# AML/KYC Policy
**Last updated:** 26.12.2025\
**Legal Entity:** Pound Payments Ltd Sp. z o.o.
This AML/KYC Policy (“Policy”) describes the Anti-Money Laundering (AML), Counter-Terrorist Financing (CTF), Customer Due Diligence (CDD), and sanctions compliance framework applied by Pound Payments Ltd Sp. z o.o., operating under the brand Bitray (“Bitray”, “we”, “us”, “our”).
Bitray is a Polish-registered Virtual Asset Service Provider (VASP) and provides B2B crypto payment processing, restricted operational custody, and crypto-to-crypto exchange services.\
This Policy outlines the principles and controls Bitray applies to prevent its services from being used for money laundering, terrorist financing, sanctions evasion, or other unlawful activities.
By applying for or using Bitray’s services, the Client agrees to comply with this Policy.
### 1. Introduction
This AML/KYC Policy applies to services provided under the brand Bitray, operated by Pound Payments Ltd Sp. z o.o., a company incorporated in Poland and registered as a Virtual Asset Service Provider (VASP).
Bitray complies with:
* The Polish Anti-Money Laundering and Counter-Terrorist Financing Act (Ustawa AML),
* EU AML Directives (AMLD IV, V, VI),
* FATF Recommendations,
* MiCA (Regulation (EU) 2023/1114)
* Regulation (EU) 2023/1113 (Travel Rule / TFR)
The purpose of this Policy is to describe how Bitray manages financial crime risk, applies due diligence to its Clients, and ensures its services are not used for money laundering, terrorist financing, or sanctioned activity.
Bitray operates exclusively in a B2B model. Bitray does not provide services to private individuals.
### 2. Scope of AML-Relevant Services
Bitray provides the following services to business clients (legal entities):
* Crypto payment processing for merchant transactions,
* Operational, short-term custody of virtual assets strictly for payment routing and settlement,
* Crypto-to-crypto exchange via external regulated liquidity providers,
* Settlement of virtual assets to merchant-controlled external wallets.
Bitray does *not* provide:
* Long-term custodial wallet services,
* Services to natural persons,
* Fiat services directly (any fiat settlement is performed by third-party regulated PSPs selected by the merchant),
* Wallets for unrelated or third-party payments.
All custody performed by Bitray is strictly operational and does not constitute deposit-taking, investment services, or general-purpose custody.
### 3. Customer Due Diligence (CDD) / Merchant Verification (KYB)
Since Bitray operates exclusively with legal entities, CDD focuses on companies and their ownership structure, not retail end-users.
Bitray verifies the following before providing services:
#### 3.1 Identification and Verification
* Legal entity information (name, registration, jurisdiction)
* Directors and authorised representatives
* Ultimate Beneficial Owners (UBOs)
* Ownership and control structure
* Nature and purpose of business activities
* Anticipated transaction profile and geography
* Relevant licenses (e.g., gambling licenses, MSB/financial registrations)
#### 3.2 Required Documentation
May include:
* Certificate of incorporation / registry extract,
* Full ownership structure chart,
* Identity documents of directors/UBOs,
* Proof of business address,
* Relevant permits or licenses,
* Source of funds / source of wealth (when applicable),
* Technical and operational information necessary to assess AML/CTF risk,
* License information where applicable,
* Website check.
#### 3.3 Risk-Based Approach
Bitray applies a risk-based approach in line with FATF and EU standards.
Enhanced Due Diligence (EDD) is applied when the Client:
* Operates in a high-risk industry (e.g., gambling, MSB/financial services),
* Has complex ownership, opaque structure, or high geographic risk,
* Is exposed to high-risk jurisdictions,
* Demonstrates elevated transactional patterns.
* Has a director, authorised representative, or UBO who is a Politically Exposed Person (PEP) or a close associate or family member of a PEP.
Failure to provide information may result in onboarding delays, suspension, or rejection.
### 4. Ongoing Monitoring
Bitray continuously monitors the business relationship and transactional activity, including:
* Consistency with the expected activity profile,
* Detection of unusual or suspicious behavior,
* Screening of directors and UBOs against sanctions lists (UN, EU, OFAC),
* Periodic re-verification of documents,
* Analysis of transactional patterns to detect ML/TF indicators,
* Monitoring adherence to jurisdictional restrictions.
