AML Policy

1. Program overview

This program covers employees, RFQ matching and routing, participant onboarding, sanctions screening, monitoring, reporting, training, independent testing, and recordkeeping. RIVERRUN is not a bank, exchange, custodian, or market maker and does not hold customer funds.

2. OFAC and multi-jurisdiction sanctions screening

Applicants, beneficial owners, control persons, authorized traders, and required transaction parties are screened against OFAC, United Nations, and other applicable sanctions lists. Screening occurs at onboarding, on list or risk changes, and before required activity. Unresolved potential matches are blocked or escalated.

3. Customer Identification Program — Individual End-User

Individual applicants provide full KYC information: legal name, date of birth, government-issued identification, ID country and expiry, citizenship, residential address, US tax-residency status, TIN where applicable, PEP status, source of funds and description, transaction purpose, expected monthly volume, and contact details. Government ID and proof of residential address are collected after submission through a secure channel.

4. Corporate-KYB — Corporate Entity

Corporate applicants provide legal name, registration jurisdiction, Tax ID or EIN, registered address, business description, directors and control persons, full UBO ownership chart and details for natural persons holding 25% or more ownership or control, settlement account authorization information, expected volume, and primary contact details. Formation documents and the UBO chart are collected after submission.

5. Institutional-KYB deep-level due diligence with mandatory EDD

Institutional applicants inherit all Corporate-KYB requirements and provide regulatory licenses and registrations, authorized trading personnel, a dedicated compliance officer's full information and email, and an internal AML or compliance policy excerpt. Enhanced due diligence is mandatory and may include source-of-wealth review, regulatory verification, adverse media, senior-management approval, and additional controls.

6. Unified sanctions screening

All three categories receive the same sanctions-screening baseline. No category may bypass screening or due diligence.

7. Travel Rule by applicant type

Where a transmittal or transfer is subject to the Travel Rule, required originator, beneficiary, and transaction information is collected. For individuals, identity and account data are verified before routing. For corporates and institutions, authorized signatory, entity, beneficial-owner, and settlement-account information is verified. Required information is shared with the receiving institution or retained as law permits.

8. Transaction monitoring and investigation

Compliance uses risk-based rules, thresholds, manual reviews, and public-source information to review applications, RFQs, routing records, participant behavior, and activity patterns.

9. SAR reporting

Where suspicious activity or attempted activity is identified and a report is required by federal law, the company prepares and files a Suspicious Activity Report (SAR) with the appropriate authority and supports law enforcement.

10. Five-year BSA retention

Applications, due-diligence materials obtained through the secure follow-up process, RFQ and routing records, required reports, and audit logs are retained for five years or longer where law requires.

11. Training and independent testing

Personnel receive role-based BSA/AML and sanctions training. The program is tested independently and updated when law, products, risks, or findings require.