AML / KYC Policy

1. Purpose

This Anti-Money Laundering and Know-Your-Customer Policy ("AML / KYC Policy") describes the controls Vizno applies to identify the persons and entities who receive funds from Vizno, to screen them against applicable sanctions lists, to monitor for transaction patterns indicating money laundering or other illicit finance, and to report suspicious activity where required.

This policy applies to all payout-side relationships: creators who monetize content on the platform, and participants in Vizno's reseller / affiliate program who receive commission payments. It does not apply to ordinary end-users (players), who are not recipients of platform funds.

The policy implements the requirements expected by Vizno's payment partners (Plaid, Increase, Payoneer, future card processors) and aligns with the framework of the US Bank Secrecy Act as applied to money-services business activity, even where Vizno is not itself a registered MSB.

2. Scope

The procedures in this policy apply to:

• Any individual or entity onboarded as a creator with monetization enabled.
• Any individual or entity enrolled in the Vizno reseller / affiliate program.
• Any payout transaction processed by Vizno on behalf of those individuals or entities.
• Any inbound transaction from a creator to Vizno (e.g., for paid promotion) above the thresholds in Section 6.

End-users (players) who only purchase content on the platform are not subject to this policy. They are subject to the standard sanctions geo-block applied at sign-in (see Section 5.2) and to the underlying card processor's KYC.

3. Customer identification (KYC)

Before any payout is processed, Vizno collects and retains the following information from the payout recipient:

• Identity information: legal name, date of birth, residential or registered business address.
• Tax form: a US Form W-9 (for US persons or US-resident entities) or a Form W-8BEN or W-8BEN-E (for non-US persons), collected before the first payout that would be reportable on a Form 1099-NEC or Form 1042-S.
• Bank account information: routing and account numbers, collected through Plaid Auth (which verifies the bank account ownership on Vizno's behalf). For international recipients, the equivalent information is collected through Payoneer's onboarding.
• Identity verification: where the cumulative payout to an individual exceeds USD 600 in a calendar year, or where any single payout exceeds USD 2,500, identity verification is performed by an identity-verification vendor or by document review by Vizno staff. Verification artifacts (a government-issued ID image and a liveness check, or equivalent) are retained per the Data Retention and Deletion Policy.

Information collected at onboarding is retained for the period required by applicable tax recordkeeping law (typically 7 years from the tax year of last activity) and is treated as Restricted data under the Information Security Policy.

4. Beneficial-ownership identification (for entities)

Where the payout recipient is a legal entity rather than an individual:

• The names, addresses, and dates of birth of all beneficial owners holding 25% or more of the entity are collected.
• The name and title of one control person (e.g., CEO, managing member) is collected.
• Each named beneficial owner and the control person are screened against sanctions lists per Section 5.

This applies to corporations, partnerships, LLCs, and similar entities. Sole proprietorships transacting under the proprietor's legal name are treated as individuals.

5. Sanctions screening

5.1 Payout-side screening

Every creator and every reseller-program participant is screened against US sanctions lists before:

• Onboarding as a payout-eligible creator (i.e., before the creator can enable monetization).
• Enrollment in the reseller / affiliate program.
• Each individual payout transaction (an automated re-screen runs at payout time).

The screening runs locally against a self-hosted OpenSanctions consolidated-dataset mirror (see the Integrations inventory entry for opensanctions). runScreen() in lib/safety/sanctions.ts matches candidates via sanctions-matcher.ts (pg_trgm) against the sanctions_entity table; the vendor recorded on each sanction_screening row is opensanctions. No vendor API is in the hot path. Lists screened include:

• US Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list.
• US OFAC Consolidated Sanctions List.
• US Treasury's published consolidated screening list (where applicable).
• EU consolidated financial sanctions list and UK HM Treasury sanctions list (for international recipients).
• Politically Exposed Persons (PEP) list (for risk-rating; PEP hits do not by themselves disqualify but trigger enhanced due diligence).

Hits surface in the admin sanctions review queue at /admin/sanctions for human review by the founder before any payout proceeds.

