KYC, AML/CFT & CPF Policy

KRYPSM Private Limited (“the Company”, “KRYPSM”, “we”, “us”, or “our”) is a Virtual Digital Asset Service Provider (VDASP) duly registered with the Financial Intelligence Unit – India (FIU-IND) as a Reporting Entity under the Prevention of Money Laundering Act, 2002 (“PMLA”).

This KYC, AML/CFT and Counter Proliferation Financing Policy (“the Policy”) establishes the framework, procedures, and controls adopted by the Company to prevent the misuse of its platform and services for money laundering, terrorist financing, proliferation financing, and other financial crimes. This Policy has been formulated in compliance with, and is governed by, the following regulatory framework:

• Prevention of Money Laundering Act, 2002 (PMLA).
• Prevention of Money Laundering (Maintenance of Records) Rules, 2005 (PMLR).
• AML & CFT Guidelines for Reporting Entities Providing Services Related to Virtual Digital Assets, FIU-IND (8 January 2026).
• FIU-IND registration circulars and directions issued from time to time.
• Unlawful Activities (Prevention) Act, 1967 (UAPA).

This Policy applies to all Users, the Company, its Board of Directors, employees, officers, agents and contractors, and to every transaction, interaction, or service provided through the Company’s platform. The Company monitors activity on the platform using a risk-based approach to detect and prevent financial crime. By accessing the Company’s services, the User agrees to comply with these standards, which form an essential and binding part of the relationship.

Unless the context otherwise requires, the following terms shall have the meanings assigned below:

• AML (Anti-Money Laundering): measures to detect, prevent, and report money laundering.
• Applicable Law: All statutes, regulations, rules, and guidelines in force in India, including PMLA, PMLR, FIU-IND Guidelines, FEMA, UAPA, the Income-tax Act, and CERT-In directions.
• CDD (Client Due Diligence): identifying and verifying a customer using reliable, independent sources of documents, data, or information.
• CFT: Countering the Financing of Terrorism.
• CPF: Countering Proliferation Financing.
• Designated Director: Responsible for ensuring the Company’s overall compliance with the AML Regulations.
• EDD (Enhanced Due Diligence): additional verification and monitoring measures applied to high-risk customers or transactions.
• KYC (Know Your Customer): verifying the identity of clients at onboarding and on an ongoing basis.
• OVD (Officially Valid Document): Passport, Driving Licence, Aadhaar, Voter ID, NREGA Job Card, NPR letter, or any document notified by the Central Government.
• PEP (Politically Exposed Person): an individual entrusted with a prominent public function (domestic or international), and their immediate family members and close associates.
• Principal Officer: Responsible for day-to-day AML/CFT/CPF compliance, transaction monitoring, reviewing alerts, filing STRs with FIU-IND, and regulatory liaison.
• PMLA / PMLR: The Prevention of Money Laundering Act, 2002, and the Prevention of Money Laundering (Maintenance of Records) Rules, 2005.
• Restricted Jurisdiction: Any jurisdiction other than India; the Company provides services only to persons resident in India.
• STR: Suspicious Transaction Report filed with FIU-IND.
• VDA: Virtual Digital Asset, as defined under Section 2(47A) of the Income-tax Act, 1961.
• VDASP: Virtual Digital Asset Service Provider.

The Company has established a governance structure for AML/CFT/CPF compliance in accordance with the PMLA, PMLR, and FIU-IND Guidelines 2026, with responsibility and accountability embedded at the highest levels of the organisation. The Board of Directors holds ultimate responsibility for the compliance programme, supported by:

• Designated Director: responsible for overall regulatory compliance and oversight.
• Principal Officer: responsible for the day-to-day compliance programme, monitoring of transactions, and reporting of suspicious activity to FIU-IND, supported by the Compliance team.

KYC is the foundation of the Company’s AML/CFT/CPF framework. It enables the Company to identify and verify customers, understand their profile and activity, assess risk, and ensure transactions are consistent with their declared profile. The objectives of KYC are to:

• ensure accurate identification of customers;
• verify identity using reliable, independent sources of documents, data, or information;
• conduct ongoing due diligence consistent with the customer’s profile and source of funds;
• monitor and report suspicious transactions to FIU-IND;
• prevent the opening of anonymous, fictitious, or benami accounts; and
• Minimise fraud, financial crime, and reputational risk.

