Interne Richtlinien

I. Introduction

In the content of this internal policy adopted and used by the operator of the zondacrypto exchange, we want to provide you, in a comprehensive manner and in accordance with valid legal regulations, with a description of how we act in order to counteract money laundering and financing of terrorism by means of cryptocurrencies. We present the legal basis of our actions and the assumptions and rules that directly apply to users of our exchange and influence the form of our services.

II. General information

The operator of the zondacrypto cryptocurrency exchange is BB Trade Estonia OÜ, a company based in Estonia at: Harju maakond, Tallinn, Lasnamäe linnaosa, Tähesaju tee 9, 13917 ESTONIA (office no. 10, 2nd floor), entered into the Register of Companies under no. 14814864 (hereinafter the Company). Within the scope of the zondacrypto.com website (hereinafter called the Website) and its subdomains, the Company provides electronic services based bringing users together via the Website so that they can conclude transactions involving the purchase or sale of cryptocurrencies available on the Website.

BB Trade Estonia OÜ is licensed as virtual currency service provider under number license number FVT000209.

In accordance with applicable EU and national AML/CTF (Anti-Money Laundering / Counter-Terrorism Financing) provisions, the operator of the zondacrypto exchange, BB Trade Estonia OÜ, is an entity obliged to take actions aimed at counteracting the criminal use of business activity for money laundering and financing of terrorism and is subject to supervision by the Estonian Financial Intelligence Unit in this respect.

III. Legal Basis

As an entity engaged in the provision of currency exchange services between virtual currencies and fiduciary currencies within the meaning of European Union law, we are obliged to counteract money laundering and the financing of terrorism. Within this scope, our activity and the internal procedures we have adopted are based on the following EU regulations:

• Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or financing of terrorism, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and the Commission Directive 2006/70/EC (OJ EU L, 5.06.2015, p. 73) (“AML Directive 4”);
• Directive (EU) 2018/843 of the European Parliament and the Council of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or financing of terrorism, and amending Directives 2009/138/EC and 2013/36/EU (“AML Directive 5”).

In view of the fact that the operator of the zondacrypto exchange (hereinafter called zondacrypto) is an entity registered in Estonia, our activity and internal procedures are also consistent with the law of the Republic of Estonia, in particular:

• the Act of 26 October 2017 on the prevention of money laundering and financing of terrorism (hereinafter called the Act). We must also stress that, because we use the services of Polish payment operators and Polish banks, we are also obliged to comply with the guidelines that are imposed upon payment operators co-operating with zondacrypto by Polish anti-money laundering and counter-financing of terrorism (AML/CTF) laws, in particular:
• the Act of 1 March 2018 on counteracting money laundering and financing of terrorism (unified text: Journal of Laws 2018, item 723). Moreover, zondacrypto is obliged to apply guidelines published by European supervisory bodies, the Financial Action Task Force (an independent intergovernmental entity specifying AML/CTF standards) or the MONEYVAL Committee (appointed within the Council of Europe and affiliated with FATF). Compliance with the rules specified in AML/CTF laws is also related to the legal security of both the “obliged entities” themselves and, consequently, their customers. We try to maintain the highest standards in the field of ICT security and legal security and we assure you that our actions are fully consistent with the requirements of EU and national law.

IV. Internal anti-money laundering and counter-terrorism (AML/CTF) procedures

Each entity obliged in accordance with § 14 of the Act must have procedures regulating anti-money laundering and counter-financing of terrorism (AML/CTF) activities. These procedures specify the rules for application of due diligence measures, the risk identification and management model, methodologies and instructions on how to act in cases of suspected money laundering or financing of terrorism, the rules for storing and sharing data, the rules for training employees, and any other actions necessary for the effective functioning of the AML/CTF system.

Bearing the financial security of our users in mind, we have implemented a number of due diligence measures that are thoroughly specified in provisions of law. The procedures adopted by us define precisely the full scope of zondacrypto’’s activities aimed at counteracting financial fraud and other forms of financial abuse made to the detriment of our users and the Internet community in its broad sense.

Due to the fact that AML/CTF procedures specify details of zondacrypto’’s activities in formal, organisational and technological aspects, documents concerning these activities are not made publicly available. However, we assure you that they are consistent with applicable laws and that they are subject to evaluation by auditors and FIU supervision.

V. Due diligence measures

As an obliged entity, zondacrypto uses due diligence measures in accordance with § 19 of the Act. These consist in the identification and verification of a private customer (§ 21 of the Act), the identification and verification of a legal entity (§ 22 of the Act), the identification and verification of the actual beneficiary (§ 22 of the Act), the specification of the customer’s risk profile (§ 20 of the Act), the monitoring of business relations (§ 23 of the Act), the use of enhanced due diligence measures (§ 36 of the Act), the use of additional due diligence measures in legally stipulated cases (§ 38 of the Act), the use of increased due diligence measures towards persons from high-risk countries (§ 39 of the Act), the use of increased due diligence measures towards persons holding prominent political positions (called politically exposed persons – “PEP”) (§ 41 of the Act).

