AML and Sanctions Policy

Document owner: [MLRO OR COMPLIANCE FUNCTION]

Approved by: [BOARD OR GOVERNING BODY]

Version: [VERSION NUMBER]

Effective date: [EFFECTIVE DATE]

Next review: [NEXT REVIEW DATE]

Public or internal status: [PUBLIC SUMMARY OR INTERNAL POLICY]

1 Purpose

This policy describes the framework used by BARS 8 LTD, trading as BARS 8, to identify, assess, manage and report risks relating to money laundering, terrorist financing, proliferation financing, sanctions evasion, fraud and related financial crime.

BARS 8 applies a risk-based approach. Controls reflect the nature of the client, beneficial ownership, geography, products, delivery channels, transactions, payment methods and other relevant factors. A completed identity check does not end the assessment. Risk is considered throughout the relationship.

2 Scope

This policy applies to:

• directors, officers, employees and temporary personnel;
• branches, subsidiaries and controlled operations listed in [IN-SCOPE ENTITY SCHEDULE];
• contractors, agents and outsourced providers performing in-scope controls;
• prospective and current clients, authorised representatives and beneficial owners;
• strategy providers, PAMM managers, partners, affiliates and other business relationships where due diligence is required; and
• all products, accounts, payment channels, jurisdictions and technology used to deliver BARS 8 services.

Each in-scope person must comply with this policy, related procedures and applicable law. Local rules take priority where they impose a higher or mandatory standard. A conflict between requirements must be escalated to the Money Laundering Reporting Officer or equivalent function before activity continues.

3 Legal and standards framework

The final policy must identify the legislation, regulations, regulator rules, sanctions regimes and official guidance binding on each in-scope entity. The approved schedule should include:

• [PRIMARY AML AND COUNTER-TERRORIST FINANCING LAW];
• [PROLIFERATION FINANCING REQUIREMENTS];
• [APPLICABLE SANCTIONS LAW AND REGIMES];
• [BENEFICIAL OWNERSHIP AND COMPANY TRANSPARENCY RULES];
• [RECORDKEEPING AND REPORTING RULES];
• [DATA PROTECTION AND INFORMATION SHARING RULES]; and
• [REGULATOR OR FIU GUIDANCE].

BARS 8 considers relevant Financial Action Task Force standards and authoritative sanctions guidance when designing its controls. These sources support the framework and do not replace binding local law.

4 Governance and responsibility

4.1 Governing body

The board or governing body approves the financial-crime risk appetite, this policy and material changes. It receives management information at least [REPORTING FREQUENCY], including client risk distribution, high-risk approvals, screening results, monitoring alerts, internal reports, regulatory reports, overdue reviews, training completion, quality findings and remediation.

4.2 Senior management

Senior management allocates adequate authority, staff, data, technology and budget. It ensures commercial targets do not override due diligence, escalation or reporting responsibilities.

4.3 MLRO or nominated officer

The [MLRO OR NOMINATED OFFICER TITLE] has direct access to the governing body and sufficient independence to:

• maintain the enterprise financial-crime risk assessment;
• approve or reject relationships requiring elevated approval;
• receive and assess internal suspicious activity reports;
• submit external reports to [FINANCIAL INTELLIGENCE UNIT OR AUTHORITY];
• oversee sanctions and transaction-monitoring controls;
• maintain regulatory engagement and reporting records;
• require restrictions, enhanced monitoring, account suspension or exit; and
• report material weaknesses and remediation progress.

4.4 First, second and third lines

Business and operations teams perform onboarding, understand expected activity and raise concerns. Compliance designs and oversees the framework, provides advice and conducts monitoring. Internal audit or an appropriately independent reviewer tests design and effectiveness according to the risk-based assurance plan.

4.5 Individual duty

Every in-scope person must report knowledge, suspicion or reasonable grounds for suspicion through the approved internal channel immediately. They must preserve confidentiality and avoid any action that could prejudice an investigation or amount to prohibited tipping off.

5 Enterprise risk assessment

BARS 8 maintains a documented enterprise-wide assessment that identifies inherent risk, evaluates control effectiveness and determines residual risk. It is reviewed at least annually and when a material trigger occurs, including:

• entry into a new country or client segment;
• launch of a product, payment method, partner channel or technology;
• acquisition, merger or significant outsourcing;
• a material change in law, sanctions or official guidance;
• discovery of a control failure or financial-crime typology; or
• a significant change in transaction volumes, client behaviour or threat intelligence.

