Financial Crime Prevention and Customer Verification Standard

This Standard describes the principal controls Orvexa LLC applies or may require in connection with its payment-facilitation activities, including limited non-custodial payment flows involving Customer-controlled self-hosted wallets. It is a public statement of Orvexa's compliance approach and does not disclose confidential detection rules, thresholds, investigation methods or reporting procedures.

1. Purpose and scope

Orvexa seeks to prevent its Services from being used for money laundering, terrorist financing, proliferation financing, sanctions evasion, fraud, cybercrime or other unlawful activity. Controls are applied on a risk-sensitive basis and may differ according to transaction type, jurisdiction, Merchant, payment method, use of a self-hosted wallet and other relevant factors.

This Standard applies to Customers using Orvexa-powered interfaces and supports the compliance framework applied to Merchants and other business relationships. It should be read together with the Terms and Conditions of Service and the Data Protection and Privacy Notice.

2. Shared compliance model

A Transaction can involve several specialised participants. Identity verification and AML checks may therefore be carried out by Orvexa itself and/or by a Merchant, Payment Partner, independent Digital-Asset Provider or verification provider, depending on the transaction flow and the responsibilities of each participant.

Where Orvexa relies on information or checks performed by another party, Orvexa may still request underlying data, additional documents, explanations or a fresh verification when reasonably required by law, contract, risk assessment or the circumstances of a Transaction.

Reliance on a partner does not prevent Orvexa from independently refusing or suspending a Transaction under its own risk controls.

3. Customer identification and verification

Orvexa may require information sufficient to identify the Customer and, for a legal entity, its authorised representatives and beneficial owners. The level of verification depends on risk and applicable requirements.

Verification may include review of government-issued identification, proof of address, corporate registry documents, ownership and control information, liveness or facial checks, and verification through reliable databases or electronic identity services.

Orvexa may perform further checks if information is inconsistent, incomplete, expired, difficult to verify, or otherwise raises a concern.

4. Information that may be requested

• Full legal name, date of birth, citizenship, residential address and contact information.
• Government-issued identification and, where relevant, proof of address.
• For businesses: legal name, registration details, registered address, directors, authorised representatives, ownership and beneficial-owner information.
• Purpose and expected nature of a Transaction or business relationship.
• Evidence concerning source of funds or source of wealth, including bank records, payroll or business documents, sale agreements, tax information or other reasonable evidence depending on the case.
• Proof that a payment instrument or bank account belongs to or is lawfully controlled by the Customer and, where relevant, evidence that a self-hosted wallet address is controlled by the Customer.
• Explanations or supporting records for unusual activity, counterparties, payment patterns or relevant self-hosted wallet activity.

5. Risk assessment

Orvexa uses a risk-based approach. Risk may be assessed by reference to customer profile, geography, product, delivery channel, Merchant category, transaction size and frequency, payment method, relevant self-hosted wallet risk indicators, sanctions indicators, adverse information and other factors relevant to the Services.

Higher-risk situations may require enhanced due diligence, management review, additional evidence, stricter transaction limits or a decision not to proceed. Lower-risk situations may be handled through proportionate simplified measures where legally permitted.

6. Sanctions and politically exposed persons

Orvexa may screen Customers, beneficial owners, counterparties and relevant transaction data against sanctions, terrorism and other restrictive-measures lists maintained by competent authorities. Screening may also include politically exposed persons and other heightened-risk categories where appropriate.

A potential match may lead to additional verification, delay, rejection, restriction, reporting or other action required by law. Where a payment flow includes a Customer-provided self-hosted wallet address, Orvexa may use specialist tools to screen the public address and associated risk indicators for sanctions, fraud or financial-crime purposes.

Customers must not attempt to evade sanctions or geographic restrictions by using a nominee, false identity, VPN, third-party wallet, structured transactions or other concealment technique.

7. Transaction and wallet risk monitoring

Orvexa may review transactions in real time or after execution using automated rules, risk scores, manual analysis and information supplied by participating providers. Monitoring is designed to identify patterns or events inconsistent with expected or lawful use of the Services.

Where a Customer supplies a self-hosted wallet address as part of a supported payment flow, monitoring may include public-blockchain risk indicators, exposure to known illicit services and review of the stated purpose and destination. The wallet remains self-hosted and under the Customer's control throughout the relevant flow.

No monitoring system can eliminate financial crime. An alert is a risk signal and may require investigation rather than being treated automatically as proof of wrongdoing.