Acting in compliance with the law, zondacrypto tries to ensure that AML/CTF processes cause as little inconvenience as possible to users, while securing the implementation of all legally stipulated tasks of an obliged entity.

VI. Know Your Customer (KYC) process

In implementing the obligations specified in § 21 and § 22 of the Act, we are obliged to become familiar with and verify the identity of our customers. In the first phase, the user must enter his/her data into registration forms and fill in the AML questionnaire. The second phase is the verification of the customer, which must be based on independent and reliable sources – in our case, we have assumed that photographs of identity documents issued by government institutions (in the case of ascertaining the user’s identity) constitute a reliable and independent source; in the case of ascertaining the address, these are photographs of documents issued by independent and reliable institutions. A detailed catalogue of such documents is available on the verification pages in the Website; for the sake of example, however, we can indicate the following documents:

• Official document
• Bank account statement
• Confirmation of a transfer made by the Customer
• Telephone service/utility bill
• Agreement with a bank or any other public trust institution

During registration, as part of the KYC process, the user is obliged to submit a number of statements, for example, about his/her employment status, average remuneration, country of employment, purpose of setting up an account, the expected amount of the investment and his/her investment experience. In addition, the user is asked about the origin of funds to be allocated to the platform, their legality and whether he/she is a politically exposed person or a person from the inner circle of such a person. All such information helps us learn more about the customer and make sure that transactions are consistent with our knowledge about the user. In each case, an employee of the Security Department of zondacrypto.com may ask the user to send additional documents both in the case of private and corporate customers; this is always determined by the Company’s need to fulfil its statutory duties and should also be treated as a sign of concern for the user and protection of his/her significant legal interests.

VII. Private user identification

For the purposes of identification of a private customer, it is required to fill in the form submitted to the Website during the registration of the user’s account.

The customer may verify their account by attaching to the verification form two sides of an identity document (e.g., an identity card, a passport or a residence card) and a selfie photograph with the identity document used in the verification process. The photograph must show the full face of the person whose account being verified along with the identity document held in his/her hand. It is very important not to process submitted photographs in any manner. A watermark may not be placed on the photograph nor may any part of the documents be covered. The submitted photograph of the document should be fully (1:1) consistent with the original.

The verification of identity documents on the Website is supported by specialist software made by Onfido, which scans submitted documents and checks both their substantive and formal aspects. Thus, any processing of the submitted photograph is treated as a falsification of the document and verification is automatically rejected. For the purpose of avoiding complications during the verification of your account, please adhere strictly to instructions specified on the verification pages of the zondacrypto.com website.

The fundamental rules of customer identification and verification are presented below:

• The submitted copy of the document should be fully (1:1) consistent with the original (covering a fragment of the document or its processing in graphics software, e.g., adding a watermark, is unacceptable).
• The identity document must not bear visible signs of damage.
• All data on the document must be legible.
• All four corners of documents must be visible.
• The verification may only take place on the basis of an identity document that will remain valid for at least one month from the submission of the verification request.

Moreover, for verification purposes, it is also necessary to include a document confirming the customer’s address that is not older than 6 months from the date of issue. If any discrepancies are found, we are entitled to ask the customer for a video call in order to rule out any doubts regarding the verification of the user and data submitted by him/her.

CORPORATE USER IDENTIFICATION

In the case of verification of business entities, the identification process is more complex due to the fact that we must acquire information about the actual beneficiaries of verified entities and persons entitled to represent entities, the type of their business activity and business relations, as well as the origin of funds.

For this purpose, each corporate customer is required to fill out a detailed AML questionnaire. Moreover, a corporate customer is obliged to submit a copy of a document from the official register of companies that presents the structure of the company under verification. Please remember that the aforementioned document must reflect the factual state and may not be older than 3 months. In addition, a corporate customer is obliged to submit a scan of its articles of association and a document confirming who is the actual beneficiary of the entity concerned and confirming who has the right to represent the entity concerned if is not immediately apparent from the aforementioned documents. For the purpose of verification of a corporate customer's representative, it is also necessary to submit a scan of an identity document, in accordance with the requirements relating to a private customer.

VIII. Monitoring of business relations

According to § 23 of the Act, zondacrypto is obliged to monitor business relations established within the scope of business activity by checking transactions for the purpose of ensuring the conformity of the transaction with knowledge about the customer, its activity and risk profile, determining the origin of funds and updating documents and data. The transaction monitoring process is performed with the use of dedicated AML software that defines transactions deviating from certain standards that have no justified, visible or lawful economic purpose. Each transaction identified in this manner is checked individually and usually verified directly with the user for the purpose of full compliance with the provisions of law. Please remember that the higher the amount of funds traded at the exchange by the user, the more intense due diligence measures zondacrypto is obliged to use towards the user in order to comply with the provisions of law.

IX. Limitations that may occur during the use of zondacrypto's services

On the basis of internal policy, FATF guidelines, the list of international sanctions or the list of high-risk industries, zondacrypto may refuse to establish economic relations with a customer or terminate relations already established if we find during the risk analysis process that the customer-related risk level is unacceptable to the Company.

