1. Introduction

Castle Rich Limited Luxembourg ("Castle Rich", "we", "us", "our") is committed to combating money laundering, terrorist financing, and other financial crimes. This Anti-Money Laundering (AML) and Know Your Customer (KYC) Policy outlines our comprehensive framework for identifying, preventing, and reporting suspicious activities.

We adhere to the highest standards of financial integrity and regulatory compliance. Our AML/KYC program is designed to meet or exceed the requirements of Luxembourgish and European Union regulations.

2. Legal Framework

Our AML/KYC Policy is based on the following legal instruments:

• Law of 12 November 2004 on the fight against money laundering and terrorist financing (as amended);
• EU Directive 2015/849 (4th Anti-Money Laundering Directive);
• EU Directive 2018/843 (5th Anti-Money Laundering Directive);
• EU Directive 2024/1640 (6th Anti-Money Laundering Directive);
• EU Regulation 2023/1113 on information accompanying transfers of funds and certain crypto-assets;
• Financial Action Task Force (FATF) Recommendations;
• Luxembourg CSSF Circulars and Regulations applicable to financial sector professionals.

3. AML Compliance Officer

Castle Rich Limited Luxembourg has appointed a qualified AML Compliance Officer responsible for the implementation and oversight of our AML/KYC program. The AML Compliance Officer's responsibilities include:

• Developing and maintaining AML/KYC policies and procedures;
• Receiving and reviewing suspicious transaction reports;
• Liaising with the Financial Intelligence Unit (FIU) of Luxembourg;
• Conducting regular risk assessments;
• Overseeing employee training programs;
• Reporting to senior management and regulatory authorities.

Our AML Compliance Officer can be reached at aml@castlerck.com.

4. Customer Due Diligence (CDD)

We perform Customer Due Diligence on all clients before establishing a business relationship. CDD measures include:

• Valid government-issued identification (passport, national ID card, driver's license);
• Proof of residential address (utility bill, bank statement, tax notice - dated within 3 months);
• Tax identification number (TIN);
• Source of funds and source of wealth declaration;
• Purpose of account and expected trading activity;
• Employment and financial background information.

• Certificate of incorporation and memorandum/articles of association;
• Register of shareholders and ultimate beneficial owners (UBOs);
• Identification of directors and authorized signatories;
• Audited financial statements;
• Business license and regulatory authorizations (if applicable);
• Proof of business address;
• Nature of business and expected trading activity.

We continuously monitor client accounts and transactions to ensure information remains current. Clients are required to notify us of any material changes to their circumstances.

5. Enhanced Due Diligence (EDD)

Enhanced Due Diligence is applied in higher-risk situations, including:

• Clients identified as Politically Exposed Persons (PEPs);
• Clients from high-risk jurisdictions (as identified by FATF and EU);
• Complex or unusually large transactions;
• Accounts with unclear purpose or ownership structures;
• Non-face-to-face onboarding (remote verification);
• Correspondent banking relationships.

EDD measures may include senior management approval, additional verification sources, enhanced monitoring, and increased frequency of review.

6. Politically Exposed Persons (PEPs)

A Politically Exposed Person is an individual entrusted with a prominent public function. PEPs include heads of state, government ministers, senior politicians, senior judges, senior military officials, and their immediate family members and close associates.

We conduct enhanced due diligence for PEPs, including:

• Senior management approval for account opening;
• Source of wealth and source of funds verification;
• Enhanced ongoing monitoring;
• Annual review of PEP status.

Accounts for family members and close associates of PEPs are subject to the same enhanced measures.

7. Transaction Monitoring

We employ automated and manual monitoring systems to detect unusual or suspicious transactions. Our monitoring framework includes:

• Real-time transaction screening against sanctions lists and watchlists;
• Algorithmic detection of unusual patterns (structuring, rapid trading, round-number transactions);
• Threshold monitoring (large deposits, rapid withdrawals, multiple small transactions);
• Geographic risk assessment for cross-border transfers;
• Comparison of transaction activity against expected client profile.

