:

• Risk Assessment: UEX conducts an enterprise-wide AML risk assessment at least annually (and more frequently if needed) to evaluate the inherent risks in its customer base, products/services, delivery channels, and geographic areas of operation. This assessment considers factors such as the types of customers (e.g., individuals, businesses, foreign vs. domestic), the nature of products and transaction types (e.g., money transmission, currency exchange, digital assets if any), transaction volumes and sizes, involvement of cash or crypto, and countries involved in transactions. Each factor is analyzed for risk indicators (for example, customers from countries identified by FATF as having weak AML regimes would carry higher geographic risk).
• Risk Rating of Customers: As part of the Customer Due Diligence process (see Section 6), UEX assigns a risk rating to each customer at onboarding and adjusts it over time based on account activity and periodic reviews. Customers are typically classified into categories such as low, medium, or high risk. Factors that may lead to a customer being rated higher risk include (but are not limited to): being a Politically Exposed Person (PEP), having connections to high-risk jurisdictions, engaging in high transaction volumes or patterns atypical for their stated profile, operating in industries known for higher money laundering risk, or any past suspicious activity alerts. The risk rating influences the level of due diligence and ongoing monitoring applied (e.g., high-risk customers are subject to Enhanced Due Diligence and more frequent review​, whereas low-risk customers may undergo simplified due diligence where appropriate and permitted by law).
• Enhanced Measures for Higher Risks: In line with FATF guidance, UEX applies enhanced measures when higher risks are identified​.
• This includes conducting Enhanced Due Diligence (EDD) for high-risk customers (Section 7), obtaining additional information or verification, increased monitoring of their transactions, and requiring senior management approval for establishing or continuing such relationships. Conversely, for lower-risk scenarios, UEX may apply standard due diligence measures (while still meeting all minimum legal requirements) and may streamline certain processes for customer convenience if justified by low risk – however, no risk is ever deemed “zero”, and UEX does not exempt any customer entirely from KYC procedures or monitoring. Notably, UEX will not apply any simplified measures in situations where money laundering or terrorist financing is suspected or where it would conflict with U.S. regulatory requirements.
• Continuous Risk Reassessment: Risk-based compliance is not a one-time task. UEX continuously reassesses risk throughout the customer relationship. Our transaction monitoring systems and periodic account reviews (described in Section 8) feed into the risk profile of each customer. If a previously low-risk customer begins to demonstrate high-risk behaviors or external risk factors change (e.g., their country of residence is added to a sanctions list or they become a PEP), UEX will promptly elevate their risk rating and apply appropriate controls. Conversely, if a customer’s risk profile diminishes over time (e.g., they move to a lower-risk jurisdiction or reduce high-risk transactions), UEX may adjust their risk rating accordingly, while still complying with any ongoing regulatory obligations.
• Documentation and Approval: UEX documents its risk assessments and methodologies. The overall AML Risk Assessment is approved by senior management and the Board (or equivalent governing body). The risk assessment results guide the allocation of resources (for example, investments in compliance technology, hiring of personnel, frequency of training) and the focus of internal controls. UEX’s Compliance Officer (see Section 13) is responsible for ensuring that the risk-based approach is implemented effectively and that staff are trained to understand risk factors and red flags.

In summary, UEX’s risk-based approach ensures that our AML/CFT efforts are “commensurate with the risks posed by the location, size, nature and volume” of our services and customers​

By tailoring our compliance measures to the level of risk, we aim to efficiently prevent misuse of our platform while providing legitimate customers with efficient service.

5. Customer Identification Program (CIP)

UEX has established a robust Customer Identification Program (CIP) as a critical component of its KYC procedures. The CIP is designed to ensure the true identity of each customer is known before they are allowed to use the Company’s services, thereby preventing anonymous access that could facilitate illicit activity. Although CIP requirements are explicitly mandated for banks under the USA PATRIOT Act, UEX voluntarily adheres to these high standards as an MSB in order to protect our business and comply with FinCEN’s expectation of rigorous customer identification as part of an AML program.Key elements of UEX’s CIP include:

• Customer Information Collection: At a minimum, UEX collects the following identifying information from each customer (individual or legal entity) prior to account opening or activation of services​:

  • Full Name: For individuals, the first and last name (and any middle name or suffix). For legal entities, the legal business name and any trade name or DBA.
  • Date of Birth: For individual customers, date of birth is required (to ensure the person is of legal age and for identity verification). For entities, the date of incorporation or registration may be collected, and dates of birth of beneficial owners are collected under CDD procedures.
  • Physical Address: A residential street address for individuals, or a principal place of business address for entities. (For individuals who do not have a permanent address, an Army/Air Post Office or FPO address, or the address of next of kin or another contact address is obtained as allowed by regulation).
  • Identification Number: For U.S. persons, a taxpayer identification number (such as Social Security Number or Employer Identification Number) is obtained. For non-U.S. persons, a government-issued identification number from an unexpired official document (such as a passport number, national ID number, or similar) is collected. In the case of legal entities, an EIN or other business identification number is obtained, and information on controlling persons may include their passport/ID numbers.
  • Additional Information: UEX also asks for contact information (phone number, email), and may request information on the customer’s occupation or nature of business, and intended purpose of the account (this overlaps with CDD, see Section 6). If the customer is a legal entity, UEX gathers information on the entity’s business activities and the identities of directors, account controllers, and beneficial owners (generally persons owning 25% or more of the equity, and at least one person who controls the entity – see Section 6).

• Verification of Identity: UEX verifies the collected identity information through risk-based procedures​. Verification is completed before the customer is allowed to transact, or in limited cases, promptly after account opening (with safeguards to prevent misuse prior to completion). Verification methods include:

  • Documentary Verification: UEX requires customers to provide unexpired, government-issued photo identification documents. For individuals, acceptable IDs include a driver’s license, passport, or other government ID that bears a photograph. For businesses, we may obtain certified articles of incorporation, government-issued business licenses, trust instruments, partnership agreements, or other proof of existence and authority, as well as ID documentation for the individuals who act on the business’s behalf. The documentation provided is reviewed for authenticity (e.g., checking security features of IDs) and consistency with the information provided by the customer.
  • Non-Documentary Verification: UEX supplements document checks with non-documentary methods when appropriate. These may include comparing provided information against third-party databases (e.g., identity verification services, public records, credit bureaus), checking references from financial institutions, verifying phone/email by sending confirmation links or codes, and using knowledge-based authentication questions. Non-documentary methods are especially useful for remote onboarding to detect fraud or identity theft (e.g., verifying that SSN and DOB match public records, or using selfie photo comparisons to the ID document).
  • Reliance on Third Parties: In some cases, where a customer’s fiat transactions are facilitated via a partner financial institution, UEX may rely on certain elements of identity verification performed by that regulated partner, provided that the partner’s CIP program is equivalent to UEX’s standards and is BSA-compliant. Such reliance will be subject to a formal agreement and periodic audits/confirmation that the third party is performing adequate CIP (as permitted under FinCEN rules for reliance on other financial institutions​). Ultimately, UEX remains responsible for its customers’ identification.
• Government Watchlist Screening (USA PATRIOT Act/OFAC): As part of the CIP process, UEX checks each new customer (and beneficial owner, where applicable) against relevant government watchlists, in particular the OFAC Specially Designated Nationals (SDN) and other sanctions lists. This is to ensure we do not do business with any individual or entity that is prohibited or subject to restrictions under U.S. law. (See Section 10 for more details on sanctions screening.) UEX’s CIP incorporates procedures to compare customer names against these lists at account opening​ and, if a match or a potential match is found, to escalate for further review and possible account denial, blocking of transactions, and reporting to OFAC as required. Additionally, if the U.S. government issues any specific lists of known or suspected terrorists (e.g. pursuant to Section 326 of the PATRIOT Act), UEX will ensure compliance by checking customers against such lists.
• No Account If Identity Cannot Be Verified: If UEX is unable to form a reasonable belief that it knows the true identity of a customer, the account will not be opened (or will be blocked/closed if already opened pending verification). In such cases, UEX’s procedures dictate that we may request additional information or documentation and if still unsatisfied, deny the customer’s registration. We also evaluate whether a Suspicious Activity Report should be filed when a customer’s identity information cannot be verified despite attempts (since refusal or inability to provide adequate KYC info may itself be a red flag)​.
• UEX also provides a notice to customers during the account opening process (e.g., in the terms of service or on the KYC submission page) that we require this information to comply with federal law and that we may not open the account if the information is not provided or verified.
• Recordkeeping of CIP Data: In compliance with regulatory requirements, UEX maintains records of all information obtained through the CIP. Specifically, we retain a record of the identifying data collected (name, DOB, address, ID number, etc.), copies of or references to the documents relied upon for verification, descriptions of the non-documentary methods and results if used, and the resolution of any discrepancies or substantiated doubts about the customer’s identity​.
• These records are kept for a minimum of five (5) years after the date the account is closed or, for occasional transactions, five years after the transaction​ (see Section 11 on Recordkeeping).