The methodology considers client, ownership, geography, product, transaction, delivery-channel, payment, partner, technology and employee risk. Assumptions, data sources, scoring, limitations, control ratings and approval are documented.

6 Client risk assessment

Each relationship receives an initial and ongoing risk classification under the approved methodology. Relevant factors can include:

• legal form, occupation, industry and business activity;
• ownership and control complexity;
• nationality, residence, incorporation and operating locations;
• politically exposed person status and close associations;
• sanctions, adverse media, law-enforcement or regulatory concerns;
• expected deposit, withdrawal and trading patterns;
• source of funds and, where appropriate, source of wealth;
• use of corporate vehicles, trusts, nominees or intermediaries;
• reliance on non-face-to-face onboarding or third parties;
• payment instruments and links to crypto-assets;
• partner or affiliate source; and
• inconsistency between the stated profile and observed behaviour.

Risk scoring supports judgement and never replaces it. Manual changes to a risk outcome require a recorded reason, authorised approver and audit trail.

7 Customer due diligence

7.1 Timing

BARS 8 completes required identification, verification, screening and risk assessment before establishing a relationship or permitting activity, except where a specific legal allowance has been documented and approved. No exception may enable anonymous use or unrestricted transactions.

7.2 Individuals

Required information can include:

• full legal name and any former or alternative names;
• date and place of birth;
• nationality and tax residence;
• residential address and contact details;
• government-issued identity information;
• occupation, employer or business activity;
• purpose and intended nature of the relationship;
• expected funding, withdrawal and trading profile;
• source of funds and source of wealth where risk requires; and
• tax identification and declarations required by law.

Identity and address are verified using reliable, independent sources approved in the onboarding procedure. Liveness, device, database and documentary checks may support verification. Failed, inconsistent or manipulated evidence is escalated.

7.3 Legal persons and arrangements

For a company, partnership, trust, foundation or other arrangement, BARS 8 obtains and verifies information appropriate to its form, including:

• legal name, form, status, number and registered address;
• constitutional and ownership documents;
• principal business, operating locations and expected activity;
• directors, partners, trustees, protectors, beneficiaries or equivalent persons;
• persons authorised to act and evidence of their authority;
• ownership and control structure; and
• ultimate beneficial owners under [APPROVED OWNERSHIP THRESHOLD AND CONTROL TEST].

Ownership is traced through each layer to the natural persons who ultimately own or control the relationship. Where no person meets an ownership threshold, the applicable senior-managing-official or alternative-control rule is followed and recorded. Bearer instruments, nominee arrangements and unexplained complexity require enhanced review.

7.4 Purpose and expected activity

BARS 8 records why the client seeks the relationship and develops a reasonable expectation of account use. The profile includes expected funding sources, values, currencies, frequency, withdrawal destinations, intended products, trading volume and relevant third parties.

7.5 Inability to complete due diligence

Where required due diligence cannot be completed, BARS 8 will refuse, restrict or end the relationship as appropriate, consider whether funds may lawfully be returned, document the decision and assess whether an internal or external suspicious activity report is required.

8 Enhanced due diligence

Enhanced due diligence is applied where higher risk is identified or law requires it. Measures are tailored to the risk and may include:

• obtaining additional identity, ownership or business evidence;
• establishing source of funds and source of wealth in greater depth;
• verifying income, asset sale, inheritance, business revenue or other funding origin;
• obtaining senior-management approval;
• conducting focused adverse-media and public-record research;
• understanding reasons for complex structures or unusual geography;
• establishing the purpose and counterparties of material transactions;
• limiting products, payments, leverage, values or channels;
• increasing monitoring frequency and lowering alert thresholds; and
• requiring the first payment from an account in the client's verified name at an approved institution.

The file records the risk, evidence reviewed, conclusion, conditions, approver and next review date.

9 Politically exposed persons

BARS 8 identifies domestic and foreign politically exposed persons, persons entrusted with prominent functions in international organisations, their family members and known close associates in accordance with applicable law.

Before establishing or continuing a higher-risk PEP relationship, BARS 8 obtains [REQUIRED SENIOR APPROVAL], takes reasonable measures to establish source of wealth and source of funds, and applies enhanced ongoing monitoring. Former status is handled according to risk and applicable minimum periods. PEP status alone is not evidence of criminal conduct.

10 Sanctions and restricted parties

10.1 Screening

BARS 8 screens relevant clients, beneficial owners, authorised persons, payers, payees, partners and other parties against the sanctions lists legally applicable to the business. Screening occurs:

• before onboarding or activation;
• when relevant data changes;
• when sanctions data is updated;
• before or during payments where required; and
• periodically throughout the relationship.

