AML & KYC Policy

Last updated 5 October 2026

Anti-Money Laundering & KYC Policy

EriPay is committed to preventing its Services from being used for money laundering, terrorist financing, the financing of weapons proliferation, fraud or sanctions evasion. This policy summarises the controls we apply to every user, merchant and agent. It reflects the Anti-Money Laundering Act, 2013 (as amended) and its regulations, the Anti-Terrorism Act, 2002 (as amended), guidance from the Financial Intelligence Authority (FIA) of Uganda, and the international standards of the Financial Action Task Force (FATF).

1. Governance

EriPay's management is responsible for this policy and approves it at least once a year. A designated Money Laundering Reporting Officer (MLRO) oversees day-to-day compliance, reviews alerts, files reports with the FIA and trains our staff. All staff and agents receive anti-money laundering training when they join and at regular intervals.

2. Risk-based approach

We assess the money laundering and terrorist financing risk of each customer, product, delivery channel, currency and country we serve, and apply stronger controls where risk is higher. Products such as crypto Wallets, cross-border transfers, virtual cards and agent cash-out receive particular attention.

3. Customer due diligence (KYC)

3.1 Individuals

Before you can use the full Services we collect and verify:

• full name, date of birth, nationality and residential address;
• a valid government-issued photo ID, such as a Ugandan National ID (NIN), passport, driving permit or refugee ID;
• a selfie or liveness check that matches the ID;
• a verified phone number and email address; and
• where needed, proof of address, occupation, and the source of funds or wealth.

3.2 Businesses and merchants

• certificate of incorporation or business registration, and constitutional documents;
• registered address and place of business;
• identity of directors, authorised signatories and beneficial owners holding 10% or more, or otherwise controlling the business;
• the nature of the business, website, expected transaction volumes and the countries it serves; and
• any licence the business needs for its activity.

3.3 Agents

Agents go through business due diligence, location checks and a review of their operating history before approval, and are monitored on an ongoing basis.

3.4 Tiered limits

Accounts start with low limits that increase as verification is completed. Limits are shown in your Account and may change to reflect risk or legal requirements.

4. Enhanced due diligence

We apply enhanced checks, which may include source of funds and source of wealth evidence, senior management approval and closer monitoring, for:

• politically exposed persons (PEPs), their family members and close associates;
• customers connected to high-risk countries identified by the FATF or Ugandan authorities;
• businesses in higher-risk sectors, such as money services, virtual assets, gambling and high-value goods; and
• unusually large, complex or patterned transactions with no clear economic purpose.

5. Sanctions screening

We screen customers, beneficial owners and, where relevant, transaction counterparties against the sanctions lists of the United Nations Security Council and other lists that apply to EriPay, including designations made under Ugandan law. We do not open or maintain accounts for sanctioned persons and we block transactions that would breach sanctions.

6. Transaction monitoring

Our systems and team monitor activity for signs of money laundering, terrorist financing and fraud, such as structuring payments to stay under limits, rapid movement of funds in and out, use of many accounts by one person, mismatches with your profile, and links to high-risk crypto addresses. When we see unusual activity we may ask you for information or documents, delay or decline a Transaction, or restrict your Account.

7. Reporting to authorities

As required by law, we report suspicious transactions and other reportable transactions to the Financial Intelligence Authority and cooperate with lawful requests from regulators and law enforcement. The law prohibits us from telling a customer that a report has been made or is being considered ("tipping off"), so we may be unable to explain why a Transaction or Account has been restricted.

8. Crypto transfers

For digital asset transfers we collect originator and beneficiary information where required, may screen wallet addresses with blockchain analytics tools, and may decline transfers to or from addresses linked to sanctions, fraud, darknet markets, mixers or other illicit activity.

9. Record keeping

We keep customer identification records, transaction records and related correspondence for at least ten years after the end of the business relationship or the date of the transaction, or longer where an investigation or the law requires it. Records are stored securely as described in our Privacy Policy.

10. Your obligations

• Provide true, complete and current information, and update it when it changes.
• Respond promptly to our requests for information or documents.
• Use your Account only for yourself or your own business, never on behalf of someone you do not know.
• Do not try to avoid limits or checks by splitting payments or using multiple Accounts.

If you do not provide the information we need, we may be unable to continue serving you, and we may restrict or close your Account as described in our Terms & Conditions.

11. Report a concern

If you suspect fraud, a scam or misuse of EriPay, contact us at info@eripays.com with the subject line "Compliance". Reports are handled confidentially.