X. Non-acceptable countries and high-risk countries

On the basis of internal policy and the list of international sanctions, zondacrypto reserves the right to refrain from concluding business relations with citizens, residents or entities based in or staying in countries included on the list of international sanctions. Moreover, because of a very high risk of money laundering and financing of terrorism, zondacrypto stipulates that it will not establish business relations with customers, residents or entities based in or staying in countries that have been identified as unacceptable countries by internal procedures. This situation results strictly from international guidelines and legal requirements and is absolutely not aimed at the discrimination of such persons due to their nationality. List of non-acceptable countries and regions

1. Countries not co-operating in anti-money laundering activities:

a) Iran

b) Pakistan

c) São Tomé and Príncipe Islands

2. Countries supporting terrorist activities:

a) Iran,

b) Libya,

c) Sudan,

d) Syria,

e) North Korea

3. Countries and regions not acceptable for legal and licence reasons:

a) Crimea

b) United Kingdom – Please be advised that currently due to the laws introduced in this country, we are also unable to accept customers who are residents of the United Kingdom (UK).

In addition, the operator of the zondacrypto exchange as an obliged entity is obliged to use enhanced due diligence measures towards customers who are citizens, residents or entities based in or staying in countries that are recognised as high-risk countries in terms of money laundering. Enhanced due diligence measures involve, among other things, the additional verification of the customer, the collection of additional information about the purposes and type of commercial relations and transactions undertaken by the customer, and the identification and origin of funds being used. We stress that each establishment of business relations with a customer from a high-risk country requires the prior consent of the Management Board of the Company. In addition, more detailed questions regarding the identification and verification of the user, the understanding of its business relations or the ascertainment of the origin of funds should be expected. If we recognise the risk concerning AML/CTF as too high, we will not establish relations with the user or previously established relations will be dissolved. List of high-risk countries:

4. Countries and territories using harmful tax competition (“tax havens”):

a) American Samoa

b) Guam

c) Samoa

d) Trinidad and Tobago

e) US Virgin Islands

f) Fiji

g) Oman

h) Vanuatu

i) Palau

j) Panama

The above list is in accordance with the current EU black list of tax havens:https://ec.europa.eu/taxation_customs/tax-common-eu-list_en#heading_3

5. Countries producing drugs, in particular:

a) Colombia

b)the Golden Triangle (Burma, Laos and Thailand)

c) the Golden Crescent (Afghanistan, Pakistan and Iran)

6. High-risk countries resulting from the delegated regulation of the European Commission

a) North Korea (DPR Korea)

b) Afghanistan

c) Bosnia and Herzegovina

d) Guyana

e) Iraq

f) Lao People’s Democratic Republic

g) Syria

h) Uganda

i) Vanuatu

j) Yemen

k) Ethiopia

l) Sri Lanka

m) Trinidad and Tobago

n) Tunisia

Additional jurisdictions specified by the European Commission

a) Afghanistan,

b) American Samoa,

c) Guam

d) Iraq,

e) Libya,

f) Nigeria,

g) Panama,

h) Puerto Rico,

i) Samoa,

j) ASaudi Arabia

k) Virgin Islands https://ec.europa.eu/commission/presscorner/detail/en/MEMO_19_782

7. High-risk countries

a) Bahamas

b) Botswana

c) Cambodia

d) Ghana

e) Iceland

f) Mongolia

g) Panama

h) Trinidad and Tobago

i) Yemen

j) Zimbabwe

In addition, as a part of managing the risk of money laundering and financing of terrorism, zondacrypto uses also enhanced due diligence measures towards entities operating in industries or conducting a kind of business activity that increases the risk of money laundering and financing of terrorism. A detailed list of industries and business activities generating a higher risk of money laundering and financing of terrorism is included in the appendix to the internal AML procedure.

XI. U.S. Tax residency

The applicable provisions of Estonian law oblige financial institutions to comply with the Foreign Account Tax Compliance Act (FATCA).

The American FATCA regulation puts foreign (non-American) financial institutions under an obligation to submit specific information about accounts kept for U.S. taxpayers to local fiscal authorities.

These institutions are obliged to identify American accounts – i.e., accounts held by tax residents of the United States of America – and to report information about these accounts and profits related to them to Estonian fiscal authorities.

zondacrypto is not registered on the website of the Tax Office of the United States of America and does not provide reporting services; therefore, for the purpose of compliance with the law, we prevent tax residents of the United States of America from using our services.

XII. Data storage and protection

According to § 47 of the Act, zondacrypto as an obliged entity is obliged to keep original documents or their copies that serve as a basis for the identification and verification of persons and documents serving as a basis for the determination of a business relation, correspondence and documentation of all activities conducted as a part of AML/CFT policy for a period not shorter than 5 years after the end of the business relation.

In practice, the above means that we are obliged to keep all data concerning the customer and its transactions for a period not shorter than 5 years after the end of co-operation between the user and zondacrypto.

zondacrypto is obviously obliged to protect personal data in accordance with the provisions of the Act and the regulations of the European Union.

With regard to personal data protection, zondacrypto complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), called also the GDPR, unless the provisions concerning AML/CFT specify otherwise.