SharkPay OÜ

1.1.

These rules of procedure for prevention of money-laundering and financial terrorism (“Rules”) provide guidelines for the Company and its employees to perform due diligence obligations pursuant to Money Laundering and Terrorist Financial Prevention Act of Estonia and International Sanction Act.

1.2.

The basis of these Rules comprises International Sanctions Act, Money Laundering and Terrorist Financing Prevention Act (“Act”) and Directive (EU) 2015/849 of the European Parliament and of the Council.

1.3.

The purpose of these Rules is, by increasing the trustworthiness and transparency of the business environment, to prevent the use of the financial system and economic space of the Republic of Estonia for money laundering and terrorist financing (“ML/TF”).

1.4.

These Rules regulate and provide:

1.4.1.

a procedure for the application of due diligence measures regarding a customer, including a procedure for the application of simplified due diligence measures specified;

1.4.2.

a model for identification and management of risks relating to a customer and its activities and the determination of the customer’s risk profile;

1.4.3.

the methodology and instructions where the Company has a suspicion of ML/TF or an unusual transaction or circumstance is involved as well as instructions for performing the reporting obligation;

1.4.4.

the procedure for data retention and making data available;

1.4.5.

instructions for effectively identifying whether a person is a politically exposed person or a person subject to international sanctions or a person whose place of residence or seat is in a high-risk third country or country that, according to credible sources such as mutual evaluations, detailed evaluation reports or published follow-up reports, (i) has not established effective AML/CFT systems; or (ii)has significant levels of corruption or other criminal activity; or (iii) that is subject to sanctions, embargos or similar measures issued by, for example, the European Union or the United Nations; or (iii) that provides funding or support for terrorist activities, or that has designated terrorist organisations operating within their country, as identified by the European Union or the United Nations;

1.4.6.

the procedure for identification and management of risks relating to new and existing technologies, and services and products, including new or non-traditional sales channels and new or emerging technologies;

1.5.

The provisions of these Rules apply to all business relationships and transactions related to customers pursuant to the procedure provided by Act.

1.6.

The employees of the company must be familiar with and strictly follow the requirements provided for in the Act, the instructions for identifying the characteristics of a transaction suspected of ML/TF issued by the FIU and these Rules.

1.7.

A regular review is performed whether the Rules are up to date and they will be supplemented and updated as necessary, but not less frequently than once per year.

1.8.

To follow the rules of procedures, the Company has developed and implemented internal rules and procedures pursuant to the Act.

1.9.

The Company cooperates with other obliged entities and with state supervisory and law enforcement authorities in preventing ML/TF, including communicating information available to them and replying to queries within a reasonable time, following the duties, obligations and restrictions arising from legislation.

2.1.

Money laundering means:

• the conversion or transfer of property derived from criminal activity or property obtained instead of such property for the purpose of concealing or disguising the illicit origin of the property or of assisting any person who is involved in the commission of such an activity to evade the legal consequences of that person’s actions;
• the acquisition, possession or use of property derived from criminal activity or property obtained instead of such property, knowing, at the time of receipt, that such property was derived from criminal activity or from an act of participation therein;
• the concealment of the true nature, origin, location, manner of disposal, relocation or right of ownership of property acquired as a result of a criminal activity or property acquired instead of such property or the concealment of other rights related to such property;

2.1.1.

Money laundering also means participation in, association to commit, attempts to commit and aiding, abetting, facilitating and counselling the commission of any of the activities referred to in section 2.1.

2.1.2.

Money laundering is regarded as such also where a criminal activity which generated the property to be laundered was carried out in the territory of another country.

2.1.3.

Money laundering is regarded as such also where the details of a criminal activity which generated the property to be laundered have not been identified.

2.2.

Terrorist financing means the financing and supporting of an act of terrorism and commissioning thereof as well as the financing and supporting of travel for the purpose of terrorism within the meaning of §§ 2373 and 2376 of the Penal Code.

2.3.

The beneficial owner (UBO) means a natural person who, via ownership or other type of control, has the final dominant influence over a natural or legal person, or in whose interests, for the benefit of whom or in whose name a transaction or operation is made. In the case of companies, the beneficial owner of a company is a natural person whose direct or indirect shareholding or the total shareholding of all of the direct and indirect shareholdings in the company exceeds 25 per cent, including shareholdings in the form of bearer shares or otherwise

2.4.

