AML and CTF Policy

This is the public statement of how GTAMarket handles financial crime risk. The operating procedures behind it are internal, for the reason given in Section 5.

---

1. Scope and status

This policy covers every deposit, withdrawal, order, escrow movement and payout on GTAMarket, and every user who touches money here.

[TO BE COMPLETED: registered company name] is [TO BE COMPLETED: either 'a registered obliged entity under the named law' or 'not a licensed or registered financial institution; the standards below are applied voluntarily'].

We say that plainly because claiming to be regulated when you are not is a misleading practice and, in some places, an offence. Read that line before you read anything below it. It tells you whether the controls here are supervised by an authority or applied by us because they are the right thing to do.

Settlement is handled by [TO BE COMPLETED: licensed payment processor of record], which operates under its own licence and its own programme. That does not transfer our responsibility to it, and it does not transfer its responsibility to us.

2. Who is accountable

Money Laundering Reporting Officer: [TO BE COMPLETED: Money Laundering Reporting Officer] — compliance@gtamarket.store

The MLRO owns this policy, receives internal escalations, decides what is reported externally, and reports to the board directly, without going through anyone whose targets depend on transaction volume. The board is accountable for the programme. It is reviewed at least annually and after any material change to the business.

3. A risk-based approach

We assess risk across the whole business — customer, product, delivery channel and geography — and we set controls in proportion to it. That assessment is written down, reviewed at least once a year, and revised when something changes: a new category, a new settlement network, a new jurisdiction, or a pattern we had not seen before.

Higher risk gets more friction. Lower risk gets less. Nobody gets none.

4. Knowing who our users are

Controls are tiered, and the tier moves with what a user does rather than with who they say they are.

Everyone, at registration: a verified email address, a date of birth, and a declaration of whether they sell as a business or privately. Session, device and network signals from the first visit.

Everyone who sells as a trader: the identification, registration and contact details set out in Section 3.5 of the Terms of Service, checked against official public databases where they exist, and republished on their listings.

Above defined thresholds, and on any trigger: identity verification against a government-issued document with a liveness check; screening against sanctions lists, politically-exposed-person lists and adverse media; and, where warranted, questions about the source of the funds.

Enhanced due diligence, where risk requires it: source of funds and source of wealth, documented; beneficial ownership for a corporate seller; senior sign-off; and closer ongoing monitoring.

Continuously, for everyone: transaction monitoring, screening of blockchain addresses used for deposits and withdrawals, and periodic rescreening against updated lists. Verification data is refreshed on a cycle, not collected once and forgotten.

5. Thresholds

Thresholds and triggers exist, are written, and are applied consistently.

We do not publish the numbers. Publishing the exact point at which a check begins tells the people we are checking for exactly how to stay underneath it, and it is the single most useful piece of information we could hand them. Every serious programme withholds them for the same reason.

What we will tell you is what to expect: verification is asked for as amounts rise, and always before a payout of any size to a new address; it is asked for once, not repeatedly; and if you are asked, you will be told what document is needed and roughly how long it takes.

6. Sanctions

We screen users, and the blockchain addresses they deposit from and withdraw to, against:

• the consolidated list of the United Nations Security Council;
• the consolidated list of the European Union;
• the UK Sanctions List;
• the Specially Designated Nationals list and other lists administered by the US Office of Foreign Assets Control;
• the lists applying in [TO BE COMPLETED: country of incorporation].

Screening happens at onboarding, before each payout, and on an ongoing basis as lists are updated — a list changes after you joined, and we rescreen.

We do not provide services to anyone in, ordinarily resident in, or acting for a person or entity in a comprehensively sanctioned territory, and we use geolocation and IP-based blocking as well as declared residence. An entity owned 50% or more by a designated person is treated as designated.

A confirmed match is blocked and reported to the competent authority within the period the law requires. We are not permitted to negotiate over a match.

7. What we watch for

Monitoring is tuned to how money is actually laundered through a marketplace like this one. Saying so publicly is deliberate: these are the patterns our freeze rights exist for.

• Wash trading — a buyer and a seller who are the same person, or working together, running value through the marketplace so that it comes out as a clean payout. Shared devices, shared networks, mirrored timing and reciprocal orders are all signals.
• Structuring — one person splitting activity across several accounts, or several transactions, to stay under a threshold.
• Pricing anomalies — a listing priced far above or far below the market for what it is, where the price is the point of the transaction rather than the goods.
• Deposits from high-risk sources — mixers, tumblers, addresses with sanctions exposure, addresses linked to known theft.
• Goods funded by crime — currency, items or access obtained through account takeover, phishing or credential stuffing, and orders funded by a stolen payment instrument.
• Mule behaviour — a new account whose only pattern is value in and value out.
• Refusal or evasion — declining to verify, giving documents that do not survive checking, or repeatedly abandoning a transaction at the point verification is requested.
• Rapid pass-through — value deposited and withdrawn with no marketplace activity in between. This one is not only monitored, it is designed out: only value earned on the marketplace withdraws to an address of the user's choosing. Unspent deposits go back the way they arrived, after review. Section 9 of the Terms of Service sets out the rule and Section 4 of Fees and Payouts shows the two figures a user sees.

8. What happens when something is flagged

Staff escalate internally to the MLRO. The MLRO decides. Where a suspicion meets the reporting standard, it is reported to the competent financial intelligence unit.

Where the law prohibits us from telling a user that a report has been made, we will not tell them. That is called tipping off, it is a criminal offence in most places, and it is the reason a freeze is occasionally explained less fully than we would like. It is a narrow exception and we do not use it to avoid an awkward conversation. Section 9.1 of the Terms of Service sets out the freeze grounds, the maximum duration and your right to appeal to a human being.

9. Records

Customer due diligence files, verification results, screening outcomes, transaction records and the reasoning behind escalations are kept for at least five years from the end of the relationship or the transaction, and longer where a law or a live matter requires it.

This is why some data cannot be deleted on request. Section 10 of the Privacy Policy explains how that sits alongside your data rights.

10. Training and testing

Everyone who touches user money, verification or disputes is trained on this policy before they start and at least annually after that. The programme is independently tested at least annually, and the findings go to the board. Testing that never finds anything is not testing.

11. Who we do not serve

• Anyone under 18.
• Anyone we cannot identify to the standard the risk requires.
• Anyone in, ordinarily resident in, or acting for a person in a comprehensively sanctioned territory.
• Anyone on a sanctions list, or owned or controlled by someone on one.
• Anyone whose funds we reasonably believe are the proceeds of crime.
• Anyone previously closed for financial crime reasons, and anyone re-registering after one.

12. Working with authorities

We respond to lawful requests from law enforcement, regulators and courts with jurisdiction. We ask for the legal basis, we give what is required and not more, and where the law permits us to tell the user, we do.

13. Review

Reviewed at least annually, and immediately after any material change to the business, the settlement arrangements or the applicable law. Questions: compliance@gtamarket.store.