AML Policy
Last updated October 17, 2026 QUARION LLC
Brand “DESTRAL”
Company number: 412789825
ANTI-MONEY LAUNDERING AND COUNTERING THE FINANCING OF TERRORISM POLICY
Adopted by the management of QUARION LLC in accordance with the Law of Georgia “On Facilitating the Suppression of Money Laundering and Terrorism Financing”, the Recommendations of the Financial Action Task Force (FATF) applicable to virtual asset service providers, and the rules applicable to QUARION LLC as a VASP established in the Kutaisi Free Industrial Zone (licence N193).
This Policy takes effect on March 4, 2025.
I. Introduction and Purpose
1. This Anti-Money Laundering and Countering the Financing of Terrorism Policy (the “Policy”) sets the minimum and mandatory standards of QUARION LLC, operating under the brand “DESTRAL” (a limited liability company incorporated in Georgia, identification code 412789825, “THE COMPANY”), to prevent, detect and report money laundering and financing of terrorism, and to control and manage the related risks (collectively “ML/FT Risks”).
- a) prevent the abuse of the Platform and of the Services for money laundering (“ML”) and (or) financing of terrorism (“FT”);
- b) meet the applicable legal requirements and the international standards in the jurisdictions where THE COMPANY operates;
- c) refrain from establishing any relationship or processing any operation that relates to or may facilitate ML, FT, the evasion of sanctions or any other illicit activity;
- d) apply due diligence to its Users, to the persons acting on their behalf and to their beneficial owners;
- e) mitigate the reputational, financial and legal risks; and
- f) review and update this Policy as threats, technologies and international standards evolve.
II. Scope
3. This Policy applies to all the Services offered through the Platform, to all Users and prospective Users, and to all members of the staff and other individuals engaged by THE COMPANY to perform functions for it (“THE COMPANY Personnel”).
4. The Services are intended for Users located outside Georgia. The Policy applies in the same manner to all Users, wherever they are located.
5. This Policy is part of the Terms of Use, as provided in Clause 3.5 of the Terms of Use.
III. Definitions
- a) “Virtual Asset” means a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes;
- b) “VASP” means a virtual asset service provider;
- c) “User” means a natural or legal person that applies for, or holds, an Account on the Platform;
- d) “Smart Account” means the smart contract account deployed for the User on a Supported Chain and controlled by the User through its Means of Control, as defined in the Terms of Use;
- e) “Beneficial Owner” means the natural person(s) who ultimately owns or controls a User and (or) the natural person on whose behalf a transaction is conducted, including the persons who exercise ultimate effective control over a legal person or arrangement;
- f) “Politically Exposed Person (PEP)” means an individual who is or has been entrusted (domestically or by a foreign country) with a prominent public function, such as a head of state or of government, a senior politician, a senior government, judicial or military official, a senior executive of a state-owned corporation, an important political party official, or a person entrusted with a prominent function by an international organisation, together with their immediate family members and close associates;
- g) “Sanctions” means the restrictive measures, including asset freezes and prohibitions, imposed by the United Nations, the European Union, the Office of Foreign Assets Control (OFAC) and the competent authorities of Georgia;
- h) “Blockchain Analytics” means the tools and data used to trace the origin and the destination of Virtual Assets on public blockchain networks and to identify addresses associated with illicit activity or with sanctioned persons;
- i) “Suspicious Activity” means any activity, with or without monetary value, connected in any manner with THE COMPANY, that appears to be related to ML, FT, the evasion of Sanctions, fraud or another criminal offence;
- j) “Suspicious Activity Report (SAR)” means a report concerning a Suspicious Activity made to the AML/CFT Compliance Officer for investigation and (or) disclosure to a Competent Authority;
- k) “Competent Authority” means the public authority designated by the Applicable Law to receive reports on ML/FT or to supervise compliance with AML/CFT requirements;
- l) “Tipping-off” means disclosing to a User or to a third party that a Suspicious Activity or related information has been or will be reported to THE COMPANY management or to a Competent Authority, or that an investigation is ongoing; and
- m) “Travel Rule” means the requirement, where it applies, to obtain, hold and transmit information on the originator and the beneficiary of a transfer of Virtual Assets.
7. Capitalized terms not defined here have the meaning given in the Terms of Use. Any other term has the meaning given in the Applicable Law.