8. Examples of red flags may be the following, but not limited to:

• Use of a payment instrument or self-hosted wallet address that appears to belong to an unrelated third party without a credible explanation.
• Attempts to break one expected transaction into multiple smaller transactions in order to avoid controls or limits.
• Information that conflicts with identification documents, known profile, transaction purpose or funding source.
• Repeated failed verification, unusual device or location behaviour, or signs of identity theft or account takeover.
• Payment flows associated with sanctioned persons, prohibited jurisdictions, darknet markets, ransomware, scams, stolen funds or other high-risk public-blockchain indicators.
• Rapid or circular movement of funds, including unusual pass-through behaviour, or self-hosted wallet activity inconsistent with the stated payment purpose.
• Unwillingness or inability to explain source of funds, source of wealth, beneficial ownership, or the purpose of a transaction when reasonably requested.
• Attempts to pressure staff to bypass controls, conceal counterparties, alter documentation or process a transaction despite a compliance warning.

9. Enhanced review

Where a Transaction or Customer presents elevated risk, Orvexa may conduct enhanced due diligence. This can include obtaining additional identification, clarifying beneficial ownership, verifying source of funds or wealth, obtaining more detailed transaction rationale, reviewing supporting contracts or invoices, reviewing relevant public information connected with a Customer-provided self-hosted wallet address, or seeking information from a Merchant or partner.

Enhanced review can take longer than ordinary processing. Orvexa is not required to complete a Transaction before the review is satisfactorily concluded.

10. Prohibited activity and geographic controls

Orvexa does not knowingly support Transactions connected with money laundering, terrorist financing, fraud, cybercrime, trafficking, sanctions evasion, unlawful weapons, illegal drugs, stolen property, unlawful gambling, child exploitation, or other criminal conduct.

Orvexa may restrict entire jurisdictions or customer categories based on applicable law, sanctions, partner requirements or its risk appetite. A list used operationally may change as risk conditions or legal requirements change.

A Customer who is ineligible for the Services must not attempt to bypass a restriction through false information, proxy users or location-masking techniques.

11. Action on a compliance concern

When Orvexa identifies a compliance concern, it may request information, pause processing, refuse a Transaction, prevent onward settlement, return funds where lawful and technically possible, restrict further access, terminate a business relationship, or take another measure reasonably required by the circumstances.

Where law prohibits disclosure, Orvexa may be unable to explain the reason for a hold, refusal, report or investigation in detail.

Customers must cooperate with reasonable information requests. Failure to cooperate can result in rejection or restriction even where no final conclusion about wrongdoing has been reached.

12. Suspicious activity and cooperation with authorities

Orvexa will cooperate with competent authorities as required by applicable law. Where a reporting obligation applies, Orvexa may submit information concerning suspicious or prohibited activity to the relevant authority or otherwise respond to lawful requests for records.

Orvexa may preserve records, refrain from executing a transaction, or take other steps where directed or required by a court, law-enforcement body, regulatory authority or other competent body.

Customers are not entitled to receive confidential information about internal investigations, detection logic, reports made to authorities or information whose disclosure is restricted by law.

13. Records and data protection

Information obtained for financial-crime prevention is processed for compliance, fraud prevention, security, payment processing and legal obligations. It may be shared with Merchants, Payment Partners, independent Digital-Asset Providers, verification vendors, professional advisers and competent authorities where there is a lawful and relevant need.

Orvexa retains compliance and transaction records for the period required by applicable law and for reasonable additional periods where necessary to deal with investigations, disputes, fraud prevention or legal claims.

Personal data is handled in accordance with the Data Protection and Privacy Notice and applicable data-protection law.

14. Merchant and partner oversight

Orvexa may conduct due diligence on Merchants and service providers before and during a business relationship. This can include ownership checks, business-model review, licensing or registration checks where relevant, sanctions screening, website review, risk classification and ongoing information requests.

Merchants and partners may be required to provide customer or transaction information to Orvexa when necessary for compliance, investigation, reconciliation or a lawful authority request, subject to applicable law and contractual arrangements.

Orvexa may suspend or end a relationship where a Merchant or partner does not meet required compliance standards or fails to provide information reasonably requested.

15. Customer responsibilities

• Provide accurate, current and complete information and genuine documents.
• Use only funds and payment methods that are lawfully owned or controlled and, where applicable, provide only self-hosted wallet addresses that you lawfully control.
• Respond promptly to reasonable verification or compliance requests.
• Do not conceal the true purpose, counterparty, source or destination of a Transaction.
• Do not use Orvexa Services for prohibited activity or to evade sanctions, geographic restrictions or transaction controls.
• Notify the relevant support channel if you become aware of unauthorised or suspicious use connected with your Transaction.

16. Updates to this Standard

Financial-crime risks, sanctions and regulatory expectations change over time. Orvexa may therefore revise this Standard, its internal procedures and operational controls. The current public version will show its effective date.

Internal thresholds, detection scenarios, vendor configurations and investigation procedures are confidential and may be changed without publication where necessary to maintain effective controls or respond to emerging risk.

17. Corporate information

Orvexa LLC is a Georgian limited liability company, identification number 412800394, registered at 88 Avtomshenebeli Street, Kutaisi 4600, Georgia.

Compliance-related questions may be submitted through the contact channel published on the Orvexa website or the Orvexa-powered interface used for the relevant Transaction.