5.2 End-user-side geo-block

Sign-ups and access from jurisdictions under comprehensive US sanctions (Cuba, Iran, North Korea, Syria, Crimea / so-called "Donetsk People's Republic" / so-called "Luhansk People's Republic") are blocked at the application layer based on the visitor's approximate geographic location. This is a separate control from the payout-side screening above and is described in the platform's geographic availability infrastructure.

5.3 Ongoing monitoring

Once a creator is onboarded, the OpenSanctions ingest cron plus the pre_remittance and periodic triggers in lib/safety/sanctions.ts run daily re-screens for any new hit (a creator being added to a sanctions list after onboarding, for example). New hits surface in the admin queue and trigger immediate payout suspension pending human review.

6. Transaction monitoring

Vizno monitors payout-side and inbound-side transaction patterns for the following red flags. Each flagged transaction is reviewed before being processed.

• Structuring: payouts deliberately split into amounts below identity-verification or tax-reporting thresholds.
• Unusual volume relative to a creator's published-content level: significant earnings from a creator with little or no published work, or a sudden change in payout velocity inconsistent with prior pattern.
• Round-tripping: a participant paying into the platform and then receiving payouts of similar amount in short succession (a money-laundering signature).
• Geographic mismatch: a creator whose declared residence, bank country, and IP country are materially inconsistent.
• High-risk-jurisdiction routing: a payout to a bank in a jurisdiction with elevated AML risk (FATF "increased monitoring" or "call for action" lists).
• Recipient changes: an unusual rate of payout-bank changes on an account.

Flags are reviewed by the founder. Where the review identifies a credible indication of money laundering or other illicit finance, the payout is held and the matter is escalated per Section 7.

7. Suspicious-activity escalation

Where transaction monitoring or sanctions screening identifies activity that the reviewing person determines, in good faith, may indicate money laundering, sanctions evasion, terrorist financing, or other illicit finance:

1. The payout (or other relevant transaction) is held.
2. The matter is recorded in an internal investigation log with the relevant evidence, the reviewer's findings, and the date.
3. Where Vizno is required by law to file a Suspicious Activity Report (SAR) or to make an equivalent disclosure to a regulatory authority, the report is prepared and filed within the timeframes required by the relevant law.
4. Where Vizno is not legally required to report but the conduct constitutes a clear policy violation, the account is suspended or terminated per the Acceptable Use Policy, and the matter is referred to the affected payment partner if their contract or program rules require it.
5. The reporting individual is bound by any applicable confidentiality rule that prohibits "tipping off" the subject of the report.

Vizno does not currently operate as a registered money-services business in the US. The thresholds and procedures above apply prophylactically to ensure that, in the event the platform's activity is later found to fall within MSB-regulated activity, the foundation for compliance is already in place.

8. Recordkeeping

The following records are retained per the Data Retention and Deletion Policy:

• Customer identification records (KYC): 7 years from the year of last activity.
• Beneficial-ownership records (for entities): 7 years from the year of last activity.
• Sanctions-screening results and review notes: 7 years from the screening date.
• Transaction-monitoring logs and flagged-transaction review records: 7 years from the date of the flag.
• Suspicious-activity reports and supporting documentation: 7 years from the date of filing (where applicable).

9. Roles and responsibilities

The founder is currently the designated AML / KYC compliance officer for Vizno and is responsible for:

• Approving creator and reseller onboarding decisions where a sanctions hit, PEP hit, or other red flag has been raised.
• Reviewing the transaction-monitoring queue.
• Filing any required suspicious-activity reports.
• Conducting the annual review described in Section 11.

When Vizno's team grows, this responsibility may be delegated to a named compliance officer; the delegation is recorded in an update to this policy.

10. Training

The founder, and any staff or contractors with payout-approval authority, complete an annual review of this policy and of the practical procedures for the Vizno sanctions queue at /admin/sanctions and the npm run sanctions:ingest ingest script. Completion of the review is recorded with a date.

11. Policy review

This policy is reviewed at least annually by the founder and updated as the platform's payment activity, the regulatory environment, or the requirements of Vizno's payment partners evolve. Material changes are recorded with a revision date.

12. Contact

• AML / KYC compliance contact: compliance@vizno.com
• Sanctions matters: compliance@vizno.com
• Payout questions: support@vizno.com