Compliance
AML / CFT Policy
1. Purpose
Loco Pay will not be used to launder money, finance terrorism or proliferation, evade sanctions, or move the proceeds of crime. This policy sets the controls that apply to account balances, deposits and withdrawals, internal conversion, Visa cards, and third-party access to those functions.
The policy follows a risk-based approach consistent with the FATF Recommendations, and with the anti-money laundering and counter-terrorist financing laws that apply to Loco Pay and to each regulated partner that performs card issuing, safeguarding, or money transmission. Where a partner’s licence imposes a stricter rule, the stricter rule applies to that activity.
2. Scope
This policy applies to all customers, natural persons and legal entities, in every region where the services are offered; to beneficial owners and controllers of business customers; to authorised users and cardholders; to deposit sources and withdrawal destinations; to software partners that instruct payments or asset movements; and to employees, contractors, and agents of Loco Pay who design or operate the services.
It applies before an account is opened, for the life of the relationship, and for the record-keeping period after the relationship ends.
3. Governance
The board, or the most senior governing body of the contracting Loco Pay entity, approves this policy and reviews it at least once a year, and whenever the business or the law changes in a material way.
A Money Laundering Reporting Officer (MLRO) is appointed with sufficient seniority, independence from sales targets, and direct access to the governing body. The MLRO owns the programme, decides suspicious-activity reports, and is the point of contact for partners and competent authorities. A deputy is appointed so that the function is covered during absence.
Sales, support, product, and engineering do not have authority to override a decline, a hold, or a filing decision made by compliance. Staffing of the compliance function is kept proportionate to the number of customers, corridors, and alert volumes.
4. Risk assessment
Loco Pay maintains a written assessment of money-laundering and terrorist-financing risk across customers, countries, products, and delivery channels. The assessment is updated at least annually and when a new corridor, card programme, or customer segment is added.
Products in scope, and the risks they carry, include:
- Account balance. Placement from outside sources, conversion, and rapid movement out again.
- Deposits and withdrawals. On-chain or account transfers, including the wrong asset, a high-risk address, or a source that does not match the customer.
- Visa cards. Spending that cashes out value, including ATM withdrawal, or that disguises the recipient as a merchant.
- Third-party software. Another product moving customer assets or triggering card spend without a clear, identified user.
Higher residual risk leads to enhanced due diligence, lower limits, or a decision not to offer the feature.
5. Customer due diligence
Loco Pay does not offer anonymous accounts, no-KYC cards, or no-KYC deposits and withdrawals. A service that can hold or move funds is enabled only after customer due diligence is complete and accepted.
Individuals
For a personal customer we collect and verify, using reliable and independent sources:
- full legal name, date of birth, and nationality;
- a government photo identity document, checked against a likeness capture of the applicant;
- residential address;
- mobile number and email under the applicant’s control;
- the purpose of the account and the expected size and frequency of activity;
- where the risk or the amount requires it, source of funds and source of wealth.
When checks happen
Checks are completed before the first deposit, withdrawal, conversion, or card issuance. They are repeated when data expires, when activity changes, and when an alert or a partner requires it. A customer who does not complete a check does not receive the service. We do not issue a card or release a withdrawal while identity is still open.
6. Business customers
For a legal entity we identify and verify the entity itself and the natural persons behind it:
- legal name, registration number, registered office, and principal place of business;
- constitutional documents and, where relevant, good-standing evidence;
- the nature of the business and the reason it needs account balances, cards, or a software connection;
- directors and the natural persons who ultimately own or control 25% or more, or a lower percentage where the applicable law requires it; if no one owns 25%, the natural persons who otherwise exercise control, and otherwise the senior managing official;
- each authorised user who can view, initiate, or approve payments;
- each employee cardholder before that card is used.
A business account is not a way to avoid personal due diligence. A company that is a shell, whose ownership cannot be explained, or whose activity does not match the payments it wants to make, is declined.
7. Enhanced due diligence
Enhanced due diligence is applied, and a senior member of compliance approves the relationship, where the customer or the payment presents higher risk. Triggers include:
- a politically exposed person, or a family member or close associate of one, including after the person has left office for as long as the applicable law requires;
- a high-risk country, as identified by FATF or by our own country-risk list;
- adverse media relevant to financial crime;
- a deposit, withdrawal, or conversion whose size, asset, or counterparty is unusual for that customer;
- use of a third party to pay or to receive;
- a business whose ownership is complex, recently changed, or involves a nominee;
- activity that is inconsistent with the profile collected at onboarding.
Enhanced due diligence includes a deeper source-of-funds enquiry, more evidence of the purpose (for example an invoice, admission letter, or contract), and a shorter review cycle. If the extra information is not satisfactory, the relationship or the payment is refused.
8. Ongoing monitoring
Monitoring is not a one-time gate. Loco Pay screens transactions and customer behaviour throughout the relationship. The programme looks for, among other things:
- pass-through activity, where value arrives and leaves quickly without a reason that matches the profile;
- structuring, including splitting payments to stay under a threshold;
- a sudden change in volume, country, merchant category, or counterparty;
- card use that is inconsistent with the cardholder, including ATM patterns that resemble cash-out;
- many small inbound transfers from unrelated people;
- a deposit or withdrawal that does not match the address, asset, or documents provided;
- attempts to keep using the service after a request for information has been ignored.
