KYC and Sanctions Policy

1Purpose

1.1We work to prevent NEVIX services from being used for money laundering, terrorist financing, proliferation financing, sanctions evasion, fraud and other unlawful activity. This Policy explains the controls that affect you; we do not disclose confidential detection rules. We apply relevant controls to each enabled exchange, wallet, transfer and P2P service.

1.2NeviX operates its compliance programme with reference to applicable Malaysian laws and regulatory guidance, including the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), guidance issued by the Financial Intelligence and Enforcement Department of Bank Negara Malaysia, and the Securities Commission Malaysia guidelines on prevention of money laundering, countering financing of terrorism and targeted financial sanctions for reporting institutions in the capital market. We do not claim in this Policy to be registered, licensed, recognised or approved by any Malaysian authority.

1.3Our controls follow a risk-based approach. The information, verification level, monitoring and limits applied to an account or transaction can differ according to customer type, geography, product, payment method, asset, volume and other relevant risk indicators.

1.4This public Policy does not disclose thresholds, detection scenarios or investigation methods that could enable evasion. We may update operational controls without describing every confidential change, while material customer obligations remain governed by published terms and applicable law.

2Responsibility and governance

2.1NEVIX Exchange is a brand and platform owned and operated by NeviX, with technology powered by Pips Forex Technology. NeviX is responsible for the controls we perform. Banks, payment services and other partners retain their own legal obligations; their controls do not replace ours. Our Compliance personnel oversee risk assessment, escalation, monitoring, record keeping and policy review, with management oversight.

2.2Management assigns responsibility for the AML programme, approves material policies and receives reporting on significant risks, control performance and remediation. Compliance personnel must have appropriate authority, access to records and escalation routes.

2.3We assess the money-laundering, terrorist-financing, proliferation-financing, sanctions and fraud risks of our customers, products, assets, delivery channels and geographic exposure. The assessment is reviewed when material services or risks change and at appropriate periodic intervals.

2.4Business objectives do not override a legal reporting duty or a documented compliance control. Personnel must escalate suspected interference, conflicts or attempts to bypass required review.

3Customer identification

3.1We may require your legal name, date of birth, address, identity document, photograph or liveness check, contact details and payment-account ownership before enabling an account or specific service. For businesses, we may require incorporation documents, authorised representatives and beneficial owners. We may verify information against reliable independent sources and repeat checks when information changes.

3.2We may refuse or pause a service if required information is missing, inconsistent, false or cannot reasonably be verified. Verification at one time does not guarantee that later transactions will be approved.

3.3Individual verification may include legal name, date of birth, nationality, residential address, government identification, photograph or liveness evidence, tax or residency information and ownership of contact and payment methods. We may use reliable independent sources and require updated documents when earlier evidence expires.

3.4For a legal entity, we may identify its legal form, registration, business activities, address, controllers, directors, authorised users and ultimate beneficial owners. We may request authority documents and understand the ownership and control structure before enabling the account.

3.5We may verify whether a person is acting for themselves, on behalf of another person or as an authorised representative. Accounts, payment instruments and wallet activity must not be used to conceal the true owner, beneficiary or purpose of a transaction.

3.6Customer due diligence is ongoing. We may review an account when activity differs materially from the stated purpose, ownership changes, documents expire, risk information changes or a legal requirement calls for refresh.

4Enhanced due diligence

4.1We may request source-of-funds or source-of-wealth evidence, purpose of activity, relationship to counterparties or further identity information where a risk assessment calls for it. Higher-risk activity may receive closer monitoring, lower limits or management approval. We will seek information proportionate to the risk and applicable law.

4.2Enhanced review may apply to politically exposed persons and their relatives or close associates, high-risk jurisdictions, unusual ownership structures, privacy-enhancing technology, high-risk assets or services, adverse information and activity lacking an apparent lawful purpose.

4.3Evidence can include bank or exchange statements, transaction records, payslips, business accounts, contracts, tax information, sale documents, inheritance evidence or another reliable record appropriate to the stated source. We may ask questions needed to connect the evidence to the transaction.

4.4Enhanced due diligence does not imply wrongdoing. We may nevertheless decline or restrict activity when we cannot understand or manage the risk, verify required information or satisfy a legal obligation.

5Sanctions and prohibited activity

5.1We may screen customers, beneficial owners, counterparties, addresses and transactions against applicable sanctions and risk information, including United Nations Security Council sanctions lists and the domestic list maintained by Malaysia's Ministry of Home Affairs. You must not use our services on behalf of a prohibited person, from a restricted location, with stolen assets, or to evade controls through nominees, multiple accounts, VPNs or false information.

5.2We may restrict assets, networks, jurisdictions, payment methods or counterparties where law or documented risk controls require it. A restriction may apply even after an account was opened.

5.3Prohibited activity includes laundering criminal proceeds, terrorist or proliferation financing, sanctions evasion, fraud, ransomware, trafficking, corruption, illegal gambling, market manipulation, use of stolen identity or funds and any activity unlawful in the relevant jurisdiction.