IV. Governance, Roles and Responsibilities
8. THE COMPANY appoints an AML/CFT Compliance Officer, who has the authority, the independence and the resources necessary to perform the function, and who reports directly to the management of THE COMPANY. The management of THE COMPANY may act in lieu of the AML/CFT Compliance Officer where the position is vacant.
- a) maintaining and applying this Policy and the related procedures;
- b) overseeing the business risk assessment, the due diligence, the screening and the monitoring described below;
- c) receiving, investigating and deciding on the internal reports of Suspicious Activity;
- d) reporting to the Competent Authority, in coordination with the management; and
- e) organising the training of THE COMPANY Personnel.
- a) complying with this Policy and the related procedures;
- b) reporting to the AML/CFT Compliance Officer without undue delay any Suspicious Activity or red flag; and
- c) keeping confidential any report and any related investigation.
11. Independent contractors and providers performing relevant functions are required to comply with this Policy or with equivalent standards.
12. If the ML/FT Risk of a User cannot be reasonably assessed, THE COMPANY may suspend onboarding or apply enhanced due diligence measures.
V. Business Risk Assessment
13. THE COMPANY shall identify, assess, understand and document its ML/FT Risks and apply a risk-based approach, so that the measures to prevent or mitigate ML/FT are proportionate to the risks identified.
- a) the profile and the geographic location of Users;
- b) the Services offered, including the Smart Account, the multi-chain wallet, the Swap, the Vaults, staking and the referral programme;
- c) the Supported Chains and Supported Tokens, including the traceability of the assets, and the exposure to privacy-enhancing technologies, to mixers and to bridges;
- d) the channels through which Users are onboarded and the technologies used; and
- e) the findings of the monitoring, of the SARs and of the reviews.
VI. User Due Diligence
15. Identity verification is required to open an Account. THE COMPANY shall complete and approve the due diligence on a User before opening the Account and before making a Smart Account available to the User.
- a) the identification of the User on the basis of an official identity document;
- b) the verification of the identity, including a check of the authenticity of the document and a comparison with a facial image or a short video recording of the User;
- c) the collection of the country of residence, the nationality and the date of birth; and
- d) screening against Sanctions and PEP lists.
- a) the identification and verification of the entity, on the basis of official documents;
- b) the identification and verification of its Beneficial Owners, and of the persons authorised to act on its behalf;
- c) the understanding of its ownership and control structure; and
- d) screening against Sanctions and PEP lists of the entity, of its Beneficial Owners and of the persons acting on its behalf.
18. Identity verification is carried out by THE COMPANY with the support of a specialised identity verification provider, as described in the Privacy Policy. THE COMPANY remains responsible for the result of the due diligence.
19. THE COMPANY shall assess the purpose and the nature of the relationship, and shall obtain information on the source of funds or the source of wealth of a User where required by the risk-based approach.
20. CDD information and identification evidence shall be obtained directly from the User or from independent and reliable sources.
21. Users are required to keep their information up to date and to inform THE COMPANY of any change without undue delay. THE COMPANY shall review the due diligence of Users periodically, at a frequency determined by the risk-based approach, and when a trigger event occurs.
22. THE COMPANY shall not open an Account, and shall restrict or terminate an existing relationship, where it cannot complete the due diligence, where the information provided is false or incomplete, or where it is not satisfied with the identity of the User.
- a) a person who is listed on a Sanctions list or who is owned or controlled by a listed person;
- b) a person who is a citizen or a resident of a country in the List of Prohibited Countries defined in the Terms of Use;
- c) a person seeking to remain anonymous or to use a fictitious name;
- d) a User who holds, or seeks to hold, more than one Account; and
- e) any person whom THE COMPANY has reasonable grounds to suspect of using the Services for ML, FT, the evasion of Sanctions or another criminal activity.
24. The list of unacceptable relationships may be expanded or amended in line with the changing environment.
VII. Enhanced Due Diligence
- a) Politically Exposed Persons, their family members and close associates;
- b) Users from, or with funds connected to, jurisdictions identified by the FATF as high-risk or subject to increased monitoring;
- c) legal entities with an unduly complex ownership structure, with nominee shareholders or directors, or with bearer shares;
- d) Users whose activity triggers a significant alert of the monitoring described in Section IX;
- e) Users who are the subject of adverse media information; and
- f) any other situation assessed as high risk.
26. Enhanced due diligence may include obtaining additional information and documents on the User, on the source of funds and the source of wealth, on the purpose of the activity, and on the Beneficial Owners, a more frequent review, and the approval of the AML/CFT Compliance Officer before the relationship is opened or continued.