In summary, UEX’s CIP ensures that no customer is anonymous, and that we have a high degree of confidence in the identity of our users. By rigorously identifying and verifying our customers, we lay the groundwork for effective due diligence and monitoring throughout the customer relationship.

6. Customer Due Diligence (CDD)

Customer Due Diligence (CDD) goes beyond simply identifying the customer; it involves understanding the customer’s profile and intended behavior so that unusual or higher-risk activities can be detected. UEX implements strong CDD measures in line with FinCEN’s CDD Rule and international best practices. CDD is an ongoing process that begins at account opening and continues throughout the life of the customer relationship.Key components of UEX’s CDD program include:

By performing thorough CDD, UEX not only meets regulatory expectations but also creates a knowledge base about its customers that is essential for effective monitoring and risk management. CDD information will be documented and retained, and will inform decision-making such as whether to escalate a customer to EDD or whether to file a SAR if suspicious patterns emerge. Ultimately, CDD is about knowing our customer – both who they are and what they are likely to do – so we can serve them appropriately and spot when something is out of the ordinary.

7. Enhanced Due Diligence (EDD) for High-Risk Customers

Enhanced Due Diligence (EDD) refers to additional measures that UEX takes for customers or scenarios that present a higher risk of money laundering or terrorist financing. EDD builds upon standard CDD (Section 6) and is applied in cases where the customer’s profile, behavior, or other risk factors warrant a deeper investigation and tighter controls. UEX’s policy is to automatically consider certain categories of customers or activities as high-risk, and to apply EDD to them. Additionally, if our risk assessment or ongoing monitoring flags a customer as exhibiting high-risk characteristics, we will initiate EDD procedures.Situations that typically trigger EDD include (but are not limited to):

• The customer is identified as a Politically Exposed Person (PEP) or a close associate/family member of a PEP (see subsection 7.1 below for detailed PEP handling).
• The customer is a resident in, incorporated in, or sending/receiving funds to/from a High-Risk Jurisdiction (see subsection 7.2 below), such as countries with significant levels of corruption, conflict zones, or those subject to international sanctions or on FATF’s list of high-risk and non-cooperative jurisdictions.
• The customer operates in a high-risk industry (e.g., money services businesses as customers, gambling, shell companies, cryptocurrency exchange services if applicable, import/export firms in high-risk goods, etc.) or deals largely in cash.
• The customer’s activity is high-volume or high-value relative to typical individual customers (for instance, very large transactions, or maintaining large account balances) especially if not in line with their stated profile.
• There are indications of unusual or suspicious behavior, such as multiple accounts by related parties, reluctance to provide information, transactions that appear structured to avoid reporting thresholds, or any other red flags identified by UEX’s transaction monitoring.
• Any situation where a previously low or moderate risk customer’s behavior changes in a way that increases risk (e.g., suddenly starts transacting with a sanctioned country, or a spike in activity with no clear reason).

For customers or cases requiring EDD, UEX will undertake the following enhanced measures:

• Senior Management Approval: Opening an account for a high-risk customer (or continuing a relationship that has become high-risk) requires approval from senior management (e.g., the Compliance Officer and one other senior executive). For example, if a customer is flagged as a PEP, the decision to maintain that account must be documented and authorized at a high level, given the potential risks and scrutiny involved.
• In-Depth Interview or Source of Wealth Inquiry: UEX may conduct a more extensive interview process with the customer to obtain a detailed understanding of the nature of their business or employment, the origin of their overall wealth, and the source of specific funds involved in transactions. For individuals, this might involve questions or evidence about salary, investments, inheritance, or sale of property. For businesses, this includes reviewing financial statements, information on major suppliers and clients, etc. The goal is to ensure that the customer’s funds and wealth are legitimate and proportionate to their profile. EDD often requires obtaining supporting documentation, such as bank statements, payslips, contracts, invoices, audited accounts, or letters from accountants, to verify the explanations given.
• Additional Verification Steps: If not already completed in CDD, EDD will include verification of any information that was previously unverified. For example, if during standard due diligence a customer provided an address without documentary proof (perhaps for a lower-risk scenario), under EDD we would require a utility bill or bank statement to confirm the address. We may also verify references, perform on-site visits for business customers (or virtual video calls as a proxy), or engage third-party investigators for background checks if necessary.
• Enhanced Monitoring Plan: High-risk customers are subjected to more frequent and detailed monitoring of their transactions (see Section 8 for monitoring). UEX’s compliance team may set custom rules or thresholds specific to that customer’s activity. For instance, we might require real-time review of any transaction above a certain amount for a particular high-risk client, or we may temporarily limit certain transaction types until EDD is fully satisfied. The customer’s transactions might also be reviewed on a daily or weekly basis (instead of monthly) by compliance analysts, and any exception or deviation triggers a manual analysis.
• Periodic Review Frequency: EDD cases are reviewed at more frequent intervals. For example, a high-risk account might be formally re-reviewed quarterly or semi-annually rather than annually. This review would update any KYC information, re-check sanctions/PEP status, and evaluate whether the account is operating as expected. The results of these periodic reviews are documented and, if adverse findings occur, could result in further action (such as filing a SAR or exiting the relationship).
• Documentation of EDD Findings: All steps taken in the course of EDD are documented thoroughly. This includes a memo or report summarizing the rationale for deeming the customer high-risk, what additional information was gathered, analysis of that information, and the decision of whether to continue or terminate the relationship. If the relationship is continued, any conditions or monitoring recommendations (e.g., “continue monitoring X account with daily limits of $__” or “customer to provide updated financials in 6 months”) are noted. These records are kept in the customer’s due diligence file and retained per recordkeeping rules (minimum 5 years).
• Restricted Services or Additional Controls: In some cases, UEX might allow a high-risk customer to maintain an account but with certain restrictions to mitigate risk. For example, we may limit the maximum transaction amount or volume, require manual approval for each transaction, disallow certain high-risk corridors (e.g., not permitting transfers to certain high-risk countries), or require dual signatures (two-person authorization) internally before processing the customer’s transactions. If the customer is a business, we may require them to certify their own AML procedures or to provide additional guarantees.

Through Enhanced Due Diligence, UEX demonstrates extra caution and care in dealing with high-risk situations. This not only helps protect the Company from being exploited for illicit purposes, but also provides a documented rationale to regulators and banking partners that such relationships are being responsibly managed. The following sub-sections detail two common high-risk scenarios that always trigger EDD in our program: PEPs and high-risk jurisdictions.

7.1 Politically Exposed Persons (PEPs)

Definition: A Politically Exposed Person (PEP) is generally an individual who holds or has held a senior public position, such as a head of state, senior government official, senior judicial or military official, high-ranking political party official, or senior executive of a state-owned enterprise. The definition also extends to the immediate family membersand close associates of such individuals, as they can also pose risk by virtue of their relationship. UEX uses a broad definition of PEP that includes not only foreign PEPs (as required by U.S. regulations for banks) but also domestic PEPs, in line with FATF guidance, to ensure comprehensive risk mitigation.Risk Associated with PEPs: By virtue of their position and influence, PEPs are considered higher risk for potential involvement in bribery, corruption, or misuse of public funds, and thus money laundering. FATF Recommendations explicitly call for enhanced measures for PEPs​.

It is important to note that being a PEP does not imply the person is involved in criminal activity; rather, it is a risk classification that triggers greater scrutiny. Procedures for PEPs:

• Identification of PEPs: UEX screens all new customers against recognized PEP lists and databases as part of its onboarding and ongoing screening processes. We use reputable third-party compliance screening tools that aggregate global PEP lists and known public positions. If an applicant or existing customer is flagged as a potential PEP match, the compliance team will investigate to confirm whether the individual is indeed a PEP (this may include reviewing their provided information, checking official government websites, and considering context—e.g., common names can cause false positives). We also train our staff to recognize if a customer voluntarily provides information indicating they are a public official, which might not have been caught by automated screening.