Bitray may request updated documents or clarifications at any time during the business relationship.
#### 4.1 Suspension and Review
Bitray may suspend transactions, delay settlement, or restrict access to services if:
* Activity deviates significantly from the expected profile,
* Required information is not provided,
* Travel Rule data is missing or incomplete, the client refuses to provide the required information,
* Activity triggers financial crime indicators,
* There is suspicion of ML/TF, sanctions evasion, or fraud.
If legally required, Bitray reports suspicious activity to the Polish Financial Intelligence Unit (GIIF). Bitray is prohibited from informing Clients of such reports.
### 5. Prohibited Jurisdictions & Activities
Bitray does not onboard Clients who:
* Are incorporated in, operating from, or serving customers in Prohibited Jurisdictions (Appendix 1),
* Engage in Prohibited Activities (Appendix 2),
* Are subject to international sanctions,
* Pose risks outside Bitray’s risk appetite.
Clients are responsible for implementing effective controls (including geo-blocking) to prevent access from prohibited jurisdictions.
### 6. Travel Rule Compliance
Bitray complies with FATF Recommendation 16 and the EU Travel Rule requirements.
#### 6.1 When Travel Rule Applies
Bitray collects, validates, and transmits originator/beneficiary data when:
* Required by EU thresholds or local regulations,
* Transacting with Travel Rule-enabled counterparties.
#### 6.2 Client Responsibilities
Client must:
* Provide requested information about transaction originators/beneficiaries,
* Maintain internal controls aligned with the Travel Rule,
* Notify Bitray if they rely on sub-merchants or downstream financial partners.
#### 6.3 Bitray's Responsibilities
Bitray must:
* Transmit Travel Rule data to receiving VASPs when technically possible,
* Identifies and flags counterparties that do not comply with the Travel Rule,
* May reject transactions with non-compliant VASPs,
* Applies a risk-based approach to unhosted (self-custody) wallets.
Transactions lacking required information may be paused or rejected.
### 7. Settlement Wallet Verification
Before enabling settlements, Bitray verifies:
* Ownership or control of merchant-provided settlement wallets,
* Network compatibility,
* Sanctions and jurisdictional risk associated with wallet addresses.
Bitray may refuse settlement to wallets that cannot be verified or pose compliance concerns.
### 8. Cooperation With Third-Party Financial Partners
Merchants may use external regulated service providers for:
* Fiat settlements,
* Custodial wallets,
* Payment aggregation,
* Third-party payout management.
The Client remains fully responsible for the AML/KYC obligations toward its own customers, sub-merchants, or users.
Bitray may request evidence of the Client’s AML program when:
* The client is a financial services provider (e.g., MSB),
* The client manages downstream customers,
* Needed to meet EU AML requirements or partner due diligence.
Third-party providers may perform their own verification independently of Bitray.
### 9. Data Protection and GDPR Compliance
Bitray processes personal data strictly for:
* Compliance with AML/CFT obligations (legal obligation),
* Performance of contractual requirements,
* Sanctions screening,
* Risk management and fraud prevention.
AML data may be shared with competent authorities, auditors, and regulated partners when legally required. Bitray retains AML data for the mandatory minimum period under Polish AML Act (usually 5 years).
Processing of personal data is governed by Bitray’s Privacy Policy.
### 10. Reporting Obligations
Bitray’s MLRO evaluates and reports suspicious transactions to GIIF and other competent authorities, as required.
Clients acknowledge that:
* Bitray may file reports without notifying the Client,
* It is forbidden by law to disclose STR/SAR filings.
### 11. Policy Amendments
Bitray may update this AML/KYC Policy in line with:
* Legislative changes,
* Supervisory expectations,
* Internal risk assessments,
* Technological developments.
The latest version is published on Bitray’s website.
### Appendix 1. List of restricted jurisdictions
Bitray does not provide services to legal entities incorporated in, operating from, or processing transactions on behalf of customers located in the jurisdictions listed below.
Restrictions apply for two distinct reasons, set out separately below.