VIII. Sanctions Screening
27. All Users, Beneficial Owners and persons acting on behalf of a User are screened, at onboarding and on an ongoing basis, against relevant international sanctions lists including but not limited to the lists of the UN, the EU, OFAC, and national lists.
28. A match is investigated by the AML/CFT Compliance Officer. Where a match is confirmed, THE COMPANY shall refuse, restrict or terminate the relationship, shall not make available any Service to the person, and shall report as required by the Applicable Law.
IX. Transaction and Address Monitoring
- a) the review of the activity of Users against their profile;
- b) automated rules and alerts, based in particular on the amounts, the frequency, the counterparties, the geography and the patterns of use; and
- c) the manual review of alerts by the AML/CFT Compliance Officer or the persons designated by him or her.
30. The tools used for monitoring shall be reviewed regularly for their effectiveness, and enhanced or changed where necessary.
31. Where financial transaction activities are carried out on public blockchain networks, the monitoring measures referred to above shall include the screening of the blockchain addresses involved against sanctions lists and against intelligence on addresses associated with illicit activity, both before and after the execution of a transaction. THE COMPANY may refuse or delay the processing or the relaying of an instruction, and shall report the matter in accordance with Section XI, where such screening identifies a designated or high-risk address.
32. THE COMPANY requires that withdrawals be made only to addresses previously registered by the User, and may apply a waiting period before a newly registered address can be used. These measures are intended to prevent the diversion of funds to a third party, including where the account of a User has been compromised.
33. THE COMPANY may take the following measures on the basis of its monitoring and screening: request additional information or documents from the User, refuse or delay the relaying of an Instruction, restrict or suspend access to the Platform or to a Service, hold or defer a Vault allocation or redemption in accordance with the Vault Terms, and terminate the relationship.
34. The Smart Account is controlled by the User alone. THE COMPANY cannot move or freeze assets held in a Smart Account. The measures available to THE COMPANY therefore relate to access to the Platform and to the Services, to the relaying and the sponsorship of Instructions, and to the positions in Vaults that THE COMPANY holds and operates.
X. Travel Rule
35. Where the Applicable Law requires it, THE COMPANY shall obtain, hold and transmit the information on the originator and the beneficiary of a transfer of Virtual Assets, and shall screen the information received, when it acts for a transfer with another VASP.
36. For transfers to, or from, addresses that are not hosted by a VASP, THE COMPANY shall apply risk-based measures, such as the registration of the withdrawal addresses by the User (Paragraph 32), the screening of the addresses, and, where the risk justifies it, a request for evidence that the address belongs to the User.
XI. Reporting Red Flags, Suspicious Activities and Suspected ML/FT
37. THE COMPANY Personnel shall report any Suspicious Activity, red flag (indicators of a suspicious activity), or ML/FT activity which they identify or suspect in the course of performing their duties to the AML/CFT Compliance Officer for investigation. Such reports shall be made and investigated in accordance with THE COMPANY policies and procedures. Failure to report may leave THE COMPANY open to serious reputational damages or legal liability.
38. The AML/CFT Compliance Officer shall provide easily accessible reporting channels and shall ensure that all reports are documented, attended to and investigated in a prompt and professional manner.
39. All SARs must be internally logged and retained for at least 5 years. THE COMPANY will not take disciplinary action against whistleblowers reporting in good faith.
40. The AML/CFT Compliance Officer shall notify the management of THE COMPANY when a Suspicious Activity or suspected ML/FT activity has been substantiated. The management shall determine whether to disclose it to a Competent Authority in accordance with the Applicable Law. THE COMPANY may authorise the AML/CFT Compliance Officer to make a disclosure on behalf of THE COMPANY. Decisions to disclose or not to disclose must be clearly recorded and reported.
41. THE COMPANY may take disciplinary or other remedial action against any THE COMPANY Personnel who, having knowledge of Suspicious Activities, fails without reasonable excuse to make a report, or who blocks, or attempts to block, a report by another member of THE COMPANY Personnel.
42. Under no circumstances should THE COMPANY Personnel engage in Tipping-off. Tipping-off could prejudice an existing or potential investigation by the AML/CFT Compliance Officer or by Competent Authorities and may be subject to remedial action.
XII. Exiting a Relationship
43. THE COMPANY does not enter into or maintain relationships with Users who are using the Services for ML or FT. THE COMPANY may restrict, suspend or terminate the relationship with a User in the situations described in Clause 11 of the Terms of Use.