Politically exposed person (“PEP”) means a natural person who performs or has performed prominent public functions and with regard to whom related risks remain, incl. a head of State or head of government; minister, deputy minister or assistant minister; member of a legislative body; member of a governing body of a political party; judge of the highest court of a country; auditor general or a member of the supervisory board or executive board of a central bank; ambassador, envoy or chargé d’affaires; high-ranking officer in the armed forces; member of an administrative, management or supervisory body of a state-owned enterprise; director, deputy director and member of a management body of an international organisation, and other persons as prescribed by the Act (except middle-ranking or more junior officials).

2.4.1.

Family member of PEP means the spouse, or a person considered to be equivalent to a spouse; a child and their spouse, or a person considered to be equivalent to a spouse; a parent.

2.4.2.

A person known to be close associate of PEP means a natural person who is known to have joint beneficial ownership of a legal person or trust with a PEP; known to have close business relations with a PEP; the beneficial owner of a legal person or trust set up in the interests of a PEP;

2.5.

Virtual currency means a value represented in the digital form, which is digitally transferable, preservable or tradable and which natural persons or legal persons accept as a payment instrument, but that is not the legal tender of any country or funds for the purposes of Article 4(25) of Directive (EU) 2015/2366 of the European Parliament and of the Council on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, pp. 35–127) or a payment transaction for the purposes of points (k) and (l) of Article 3 of the same Directive;

2.6.

Virtual currency exchange service means a service with the help of which a person exchanges a virtual currency against a fiat currency or a fiat currency against a virtual currency or a virtual currency against another virtual currency;

2.7.

Virtual currency wallet service means a service in the framework of which keys are generated for customers or customers’ encrypted keys are kept, which can be used for the purpose of keeping, storing and transferring virtual currencies;

2.8.

High-risk third country means a country specified in a delegated act adopted on the basis of Article 9(2) of Directive (EU) 2015/849 of the European Parliament and of the Council on the prevention of the use of the financial system for the purposes of ML/TF, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ L 141/73, 05.06.2015, pp 73–117).

2.9.

Compliance officer means an employee appointed by the resolution of the management board of the company who shall act as the compliance officer for the Financial Intelligence Unit and who regulates and supervises the fulfilment of measures for the prevention of ML/TF. If no specific compliance officer has been appointed by the resolution of the management board, the obligations of the compliance officer shall be fulfilled by the member of the management board of the legal entity.

2.10.

International sanctions means an essential tool of foreign policy aimed at supporting the maintenance or restoration of peace, international security, democracy and the rule of law, following human rights and international law or achieving other objectives of the United Nations Charter or the Common Foreign and Security Policy of the European Union.

3.1.

The Company shall regularly prepare and update the risk assessment in order to identify, assess and analyse the risks of ML/TF related to its activities.

3.2.

The Company identifies the risks associated with its activities, as well as the risks that may arise in the near future, that is foreseeable risks, and assesses and analyses their significance and impact. The risks are identified and assessed on a case-by-case basis as of the moment of the risk assessment and separately considering the situation where the Company should take the risks to the maximum extent permitted by the risk appetite. The Company identifies, assesses and analyses at least the following risks:

3.2.1.

risks relating to customers;

3.2.2.

risks relating to products, services or transactions, including risks relating to new and/or future products, services or transactions;

3.2.3.

risks relating to communication, mediation or products, services, transactions or delivery channels between the Company and customers including if the above mentioned is new and/or provided in the future;

3.2.4.

risks relating to countries, geographic areas or jurisdictions.

3.3.

The Company identifies risk factors for the risks specified in clauses 3.2.1-3.2.4 that increase or decrease the risk of ML/TF.

3.4.

As a result of the risk assessment, the Company establishes:

3.4.1.

the risk factors which may affect the risk;

3.4.2.

the risk appetite, including the volume and scope of products and services provided in the course of business activities;

3.4.3.

the risk management model, including simplified and enhanced due diligence measures, in order to mitigate identified risks.

3.5.

The risk assessment and the establishment of the risk appetite is documented, the documents are updated where necessary and based on the published results of the national risk assessment.

3.6.

The Company shall update or renew the risk assessment and the related documents on an annual basis.

4.1.

The economic activity of the Company as the provider of a virtual currency service is primarily related to the handling and storage of currencies presented in a digital form. The provision of a service of exchanging a virtual currency against a fiat currency and a virtual currency wallet service primarily requires the use of new and evolving technologies, which may involve the implementation of new or non-traditional sales channels in the economic activities of the Company.

4.2.

The Company should identify and assess the ML/TF risks that may arise in relation to

• the development of new products and new business practices, including new delivery mechanisms, and
• the use of new or developing technologies for both new and pre-existing products.

