AML/CTF programme

Policy SET-CMP-020 · Anti-Money Laundering and Counter-Terrorist Financing Programme · Version 0.1 (draft) · 2026-11-08

1. Purpose

To prevent SET's products from being used to launder money, finance terrorism or proliferation, evade sanctions, or commit fraud; to detect and report such use; and to meet SET's contractual obligations to its provider and its enterprise customers.

2. Basis

SET writes this programme to the standard the Bank Secrecy Act sets for a money services business (31 CFR 1022.210): a written programme "commensurate with the risks", with internal policies, procedures and controls; a designated person "to assure day to day compliance"; "education and/or training of appropriate personnel"; and "independent review to monitor and maintain an adequate program". It adds the customer due diligence rule (31 CFR 1010.230), the funds-transfer recordkeeping and travel rules (31 CFR 1010.410(e)–(f)), OFAC's regulations (31 CFR Part 501 and the sanctions programmes), and the FATF Recommendations. Applying MSB standards is SET's choice; it is not a statement that SET is an MSB (SET-CMP-001 §8, question 1).

3. Governance

As SET-CMP-001 §4. The Compliance Officer:

• maintains the risk assessment and this programme;
• approves high-risk customers and every exit for compliance reasons;
• decides every suspicious activity case and every report;
• is the contact for the provider's compliance team, regulators and law enforcement;
• reports to the board at least quarterly: customers by risk rating, alerts and cases, reports made, RFIs, training, open issues and the implementation status table.

4. Risk assessment

An enterprise-wide risk assessment is completed before adoption and refreshed every 12 months and on any new product, corridor or customer segment. It scores inherent risk and control effectiveness for each:

The residual rating drives monitoring thresholds and review frequency. The assessment and its approval are kept for ten years.

5. Customer due diligence

• Businesses: SET-CMP-010. Individuals: SET-CMP-011.
• No anonymous use: every account, address and key belongs to a verified customer.
• Beneficial owners at 25% (10% for high risk) and a control person are identified and verified, and screened.
• Purpose and intended nature of the relationship are recorded and used as the baseline for monitoring.
• Enhanced due diligence for high-risk customers, PEPs and restricted activities.

6. Ongoing monitoring

Customers are re-screened daily against sanctions lists, refreshed on the schedule and triggers in SET-CMP-010 §9, and their activity is compared with their profile under SET-CMP-050.

7. Transaction monitoring

SET-CMP-050 sets the scenarios, thresholds, alert handling and timelines. Every alert is reviewed and closed with a written reason. Thresholds are tuned at least annually against outcomes; a change is approved by the Compliance Officer.

8. Travel Rule

Every movement carries originator and beneficiary data built and checked in code before the request is sent; a movement missing data the provider requires is refused (worker/lib/travel-rule.ts). There is no threshold: SET applies the data to every amount, exceeding the US $3,000 rule (31 CFR 1010.410(f)) and the FATF and EU standards. Wallet ownership is attested from the user's signed identity token or, for platforms, the time the platform verified it (ownershipVerifiedAt). Third-party originators are named per payment; unidentified ones are alerts (S-07).

9. Suspicious activity

9.1 What is suspicious

Any activity SET knows, suspects or has reason to suspect: involves funds from illegal activity or is intended to hide them; is designed to evade reporting or recordkeeping (structuring); has no business or apparent lawful purpose and is not what would be expected of the customer, with no reasonable explanation after examining the facts; involves the use of SET to facilitate criminal activity; or relates to terrorist financing or sanctions evasion. This tracks the federal standard (for MSBs, 31 CFR 1022.320, which applies at "$2,000" and above); SET applies it to any amount.

9.2 Escalation

1. Anyone at SET who notices unusual activity escalates it to the Compliance Officer the same business day through the restricted channel. No one investigates by contacting the customer about the suspicion.
2. Automated alerts open a case directly.

9.3 Investigation

The Compliance Officer (or an analyst under supervision) reviews the customer file, the transaction history, payer and payee data, on-chain history, open-source information and any provider data, and may send an ordinary RFI that does not reveal the suspicion. Target: complete within 20 calendar days of the alert.

9.4 Decision and reporting

The Compliance Officer decides within 30 calendar days of initial detection (the federal filing deadline for MSB SARs, 31 CFR 1022.320(b)(3)), and records the decision and reasons whether or not a report is made.

Continuing activity is reviewed every 90 days after a report. SET keeps a report and its supporting documentation for at least five years from filing (the federal period), and under this programme ten years.

9.5 Confidentiality

A suspicious activity report, and any information that would reveal one exists, is never disclosed to the customer, the platform or any other party except as the law allows (31 CFR 1022.320(d) for MSB SARs). Customer-facing messages for a suspension or exit state only that SET cannot continue the service. A platform is told that a merchant has been suspended, not why.

10. Sanctions

SET-CMP-030.

11. Records

The ten-year period also meets Swiss law (AMLA Art. 7(3)). Records SET holds are in its own systems; identity documents are with the provider and obtainable under SET's agreement. Records are producible within 5 business days of a lawful request.

12. Training

• Within 30 days of starting, and before handling any customer: everyone at SET who onboards, monitors, supports or builds for customers.
• Every year: everyone, with a test (pass mark 80%).
• Role-specific: KYB/KYC and EDD for operators; red flags and escalation for support; sanctions and Travel Rule for engineering; the provider's requirements and reporting for the Compliance Officer.
• Content: this programme; red flags in SET-CMP-050; confidentiality; recent typologies (FinCEN, FATF, the provider).
• Records: attendee, date, content, test result.

13. Independent testing

An independent, qualified reviewer (an outside firm, or someone at SET with no role in the programme) tests the programme within 12 months of adoption and every 12 months after: the risk assessment, CDD files on a sample, alert and case handling, reports and their timeliness, sanctions screening, Travel Rule enforcement, records and training. Findings go to the board with a remediation plan and owners; the Compliance Officer tracks them to closure.

14. Information requests

15. Exit

SET exits a customer that: is a sanctions match; is engaged in a prohibited activity; cannot be verified; does not answer an RFI within 10 business days of a reminder; repeatedly generates unexplained alerts; or exceeds SET's risk appetite. Exit means: revoke keys; stop new accounts and addresses; deactivate virtual accounts; ask the provider to restrict the customer; and return or route funds only as the provider and the law allow (sanctioned funds are blocked, not returned). The decision and evidence are kept.

16. Data protection

Compliance data is the minimum needed, kept in restricted systems, never logged in clear, and never placed in analytics, prompts or public output. Access is limited to the Compliance Officer and named delegates.