Alerts are reviewed by trained staff. An alert can lead to a request for information, a hold, a decline, a report, or no further action, and the decision is recorded. Customers are not told the detection rules.
9. Sanctions, PEPs, and adverse media
Customers, beneficial owners, authorised users, cardholders, and the parties behind a deposit or withdrawal are screened against applicable sanctions lists, including those of the United Nations, and of other authorities that apply to Loco Pay or to the partner executing the payment, such as OFAC, the European Union, and the United Kingdom, together with PEP and adverse-media sources.
Screening runs at onboarding, when key data changes, when a new counterparty is paid, and on a periodic rescreen of the existing book. A potential match is resolved by a person before the related service is provided or continued. A confirmed sanctions match is rejected, the asset or payment is handled as the applicable law requires, and the MLRO considers a report. We do not open an account for a person or entity we are prohibited from dealing with, and we do not process a payment to or from one.
Countries and territories subject to comprehensive sanctions are outside the service. The unsupported list is maintained by compliance and applied in the product so that onboarding and payout to those places are blocked.
10. Prohibited activity
The following are refused. This list is not exhaustive:
- money laundering, terrorist financing, proliferation financing, fraud, scams, and handling stolen funds;
- sanctions evasion, including the use of intermediaries to reach a prohibited person or place;
- ransomware, darknet markets, and other proceeds of crime;
- unlicensed money transmission, unlicensed gambling, or using a personal account as a payment business;
- false purpose-of-payment information, false identity documents, or a borrowed identity;
- payments for an undisclosed third party, or “money mule” activity;
- any attempt to obtain a card or a payout without completing due diligence.
11. Controls by product
Deposits and withdrawals
A deposit is not credited, and a withdrawal is not released, until the customer is identified and the source or destination has been screened. Screening covers sanctions and, where the risk requires it, exposure to stolen funds, fraud, or other crime. The customer must use the method shown in the app. Value that arrives by an unsupported method can be held. A pass-through pattern, or a source that does not match the profile, can be held or refused.
Internal conversion
A conversion uses the quote shown before confirmation. It is screened like any other movement of value. A quote does not override a compliance hold.
Visa cards
A physical or virtual Visa card is issued only after the cardholder’s due diligence is accepted by us and by the issuer. Authorisations pass through fraud and sanctions checks. The customer can freeze a card; we and the issuer can freeze it as well. ATM withdrawal, cross-border use, and high-risk merchant categories can be limited or blocked. 3-D Secure is used where the programme supports it. Card spend settles against the customer’s balance.
Third-party software
An integration is approved before it can instruct a payment or an asset movement. The end user remains in scope for due diligence. API credentials are issued to a named partner, limited to the agreed functions, and can be revoked. A change in the partner’s ownership, or in how the integration is used, is a trigger to review the relationship before further instructions are accepted.
12. Suspicious activity
Staff escalate internal suspicions to the MLRO without delay. The MLRO decides whether the matter must be reported to the competent authority, and whether a partner who is executing the payment must also be told, under the terms of that partnership and the law. A report is made as soon as practicable after the suspicion is formed, and sooner where the law sets a deadline.
While a matter is open, the payment can be held. We do not close an account solely to avoid a reporting duty. We also do not continue a relationship merely because a report has been filed; the MLRO decides whether to exit.
13. No tipping-off
Employees and agents must not inform a customer, or any person who might prejudice an investigation, that a suspicion has been formed, that a report has been or may be made, or that a hold is in place for that reason, where telling them would be tipping-off under applicable law. Customer messages about a hold are limited to what the law and the partner’s rules allow.
14. Record keeping
We keep customer due diligence records, transaction records sufficient to reconstruct the payment, screening results, alert decisions, and suspicious-activity working papers. Records are kept for at least five years after the relationship ends or after the transaction, and longer where the applicable law, a regulator, or a partner contract requires it. Records are stored so that they can be retrieved promptly for an authorised request.
15. Training
Employees and relevant contractors receive training before they handle customers or alerts, and at least annually after that. Training covers this policy, red flags for fund movements and Visa spend, sanctions, tipping-off, and how to escalate. Completion is recorded. Staff in higher-risk roles receive additional training.
16. Independent review
The programme is independently reviewed at least every two years, and after a material change, by a person or firm who is not the MLRO and who is competent to assess it. Findings are reported to the governing body, and remediation is tracked.
17. Partners and reliance
Card issuers, safeguarding institutions, payout partners, and screening vendors are contracted in writing. The contract requires them to apply controls appropriate to their licence, to protect personal data, and to cooperate on investigations. Loco Pay does not rely on a third party’s due diligence unless the law allows that reliance and the quality of the third party’s work has been assessed. Outsourcing a task does not move responsibility for the customer relationship away from Loco Pay and the licensed partner who owns that activity.
18. Review of this policy
This public version is updated when the programme changes in a way customers and partners should see. The current version is this page. Questions can be sent to compliance@locopay.com.