Lists, ownership and control rules, fuzzy matching, transliteration, aliases, date-of-birth data and geography are configured under the sanctions procedure.

10.2 Alert handling

Potential matches are restricted while trained personnel compare identifiers and determine whether the match is false, possible or confirmed. Decisions, evidence and reviewer identity are recorded. Confirmed or unresolved matches are escalated immediately to the sanctions lead or MLRO.

10.3 Asset freeze, rejection and reporting

BARS 8 freezes, blocks, rejects, refrains from making available, reports or otherwise handles property and transactions exactly as applicable law requires. Staff must not return or move assets where that action would breach a prohibition. Legal advice and regulator or authority contact are obtained where required.

10.4 Geographic and sector restrictions

BARS 8 applies country, sector, product and activity restrictions in the approved matrix. Attempts to obscure location, ownership, payment origin, end use or a sanctioned nexus are treated as escalation indicators.

11 Ongoing monitoring

BARS 8 monitors the relationship so that transactions and behaviour remain consistent with its knowledge of the client, risk profile and expected activity. Monitoring combines automated scenarios, sanctions rescreening, operational review and event-driven investigation.

The monitoring framework can consider:

• deposits and rapid withdrawals with limited economic activity;
• third-party, mismatched-name or unexplained business payments;
• repeated failed or reversed payments;
• use of multiple instruments, wallets or jurisdictions without a clear rationale;
• funding inconsistent with occupation, wealth or stated purpose;
• transfers linked to high-risk jurisdictions or adverse information;
• apparent layering through trading, internal transfers, partner structures or multiple accounts;
• unusual use of managed, copy or PAMM relationships;
• account access anomalies, identity takeover indicators or collusion;
• trading patterns with no plausible market purpose where relevant to the operating model; and
• attempts to avoid verification, thresholds, monitoring or source inquiries.

Alert rules, thresholds, data coverage and prioritisation are validated and tuned. Closure targets reflect risk. Decisions must show the investigation performed, evidence considered and rationale.

12 Payments and withdrawal controls

Payments are accepted and returned only through methods approved for the client, entity and jurisdiction. Controls include:

• verifying ownership or control of the payment source where required;
• prohibiting or restricting cash, anonymous instruments and third-party payments;
• returning funds to the original verified source where legally and operationally possible;
• applying enhanced review to changed bank details or withdrawal destinations;
• reconciling deposits, trading accounts, withdrawals, chargebacks and refunds;
• preventing withdrawal activity from bypassing freezes, liens, margin obligations or reporting duties; and
• escalating suspected fraud, mule activity, payment manipulation or stolen credentials.

Any exception requires documented legal basis, risk assessment and authorised approval.

13 Suspicious activity reporting

13.1 Internal reports

An employee or contractor who knows, suspects or has reasonable grounds to suspect relevant financial crime must submit an internal report to [INTERNAL REPORTING CHANNEL] without delay. The report should contain facts, dates, parties, transactions, documents and reasons for concern. The reporter must not investigate beyond their role or tell the subject.

13.2 MLRO assessment

The MLRO assesses internal reports independently, obtains relevant information, records the reasoning and decides whether external reporting is required. Commercial impact does not determine the outcome.

13.3 External reports and consent

Reports are filed with [FINANCIAL INTELLIGENCE UNIT OR AUTHORITY] in the prescribed form and timeframe. Where a consent, defence or direction regime applies, BARS 8 will follow it before processing relevant activity.

13.4 Confidentiality

Suspicious activity reports, related deliberations and authority communications are access-restricted. Disclosure occurs only where law permits and operational need requires.

14 Relationship restrictions and exit

BARS 8 may delay onboarding, restrict activity, reject payments, suspend access or end a relationship where allowed by contract and law. The exit plan considers asset-freeze obligations, open positions, client money, reporting, communications, legal holds, staff safety and the risk of tipping off. The reason communicated to a client may be limited by law.

15 Recordkeeping

BARS 8 retains due diligence, risk assessments, screening, monitoring, investigations, decisions, transactions, communications, training and reports for [RETENTION PERIOD] or longer where a legal hold or authority requires it. Records must be retrievable, secure, complete and sufficient to reconstruct material activity and decisions.

Retention, deletion and access follow the Privacy and Cookie Policy and approved retention schedule. Regulatory secrecy and reporting requirements are respected when responding to data requests.

16 Reliance, outsourcing and data providers

Before relying on another person or appointing a provider, BARS 8 assesses legal permissibility, competence, data quality, security, location, service resilience, audit rights and termination arrangements. Accountability remains with BARS 8 to the extent required by law.