All flagged transactions are reviewed by our AML Compliance Officer.

8. Suspicious Activity Reporting

Any employee who suspects money laundering, terrorist financing, or other financial crimes must report their concerns to the AML Compliance Officer immediately. The AML Compliance Officer will:

• Conduct an internal investigation;
• Document findings and supporting evidence;
• Determine whether a Suspicious Transaction Report (STR) should be filed;
• File STRs with the Luxembourg Financial Intelligence Unit (FIU).

9. Record Keeping

We maintain comprehensive records of all AML/KYC activities in accordance with legal requirements. Records include:

• Client identification documents (copies and verification notes);
• Customer due diligence records and updates;
• Transaction records (minimum 10 years retention);
• Suspicious transaction reports and investigation documentation;
• Employee training records;
• AML risk assessments and audit reports.

All records are stored securely and are available for inspection by regulatory authorities upon request.

10. Employee Training

All Castle Rich Limited Luxembourg employees receive comprehensive AML/KYC training upon hire and annually thereafter. Training covers:

• Recognition of money laundering and terrorist financing red flags;
• Internal reporting procedures;
• Customer due diligence requirements;
• Sanctions screening protocols;
• Recent regulatory developments and enforcement actions;
• Consequences of non-compliance.

Training records are maintained and available for audit.

11. Sanctions Compliance

Castle Rich Limited Luxembourg complies with all applicable sanctions regimes, including:

• UN Security Council sanctions;
• EU sanctions and restrictive measures;
• UK sanctions (OFSI);
• US sanctions (OFAC - limited territorial applicability).

We screen all clients, beneficial owners, and transactions against global sanctions lists. We do not knowingly engage with sanctioned individuals, entities, or jurisdictions. Any positive match is immediately reported to the AML Compliance Officer.

12. Prohibited Activities

The following activities are strictly prohibited on our platform:

• Money laundering or terrorist financing;
• Using anonymous accounts, shell companies, or nominee structures without disclosure;
• Structuring transactions to avoid reporting thresholds;
• Using the platform for any illegal purpose;
• False or misleading statements during KYC onboarding.

Violations will result in immediate account termination and reporting to relevant authorities.

13. Risk Assessment

We conduct regular AML risk assessments to identify and mitigate vulnerabilities. Risk factors considered include:

• Client geography and jurisdiction risk;
• Client type (individual, corporate, trust, non-profit);
• Expected transaction size and frequency;
• Product and service offerings;
• Delivery channels (online platform, physical delivery).

Risk assessments are reviewed annually and updated as needed.

14. Third-Party Relationships

When we engage third-party service providers (payment processors, verification services, technology vendors), we ensure they maintain adequate AML/KYC controls. Third-party relationships are subject to:

• Due diligence before engagement;
• Contractual AML/KYC obligations;
• Ongoing monitoring and periodic review.

15. Audit and Review

Our AML/KYC program is subject to regular independent audits, including:

• Annual internal audit by our compliance team;
• External audits by qualified third-party firms;
• Regulatory inspections by Luxembourg authorities (CSSF, FIU);
• Surprise audits as determined by management.

Audit findings are reported to senior management and corrective actions are implemented promptly.

16. Confidentiality

All AML/KYC information, including suspicious transaction reports and internal investigations, is treated as strictly confidential. Access is limited to:

• AML Compliance Officer;
• Senior management (as needed);
• Regulatory authorities with legal authority;
• External auditors (under confidentiality obligations).

Employees who violate confidentiality requirements are subject to disciplinary action, including termination.

17. Consequences of Non-Compliance

Non-compliance with our AML/KYC Policy has serious consequences:

• For Clients: Account suspension, termination, reporting to authorities, and potential criminal prosecution.
• For Employees: Disciplinary action up to and including termination, personal criminal liability.
• For Castle Rich Limited Luxembourg: Regulatory fines, license suspension or revocation, reputational damage.

18. Contact Information

For questions about our AML/KYC Policy or to report suspicious activity, please contact: