AML & sanctions policy

1. Policy Statement

Reunion Fund ("the Platform") maintains a risk-based Anti-Money Laundering (AML) and Sanctions Compliance Program designed to prevent misuse of the platform for money laundering, terrorist financing, sanctions evasion, fraud, or other illicit financial activity. We align with the Bank Secrecy Act (BSA), USA PATRIOT Act, FinCEN guidance, OFAC sanctions requirements, and applicable international standards including FATF Recommendations.

2. Scope & Application

2.1 Applicability

This Policy applies to: employees, officers, directors, contractors, users, campaigns, transactions, third‑party service providers, and all jurisdictions where the platform operates.

2.2 Platform Services Covered

• Community event organization & expense contribution management
• Committee collaboration & multi-party governance features
• Payment / settlement integrations (fiat & payment method references)
• User identity verification workflows (via regulated vendors)
• Fraud, sanctions, and AML risk monitoring infrastructure

3. Regulatory Framework

The Platform maintains processes consistent with:

• Bank Secrecy Act (BSA) and implementing regulations
• USA PATRIOT Act customer identification and enhanced due diligence obligations
• AML Act of 2020: beneficial ownership transparency expectations
• FinCEN suspicious activity reporting (SAR) standards
• OFAC sanctions screening and blocking requirements
• FATF Recommendations & high‑risk jurisdiction advisories

4. Definitions

Selected core terms; see AML Glossary for extended list.

• Beneficial Owner: Natural person(s) with ≥25% ownership or ultimate control; includes control designee where threshold unmet.
• CDD: Baseline identification and risk profiling performed at onboarding and updated periodically.
• EDD: Heightened scrutiny applied to elevated risk profiles (PEPs, adverse media, high-risk jurisdictions, complex structures).
• PEP: Individual entrusted with prominent public function plus immediate family / close associates subject to EDD.
• SAR: Confidential regulatory report of suspicious activity to FinCEN (where required).
• Structuring: Deliberate fragmentation of transactions to evade thresholds or automated detection rules.

5. Customer Due Diligence (CDD) Program

5.1 Customer Identification Program (CIP)

All customers provide verified identity attributes. Individuals: legal name, date of birth, residential address, government ID reference. Entities: legal name, registration jurisdiction, principal address, EIN (if applicable), beneficial ownership structure.

5.1.1 Verification Methods

• Document authenticity & liveness / biometric (vendor supported)
• Database & sanctions / adverse media queries
• Beneficial ownership attestation w/ 25% threshold + control person

5.2 Risk Assessment & Scoring

Dynamic risk scoring model weighting: geography, behavior, product usage, media, structural complexity. Scores drive monitoring thresholds.

5.3 Enhanced Due Diligence (EDD)

• Triggers: PEP exposure, high-risk jurisdiction, large velocity anomalies, negative media, high-risk payment method usage.
• Measures: source-of-funds inquiry, senior compliance approval, accelerated monitoring cadence.

5.4 Ongoing Monitoring

Periodic profile refresh, event-driven re-screening, adverse media delta detection, sanctions revalidation upon list update.

6. Sanctions Screening

Coverage: OFAC SDN, SSI, Consolidated lists; UN, EU, UK, other risk-relevant jurisdictions. Screening occurs pre-activation, transaction-time, and batch re-scan.

6.1 Screening Controls

• Phonetic & fuzzy matching with threshold tuning to reduce false positives
• Delta-processing of list updates to prioritize new additions
• Geo-IP & payment rail jurisdictional blocking logic

6.2 Match Handling

1. Immediate hold & alert creation
2. Analyst triage: data quality, alias correlation, risk context
3. Escalation to compliance officer for disposition
4. Documentation & (if confirmed) blocking + reporting workflow

Report a potential sanctions match via Sanctions Match Internal Form (internal link forthcoming).

7. Transaction Monitoring

Hybrid rules + behavioral analytics (anomaly detection, velocity clustering) drive alert generation.

7.1 Core Scenarios

• Structuring indicators (repeated just-below-threshold contributions)
• Event pass-through behavior (rapid receive & release)
• Unusual cross-border contribution spikes
• Payment method pattern irregularities

7.2 Investigation Workflow

1. Alert triage & prioritization
2. Context enrichment (historical profile fetch, sanctions re-check)
3. Analyst narrative & risk conclusion
4. Escalation for SAR consideration (if threshold met)

Internal tooling endpoint: /internal/compliance/monitoring (placeholder).

8. Suspicious Activity Reporting

8.1 Triggers

• No apparent lawful purpose / inconsistent with profile
• Structuring attempts (sequential sub-threshold values)
• Use of high-risk jurisdictions or typologies

8.2 Filing Process

1. Detection & case creation
2. Investigation (≤30 days)
3. Filing decision & SAR drafting
4. Confidential submission (FinCEN portal) where required

Submit an internal suspicious activity escalation via Suspicious Activity Internal Form (link placeholder).

9. Record Keeping

Retention baselines: customer & transaction: 5 years; SAR related: 5 years; training: 3 years (unless regulatory extension). Secure storage: encryption in transit & at rest; RBAC; immutable audit logs.

9.1 Data Protection

• Least privilege enforcement via tiered roles
• Access recertification & anomaly alerting
• Cryptographic erasure at lifecycle end

10. Risk Assessment

Enterprise-level methodology covers: customer, product/service, geographic, delivery channel, and external threat evolution.

10.1 Scoring Drivers

• Customer - profile complexity, jurisdiction composite risk index
• Product - cross-border transactions and payment method risk weighting
• Geography - sanctions adjacency & FATF evaluation outcomes

Risk assessment outputs calibrate monitoring thresholds & EDD triggers.

11. Training & Awareness

Program ensures role-tailored modules, competency validation, and reinforcement of red flag typologies.

11.1 Core Curriculum

• Initial onboarding (≤30 days), annual refresh
• Role-specific: investigations, engineering (data safeguards), product (control design)
• Event-driven updates (regulatory or typology shifts)

12. Governance & Oversight

Three-lines model: operations (first), compliance (second), independent audit (third). AML Officer holds program authority and escalation mandate.

• Board oversight: quarterly reporting & annual effectiveness review
• Management ensures resourcing & remediation adherence
• Escalation path for unresolved compliance risks

13. Independent Testing & Audit

Risk-based reviews validate control design & operating effectiveness (customer due diligence, monitoring, sanctions, reporting, training).

• Annual baseline + ad hoc thematic reviews
• Remediation tracking with closure validation
• Formal reporting to AML Officer & Board delegates

13. Policy Review & Updates

Reviewed at least annually or sooner based on regulatory guidance, risk assessment findings, or platform changes.

• Version control maintained via centralized metadata constants
• Material updates reflected in public changelog
• Prior versions archived internally for reference

15. Appendices (Selected Public Summary)

A. Regulatory References

• BSA, USA PATRIOT Act, AML Act 2020, OFAC regulations
• FATF 40 Recommendations & key interpretive notes

B. Risk Matrices (Abbreviated)

• Customer: geography, transaction velocity, structure complexity
• Product: cross-border and payment method risk weighted higher

C. Red Flag Indicators

• Repeated near-threshold contributions
• Rapid inflow / immediate disbursement attempts
• Beneficiary mismatch / vague event purpose

Full internal appendices retained in controlled compliance repository.

Changelog

• v2.0.0 – Initial structured publication of AML & Sanctions Policy (extracted from comprehensive internal policy; added version metadata, JSON-LD, standardized layout).