5.1.

The management board of the Company appoints a person who acts as the compliance officer of the FIU. The compliance officer reports directly to the management board of the Company and has the competence, means and access to relevant information across all the structural units of the Company.

5.2.

The duties of a compliance officer include, inter alia:

5.2.1

organisation of the collection and analysis of information referring to unusual transactions or transactions or circumstances suspected of ML/TF, which have become evident in the activities of the Company;

5.2.2.

reporting to the FIU in the event of suspicion of ML/TF;

5.2.3.

periodic submission of written statements on compliance with the requirements arising from this Act to the management board of the Company;

5.2.4.

performance of other duties and obligations related to compliance with the requirements of the Act.

5.3.

The compliance officer may deliver information or data which has become known to him or her in connection with a suspicion of money laundering only to FIU, a pre-trial investigation authority in connection with criminal proceedings and to the court on the basis of a court order or decision.

5.4.

Each employee of the Company must inform the compliance officer of all cases of refusal to establish a business relationship on the basis of Act, suspicious or unusual transactions, cases of extraordinary termination of the long-term contract and other circumstances that may affect the performance of the obligations of the Company under Act.

6.1.

The Company applies the following due diligence measures:

6.1.1.

identification of the customer (it’s representative) and verification of submitted information;

6.1.2.

identification of the beneficial owner and, for the purpose of verifying their identity, taking measures to the extent that allows the Company to make certain that they know who the beneficial owner is, and understands the ownership and control structure of the customer;

6.1.3

understanding of business relationship or conducting a financial transaction;

6.1.4.

gathering information on whether a person is a PEP, their family member or a person known to be a close associate;

6.1.5.

business relationship monitoring.

6.2.

The due diligence measures mentioned above must be applied before establishing the business relationship or, if not in business relationship, before the transaction.

7.1.

The Company may apply simplified due diligence (SDD) measures when it is identified according to the risk assessment prepared that in the case of the economic or professional activity, field or factors, the risk of ML/TF is lower than usual.

7.2.

Before the application of SDD measures to a customer, the Company establishes that the business relationship, transaction or act is of a lower risk.

7.3.

The application of SDD measures is permitted to the extent that the Company ensures sufficient monitoring of transactions, acts and business relationships, so that it would be possible to identify unusual transactions and allow for notifying of suspicious transactions in accordance with the procedure established in the Act.

7.4.

The Company applies enhanced due diligence (EDD) measures in order to adequately manage and mitigate a higher-than-usual risk of ML/TF.

7.5.

Enhanced due diligence measures are applied always when:

7.5.1.

upon identification of a person or verification of submitted information, there are doubts as to the truthfulness of the submitted data, authenticity of the documents or identification of the beneficial owner;

7.5.2.

the customer is a PEP, their family member or a close associate;

7.5.3

the customer is from a high-risk third country or their place of residence or seat or the seat of the payment service provider of the payee is in a high-risk third country;

7.5.4.

the customer is from such country or territory or their place of residence or seat or the seat of the payment service provider of the payee is in a country or territory, according to credible sources such as mutual evaluations, reports or published follow-up reports, has not established effective AML/CFT systems that are in accordance with the recommendations of the Financial Action Task Force, or that is considered a low tax rate territory;

7.5.5.

a complex, high-value or unusual transaction or transaction pattern takes place that does not have a reasonable or apparent economic or legitimate purpose or is not characteristic to a particular business field;

7.5.6.

in other cases provided by the Act.

7.6.

The Company applies EDD measures also where a risk assessment prepared by the Company identifies that, in the case of the economic or professional activity, field or factors, the risk of ML/TF is higher than usual.

7.7.

The Company may apply additional due diligence measures in order to manage and mitigate an established risk of ML/TF that is higher than usual, by choosing at their own discretion one or several due diligence measures.

7.8.

If the data are insufficient or untrue or if there are suspicions of ML/TF, the Company must apply due diligence measures for as long as they have collected sufficient data, they are convinced that the data are true or until the suspicions of ML/TF, are eliminated.

7.9.

The Company documents and, upon the demand of the supervisory authority, demonstrates why, in respect of what and which type of due diligence measures the Company has applied to the customer upon the establishment of the business relationship or in respect of transactions during the business relationship.

8.1.

Upon the establishment of a business relationship and as in the course of a business relationship or if a certain trigger event occurs, the Company will take measures to ascertain whether the customer or the person who wants to conclude an occasional transaction and the beneficial owner or representative of these persons is a politically exposed person, their family member or close associate, or if the customer has become such a person.

