Last updated: TBC — set the date this document takes effect.
DRAFT — and the one document here you must not publish without a compliance professional. An AML policy is read by regulators and by the banking and payment partners who decide whether to process your money. It commits you to controls you then have to actually operate, and a policy describing controls you do not run is worse than no policy. Every [BRACKETED] item is a decision that must be made with advice.
1. Definitions
- AML — anti-money laundering
- CFT — combating the financing of terrorism
- KYC — know your customer
- CDD / EDD — customer due diligence / enhanced due diligence
- PEP — politically exposed person
- FATF — Financial Action Task Force
- SAR — suspicious activity report
- FIU — financial intelligence unit
2. Background
[VELTON OPERATING ENTITY], trading as Velton Markets, is committed to preventing the use of its services for money laundering, terrorist financing, bribery, fraud or any other financial crime. Compliance with this policy is mandatory for all employees, contractors, introducing brokers, partners and agents.
3. Objectives
- Prevent misuse of our services for financial crime.
- Apply KYC, CDD and EDD proportionate to the risk each client presents.
- Define verification tiers, required documentation and transaction limits.
- Monitor activity continuously and report what the law requires us to report.
- Train staff so that the controls in this policy are actually applied.
4. Scope
This policy applies to our employees and representatives, to every client — individual or corporate — transacting through our platforms, and to all products and services we offer.
5. Regulatory framework
[FRAMEWORK — list the laws and standards your entity is actually subject to, and no others. Naming frameworks you are not subject to, or claiming supervision by a regulator that does not in fact supervise you, is the fastest way to lose a banking relationship. For a Nigerian-facing operation this typically includes the Money Laundering (Prevention and Prohibition) Act 2022 and SCUML registration; for an offshore operating entity it will be that jurisdiction’s own regime. Add the FATF Recommendations and the UN and OFAC sanctions frameworks, which apply regardless.]
6. Responsibility and oversight
Senior management is responsible for implementing this policy and for allocating the resources compliance requires. A named Compliance Officer is responsible for day-to-day AML and CFT obligations and reports to senior management monthly on suspicious activity, regulatory filings, training and changes in risk.
[COMPLIANCE OFFICER — name the individual and give a direct contact. Most regimes require a named natural person, not a shared inbox.]
7. KYC and customer due diligence
No account is fully activated, and no withdrawal is processed, before customer due diligence is complete. Verification covers identity, residential address, the ownership of the payment instrument used, and — where risk requires it — source of funds and source of wealth. For corporate clients it extends to beneficial ownership.
We do not accept anonymous accounts, accounts in false names, or accounts operated for an undisclosed third party. High-risk clients, including PEPs, require enhanced due diligence and senior management approval before onboarding.
8. Account verification tiers
Tier 1 — Basic (restricted)
Limited access pending full verification.
- Documents: government-issued photo ID; full name, date of birth and nationality; self-declared residential address; valid phone and email; selfie with ID for liveness.
- Limits: [TIER 1 DEPOSIT LIMIT] per month; [TIER 1 WITHDRAWAL LIMIT] per month; maximum trading exposure [TIER 1 EXPOSURE].
- Restrictions: no third-party funding; no corporate accounts.
Tier 2 — Fully verified (standard)
Full access once KYC is complete.
- Documents: full scan of government-issued ID; proof of address dated within three months; Bank Verification Number or local equivalent where applicable; source of funds declaration; live video or selfie verification.
- Corporate clients: certificate of incorporation; memorandum and articles; list of directors and shareholders; KYC on all ultimate beneficial owners.
- Limits: no fixed limit, subject to risk assessment. Trading subject to margin requirements.
- Restrictions: transactions permitted only through accounts in the client’s own name.
Tier 3 — Enhanced due diligence (high risk)
For PEPs, clients in high-risk jurisdictions, and unusually large transactions.
- Documents: everything in Tier 2, plus detailed source of wealth, tax compliance evidence, independent references where applicable, and corporate structure and shareholder registries for corporate clients.
- Limits: case-by-case approval.
- Restrictions: enhanced monitoring on all activity; onboarding and withdrawals require senior management approval.
9. Transaction screening and monitoring
We monitor account activity on a risk basis throughout the relationship. Automated and manual monitoring covers deposit and withdrawal patterns, trading behaviour inconsistent with a client’s stated profile, use of multiple accounts, and rapid deposit-and-withdrawal cycles with little genuine trading. Escalation applies where activity is inconsistent with what we know about the client.
10. Reporting
Where we know or suspect that funds are the proceeds of criminal conduct or relate to terrorist financing, we file a suspicious activity report with [FIU — the NFIU in Nigeria] and any other regulator we are required to notify. We do not tell the client that a report has been made, and we may suspend activity without giving a reason where the law requires.
We also file large-transaction reports above the thresholds set by [AUTHORITY].
11. Sanctions and prohibited activity
Clients are screened against PEP and sanctions lists at onboarding and on an ongoing basis, including UN, OFAC and EU lists and any list applicable in our operating jurisdictions.
We prohibit:
- anonymous or fictitious accounts;
- third-party deposits and withdrawals;
- any transaction linked to a sanctioned person, entity or territory;
- accounts for residents of territories on our restricted list.
[SCREENING PROVIDER — name the tool or provider you screen with. “We screen” without a named system is the first thing a partner bank will question.]
12. PEPs and high-risk clients
Enhanced due diligence is mandatory for PEPs, their family members and close associates. Onboarding requires approval from senior management and Compliance, and all subsequent activity is subject to enhanced monitoring.
13. Risk assessment
We assess risk across clients, products, delivery channels and geographies, document the results, and use them to set the controls applied to each client. Assessments are reviewed at least annually and whenever a material change occurs.
14. Training
Every employee whose role touches onboarding, funding or monitoring receives AML and CFT training at induction and at least annually thereafter, covering KYC, recognising suspicious activity, and their own reporting obligations. Training is recorded.
15. Record retention
Identification records, transaction records and internal reports are retained for at least [RETENTION PERIOD — five years is the common minimum, seven in some regimes] after the end of the client relationship, held securely and accessible only to authorised staff.
16. Audit and review
Internal audits of AML and CFT controls are conducted [FREQUENCY]. This policy is reviewed annually, or sooner where regulation changes. Independent external audit may be commissioned where appropriate.
Contact
Questions about this document? Email help@veltonmarkets.com or see our contact page.