Contracts must address service levels, confidentiality, data protection, screening-list updates, access to records, incident notice, subcontracting, business continuity and regulatory cooperation. Providers are monitored under a risk-based plan.

17 Partners, affiliates and managers

Introducing brokers, affiliates, regional representatives, strategy providers and PAMM managers undergo risk-appropriate due diligence. Agreements prohibit misleading promotion, undisclosed client handling, circumvention of onboarding, facilitation of third-party payments and interference with monitoring or reporting.

Referral source, campaign and network information may inform client and partner risk. Compensation can be withheld or adjusted where the agreement permits and activity requires investigation.

18 Training and screening of personnel

Relevant personnel receive training at induction and at least [TRAINING FREQUENCY]. Content is role-specific and covers legal duties, red flags, sanctions, internal reporting, confidentiality, records, payment controls and emerging typologies. Completion and assessment results are recorded.

Employees in sensitive roles are subject to lawful pre-employment and ongoing screening, conflicts declarations, access controls and disciplinary standards.

19 Independent testing and quality assurance

The framework is independently tested at a frequency proportionate to risk. Reviews assess governance, risk methodology, onboarding, beneficial ownership, PEPs, sanctions, transaction monitoring, reporting, recordkeeping, training, outsourcing and remediation. Material findings are assigned an owner, due date and validation step and are reported to the governing body.

Operational quality assurance samples cases for completeness, consistent judgement and timely escalation. Repeated findings trigger root-cause analysis.

20 Data protection and information sharing

Financial-crime data is used, shared and retained under applicable legal bases and safeguards. Notices explain relevant processing unless an exemption applies. Access is limited by role. Requests from authorities, group companies and counterparties are assessed for lawful authority, necessity, proportionality, confidentiality and transfer restrictions.

Automated screening or risk scoring that produces a legally significant decision is subject to the rights and controls required by applicable data-protection law.

21 Breach and incident management

Actual or suspected breaches of this policy are reported to [INCIDENT CHANNEL] immediately. BARS 8 preserves evidence, limits harm, assesses reporting duties, records decisions and remediates root causes. Retaliation against a person who raises a genuine concern is prohibited.

22 Policy exceptions

An exception is permitted only where law allows it. The request must state the requirement, rationale, risk, compensating controls, owner and expiry date. Approval requires [APPROVER]. Permanent exceptions must be incorporated into the next policy review or closed.

23 Review and approval

This policy is reviewed at least [REVIEW FREQUENCY] and after a material legal, regulatory, business or risk change. The governing body approves material revisions. Current procedures, risk assessments, country matrices, retention schedules and escalation contacts form part of the framework.

Appendix A Client risk factors

Lower-risk indicators requiring contextual assessment

• transparent ownership and a readily verifiable business or occupation;
• funding from a regulated account in the client's name;
• activity consistent with stated means and purpose;
• residence and operations in lower-risk jurisdictions; and
• prompt, coherent response to reasonable information requests.

Higher-risk indicators

• complex or opaque ownership without a clear commercial reason;
• PEP exposure, sanctions proximity or credible adverse information;
• cash-intensive, corruption-exposed or lightly regulated activity;
• links to high-risk or secrecy jurisdictions;
• unexplained wealth or payment sources;
• nominee shareholders, bearer instruments or frequent ownership changes;
• identity, device or location inconsistencies;
• high-velocity funding and withdrawal;
• multiple third parties or payment instruments;
• resistance to due diligence or use of apparently altered evidence; and
• activity inconsistent with the stated purpose or economic profile.

Appendix B Escalation record

The case record should capture:

• client and related-party identifiers;
• alert or concern source;
• chronology and transaction data;
• due diligence and expected profile;
• screening and research results;
• explanation requested and received;
• analysis and alternative explanations;
• decision, conditions and authority;
• reporting assessment;
• client communication constraints;
• review date; and
• supporting evidence location.

Appendix C Approval schedule

Decision

Minimum approver

Evidence required

High-risk relationship

[APPROVER]

Enhanced due diligence and written rationale

PEP relationship

[APPROVER]

PEP assessment, source of wealth and source of funds

Sanctions true or unresolved match

[SANCTIONS LEAD OR MLRO]

Match analysis and legal requirements

Payment exception

[APPROVER]

Ownership, rationale, legal basis and controls

Relationship exit

[APPROVER]

Risk, reporting, asset and communication plan

Policy exception

[APPROVER]

Time-limited exception and compensating controls