8.2.

In a situation where the person participating in a transaction made in economic or professional activities is a PEP, their family member or close associate, in addition to the relevant due diligence measures the Company applies the following additional due diligence measures:

8.2.1.

obtains approval from the Company’s management board to establish or continue a business relationship with the person;

8.2.2.

requests necessary information from the customer, including applying measures to establish the sources of the wealth and financial means of the person that are used in the business relationship or upon executing transactions;

8.2.3.

verifies data or making inquiries in relevant databases or public databases or making inquiries or verifying data on the websites of the relevant supervisory authorities or institutions of the country in which the customer or person is located.

8.2.4.

monitors the business relationship in an enhanced manner.

8.3.

Where a PEP no longer performs important public functions placed upon them, the Company must at least within 12 months take into account the risks that remain related to the person and apply relevant and risk sensitivity-based measures as long as it is certain that the risks characteristic of PEP no longer exist in the case of the person.

9.1.

Where the Company comes in contact with a high-risk third country via a person participating in a transaction made in the Company’s economic or professional activities, via a person participating in a professional act, via a person using a professional service or via a customer, the Company applies the following due diligence measures:

9.1.1.

gathering additional information about the customer and its beneficial owner;

9.1.2.

gathering additional information on the planned substance of the business relationship;

9.1.3.

gathering information on the origin of the funds and wealth of the customer and its beneficial owner;

9.1.4.

gathering information on the underlying reasons of planned or executed transactions;

9.1.5.

receiving permission from the Company’s management board to establish or continue a business relationship;

9.1.6.

improving the monitoring of a business relationship by increasing the number and frequency of the applied control measures and by choosing transaction indicators that are additionally verified.

9.2.

In addition to the aforementioned, the Company may demand that a customer make a payment from an account held in the customer’s name in a credit institution of a contracting state of the European Economic Area or in a third country that implements requirements equal to those of Directive (EU) 2015/849 of the European Parliament and of the Council.

10.1.

The Company must observe the business relationship with the customer established in the course of economic or professional, i.e. perform the monitoring of the business relationship.

10.2.

The objective of monitoring is to identify suspicious and unusual transactions and transaction patterns; transactions exceeding the provided thresholds; PEP and circumstances regarding international sanctions.

10.3.

The Company must regularly check and update the documents, data and information collected in the course of the application of due diligence measures. The regularity of the checks must be based on the risk profile of the customer.

10.4.

The relevant employee must document all the findings about the customer and it’s behaviour which support the decision of the relevant employee about closing or reporting the case to the Compliance Officer.

10.5.

The monitoring of business relationships must include at least the measures envisaged by the Act.

11.1.

The Company is prohibited to establish a business relationship or allow to execute an occasional transaction or conclude it if:

11.1.1.

the Company suspects ML/TF or it is impossible for the Company to apply the due diligence measures taken upon the establishment of business relationships, because the customer does not submit the relevant data or refuses to submit them or the submitted data give no grounds for reassurance that the collected data are adequate;

11.1.2.

a person whose capital consists of bearer shares or other bearer securities wants to establish a business relationship or conclude an occasional transaction;

11.1.3.

a person who does not have the authorisation to operate as a credit or financial institution, but whose main and permanent economic activities via the Company are similar or correspond to the provision of financial services subject to authorisation, wants to establish a business relationship or conclude an occasional transaction;

11.1.4.

this would require the opening of an anonymous account or savings book, as well as the opening of an account clearly in the name of the wrong person;

11.1.5.

a natural person behind whom is another, actually benefiting person, wants to establish a business relationship or conclude an occasional transaction (suspicion that a person acting as a front is used).

11.1.6.

the Company is not allowed to establish or continue correspondent relationships with shell banks and such credit institutions or financial institutions that knowingly allow shell banks use their accounts.

11.2.

In respect of the circumstances of refusal to establish a business relationship or conclude an occasional transaction, the Company performs the reporting obligation, registers and retains the data of the refusal to establish a business relationship or conclude an occasional transaction as well as of the performance of the reporting obligation.

11.3.

The Company has the right to refuse to make a transaction within the scope of a business relationship where a person participating in a transaction or a customer, in spite of a respective request, does not submit documents and relevant information or data or documents proving the origin of the assets constituting the object of the transaction or the purpose of the transaction or where the data and documents submitted make the Company suspect ML/TF or the commission of related crimes or an attempt at such activity. 11.4. If the data are insufficient or untrue or if there are suspicions of ML/TF , the Company must apply due diligence measures for as long as they have collected sufficient data, they are convinced that the data are true or until the suspicions of ML/TF are eliminated.