#### Part A. Sanctions-Required Exclusions
Bitray is prohibited from providing services to persons or entities connected to the following jurisdictions under applicable EU, UN, and/or OFAC sanctions regimes. These restrictions are mandatory and not subject to exception.
* Afghanistan
* Belarus
* Cuba
* Iran, Islamic Republic of
* Libya
* Myanmar
* North Korea (DPRK)
* Russia (Russian Federation)
* South Sudan
* Sudan
* Syria (Syrian Arab Republic)
* Venezuela, Bolivarian Republic of
* Yemen
Occupied and non-government-controlled territories: Bitray does not provide services to persons or entities located in or operating from the non-government-controlled areas of Donetsk, Luhansk, Zaporizhzhia and Kherson oblasts, and Crimea, in line with EU Council Regulation 833/2014 as amended.
Sanctions screening is conducted against the EU Consolidated Sanctions List, UN Security Council Sanctions List, and OFAC SDN List. The applicable lists are monitored continuously and this section reflects current designations as of the policy's last updated date.
#### Part B. Risk Appetite Exclusions
The following jurisdictions are not sanctioned countries. However, Bitray has made a commercial and risk management decision not to provide services in these markets at this time, based on its internal risk assessment, regulatory exposure, licensing considerations, or operational capacity.
This list does not imply any sanctions designation or legal prohibition against these countries.
* Algeria
* American Samoa
* Bangladesh
* Bosnia and Herzegovina
* Cambodia
* Congo, Democratic Republic of
* Eritrea
* Guinea
* Guinea-Bissau
* Iraq
* Lebanon
* Mali
* Nepal
* Nigeria
* Palestine, State of
* Somalia
* Qatar
* United States of America
* Zimbabwe
Bitray reserves the right to update this list at any time, and to decline services to any jurisdiction not explicitly listed where Bitray determines that the risk profile is outside its accepted risk appetite.
### Appendix 2. List of restricted business activities
| High-Risk Industry | Characteristics |
| ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Shell Banks and Shell Corporations | - No physical presence
- No real business activity
- No factual business address
- Lack of reporting obligations
|
| Companies Offering Bearer Shares | - Facilitate anonymity and concealment of ownership |
| Cash Collection Services | - Handling large volumes of cash |
| Debt Recovery Services | - Handling distressed assets and debt |
| Detective Services | - Conduct private investigations, potentially with minimal oversight |
| Unlicensed Forex, binance, Investment Services, financial, fintech | - Unlicensed or improperly regulated forex broker and Foreign currency exchange intermediary services, credit companies, collective funds and other financial institutions , Binary options trading & financial products in jurisdictions that do not have or require regulation/ licensing |
| Unlicensed Gambling and Unregulated Lottery | - Online gambling, bidding services, sports forecasting, online gaming, casinos |
| Firearms | - Production or sale of firearms, parts, explosives, ammunition, weapons, ammunition, rifles and related goods |
| Adult Entertainment and Paraphernalia | - Pornography, prostitution, adult live chat, webcam services, escorts, human trafficking, facilitating(management) of prostitution or escort, minor prostitution. |
| Legal and Illegal Substances | - Marijuana dispensaries, steroids, medical substances |
| Cyberlockers, IPTV | - Anonymous file storage, download websites, IP-based TV streaming |
| Multi-Level Marketing | - Pyramid schemes, network marketing, referral marketing |
| Pawnshop Services | - Dealing in second-hand goods with potential for high cash transactions |
| No-Value-Added Services | - Resale of services without added benefit, deceptive or predatory sites |
| Used Cars Dealerships | - Sale of second-hand vehicles |
| Unregulated Auctions | - Conducting auctions without proper regulation |
| Tobacco and Alcohol Products Distribution | - Distribution of tobacco and alcohol, potential for smuggling and counterfeit issues |
| Any type of products or services which are restricted or required additional registration on local territory | - Based on local laws and regulations |
| Precious stones and jewelry | - Gold, jewelry, diamonds etc |
| Governmental organizations |
|
| Purchasing and selling arms or atomic power |
|
| Unregulated charity |
|
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://bitray.gitbook.io/bitray-docs/aml-kyc-policy.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.