44. When a relationship ends or is restricted, the User keeps its control over the Smart Account, and may withdraw the assets it holds to a registered address, subject to the screening described in this Policy and to the Applicable Law. Vault allocations are dealt with in accordance with the Vault Terms.
45. The decision and the communication to the User shall be made in a manner that avoids Tipping-off.
XIII. Reliance on Third Parties and Outsourcing
46. THE COMPANY may rely on third-party providers for identity verification, sanctions and PEP screening, Blockchain Analytics and other compliance functions. THE COMPANY selects such providers with care, remains responsible for compliance with this Policy, reviews their performance and obtains the data needed to demonstrate that the due diligence has been performed.
XIV. Training and Capacity Building
- a) the obligations, rules and procedures set out in this Policy and the consequences for compliance failures;
- b) the identification of ML/FT red flags, in particular those linked to Virtual Assets, and the procedures for reporting them; and
- c) the changes of the Applicable Law and of the typologies.
48. THE COMPANY shall keep a record of the trainings carried out.
XV. Record Retention
- a) the identification data and the documents obtained during due diligence;
- b) the results of the screening and of the monitoring;
- c) the records of Instructions and Transactions, including the blockchain addresses involved;
- d) the SARs and the related decisions; and
- e) the records of the trainings and of the reviews of this Policy.
- a) the duration and terms of record retention;
- b) record storage and internal and external access to records;
- c) the use of records for investigation purposes;
- d) terms of record retention compliance;
- e) confidentiality and security of record retention; and
- f) the scope and contents of records.
51. Records must be retained for a minimum of 5 years from the date of the transaction or relationship termination, unless otherwise required by law.
XVI. Data Protection and Confidentiality
52. Any data, information and documents, whether in physical or electronic format, obtained in the course of due diligence or of the monitoring of Suspicious Activities shall be protected and kept confidential in accordance with THE COMPANY policies and procedures and the Privacy Policy.
XVII. Independent Review and Review of this Policy
53. THE COMPANY shall have the effectiveness of its AML/CFT controls tested periodically, by an independent function or by an external reviewer. The results and the action plans shall be reported to the management.
54. This Policy shall be reviewed at least annually, and whenever a change of the Applicable Law, of the Services or of the risks so requires, by the AML/CFT Compliance Officer in cooperation with the management.
XVIII. Interpretation and Authority
55. The management of THE COMPANY has the ultimate right of interpretation of this Policy. For operational purposes, at first instance, this responsibility is delegated to the AML/CFT Compliance Officer.
56. This Policy is approved by the management of THE COMPANY. Any amendment requires the approval of the management.
XIX. Effective Date
57. This Policy comes into effect on the date of its approval by the management of THE COMPANY, indicated above.
Annex I: Examples of ML/TF Red Flags
The following list provides examples of red flags that may indicate money laundering or terrorist financing (ML/TF) risks. This is a non-exhaustive list and is intended to guide THE COMPANY Personnel in identifying potentially suspicious activities:
1. User Behavior Red Flags
- Reluctance or refusal to provide complete identification information or supporting documentation.
- Attempts to shield the identity of Beneficial Owners or related parties.
- Use of complex structures without a legitimate business reason.
- Use of VPNs or other means to disguise the location, inconsistent with the declared residence.
- Multiple attempts to open Accounts, or the use of inconsistent or altered documents.
- Accounts that appear to be controlled by someone other than the User.
2. Transaction and Address Red Flags
- Transfers to or from addresses linked to Sanctions, darknet markets, ransomware, scams, mixers or other illicit services.
- Rapid movement of funds in and out with no apparent economic purpose, or the structuring of amounts into many smaller transfers.
- Frequent use of Swaps or bridges between chains that appear to aim at obscuring the origin of the funds.
- Repeated registration of new withdrawal addresses, or attempts to withdraw to an address of a third party.
- Sudden or unexplained changes in activity or profile, or activity that is inconsistent with the declared source of funds.
- Allocation to a Vault followed by a rapid redemption without an apparent purpose.
3. Geographic Risk Red Flags
- Users or transactions involving jurisdictions known for high ML/TF risk or secrecy laws.
- Frequent dealings with countries under international sanctions or watch lists.
- Access from jurisdictions in the List of Prohibited Countries.
4. User Profile Red Flags
- Entities with no verifiable physical presence or operations.
- Use of shell companies.
- Unexplained relationships with PEPs or individuals on watchlists.
- Frequent changes to ownership, management or structure.