The Company applies a risk-based approach to onboarding and monitoring, and classifies every customer into a risk category: Low, Medium, or High. PEPs and other higher-risk profiles are classified as High risk. The risk classification of each account is reviewed at least once every six months. Enhanced Due Diligence (EDD), including verification of source of funds and source of wealth, and senior-management approval, is applied to high-risk customers and PEPs. Risk classification considers factors such as:

• nature of occupation and source of income or wealth;
• geographic and jurisdictional exposure (Restricted Jurisdictions, FATF-listed countries, and high-risk IP / geolocation);
• transaction value, velocity, and frequency on the fiat funding rails;
• consistency of funding with the customer’s declared profile and income;
• third-party or mismatched-name funding attempts;
• PEP status (domestic and foreign);
• adverse-media findings; and
• any prior STR or suspicious-activity history.

The Company maintains a real-time sanctions and watchlist screening programme in compliance with the PMLA, UAPA, UN Security Council Resolutions, and FIU-IND Guidelines 2026.

The Company operates a risk-based, continuous transaction-monitoring programme using automated systems and analytics to detect unusual or suspicious activity, focused on the fiat on-ramp and off-ramp rails and on-platform behaviour. Based on internal risk thresholds set by the compliance function, the Company flags and reviews suspected transactions. Where activity suggests potential money laundering, terrorist financing, or proliferation financing, the Principal Officer is required to take prompt action, including suspending the activity where appropriate and filing a report with FIU-IND as soon as reasonably possible.

Where a transaction is suspected to involve money laundering, terrorist financing, proliferation financing, or other unlawful activity, including attempted transactions, the Company files a Suspicious Transaction Report (STR) with the Financial Intelligence Unit – India. STRs are filed promptly and confidentially in accordance with Applicable Law. The Company does not disclose to any customer, or to any third party, that a report has been or may be filed, or that an investigation is underway (prohibition on “tipping-off”).

The Company maintains comprehensive records as required under Section 12 of the PMLA and the PMLR, in a manner that keeps them accessible for regulatory inspection and law-enforcement purposes at all times. Additionally, records may be reviewed during internal audits to ensure the Company’s compliance systems remain effective and secure, strictly in accordance with Applicable Law.

The Company strictly prohibits the following on its platform:

• opening or maintaining anonymous or fictitious accounts;
• transactions on behalf of, or for the benefit of, persons or entities on applicable sanctions or watchlists;
• any activity constituting money laundering, terrorist financing, or proliferation financing under Applicable Law; and
• any attempt to fund an account from a third-party or mismatched-name bank account.

The Company conducts regular AML/CFT/CPF training for employees to ensure awareness of financial-crime risks and regulatory obligations. Employees involved in compliance, operations, and transaction monitoring receive specialised training to identify suspicious activity and implement AML controls effectively.

The Company cooperates fully with FIU-IND, the Enforcement Directorate (ED), the Central Bureau of Investigation (CBI), and other law-enforcement and regulatory agencies in the prevention, detection, and investigation of financial crime. This cooperation includes:

• providing information, records, and documents lawfully requested by such authorities;
• giving effect to freezing, seizure, or attachment orders in respect of funds or accounts; and
• reporting suspicious transactions and responding to directions issued under the AML Regulations.

This Policy shall be reviewed and updated at least annually by the Compliance team, the Principal Officer, and the Designated Director, or more frequently in response to:

• changes in Applicable Law, including amendments to the PMLA, PMLR, or FIU-IND Guidelines;
• the introduction of new products, services, or technologies by the Company;
• significant changes in the Company’s risk profile or customer base;
• material findings from internal audits or regulatory inspections; and
• new FATF guidance or international standards applicable to VDASPs.

This Policy is intended solely for regulatory compliance and internal governance and does not create any rights, benefits, or obligations in favour of any User or third party, except as required under Applicable Law.

If any part of this Policy is found to be invalid or unenforceable under any law, that specific part shall be severed. This shall not affect the remainder of the Policy, which shall remain in full force and effect.

Any failure or delay by the Company in exercising any right, power, or remedy under this Policy shall not constitute a waiver of that right, power, or remedy.

Notwithstanding anything contained in this Policy, the Company shall comply with any directions, orders, or requirements issued by applicable regulatory or law-enforcement authorities, including FIU-IND, and such directions shall prevail over this Policy to the extent of any inconsistency.

This Policy is published for transparency and information purposes only and does not constitute legal, tax, financial, or investment advice. Nothing in this Policy shall be construed as creating any contractual, fiduciary, or advisory relationship between the Company and the User. Users are encouraged to seek independent professional advice where required. Questions about this Policy may be addressed to the Principal Officer at [email protected].