12.1.

Upon the entry into force of an act establishing or implementing an international financial sanction, the Company shall take measures to fulfill the obligations arising therefrom and shall show the necessary diligence to ensure the achievement of the objective of the international financial sanction and to prevent violation of the sanction.

12.2.

The subject of international sanctions is any natural or legal person, entity or body, designated in the legal act imposing or implementing international sanctions, with regard to which the international sanctions apply.

12.3.

The duties of the person liable for applying the international sanctions are performed by the compliance officer of the Company, or if not available, the management board of the Company.

12.4.

The countries subject to the European Union sanctions can be checked on the following webpage: https://www.sanctionsmap.eu/#/main; the subjects of European Union and UN sanctions can be checked on the webpage of the Financial Intelligence Unit: https://www.politsei.ee/et/rahapesu/.

13.1.

The Company must report to the FIU on the activity or the circumstances that they identify in the course of economic activities and whereby:

13.1.1.

the characteristics indicate the use of criminal proceeds or the commission of crimes related to this (this is primarily a report on a suspicious and unusual transaction or activity);

13.1.2.

in the case of which they suspect or know or the characteristics of which indicate the commission of money laundering or related crimes (this is primarily a report on a transaction or activity whereby money laundering is suspected);

13.1.3.

in the case of which they suspect or know or the characteristics of which indicate the commission of terrorist financing or related crimes (this is primarily a report on a transaction or activity whereby terrorist financing is suspected);

13.1.4.

in the case of which an attempt of the activity or circumstances specified in clause 13.1.1 to 10.1.3 is present.

13.2.

The FIU must be notified:

13.2.1.

by the Company also about the circumstances of refusal of establishment of a business relationship or completing an occasional transaction;

13.2.2.

by the Company, also about each transaction that has become known whereby a pecuniary obligation of over 32 000 euros or an equal sum in another currency is performed in cash, regardless of whether the transaction is made in a single payment or in several linked payments over a period of up to one year.

13.3.

In any case (i.e. also in the situation where an activity or circumstance is identified after the completion of the transaction), the reporting obligation must be performed immediately, but not later than two working days after the identification of the activity or circumstance or the emergence of the actual suspicion (i.e. the situation where the suspicion cannot be dispelled).

13.4.

The Company, a structural unit of the Company, a member of a management body and an employee is prohibited to inform a person, its beneficial owner, representative or third party about a report submitted to them to the FIU, a plan to submit such a report or the occurrence of reporting.

13.5.

The reporting obligations should be made in terms and in compliance with the procedure established by the Act.

14.1.

The Company must register all the Сustomer’s information and documents obtained during due diligence process, including information about the circumstances of refusal of the establishment of a business relationship or to conclude a transaction, data and documents collected in the course of monitoring the business relationship, data related to the performance of the reporting obligation. This information must be retained for at least 5 (five) years after the expiry of the business relationship or the completion of an occasional transaction or after the performance of the reporting obligation.

14.2.

Documents and data must be retained in a manner that allows for exhaustive and immediate response to the queries made by the FIU or, pursuant to legislation, other supervisory authorities, investigation authorities or the court.

14.3.

The Company deletes the retained data after the expiry of the time period, unless the legislation regulating the relevant field establishes a different procedure. On the basis of a precept of the competent supervisory authority, data of importance for prevention, detection or investigation of ML/TF may be retained for a longer period, but not for more than five years after the expiry of the first time period.

14.4.

The Company is allowed to process personal data gathered upon implementation of the Act only for the purpose of preventing ML/TF and the data must not be additionally processed in a manner that does not meet the purpose, for instance, for marketing purposes.

15.1.

The Company ensures the training of the employees involved in the prevention of ML/TF as well as of the senior management, incl. the management board.

15.2.

Training must take place when the employee commences the performance of said duties and thereafter regularly or as necessary. The Company combines explanatory and informational parts with possible assessments of knowledge during training if necessary.

15.3.

The regularity of training depends on the size of the Company and the nature, scope and level of complexity of the activities and services provided, incl. the risk appetite and risks arising from activities of the Company, but it usually takes place at least once a year. If necessary, employees are trained or informed more frequently, incl. when the rules of procedure change, there are significant changes in the risks arising from activities, new trends and methods of ML/TF are detected, etc.

15.4.

The Company retains the details of the person that carried out the training in a format that can be reproduced in writing for at least two years after the training took place.