• EDD Measures for PEPs: If a customer is determined to be a PEP or a relative/close associate of a PEP, UEX automatically categorizes the customer as high-risk. The following additional steps are taken:

  • Senior Management Involvement: As noted, opening or continuing the account requires approval from senior management. The compliance officer will prepare a briefing on the individual, including the nature of their political position and any known adverse information (for instance, if there are known corruption allegations in the press). Senior management must sign off on the decision to retain the relationship and may impose specific conditions or heightened monitoring as appropriate.
  • Source of Wealth and Funds: UEX will conduct a thorough inquiry into the PEP’s source of wealth and source of the funds expected to flow through the account. Given the risk of corruption, it is critical to ascertain that the PEP’s funds are from legitimate origins (for example, salary, business income, assets owned prior to holding office, etc.). We may require declaration and evidence of the PEP’s overall wealth (such as financial statements or asset declarations, if available) and scrutiny of any initial deposits or transactions. Any complex ownership structures (trusts, holding companies) associated with the PEP will be unraveled to understand the flow of money.
  • Account Activity Restrictions: UEX might impose lower limits or additional checks on a PEP’s transactions, especially if the PEP is from a country with a high corruption risk. We also watch closely for transactions that involve government accounts or state-owned enterprises, as these could raise additional red flags.
  • More Frequent Reviews: PEP accounts are reviewed at least annually, likely more frequently, to re-assess the risk. Additionally, if the PEP leaves office (since a person can remain a PEP for some time after leaving official position, often 12-18 months or as per risk judgment), we will consider that in the risk re-assessment but will typically continue treating them as high-risk for a period after their tenure due to potential lingering influence or access.
• No Exemptions: UEX’s policy is to not exempt domestic PEPs from EDD even though certain regulations focus on foreign PEPs. We apply a risk-based approach: a local state politician might present lower risk than a foreign head of state, but we still evaluate each case on its merits and apply appropriate due diligence. If any PEP, domestic or foreign, presents too high a risk (for example, they are publicly known to be implicated in corruption scandals), UEX reserves the right to reject or terminate the relationship to protect the Company’s integrity.
• Documentation: All steps taken for PEP due diligence are documented. We maintain information on the PEP’s role (including country, office, and when they assumed the role or left it), the assessment of their wealth, and any news or database checks (such as World-Check, etc.) that were performed. Interactions with the PEP regarding compliance matters are also logged.

By treating PEPs with heightened scrutiny, UEX aligns with global standards and ensures that any potential misuse of our platform by those with political influence is either deterred or swiftly detected and addressed.

7.2 High-Risk Jurisdictions and Other High-Risk Categories

Certain countries and geographic areas carry elevated AML/CFT risks due to factors such as high levels of corruption, inadequate AML laws, active sanctions, or significant terrorist activity. Additionally, certain categories of businesses or transaction types are widely recognized as higher risk. UEX takes the following measures regarding these high-risk factors:

• Sanctioned and FATF-Identified Jurisdictions: UEX prohibits accounts for any person or entity located in countries under comprehensive U.S. sanctions (e.g., currently this includes countries like North Korea, Iran, and others embargoed by OFAC). Our systems block IP addresses and prevent signup from sanctioned countries and we screen customer provided addresses and identification documents for location. For jurisdictions that are not outright sanctioned but are listed by FATF as “High-Risk Jurisdictions subject to a Call for Action” or on the “Jurisdictions under Increased Monitoring” (the FATF greylist and blacklist), UEX treats customers from or transacting with those areas as high-risk. This means if we onboard any such customer (for example, a customer from a greylist country), we apply EDD: obtaining more information, monitoring closely, and possibly limiting permissible transactions. UEX also stays updated on advisories from U.S. regulators (FinCEN advisories, State Department, etc.) about risks in certain regions (for instance, areas with terrorist insurgencies or narcotics trafficking hubs).
• Offshore Financial Centers and Tax Havens: Customers from jurisdictions known as offshore banking or incorporation havens (with strong secrecy laws or high anonymity) are treated cautiously. If a business customer is incorporated in such a place (e.g., certain Caribbean islands or other low-transparency jurisdictions) but operating elsewhere, we scrutinize the rationale and ensure we identify the true beneficial owners. We may require that such customers provide additional proof of substantive business (to avoid shell companies) or we might choose not to onboard them unless there is a compelling legitimate reason.

• High-Risk Industries: UEX identifies industries that pose higher risk, including:

  • Money Services Businesses (if our customer is itself an MSB, like a smaller money transmitter or currency exchange—extra due diligence to confirm they are licensed, have their own AML program, etc., often called “nested” MSB due diligence).
  • Gambling or Gaming businesses.
  • Dealers in precious metals, stones, or jewelry.
  • Cash-intensive businesses (restaurants, retail, convenience stores, etc., which might be prone to cash laundering).
  • Non-profit or charitable organizations (these are not inherently high-risk, but if they operate in conflict regions or channel funds abroad, we treat them carefully due to terrorist financing risks).
  • Virtual Asset / Cryptocurrency businesses (if UEX were to interact with crypto-related clients or payments, these have special guidance from FinCEN; even if we do not directly handle crypto now, any indirect exposure is watched).
• For such industries, UEX may require copies of relevant licenses, perform negative news media searches, and request a copy of the entity’s own AML policies or procedures to evaluate their robustness. Transactions involving these industries might also attract more scrutiny in our monitoring system.
• Unusual Ownership or Account Structures: If a customer (individual or entity) uses complex structures without obvious economic justification—such as multiple layers of trusts, shell companies, or accounts controlled by professional intermediaries (lawyers, accountants) on behalf of undisclosed clients—UEX will consider this high-risk. We will seek to understand the structure and the underlying principals. If transparency is not achieved, UEX will not establish or will terminate the relationship. We also pay attention to multiple accounts opened by the same person or group, or accounts that have proxy usage (one person transacting on behalf of another without disclosing agency); these scenarios are flagged for EDD.
• Cross-Border Transactions: By nature, cross-border money transmission can be higher risk than purely domestic. UEX monitors corridors (country-to-country flows) and if we notice transactions going to or coming from high-risk regions, those transactions are flagged for review. For example, frequent transfers to a country with weak AML controls would prompt us to ask the sender for more information about the purpose of those transfers and the recipient. For business accounts, if they start trading with counterparties in risky countries, we may reassess their risk rating.

Under EDD for any high-risk category, if UEX is not satisfied that we can effectively manage the risk or if the customer is not cooperative in providing requested information, the Company may decide to refuse the account opening or terminate the business relationship. UEX’s priority is compliance and reputational integrity over revenue. We will exit relationships that are beyond our risk appetite.All decisions and rationale related to high-risk jurisdictions or categories are documented in the customer’s file and in our risk assessment logs. Where required, any suspicious activities identified in these contexts will be reported via SAR (Section 9). By enforcing strict EDD for PEPs, high-risk countries, and other sensitive situations, UEX upholds a strong defense against being caught up (even unwittingly) in global financial crimes.

8. Ongoing Monitoring of Transactions

Transaction monitoring is a core component of UEX’s AML program. The Company has implemented systems and procedures to continuously monitor customer transactions and account activity for unusual or potentially suspicious behavior. Ongoing monitoring ensures that we not only know our customers at onboarding, but also understand how their behavior evolves, and it allows us to detect in real-time (or near real-time) signs of money laundering or terrorist financing. This section describes how UEX approaches transaction monitoring:

• Automated Monitoring Systems: UEX utilizes specialized AML transaction monitoring software to help flag patterns and transactions that may indicate suspicious activity. This software is configured with a set of rules and scenarios derived from known money laundering typologies and tailored to UEX’s business model. Examples of monitoring rules include:

  • Transactions that are unusually large for a given customer or peer group.
  • Spikes in activity volume or frequency in a short period.
  • Multiple transfers just below reporting thresholds (e.g., many transactions at $1,900 if $2,000 is a trigger for SAR) that might indicate structuring to avoid detection​.
  • Rapid movement of funds in and out (e.g., customer deposits money and quickly withdraws or transmits it elsewhere, with little economic purpose, possibly indicating layering).
  • Transactions sent to or from high-risk geographies or involving foreign currency conversions that are not typical for that customer.
  • Multiple accounts sending funds to the same recipient or one account receiving from many unrelated senders (could indicate funnel accounts or laundering networks).
  • Unusual patterns like round-dollar transactions (could indicate avoidance of leaving cents that complicate tracking), or repetitive transfers with no clear purpose.
• The system generates alerts when these rules are triggered. UEX ensures the monitoring system’s parameters are regularly reviewed and calibrated to minimize false positives while capturing true risks. As our business evolves or new risks emerge (for example, new scam typologies or regulatory advisories), we update the rules accordingly.
• Manual Reviews and Investigations: Alerts generated by the automated system are assigned to trained compliance analysts for review. The analyst will examine the transaction(s) in question, the customer’s profile and history, and any related accounts. They may also utilize external sources (public records, news databases, internet research) to see if there is any information on the customer or counterparties involved (e.g., is the recipient a known risky business or on a negative news list). The analyst then determines whether the activity can be reasonably explained (and thus the alert can be closed as a false positive/normal behavior) or whether it is truly suspicious and merits escalation. If needed, the compliance team might reach out to the customer for clarification or additional information regarding a particular transaction or series of transactions. For example, if an individual is sending frequent large transfers that don’t fit their profile, we might ask them to provide an explanation and any supporting documentation (perhaps they are purchasing property abroad, supporting family, etc., in which case we would want to document that justification).
• Suspicious Transaction Escalation: If after analysis an analyst finds the activity cannot be reasonably justified or red flags remain, the matter is escalated to the Compliance Officer (or a higher-level investigations committee, if one exists) for further review. A decision will then be made on whether to file a Suspicious Activity Report (see Section 9 for SAR filing process) and whether any immediate action is needed (such as freezing the account pending investigation, Section 15). UEX ensures this process happens within the regulatory timeframe for SAR filing (generally within 30 days of detection of facts that constitute suspicion, as discussed later)​. All investigation steps and conclusions are documented in a case management system for audit trail purposes.
• Real-Time Transaction Controls: In addition to after-the-fact monitoring, UEX may have automated real-time blocks or flags on certain transactions. For instance, if a transaction hits a known sanctions list match or exceeds a preset velocity limit, it can be automatically held for manual approval. UEX’s system can be set to decline transactions that violate certain rules (like attempting to send money to a sanctioned entity) immediately. In less clear scenarios, transactions might be queued and marked as pending review, during which time the funds are not moved until a compliance officer approves or rejects them after investigation.
• Daily OFAC Screening of Transactions: Every outgoing or incoming payment (especially if UEX were to directly handle payment messages) is scanned against OFAC sanctions lists in real time. This includes the names of senders, recipients, and any payment details. (This overlaps with Section 10 on Sanctions, but is a crucial part of transaction processing.) Any match will result in the transaction being blocked or rejected and reported as appropriate.
• Integration with Third-Party Provider Data: Since UEX uses third-party providers for fiat movement, we coordinate closely to ensure monitoring is comprehensive. UEX receives data on transactions facilitated by partners and feeds that into our monitoring systems. Conversely, if a partner is performing any first-line monitoring on transactions, UEX expects to be notified of any issues or suspicious indicators. These expectations are codified in our agreements with partners. For example, if our payment processor notices unusual funding into our master account, they will alert us. UEX treats those alerts with the same rigor as if we detected them ourselves. There is a continuous exchange of information, under appropriate confidentiality, to ensure no suspicious transaction slips through gaps between UEX and its providers.
• Pattern and Trend Analysis: Over time, UEX’s compliance team analyzes the patterns of alerts and activities to identify broader trends. If we notice multiple customers exhibiting similar suspicious behaviors, we investigate if there is a common source or scheme (e.g., are they all recruited by the same fraudulent scheme or money mule network?). We may share relevant trend information with law enforcement or industry peers through legal channels (such as FinCEN’s 314(b) voluntary information sharing, if applicable). Internally, this analysis helps refine our monitoring rules and focus on emerging threats.
• Customer Communication: Generally, UEX does not inform customers that they are under investigation or that a SAR will be filed, as this is prohibited by law (tipping off is illegal). However, in the course of normal activity, if we see something minor that’s out of pattern, we might ask the customer a routine question for clarification without revealing the compliance motivation (e.g., a customer service inquiry like “We noticed a larger transaction than usual, is everything okay? Could you provide the reason for this transfer?”). If a pattern of activity is deemed risky but not outright suspicious, UEX may also remind customers of reporting laws or our transaction limits to deter any structuring attempts.
• Quality Assurance and Auditing of Monitoring: UEX periodically tests its monitoring program to ensure it’s effective. This involves reviewing a sample of transactions to see if the monitoring system correctly generated alerts (or verifying that alerts generated were properly dispositioned). Independent auditors or the Compliance Officer might simulate certain scenarios or back-test past cases. The system parameters are adjusted if any gaps are found (for example, if a customer managed to structure transactions just under a threshold and it wasn’t flagged, we might lower thresholds or implement aggregation rules).

By diligently monitoring transactions on an ongoing basis, UEX aims to spot suspicious activity early and take appropriate action. This continuous vigilance is essential for protecting both UEX and the financial system from being misused by criminals. The insights gained from monitoring feed directly into our Suspicious Activity Reporting process as described next.

9. Suspicious Activity Reporting (SAR)

UEX.US Inc. complies fully with its obligation to report suspicious activities by filing Suspicious Activity Reports (SARs) with FinCEN in accordance with the BSA and FinCEN regulations. A SAR is a confidential report that provides information to law enforcement about transactions or attempted transactions that appear suspicious and may involve criminal activity. UEX’s policies and procedures for SAR filing are as follows:

• Thresholds for Reporting: U.S. regulations for MSBs require that a SAR be filed if a transaction (or series of related transactions) is conducted or attempted by, at, or through the MSB, involves at least $2,000 (in funds or assets), and the MSB knows, suspects, or has reason to suspect that the transaction or pattern of transactions is suspicious​.

• Suspicious means it falls into one of these general categories:

  • Involves funds derived from illegal activity, or is intended or conducted in order to hide or disguise funds or assets derived from illegal activity (e.g., drug trafficking, fraud, corruption) as part of a plan to violate or evade any law or regulation (money laundering).
  • Is designed to evade any BSA regulations (for example, structuring transactions to avoid CTR or SAR thresholds).
  • Appears to serve no business or lawful purpose, or is not the sort of transaction in which the particular customer would normally be expected to engage, and the MSB knows of no reasonable explanation for it after examining the available facts.
  • Involves use of the MSB to facilitate criminal activity, including terrorist financing.
• UEX will also file SARs for any situation involving insider abuse of the Company’s platform (though unlikely in an MSB context, if an employee were colluding with customers or misusing systems, that would be reported). It’s important to note that even if a transaction is less than $2,000, UEX may file a SAR at its discretion if we believe it to be appropriate (voluntary reporting) – for instance, if we suspect terrorist financing, we would not be limited by a dollar threshold.
• SAR Decision Process: As described in Section 8, when the compliance team identifies activity that cannot be reasonably explained and fits the suspicious criteria, the matter is escalated. The Compliance Officer (BSA Officer) or his/her delegate will decide whether to file a SAR. Often, UEX’s internal policy is that any unresolved red flag resulting in suspicion must result in a SAR filing – we generally err on the side of reporting, given the legal protections for filing and penalties for failing to report. The decision may involve consultation with legal counsel or senior management, but ultimate responsibility lies with the Compliance Officer to ensure SARs are filed when required.
• Timeliness of Filing: UEX understands that SARs must be filed promptly and within regulatory deadlines. Specifically, a SAR is required to be filed no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing​. “Initial detection” is generally when we, as a reporting entity, have conducted enough review to determine that the activity is suspicious (this might be the conclusion of an investigation). If we cannot identify a suspect (e.g., perhaps an unknown person attempted something illicit through us), the deadline can be extended to 60 days from detection, but that scenario is rare for us since we know our customers. UEX’s internal goal is to complete investigations and draft SARs as quickly as possible, often well before the 30-day mark, to ensure timely reporting. Additionally, if a situation is immediately critical (e.g., it might involve ongoing fraud or terrorism that could be imminent), UEX will contact appropriate authorities right away in addition to filing a SAR, such as calling law enforcement or FinCEN’s Financial Institution Hotline.
• SAR Filing Procedures: All SARs are filed electronically through FinCEN’s BSA E-Filing system (as mandated; paper filings are only allowed in extraordinary cases). The Compliance Department will prepare the SAR narrative and complete the required fields in FinCEN SAR Form 111. Our SAR narratives are detailed and include the who, what, when, where, and why of the suspicious activity, as well as how it was detected. We include all relevant dates, transactions, amounts, account numbers, and any identification information on the subjects involved. We strive to make the narrative clear for law enforcement to understand the activity and its context. Once completed, the SAR is reviewed by a second compliance officer or manager for quality control, then submitted via the E-Filing portal. UEX retains a copy of the filed SAR (and any related workpapers or documentation that support the filing) in our secure compliance records.
• Confidentiality and No Tipping Off: SAR filings and their contents are kept strictly confidential. We do not inform the customer or any unauthorized person that a SAR has been filed or considered. This information is shared within UEX only on a need-to-know basis (usually just the compliance team and senior management or legal if necessary). If the fact of a SAR filing must be referenced internally (for example, to justify account closure to a business team), it is done without revealing the SAR itself, just citing policy violation or risk reasons. UEX recognizes that disclosing a SAR or related information outside of appropriate channels is against federal law and could severely harm law enforcement investigations​. All employees are trained on SAR confidentiality.
• Continuing Activity Reporting: If a customer continues to conduct suspicious activity after an initial SAR has been filed, UEX will file “continuing activity” SARs at appropriate intervals (usually every 90 days for ongoing activity, in line with FinCEN guidance) until the activity ceases or the relationship is terminated. Each subsequent SAR will reference the previous SAR filings and provide updated information. We have controls to diarize follow-up SARs if needed.
• Interaction with Law Enforcement: Filing a SAR does not prohibit UEX from also taking action like terminating the account (and often we will, see Section 15). However, if law enforcement contacts us (e.g., issues a subpoena or informally asks us to keep the account open for monitoring), we will cooperate within the bounds of the law and coordinate actions accordingly. UEX will also consider 314(b) information sharing with other financial institutions if we are registered for that program and if doing so could help identify related suspicious activity in the broader network (subject to the safe harbor provisions).
• Internal SAR Log and Board Reporting: UEX maintains an internal log of all SARs filed, including basic details like date of filing, subject(s), general reason (e.g., “structuring”, “possible fraud”, “unusual wires to high-risk country”), and the name of the person who authorized the filing. This log is kept securely. Senior management and the Board of Directors (or equivalent governing body) are informed of SAR filings on a high-level basis (number of SARs, general categories of issues) at least quarterly, without disclosing sensitive details that could compromise the confidentiality. This ensures leadership is aware of the risks facing the company and the effectiveness of the AML program.

