AML & KYC Policy

Fylu applies risk-based controls designed to identify and reduce fraud, money laundering, sanctions evasion and other prohibited financial activity. The controls used may differ by service, location, account risk and available verification capability. Additional information or identity verification may be required before an account or transaction can proceed.

When supported by the applicable service, Fylu collects identifying information such as a legal name, date of birth or formation, address, contact details, nationality or residence and a government-issued identifier. Business accounts may also be asked for formation details and information about their controllers or beneficial owners.

Identity checks may include government-issued documents, a selfie or liveness check, confirmation of contact details, business records or information supplied by a configured verification provider. Missing, expired or inconsistent information may delay verification or restrict access until the review is resolved.

Due-diligence review may consider the purpose of the account, expected activity, relevant locations, products used, transaction behavior and other verified risk indicators. An account's risk assessment may be updated when its circumstances or activity materially change.

An account or transaction presenting higher risk may receive additional review, including further identity checks, beneficial-ownership information, source information or approval by authorized personnel. Enhanced review is a risk-control measure and does not by itself mean that a customer has done anything wrong.

Implemented monitoring systems may evaluate transaction details and activity patterns for unusual or prohibited behavior. An alert is an indicator for review, not a conclusion of wrongdoing; relevant context and available records are considered before a decision is made.

Where configured and applicable, Fylu may screen names, identifying details, counterparties or wallet addresses against supported sanctions and restriction data. A potential match may be paused for review. Fylu does not claim coverage of a particular list or jurisdiction unless that coverage is actually configured and verified.

For a transaction or account requiring additional review, Fylu may request an explanation and proportionate evidence showing how the relevant funds or assets were obtained. Evidence may include account statements, exchange or wallet records, transaction receipts, sale documents or income information, depending on the circumstances.

Alerts requiring escalation may be reviewed using available account, device, counterparty and transaction context. Any external report is made only where an applicable obligation and reporting channel have been verified; Fylu does not represent that a report exists merely because an internal review occurred.

Identity records, review evidence, monitoring results, decisions and relevant communications are retained only for periods supported by implemented operations and verified requirements. Access is restricted to authorized purposes, and records should be securely deleted or anonymized when retention is no longer justified.

An account may be limited, paused or suspended while information is missing, a review is pending, a security concern exists or prohibited activity is reasonably suspected. Restrictions may affect deposits, withdrawals, trading or other services and are recorded so that authorized personnel can review the decision.

Fylu services must not be used for fraud, money laundering, sanctions evasion, handling stolen assets, impersonation, account renting, unauthorized financial activity or attempts to bypass security and compliance controls. Related accounts or transactions may be restricted and reviewed.

Financial-crime controls are reviewed when services, risks, providers or verified requirements change. Review may include testing control operation, checking access and decision records, correcting identified weaknesses and documenting material updates.

Fylu does not claim government affiliation, regulatory authorization, registration, supervision or reporting relationships unless each statement has been independently verified and is applicable. Where a real legal reporting obligation exists, information is handled only through the authorized process for that obligation.