Anti-Money Laundering Policy Statement

Where we are today

HYRO is not open for business. We have no customers, we hold no customer funds and no customer assets, and we process no transactions. This website collects an email address and nothing else, so there is no customer due diligence to perform here.

What follows describes the standard we are building to and will operate under before we accept a single customer. We publish it now so that counterparties, partners, banks and regulators can see our intentions, and so that anyone looking for a loosely run venue understands that this is not one.

The framework we are building to

Our program is designed around the following:

• the Anti-Money Laundering Act, 2020 (Act 1044), together with its regulations and the guidance of the Financial Intelligence Centre of Ghana;
• the Anti-Terrorism Act, 2008 (Act 762);
• the Virtual Asset Service Providers Act, 2025 (Act 1154), which governs virtual asset service providers in Ghana;
• the requirements and conditions attaching to the regulatory sandbox in which we participate, and to any license subsequently granted to us;
• the Financial Action Task Force Recommendations, including Recommendation 15 on new technologies and the travel rule requirement to transmit originator and beneficiary information with transfers;
• the sanctions regimes we are required to apply, including United Nations Security Council measures.

Where a Ghanaian requirement and an international standard differ, we apply the stricter of the two.

Governance

• The board of HYRO Exchange Ghana Ltd owns this policy, approves it, and reviews it at least annually.
• A dedicated Anti-Money Laundering Reporting Officer will be appointed, with direct access to the board, before we accept any customer. That officer has the authority to refuse, suspend or exit any relationship, and that decision cannot be overruled on commercial grounds.
• Compliance screening sits before revenue in every process we design. An account that cannot be verified is not opened.
• All staff and contractors receive anti-money laundering and sanctions training on joining and at least annually, appropriate to their role.
• The program will be independently reviewed, and we will remediate what a review finds.
• Staff can raise a concern confidentially and without retaliation.

A risk based approach

We assess risk across customers, countries, products, delivery channels and transactions, and we apply controls in proportion to it. Higher risk means more evidence, more scrutiny and more senior approval. It does not mean a higher price for a weaker check.

Customer due diligence at launch

• Every customer will be identified and verified before they can transact. No exceptions, no grandfathering and no introductions that skip the process.
• Identity will be verified against the national identity register, together with a liveness check confirming that the person presenting the identity is the person it belongs to.
• We will not open anonymous accounts, accounts in false names, numbered accounts, or accounts operated for an undisclosed third party. A withdrawal destination must belong to the verified account holder.
• Beneficial ownership and control will be established for any business customer, along with the purpose of the relationship.
• Enhanced due diligence, including source of funds and source of wealth, will apply to higher risk customers, to politically exposed persons and their close associates and family members, and to unusually large or complex activity.
• Due diligence information will be refreshed periodically and whenever something material changes.

Sanctions

We screen customers, related parties and counterparties against the sanctions and watch lists we are required to apply, at onboarding and on an ongoing basis against list changes.

A confirmed match results in an immediate freeze, a refusal to act, and a report to the authorities entitled to receive it. We will not process around a sanctions measure, and we will not accept an instruction whose purpose is to evade one.

Ongoing monitoring

• Transactions will be monitored for patterns associated with laundering, fraud, scam proceeds and structuring, with alerts investigated and documented.
• Blockchain analytics will be used to assess the origin and destination of virtual asset transfers. Exposure to darknet markets, ransomware, sanctioned addresses, theft and high risk mixing services will be treated as a serious risk event.
• We will transmit and receive the originator and beneficiary information required by the travel rule for qualifying transfers, and we will apply controls to transfers involving unidentified or self hosted wallets.

What we will not do business with

We will refuse, and where necessary report, any relationship or transaction involving:

• proceeds of crime, fraud, corruption, bribery, tax evasion or a scam of any kind;
• terrorist financing or proliferation financing;
• a sanctioned person, a person acting for a sanctioned person, or a jurisdiction we are prohibited from serving;
• a person who refuses to provide the information we are required to obtain, or who provides false or altered documents;
• a shell arrangement with no evident economic purpose, or a structure deliberately designed to obscure ownership;
• unlicensed money transmission, unlicensed exchange activity, or a third party trading scheme operated through an account;
• child sexual abuse material, human trafficking, weapons trafficking, or narcotics;
• activity whose evident purpose is to disguise the source of funds.

Reporting, and why we may not be able to explain

Where we have reasonable grounds to suspect that funds or activity are connected to crime, we are required to report it to the Financial Intelligence Centre. We will do so.

The law prohibits us from telling a person that a report about them has been made or is being considered. If we restrict an account and decline to give a reason, that silence may be a legal obligation rather than a choice, and no inference should be drawn from it in either direction.

Records

Identification records, transaction records, correspondence and the results of investigations will be retained for at least five years after the end of a customer relationship or the completion of a transaction, as Ghanaian law requires, and longer where an authority directs us to keep them.

This obligation overrides a request for deletion. We cannot delete a record that the law requires us to keep, even if you ask us to, and our Privacy Policy says the same.

What this means for you, when we open

• We will ask you to prove who you are, and we may ask where funds came from. If you prefer not to answer, we cannot act for you.
• We may refuse an application, delay or decline a transaction, freeze a balance, or end a relationship, where our obligations require it or where our assessment of risk requires it.
• We may be unable to tell you why, as described above.
• To the maximum extent permitted by law, we accept no liability for a loss, a missed opportunity or a price movement arising from action we take to comply with these obligations.

Status of this statement

This statement is published for information. It is not a contract, it does not create any right, duty or standard of care owed to you or to any third party, and nobody may rely on it as a representation about the state of our controls at any particular moment.

It describes a program under construction and it will be replaced by the policies in force when we launch. Nothing in it is an admission, a warranty, or a waiver of any privilege.

Reporting a concern

If you suspect that HYRO’s name is being used for fraud, or you want to raise a compliance concern, write to compliance@hyro.to. If you believe you are being defrauded by somebody impersonating us, also write to security@hyro.to and report it to the Ghana Police Service.