• Case Examples (Hypothetical for Illustration):

  • If a customer named John Doe consistently sends $1,900 transfers multiple times a week to different individuals, and this behavior seems like structuring to avoid a $2,000 reporting threshold, UEX would investigate and likely file a SAR describing John Doe’s pattern of structuring and any known purpose (or lack thereof) for these payments.
  • If a business customer suddenly receives a large number of payments from unrelated third parties and then quickly moves the funds abroad, and we suspect it might be a mule account or unlicensed money transmitter, we would file a SAR, including all relevant transaction details and any info we have on those third parties.
  • If we detect that an account might be involved in fraud (say, a customer is collecting deposits from victims and we receive fraud reports), we would file a SAR indicating potential fraud and identify the victims and perpetrators if known.

In all cases, SAR filing is a critical duty for UEX to help U.S. authorities combat financial crime. We take this responsibility seriously and ensure that our SAR submissions are timely, accurate, and complete​. By doing so, we contribute to the larger fight against money laundering, fraud, terrorist financing, and other crimes, and we protect the Company from legal and reputational harm.

10. Sanctions Compliance (OFAC Screening)

UEX.US Inc. fully complies with U.S. economic sanctions laws and regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC). Sanctions compliance is a crucial part of our AML/CFT measures, as dealing with sanctioned parties or countries can have severe legal consequences and often overlaps with money laundering/terrorist financing risks. This section outlines how UEX manages sanctions screening and compliance:

In summary, UEX’s sanctions compliance program is designed to prevent any business involving sanctioned persons, entities, or countries. We incorporate automated tools and manual oversight to achieve full OFAC compliance. This not only keeps UEX within the law but also protects the Company from severe reputational damage that could arise from a sanctions violation. By diligently checking the OFAC Specially Designated Nationals list and other sanctions lists for every customer and transaction​, UEX upholds its commitment to operating within all U.S. legal boundaries and contributing to national security objectives.

11. Recordkeeping and Retention

Proper recordkeeping is fundamental to UEX’s compliance with the BSA, FinCEN regulations, and general sound business practices. UEX maintains detailed records of customer information and financial transactions as required by law, and retains them for the mandated time periods (at least five years, and in certain cases longer)​. These records support our ability to monitor activity, to investigate and report suspicious behaviors, and to provide evidence of compliance to regulators or law enforcement when requested. The following outlines our recordkeeping policies:

• Customer Identification Records: As part of the CIP (Section 5), for each customer UEX will maintain a record of all identifying information obtained (name, DOB, address, identification number, etc.), copies of identification documents provided (or descriptions if copying is not feasible), results of identity verification (e.g., note which documents were verified, any non-documentary verification results), and the notice provided to customers about verification (if applicable). These CIP records are kept for five (5) years after the date the account is closed​. If an application is rejected or not completed, information collected up to that point is retained for a similar period, since it could be relevant to any future suspicious correlation.

• Transaction Records: UEX retains records of all transactions processed through our systems. Depending on the type of transaction, different regulatory recordkeeping rules may apply:

  • For funds transfers of $3,000 or more, UEX (and/or the partner institution) must collect and retain certain information under the “Travel Rule” (31 C.F.R. §1010.410(e))​. This includes details like the name and address of the sender, the amount, date, any payment instructions, and the recipient’s name and address, and any other identifying info (plus account numbers of both if applicable). UEX ensures that for any such transmittal of funds, the required originator and beneficiary information is recorded and retained. We keep these records for at least 5 years from the date of the transaction.
  • For currency exchanges over $1,000, if UEX were to offer such service, we’d record the details (per BSA rules) and keep for 5 years.
  • For cash purchases of monetary instruments (if applicable, though currently UEX doesn’t deal in cash instruments directly; if we did, amounts $3,000–$10,000 require specific records per 31 C.F.R. §1010.415).
  • Currency Transaction Reports (CTR) filings: If UEX (or its partner on UEX’s behalf) has a situation with over $10,000 in cash in or cash out in one day for one customer, a CTR must be filed​. UEX would maintain copies of any filed CTRs and the supporting data (identification of customer, amount, etc.) for at least 5 years from filing. While UEX currently does not handle physical cash directly, this is noted for completeness and future operations—if our model changes or if customers use cash via an agent, CTR obligations would be triggered.
  • SAR filings: Copies of SARs and supporting documentation are retained for at least 5 years from the date of filing (by regulation). UEX actually retains them longer by practice (7 years or more) to be safe. Supporting documentation (which is anything that was part of forming the basis of the SAR) is preserved and catalogued securely. Note: Supporting documents do not get filed with the SAR, but if law enforcement subpoenas them, we must be able to provide.
  • Account statements or ledgers: While UEX may not produce “statements” like a bank, we keep logs of all debits/credits to each customer account (ledger history) for at least 5 years.
  • Communication records: Any substantive communications with customers that relate to their transactions or compliance matters (e.g., explanations for transactions, responses to inquiries about source of funds, etc.) are retained as part of the customer’s record.
• Format and Accessibility: All records are maintained in a form that is accessible and readily producible upon official request. UEX uses secure electronic storage for most records (scanned documents, database entries, encrypted cloud storage that meets security standards). If any paper records exist, they are stored in secure filing areas with controlled access. Per 31 C.F.R. §1010.430, records must be filed or stored in a way as to be accessible within a reasonable period​. We test our ability to retrieve records to ensure compliance (for example, we simulate a regulatory request to see how quickly we can gather all KYC and transaction records for a given customer).
• Retention Periods: As a rule, UEX uses a 5-year retention period from the date of the event (account closure or transaction) for BSA-related records, because that is the standard in the regulations​. In practice, to simplify, UEX may choose to keep certain records for longer, especially if they might be relevant for ongoing business analysis or in anticipation of any legal needs. However, we ensure nothing is destroyed before 5 years. We have a schedule and process for record destruction/disposal once records are past retention and not needed, which will be done securely (shredding paper, permanent deletion of electronic files) to protect customer privacy.
• Logs and Miscellaneous: UEX also keeps logs of daily operations as needed: for example, a log of issued and voided monetary instruments (if any), a record of all OFAC checks performed and results, training attendance records (see Section 14), and audit logs from our monitoring systems showing alerts and dispositions. These meta-records help demonstrate our compliance activities were carried out.
• Requests by Regulators or Law Enforcement: If FinCEN, IRS (which is the examining authority for MSBs), or any other regulator or law enforcement agency requests information, UEX will promptly provide copies of relevant records. Under the BSA, we must be able to retrieve specific transaction or customer records and provide them. We do so under proper legal process (summons, subpoena, etc.), and maintain confidentiality as required. We document any information provided to authorities to have an audit trail.
• Nondisclosure and Privacy: While maintaining records, UEX also respects customer privacy and data security. Records are accessible only to authorized personnel with a need to know (e.g., compliance team, auditors, senior management). We comply with any applicable data protection laws. However, BSA-required records are exempt from certain privacy provisions in that we must keep them and share with regulators irrespective of customer consent.
• Recordkeeping for Third-Party Transactions: In cases where our third-party banking or payment partners hold certain records (like actual bank account numbers used to fund a transaction, etc.), UEX ensures via agreement that those records will be maintained and accessible as if we maintained them. Typically, our system will capture reference IDs and we coordinate retrieval from the partner if needed. But to the extent possible, we integrate that data into our own records to not rely solely on a partner for compliance evidence.

In conclusion, UEX’s recordkeeping system is comprehensive and compliant. We recognize that “if it’s not documented, it didn’t happen” in the eyes of regulators. By preserving detailed records of all required information for the mandated time frames​, UEX not only abides by the law but also equips itself to effectively review historical activity, support investigations, and demonstrate the effectiveness of its AML program over time.

