AML & KYC Policy

This Anti-Money-Laundering (AML) and Know-Your-Customer (KYC) Policy sets out how the OKIAS Service may be used, the jurisdictions we do not serve, our sanctions-screening approach, and the record-keeping expectations on customers. It forms part of your agreement with OKIAS (SMC-Pvt) Ltd and should be read with our Terms of Service.

1. Purpose & scope

OKIAS provides identity-verification technology that helps regulated and non-regulated businesses meet their AML/KYC and counter-terrorist-financing obligations. This policy applies to every customer and every verification submitted through the Service.

2. OKIAS’s role

OKIAS is not a bank, money-services business, or the customer’s compliance officer. We supply verification decisions, reason codes and screening signals as decision-support. The customer is responsible for its own AML/KYC programme, risk appetite, ongoing monitoring, and the final decision to onboard, approve, reject or offboard any End User.

3. Acceptable use

You may use the Service only where you:

• Have a legitimate compliance or fraud-prevention purpose and a valid legal basis.
• Have obtained any legally required notice and consent from each End User, including explicit consent for biometric processing where applicable.
• Comply with all applicable AML, sanctions, data-protection and consumer-protection laws.

4. Prohibited uses

• Verifying individuals without a lawful basis or required consent.
• Surveillance, discriminatory profiling, harassment, or building a watchlist of individuals unrelated to a genuine compliance purpose.
• Facilitating money laundering, terrorist financing, sanctions evasion, or any other criminal activity.
• Submitting fraudulent, stolen, or synthetic identities other than your own bona fide test fixtures.
• Using the Service to serve customers in prohibited jurisdictions or in breach of applicable sanctions.

5. Prohibited & restricted jurisdictions

The Service is not offered in, and may not be used for individuals ordinarily resident in, Israel (IL). In addition, OKIAS does not provide the Service in comprehensively sanctioned jurisdictions or to any person on an applicable sanctions list. Comprehensively sanctioned regions currently include, without limitation, the Crimea, Donetsk and Luhansk regions, Cuba, Iran, North Korea and Syria. You are responsible for ensuring your own use complies with the sanctions regimes that apply to you, which may be broader than this list. OKIAS may update the restricted list at any time to reflect legal and risk developments.

6. Sanctions & watchlist screening

Where enabled, verifications are screened against official government sanctions and watchlists, including the U.S. OFAC SDN and consolidated lists, the EU consolidated list, the UN Security Council list and the UK (OFSI) list. Lists are refreshed on a regular cadence. Screening returns potential matches with reason codes; a screening hit is a signal for the customer to review and adjudicate, not an automatic determination by OKIAS. Customers are responsible for acting on hits in line with their own obligations, including any reporting and asset-freezing duties.

7. Customer due diligence obligations

Customers must implement their own risk-based customer due diligence (CDD), enhanced due diligence (EDD) for higher-risk cases, and ongoing monitoring as required by the laws that apply to them. The OKIAS Service supports, but does not replace, these obligations. OKIAS may perform its own KYB checks on customers before or during use of the Service.

8. Record-keeping

OKIAS retains verification decisions, reason codes, screening results and audit logs to support customers’ record-keeping and to defend against fraud, in line with our Privacy Policy and any executed DPA. Many AML regimes require obligated entities to retain verification records for a minimum period (commonly five years) after the end of the business relationship; customers remain responsible for meeting their own statutory retention requirements and can export the records they need.

9. Suspicious activity & reporting

OKIAS does not file suspicious-activity or suspicious-transaction reports on a customer’s behalf; that duty rests with the obligated entity. If OKIAS detects abuse of the Service, we may investigate, restrict access, and where legally required, report to competent authorities.

10. Enforcement

Violations of this policy may result in warning, throttling, suspension or termination of the account under our Terms of Service, and, where required, notification to relevant authorities. We may act immediately where there is risk of harm, sanctions exposure or unlawful use.

11. Contact

To report suspected misuse of the Service or ask about this policy, contact us. A dedicated compliance alias will be published when available; until then please use the addresses below.

• Compliance & abuse reports: security@okias.io
• General support: support@okias.io
• OKIAS (SMC-Pvt) Ltd — Reg No. H489273 — ICN 0308002, Lane No 1, Bank Street, Husaini Chowk, Bahawalpur, Punjab 63100, Pakistan.