Anti-Money Laundering (AML) Policy

1. Policy Objective & Regulatory Scope

OctopusCRM Solutions Ltd ("OctopusCRM") maintains zero tolerance for money laundering, terrorist financing, fraud, and illegal financial operations. Because our software facilitates on-site card processing, invoicing, and sub-tenant payment link dispatch for trade professionals and white-label agency partners, we strictly comply with the UK Money Laundering Regulations 2017 (MLR 2017), the Proceeds of Crime Act 2002 (POCA), the Terrorism Act 2000, and FATF international standards.

2. Know Your Customer (KYC) & Verification

All merchants, trade contractors, and agency resellers onboarding onto OctopusCRM or deploying sub-tenant accounts must undergo automated identity and business verification before processing live transactions:

• Business & Identity Verification: Government-issued photo ID verification for primary account owners and corporate registry checks for trading entities.
• Bank Account Matching: Payout destination bank accounts must strictly match the verified legal business entity name. Third-party payouts are prohibited.
• White-Label Sub-Tenant Oversight: Agency partners subscribing to Wholesale Tiers must enforce equivalent KYC standards across their deployed sub-tenants.

3. Real-Time Transaction Monitoring & Fraud Detection

To detect and prevent illicit cash flows through on-site payment terminals and invoice payment links, OctopusCRM deploys automated transaction monitoring heuristics, including:

• Monitoring for sudden velocity spikes in transaction volume or high-value payment link generation.
• Flagging unusual card testing patterns, rapid refund attempts, or mismatched geo-location IP coordinates relative to job site coordinates.
• Immediate temporary freeze on merchant payouts upon detection of high-risk AML or chargeback triggers pending review.

4. Suspicious Activity Reporting (SAR) & Escalation

OctopusCRM appoints a designated Money Laundering Reporting Officer (MLRO). Where transaction monitoring or manual audits reveal grounds for suspicion that funds represent proceeds of crime, our compliance team submits a Suspicious Activity Report (SAR) to the National Crime Agency (NCA) or relevant financial intelligence authority. Under statutory tipping-off regulations, affected accounts will not be notified of active investigations.

5. Sanctions Screening & Record Retention

We conduct automated daily screening against OFAC, UK Treasury (HMT), EU, and UN financial sanctions lists. In accordance with statutory compliance guidelines, all KYC identity records, transaction logs, e-signature audit trails, and payment telemetry are securely retained for a minimum of five (5) years following account termination.