5.4You must not split activity to avoid a threshold; use nominees, mule accounts or unrelated third-party payment methods; misstate a transaction’s purpose; trade with yourself to fabricate activity; or use privacy tools to conceal prohibited conduct.

5.5A potential sanctions match is reviewed using available identifying information. We may reject, block, freeze or report property or activity where required by applicable sanctions or a competent authority. We may be legally unable to notify you in advance or provide details.

6Transaction monitoring

6.1We review patterns that may indicate suspicious trading, layering, circular transfers, structuring, fraud, compromised credentials, sanctions exposure or misuse of P2P. Monitoring can include account records, blockchain information and information lawfully obtained from providers. An alert is not itself a finding of wrongdoing.

6.2Monitoring can occur before, during or after a transaction and may consider connected accounts, counterparties, devices, payment instruments, wallet addresses, asset flows, velocity, value and stated account purpose. We may combine automated detection with specialist review.

6.3Examples of activity that may require review include rapid movement without an apparent purpose, repeated failed verification, deposits followed by immediate withdrawals, unexplained third-party payments, circular trading, interaction with high-risk services and attempts to defeat limits.

6.4We document investigation steps and the basis for closing, escalating or continuing an alert. A cleared alert does not prevent later review if new information becomes available.

7Holds, reports and cooperation

7.1We may delay, reject, freeze or review a transaction or account where required or permitted by law and the Terms. We may request documents and report relevant activity to competent authorities where legally required. We may be unable to explain a hold or report where disclosure would be unlawful or compromise an investigation. We cooperate with valid legal requests and challenge or narrow them where appropriate.

7.2A hold can apply to a specific transaction, asset, product or the whole account. We review whether the restriction remains necessary and release it when the lawful or risk basis no longer applies, subject to settlement and operational requirements.

7.3We submit reports to competent authorities when applicable law requires us to do so, including suspicious transaction reports to the Financial Intelligence and Enforcement Department of Bank Negara Malaysia under the AMLA. A report is not a determination of guilt. We do not disclose the existence or contents of a protected report where doing so is prohibited or could prejudice an investigation.

7.4Law-enforcement and authority requests must use an authorised channel and provide sufficient information to establish identity, authority, legal basis, scope and account connection. We preserve or disclose records only to the extent required or permitted by law.

8Records and confidentiality

8.1We keep identity, transaction, screening, review and decision records for the period required by applicable law and longer only where another lawful reason applies. Access is limited to authorised personnel and service providers. We protect report confidentiality and do not disclose a suspicious-activity report to a person where doing so is prohibited.

8.2Records may include identification evidence, beneficial ownership, risk assessments, monitoring alerts, supporting documents, communications, decisions, transaction references, reports and training or control-test results. We maintain them in a form reasonably capable of reconstruction and lawful production.

8.3We apply access control, logging, secure transmission and retention measures appropriate to the sensitivity of compliance data. Personnel may access it only for authorised duties and are subject to confidentiality requirements.

8.4When a retention period ends, records are securely deleted or anonymised unless an investigation, legal hold, dispute or another lawful need requires continued preservation.

9Partners, training and review

9.1We assess relevant banks, payment, identity and other material service providers according to risk. Staff handling accounts and investigations receive role-appropriate training. Controls are reviewed after material legal, product or threat changes and tested independently where required or appropriate.

9.2Due diligence on a material provider can include ownership, reputation, regulatory status where relevant, security, privacy, financial-crime controls, subcontracting, resilience and termination arrangements. We define responsibilities contractually and monitor material performance.

9.3Training covers relevant legal duties, customer due diligence, sanctions, red flags, escalation, confidentiality, record keeping and the prohibition on tipping off. Completion and effectiveness are recorded and refreshed according to role and risk.

9.4Control testing assesses design and operation, records findings, assigns remediation owners and tracks material issues to closure. Significant weaknesses are escalated to management.

10Customer duties and contact

10.1Keep your information current; use payment methods and assets you are authorised to use; respond accurately to reasonable compliance requests; and do not attempt to bypass a hold. Send compliance questions to compliance@nevix.com and suspected fraud to security@nevix.com. Complaints about a decision may be submitted to complaints@nevix.com, although legal confidentiality can limit the details we provide.

10.2You must notify us if your identity, address, residency, beneficial ownership, authorised users, business activity, source of funds or intended account use materially changes. Continued use of outdated or false information may result in restriction or closure.

10.3Provide genuine, complete and readable documents through the approved channel. Do not redact information needed for verification unless we agree, and never send a private key, seed phrase, password or authentication code.

10.4A complaint or request for review does not require us to execute a transaction while the review is pending. We will explain the decision and route for escalation as far as applicable law and investigation integrity permit.

Regulatory reference: Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (Malaysia); Bank Negara Malaysia Financial Intelligence and Enforcement Department; Securities Commission Malaysia AML/CFT and targeted financial sanctions guidelines for the capital market.