12. Internal Controls and Independent Review

UEX has established a strong system of internal controls to ensure day-to-day compliance with AML/CFT requirements and to safeguard against lapses or violations. Additionally, the Company subjects its AML program to regular independent reviews (audits) to test the program’s effectiveness and identify areas for improvement. These measures correspond to two of the key pillars of an AML program as required by FinCEN​ : (a) internal policies, procedures, and controls, and (b) independent testing.Internal Controls and Procedures:

• UEX’s AML policies (this document) and the more detailed operating procedures derived from it are designed to ensure compliance with all BSA requirements and to produce timely detection and reporting of suspicious activities. These controls cover customer onboarding, transaction processing, exceptions handling, etc., and are embedded in our operational workflows. For example, the system will not allow an account to be fully activated until the KYC information has been collected and approved by compliance (control on onboarding). Another control is that large transactions might require dual authorization – one by an operations staff and one by a compliance staff – before execution.
• Access to critical systems (like the transaction monitoring software, customer profile databases) is restricted to authorized personnel. For instance, only compliance team members can clear alerts or mark a customer as high-risk in the system. System permissions are an internal control to prevent unauthorized changes or someone bypassing AML checks.
• Dual-control and segregation of duties: UEX implements segregation of duties in its compliance processes. The person who conducts a transaction or handles the customer relationship (front-end) is not the same person who reviews for AML compliance (back-end). This ensures independent oversight. For high-risk or sensitive decisions (like closing an account for suspicion or filing a SAR), more than one person (or a manager) is involved to ensure proper decision-making.
• Approval processes: Certain actions require formal approval within the compliance program. For example, onboarding a customer that had a false positive name match to a sanctions list might require a compliance manager’s sign-off with rationale documented. Likewise, decisions to exempt any transaction from monitoring (if ever) or to change risk scoring models are approved by the Compliance Officer.
• Policy enforcement: If any employee deviates from these policies or if any system malfunction is detected (e.g., a bug that fails to screen a name properly), internal controls require that it be reported immediately (internally) and remedied. UEX fosters a culture where employees understand the importance of compliance and are encouraged to report issues or suggest improvements.
• Audit trails: Systems maintain logs of actions taken (e.g., who reviewed an alert, who approved a customer’s documents, when a list update was installed, etc.). These audit trails are part of our controls to be able to reconstruct what happened in any given case and ensure accountability.
• Compliance Committee: Although UEX is not a bank, it may benefit from a management-level Compliance Committee that meets periodically (say quarterly) to review AML issues. Members could include the Compliance Officer, other senior executives (operations, legal, finance, etc.). This committee reviews key metrics (number of SARs, trends in alerts, any major compliance issues), approves any policy changes, and ensures that any identified deficiencies are corrected. This forms part of our internal governance controls.

Independent Audit/Review:

• UEX arranges for an independent review of its AML program at least annually, or more frequently if deemed necessary by the risk assessment. The independent review can be conducted by a qualified third-party auditor or consultant, or by an internal audit department if one exists, provided the reviewers are not part of the day-to-day AML compliance operations (to ensure true independence)​. The reviewers should have expertise in BSA/AML regulations.
• The scope of the independent review covers all aspects of the AML program: the adequacy of the risk assessment, CIP processes, CDD/EDD implementation, transaction monitoring effectiveness, SAR and CTR filings, OFAC compliance, recordkeeping, training records, and the overall governance structure. It often involves sample testing – e.g., picking random customer files to see if KYC was done right, reviewing a sample of transactions to see if any missed generating an alert or if any alerts were improperly cleared, etc. It also verifies that earlier audit recommendations were implemented.
• After the review, the auditor provides a written report of findings to senior management and the Board. This report will highlight any compliance deficiencies or areas where controls could be strengthened. For example, an audit might find that training frequency is sufficient but content could be improved, or that the OFAC screening software needs an update for new list types, or simply commend that everything is working effectively.
• UEX is committed to addressing any findings promptly. We develop a corrective action plan for each issue identified. For instance, if the independent review finds that our risk-rating methodology doesn’t consider a certain factor which it should, we will update that methodology. If it finds a gap in documentation, we will reinforce procedures and maybe re-train staff on that point.
• The results of independent audits and our responses are maintained as part of our compliance records and will be made available to regulators on request. Demonstrating a cycle of audit and remediation is important to show that our program is dynamic and continuously improving.
• UEX also monitors regulatory developments and enforcement actions against other institutions to preemptively update controls (even outside of formal audits). This proactive adjustment is an informal ‘self-audit’ mechanism.

In summary, internal controls are how we implement this Policy in practice day-to-day, ensuring no critical process is left to chance, and independent testing is how we validate that those controls (and the overall program) are functioning as intended​. Together, these elements help UEX maintain a strong compliance environment and swiftly correct any weaknesses. They also provide assurance to our banking partners and regulators that UEX’s program is sound and meets all requirements.

13. Compliance Officer and Management Oversight

UEX.US Inc. has appointed a dedicated Compliance Officer (also known as the BSA Officer) who is responsible for overseeing and administering the AML/KYC Program. Additionally, the Company’s senior management and Board of Directors (or equivalent governing body) exercise oversight to ensure that compliance is taken seriously at the highest levels and that the Compliance Officer has the necessary authority and resources. This section outlines the roles and expectations for the Compliance Officer and management in AML compliance:

• Designation of a Compliance Officer: UEX formally designates an AML/BSA Compliance Officer​. This individual is knowledgeable about BSA/AML regulations and industry practices and has sufficient experience or training to manage the complexities of our business’s compliance requirements. The Compliance Officer’s name and contact information are documented internally and communicated to all employees so they know who to approach with compliance issues. (If required by regulation or banking partners, UEX will also report or certify the name of the Compliance Officer to them.)
• Compliance Officer Authority: The Compliance Officer has full responsibility and authority to develop and enforce the AML/KYC policies and procedures. They have the authority to make compliance decisions independently (for example, to refuse or terminate a customer relationship due to compliance risk, or to file SARs without interference). The Compliance Officer can escalate issues directly to senior management or the Board as needed. Importantly, the Compliance Officer is not placed in a position that has conflicts of interest with business development – meaning their judgment is not clouded by revenue concerns, and their compensation is not solely tied to business performance but also to compliance performance.

• Duties of the Compliance Officer: Some of the key duties include:

  • Day-to-Day Compliance Management: Ensure CIP is being performed on all new accounts, ensure transaction monitoring alerts are reviewed properly, sanctions screening is up to date, and generally that all aspects of the program are operational each day. They coordinate among different departments (e.g., with operations for implementation of controls in the platform, with IT for system enhancements, etc.).
  • Maintaining and Updating the AML Policy: The Compliance Officer reviews this Policy at least annually (more frequently if needed due to regulatory changes or new business lines) and proposes any updates. They also develop any supplemental procedures or guidance for staff.
  • Regulatory Liaison: Serve as the primary point of contact with regulatory examiners, auditors, and law enforcement for AML matters. If FinCEN, IRS, or state regulators have inquiries or during examinations, the Compliance Officer coordinates the responses and provides documentation. They also handle any 314(a) information requests from FinCEN and ensure timely searches and responses.
  • Approvals and Decision-Making: As noted in earlier sections, the Compliance Officer often is the one to approve EDD cases, deciding on SAR filings, approving high-risk client onboarding, etc. They convene any necessary internal discussions around these decisions.
  • Reporting to Management/Board: The Compliance Officer prepares periodic reports (e.g., quarterly) summarizing the status of the AML program: statistics on KYC processing, number of SARs/CTRs filed, noteworthy compliance incidents, results of any audits or regulatory exams, current key risks, and resource needs. They may present these findings in management meetings or board meetings. This ensures transparency and keeps the leadership informed.

• Management and Board Oversight: UEX’s leadership is committed to a culture of compliance. Senior management (like the CEO, COO) and the Board of Directors:

  • Approve the AML Policy: The Board (or an appropriate committee) reviews and formally approves this Policy and any material revisions. This top-level sign-off demonstrates that compliance is a priority and not just a back-office function.
  • Provide Resources: Management ensures that the Compliance Officer and program have adequate resources – both human (sufficient compliance staff for the size and risk of business) and technological (budget for transaction monitoring systems, KYC tools, training, etc.). If the Compliance Officer indicates more staffing or tools are needed to effectively manage risks, management will carefully evaluate and support reasonable requests. Operating as an MSB and pursuing MTLs means understanding that compliance costs are an investment in the company’s legitimacy and long-term viability.
  • Independence and Escalation: The Compliance Officer has a direct reporting line to a high level within the company (e.g., reporting to the CEO or Board Audit/Compliance Committee, rather than being buried under several layers of management). This ensures that if there are serious issues, they can be escalated without delay or dilution. The Board should meet with the Compliance Officer at least annually without other executives present, to allow candid discussion of any management-level obstacles or needed improvements.
  • Accountability: If there are compliance failures, management will hold the relevant units accountable, not scapegoating the compliance staff. Conversely, the Board holds the Compliance Officer accountable for maintaining an effective program – if audits or exams reveal chronic deficiencies, the Board will require corrective action and could replace the Compliance Officer if needed (just as a measure of accountability, though our aim is to empower the CO to succeed).
  • Tone at the Top: The Company’s leadership communicates a strong “tone from the top” that AML compliance is every employee’s responsibility and that the Company does not tolerate unethical behavior or shortcuts. This tone is conveyed in internal communications, training introductions, and by example – e.g., leadership doesn’t pressure sales staff to onboard questionable clients, and they praise compliance achievements as well as sales achievements.
• Integration with Business Strategy: As UEX plans to expand (including applying for MTLs), the Compliance Officer and management work hand-in-hand to ensure that expansion plans incorporate compliance considerations from the start. For instance, before launching a new product or entering a new state, the compliance team assesses the regulatory requirements and risks, and management adjusts timelines or budgets to accommodate compliance measures (like new licensing or system changes). This integrated approach prevents compliance from being an afterthought and demonstrates proactive management oversight.

In essence, UEX’s AML program is championed by a competent Compliance Officer and actively overseen by the highest levels of the company. This structure fulfills the FinCEN requirement of a designated person for day-to-day compliance​, and it ingrains compliance into the corporate governance. It sends a clear message internally and externally (to regulators, banks, partners) that UEX is serious about meeting its legal obligations and maintaining a compliant operation.

14. Employee Training and Awareness

An effective AML program requires that all relevant personnel are knowledgeable about the laws, regulations, and internal policies that pertain to their duties. UEX has implemented a comprehensive AML training program for its employees (and, where appropriate, for contractors or agents) to ensure that everyone understands their compliance responsibilities and can recognize potential money laundering or terrorist financing activities. Key aspects of the training program include:

• Frequency of Training: UEX provides AML/KYC training to all employees at least annually​. New hires whose roles are relevant to AML (e.g., customer onboarding teams, finance operations, compliance staff, managers in key positions) receive training promptly upon joining the company, ideally within their first few weeks. If regulations or our business model change significantly, or if a significant emerging risk is identified, additional interim training sessions or refreshers will be conducted as needed. Essentially, training is ongoing, not a one-time event.

• Scope and Content: The training program is tailored to different roles, but generally covers:

  • AML/BSA Laws Overview: Explanation of what money laundering and terrorist financing are, and why AML/CFT regulations exist. Overview of the BSA, FinCEN’s role, and major requirements like CIP, SAR, CTR, etc., as relevant to UEX. We include specifics like the $2,000 SAR threshold for MSBs​, importance of SAR confidentiality, and heavy penalties for non-compliance or willful blindness.
  • Company Policies and Procedures: Review of UEX’s own AML/KYC Policy and procedures, so employees know how the law is implemented internally. This includes step-by-step processes they must follow: e.g., how to verify customer ID, how to escalate a suspicious behavior, how to respond if someone asks “why do you need my ID?” etc. We make sure employees know where to find the written procedures and forms.
  • Red Flags and Scenarios: Practical examples of red flags that could indicate money laundering or fraud in UEX’s context. For instance, we teach customer service reps to spot if a customer is structuring transactions or if they use language hinting someone else is directing their account activity. We also cover possible signs of identity theft or account takeovers. Scenarios-based training is effective: e.g., present a fictional case and ask trainees what they would do. This helps them apply concepts. Red flags can be drawn from FinCEN advisories, FATF reports, etc., but made relevant to our business.
  • PEP and Sanctions Awareness: Training highlights the importance of identifying PEPs and sanctioned parties (e.g., showing what a PEP hit might look like in our system, or explaining that if someone mentions connections to a sanctioned country, it must be reported). We reiterate that doing business with sanctioned parties is illegal and that if any employee suspects such a situation, they must halt and inform Compliance immediately.
  • Risk-Based Approach: We educate staff on the concept of RBA – that not all customers are the same and that’s why we ask more questions to some than others. This helps front-line teams handle customers appropriately and explains why sometimes we need extra documentation (so they can communicate that to customers without frustration).
  • Employee Obligations and Consequences: It’s clearly communicated that compliance is part of everyone’s job. Employees are instructed that if they detect something suspicious, they must report it internally (e.g., to the Compliance Officer) and not to tip off the customer. The training also covers that non-compliance can lead to internal disciplinary action and that individuals can face legal consequences (including fines or imprisonment) for willful BSA violations or for assisting money launderers. We want them to take personal ownership.
  • Company Culture and Ethics: We tie AML training into our overall code of conduct, emphasizing integrity and ethical business. Employees should feel empowered to do the right thing even if it means delaying a business transaction or potentially losing a sale – management backs them up on compliance decisions.

• Training Methods: UEX uses a combination of training methods such as:

  • Classroom/Workshop sessions: especially for new or complex material, possibly led by the Compliance Officer or an external expert.
  • E-learning modules: Annual refreshers might be done through interactive online courses that include a test at the end to assess understanding.
  • Quizzes/Certifications: We often include short quizzes or case studies that employees must complete to verify they grasp key points. Employees must achieve a passing score, otherwise additional coaching is provided.
  • Interactive discussions: Encouraging Q&A and discussion of real challenges employees have faced, to learn from each other’s experiences.
  • Materials: Provide quick reference guides or infographics that summarize red flags, or checklists for KYC steps, which employees can keep at their workspace for daily reference.
• Documentation of Training: UEX keeps records of all training sessions conducted. This includes dates of training, list of attendees (or completion records for online modules), topics covered, and copies of training materials used. Each employee has a training record to show they have completed required AML training. These records are retained as part of our compliance documentation (commonly at least 5 years, often longer) to evidence to examiners that training is ongoing​.
• Employee Acknowledgment: After training, employees may be asked to sign an acknowledgment (or electronically acknowledge) that they understand UEX’s AML Policy and their role in it, and that they will comply with it. This reinforces accountability and could be useful if an issue arises showing that an employee was indeed informed of the rules.

• Specialized Training: Certain roles get more in-depth specialized training. For example:

  • Compliance analysts and investigators get advanced training on conducting investigations, writing SARs, using the monitoring system, etc., possibly by attending external workshops or certifications (like ACAMS or similar if useful).
  • Customer-facing teams get tailored training on how to handle customer queries about KYC (“Why do you need my SSN?” or complaints about delays) and how to spot if a customer might be lying or exhibiting odd behavior.
  • Senior management and the Board are briefed on AML responsibilities at a high level periodically, so they too are aware of their oversight duties (though they may not need the granular training that staff do).
• Testing Effectiveness: UEX evaluates the effectiveness of its training program by monitoring compliance incidents. If we notice repeated errors or misunderstandings by staff in a certain area, it indicates the training might need enhancement on that topic. We may conduct periodic surveys or interviews with employees to gauge their comfort level and knowledge on AML procedures. Regulators often quiz front-line staff during exams to see if training has been absorbed; we strive to ensure any employee could answer basic questions about our AML procedures correctly.

By educating our employees thoroughly, UEX ensures that our first line of defense – the staff operating the business – are equipped to implement AML controls and to act as the eyes and ears of the organization. A well-trained workforce is essential for the effective execution of the procedures outlined in this Policy and for fostering a company-wide culture of compliance and vigilance.

15. Account Freezing, Restrictions, and Termination

UEX.US Inc. reserves the right to freeze, restrict, or terminate customer accounts or transactions in order to comply with legal requirements and to protect the Company from involvement in illicit activities. This section details the circumstances and procedures under which UEX will take such actions, balancing the need for quick risk mitigation with fairness and regulatory compliance.

• Freezing Accounts for Suspicious Activity: If UEX’s compliance team determines that a customer’s activity is suspicious and possibly linked to illegal activity (for example, fraud, money laundering, terrorist financing, or sanctions violations), UEX may immediately freeze the account to prevent further transactions while an investigation is ongoing​. “Freezing” typically means the customer is temporarily unable to initiate new transactions or withdraw funds; essentially the account is put on hold. During this freeze, we may still allow inward credits (to not tip off if law enforcement is tracing funds) but not outward debits, depending on guidance from authorities. This action would typically coincide with or precede the filing of a SAR (Section 9) if the suspicion meets that threshold.
• Notification of Freeze: In many cases, UEX is not obligated to notify a customer that their account is frozen, especially if doing so could tip them off about a pending SAR or investigation. We tread carefully: if the freeze is purely an internal precaution and we need more information from the customer to resolve a red flag, we might contact them with a neutral request (e.g., “Please provide documentation for X transaction” while keeping the account frozen in the interim). But if we have reason to believe notifying them would impede investigation or allow asset flight, we may keep the account frozen without immediate notice. UEX follows any instructions from law enforcement in this regard when applicable.
• Restricting Account Features: Sometimes an outright freeze isn’t necessary, but certain restrictions are applied. For example, UEX might lower transaction limits, disallow certain types of transfers, or place a hold on outgoing international transfers for a particular account. These tailored restrictions can mitigate risk while an issue is being resolved. For instance, if a customer hasn’t updated KYC after multiple requests, we might restrict them to only withdrawals (closing out) but no new activity until they comply.

• Termination of Account/Relationship: UEX may decide to terminate (close) a customer’s account under several scenarios:

  • The customer is confirmed to be involved in fraudulent or illicit activities, or has violated our terms of service by using the account for prohibited purposes.
  • The customer refuses to provide required KYC information or enhanced due diligence information, or provides information that we deem unsatisfactory or deceptive.
  • The customer is identified as a sanctioned person or from a sanctioned jurisdiction (in which case termination is immediate and mandatory).
  The customer repeatedly engages in behaviors that trigger suspicious activity alarms, even after warnings, indicating an unacceptable risk level.
  • Regulatory or law enforcement guidance: In rare cases, authorities might request we keep an account open (for monitoring), but more often, if they have what they need, we can terminate to avoid further risk.
• When terminating for AML reasons, typically we will give the customer notice that their account is being closed (without specific details beyond perhaps citing a violation of terms or risk concerns). We may allow them to withdraw any remaining legitimate funds via a controlled process (unless funds are blocked by authorities). In extreme cases, funds might be held or surrendered to law enforcement if deemed proceeds of crime.
• Documentation and Approval of Freezes/Closures: Any decision to freeze or terminate an account for compliance reasons is documented, including the reasons and evidence. Such actions are generally approved by the Compliance Officer and possibly another senior executive. We maintain an internal list of accounts closed for suspicious or sanctioned activity to ensure they are not inadvertently re-opened or allowed to resubmit under a different identity without extra scrutiny.
• Handling of Funds in Frozen Accounts: If funds are frozen due to sanctions (blocked property) or court orders, UEX will maintain the funds in a segregated account as required until further notice from authorities. If funds are simply held during an internal review, we aim to conclude the review promptly. If the outcome is account closure, funds that are not illegal will be returned to the customer via the original funding source if possible, or via a method we deem safe (perhaps a cashier’s check mailed to an address on file, if electronic means present risk). If illegal funds are suspected, we coordinate with law enforcement—once a SAR is filed, we might get subpoena or seizure warrant for the funds. UEX complies with any such legal process.
• Legal Process and Safe Harbor: UEX’s right to freeze or close accounts is supported by our Terms of Service which customers agree to. Those terms explicitly state that we may take such actions to comply with AML laws or if illegal activity is suspected​. Under U.S. law, if we in good faith shut an account and file a SAR, we have safe harbor from liability to the customer for that closure (they typically cannot successfully sue us for closing their account in a SAR situation, especially since we are prohibited from telling them about the SAR). Nonetheless, we handle these matters sensitively to avoid unnecessary customer impact and only resort to terminations when justified by risk or required by law.
• Coordination with Partners: Because UEX uses third-party providers for fiat custody/transactions, when we freeze or terminate an account, we also inform those partners if needed so they can enact parallel restrictions on their side (for example, if they hold the wallet or sub-account for that user). Conversely, if a partner flags something severe, we will take action on the UEX account accordingly. This coordination is covered by data sharing agreements ensuring we can lawfully share information for compliance purposes (including under the 314(b) voluntary information sharing safe harbor if applicable between financial institutions).
• Reinstatement: In some cases, after investigation, if it is determined the suspicion was unfounded or the customer subsequently provided a satisfactory explanation or documentation, UEX may unfreeze the account and allow the customer to continue using services. Such decisions are carefully considered by Compliance. The customer may be kept at a higher risk level for a period to ensure close monitoring.
• General Account Closure (Non-AML): (Note: Outside of AML context, UEX can close accounts for inactivity or business reasons too, but here we focus on suspicious/illegal cases.)

By maintaining the right and operational capability to freeze and terminate accounts, UEX adds an important control to its risk management toolkit. This ability to quickly isolate and eject risky actors helps protect our broader customer base, our partners, and the financial system. We will always exercise this right in a manner consistent with applicable laws, and with documentation to back our decisions. In sum, UEX will not hesitate to sever customer relationships that threaten compliance or safety, and this Policy makes that clear to all stakeholders.

16. Review and Update of Policy (Including Future Licensing Plans)

UEX.US Inc.’s AML/KYC Policy is a living document that will be reviewed regularly and updated as necessary to reflect changes in regulatory requirements, industry best practices, and the company’s business activities (including its expansion plans such as obtaining Money Transmitter Licenses in additional jurisdictions). This final section covers the maintenance of the Policy and how UEX prepares for future developments:

• Regular Policy Reviews: At a minimum, the Compliance Officer will review this Policy annually to determine if updates are required. This annual review will take into account:

  • Changes in relevant laws or regulations in the past year (for example, any new FinCEN rules, updates to the FATF recommendations adopted by the U.S., changes in state regulations especially as UEX pursues MTLs, etc.).
  • Changes in UEX’s business lines, customer base, or geographic reach. If UEX introduces a new product or enters a new market, the Policy may need adjustments.
  • Lessons learned from internal audits, independent reviews (Section 12), or regulatory examinations. If any deficiencies were identified, the Policy will be strengthened accordingly.
  • New typologies or risks observed (e.g., if virtual currency usage becomes part of our services, we’d integrate relevant controls; or if COVID-19 style scams arise, incorporate guidance, etc.).
• The Compliance Officer will draft proposed revisions and present them to senior management and the Board for approval. Minor tweaks (e.g., updating job titles or minor clarifications) can be made administratively, but material changes (like procedural shifts or new sections) get formal approval and are documented.
• Interim Updates: Apart from the annual cycle, updates will be made as needed. For instance, if Congress passes a law tomorrow that directly impacts MSB obligations, we would update the Policy promptly rather than waiting. FinCEN advisories or enforcement actions might prompt adding specific guidance into our procedures (which can be referenced in the Policy or appended as internal memos). Also, when UEX obtains new state licenses, those states might have specific AML requirements (some states codify certain minimum standards for licensees). We will incorporate those either directly into this Policy or in state-specific addenda, ensuring that our program meets the highest standard across the board. Essentially, as UEX’s regulatory footprint grows, this Policy will be adjusted to uniformly meet all applicable obligations so that we operate one cohesive compliance program.
• Board Approval and Version Control: Every time the Policy is updated, the new version is approved by the Board (or designated committee) and a version number and effective date are assigned. We keep past versions on file for reference and to show the evolution over time, if needed. The effective date of the current Policy will be clearly indicated on the cover page or in the introduction.
• Dissemination of Updates: When the Policy is updated, all relevant staff are informed. If changes affect procedures employees perform, training sessions or at least memos will be given to ensure everyone understands the new expectations. New hires will always get the latest version. Partners or service providers who play a role in our compliance efforts may also be informed if the changes impact them (for example, if we change how we handle certain referrals or what data we collect that might involve their systems).
• Future Licensing (MTLs) Considerations: As mentioned, UEX plans to apply for Money Transmitter Licenses in various states to expand its services. Each state’s licensing process often requires submission of an AML/BSA compliance program or description. This Policy is drafted to anticipate those needs; however, as part of each MTL application, the Compliance Officer will cross-check the state’s requirements (often found in state regulations or guidance) against this Policy. If a particular state expects an explicit statement or additional procedure (for instance, some states might explicitly mention requiring an annual independent review, which we already have, or maybe specific record retention beyond federal – generally 5 years is standard across but we’ll check), we will ensure the Policy or accompanying documentation addresses it. In some cases, states also require inclusion of consumer protection elements like fraud prevention or transaction dispute processes, which might be separate from AML but related – those can be added in a complementary policy or appended.Once UEX obtains additional licenses, the scope of this Policy (Section 2) will be updated to reflect operations under those licenses as well. We will also monitor state law changes (e.g., if a state passes its own requirement on virtual currency compliance, etc.) and integrate those.
• Continuous Improvement: UEX is committed to continuous improvement of its AML program. Beyond formal policy text changes, continuous improvement includes updating our technology, refining our risk assessment, and adopting industry best practices (for example, if a new AML technology like AI-based monitoring becomes feasible and regulators view it positively, we might integrate that and note it in policy as methodology). We maintain memberships or follow guidance from industry groups like ACAMS, NACHA (if relevant), ABA or MSB associations, etc., to stay ahead.
• Regulatory Engagement: We will remain engaged with our regulators. If FinCEN or state regulators issue new guidance or request feedback on proposed rules, UEX will review those and potentially comment. This not only keeps us informed but also contributes to shaping practical regulation.
• Adapting to Scale: As UEX grows, the AML program will scale. For example, if customer volume increases significantly, we may need more automated tools or bigger teams. The Policy might then include references to departments or roles that don’t exist while small (like a dedicated investigative unit). We foresee those changes and plan accordingly. The Policy is flexible to encompass either a small team scenario or a larger institution scenario by focusing on functions rather than specific headcount.
• Final Note: This Policy (current version) has been reviewed and approved by UEX.US Inc.’s Board of Directors as of [Date]. It is effective immediately and supersedes any previous AML/KYC policy of the Company. All employees are required to adhere to it. The Board and Management endorse this Policy unequivocally and expect full cooperation in its implementation.

In conclusion, UEX.US Inc.’s AML/KYC Policy is a comprehensive framework designed to ensure full compliance with U.S. AML laws and international standards, protect the Company from illicit finance risks, and instill trust among our customers, banking partners, and regulators. By following the procedures and controls outlined in this Policy, UEX demonstrates its commitment to ethical conduct and legal compliance. This Policy will be kept up-to-date and dynamically evolve as UEX grows, including the transition from a FinCEN-registered MSB relying on partners to a fully licensed money transmitter across jurisdictions. We are confident that through rigorous application of this Policy, UEX will maintain a strong defense against money laundering and help contribute to the overall integrity of the financial system.