Anti-Money Laundering & Counter-Terrorism Financing Policy

1. Purpose and Scope

This Policy sets out Gixodia's commitment to preventing money laundering (ML), terrorism financing (TF), proliferation financing (PF), sanctions evasion, and related financial crime. It applies to:

All Gixodia employees, contractors, officers, and directors.
All customers, prospects, partners, affiliates, and resellers.
All products and services offered under the Gixodia brand, including GIX-GOLD, GIX-EURO, and any future software products.
All websites, web forms, and communication channels operated by Gixodia.

The Policy is reviewed at least annually and updated as needed to reflect changes in law, regulation, guidance, or our risk profile.

2. Our Regulatory Status

Gixodia is a software licensor. We design, develop, and license algorithmic trading software. We do not:

Hold, receive, transmit, or exchange customer funds.
Hold customer cryptocurrency, tokens, or other digital assets.
Operate a trading venue, exchange, broker-dealer, money-services business, or payment institution.
Provide investment advice, portfolio management, or fiduciary services.
Accept deposits or issue financial instruments.

Because of this, Gixodia is not a "financial institution" within the meaning of the U.S. Bank Secrecy Act (BSA), FinCEN regulations (31 CFR Chapter X), or the EU Anti-Money Laundering Directives (AMLD4, AMLD5, AMLD6, and the 2024 AML Package including Regulation (EU) 2024/1624 and Directive (EU) 2024/1640). We are not registered as a Money Services Business (MSB), a Virtual Asset Service Provider (VASP), or a Crypto Asset Service Provider (CASP), and are not required to be.

3. Why We Still Publish This Policy

Although we are not legally obligated to maintain an AML program, we choose to do so because:

Customer trust. Our customers operate in the financial markets and expect the tools they use to be built by responsible companies.
Alignment with best practices. The Financial Action Task Force (FATF) Recommendations encourage a risk-based approach across the entire financial-services value chain, including technology providers.
Reputation and integrity. We refuse to be a vector, even indirectly, for criminal activity.
Broker relationships. Many of the brokers our customers use are themselves regulated and expect their technology vendors to apply comparable standards.
Future-proofing. Regulation of fintech software providers is evolving, and we prefer to operate above the current minimum.

4. Governing Principles

Our AML/CTF program is built on the following principles, drawn from the FATF Recommendations (2012, as updated) and international best practice:

Risk-based approach. Controls are proportionate to the ML/TF risks we identify.
Know Your Customer (KYC) reliance. We rely on the regulated brokers that our customers use to perform full KYC/CDD on their clients.
Zero tolerance for sanctions violations. We will not do business with any person or entity on a prohibited list.
Cooperation with authorities. Where legally permitted, we cooperate with law-enforcement and regulatory requests.
Ongoing monitoring. Our controls are not "set and forget"; we review them continuously.

5. Prohibited Customers

Gixodia will not knowingly license its software to, or otherwise do business with:

Individuals or entities on the U.S. Department of the Treasury Office of Foreign Assets Control (OFAC) Specially Designated Nationals and Blocked Persons (SDN) list or any other OFAC sanctions list.
Individuals or entities on the European Union Consolidated List of Sanctions.
Individuals or entities on the United Nations Security Council Consolidated List.
Individuals or entities on the UK HM Treasury Office of Financial Sanctions Implementation (OFSI) Consolidated List.
Individuals or entities on the Canadian, Swiss, Japanese, Australian, or other applicable national sanctions lists.
Persons ordinarily resident in, or entities organised under the laws of, jurisdictions subject to comprehensive U.S., EU, UK, or UN embargoes, currently including (without limitation) Iran, North Korea (DPRK), Syria, Cuba, the Crimea, so-called Donetsk People's Republic and Luhansk People's Republic regions of Ukraine, and any other jurisdiction added to comprehensive-embargo lists.
Persons ordinarily resident in, or entities organised under the laws of, FATF-listed "High-Risk Jurisdictions subject to a Call for Action" (the FATF "black list").
Politically Exposed Persons (PEPs), their family members, or close associates, unless cleared through enhanced due diligence.
Any person or entity we have reasonable grounds to believe is engaged in, or has facilitated, money laundering, terrorism financing, proliferation financing, fraud, or other financial crime.

6. Prohibited Activities

Customers are prohibited from using Gixodia software to:

Launder proceeds of crime or conceal the origin of funds.
Finance terrorism or the proliferation of weapons of mass destruction.
Evade economic sanctions.
Commit market abuse, including insider dealing, market manipulation, spoofing, layering, or wash trading.
Circumvent the AML/KYC controls of any broker, exchange, or financial institution.
Operate a "pooled account" or managed-account scheme for third parties without appropriate regulatory authorisation.
Run our software on accounts that belong to persons other than the licensed user, without that user's authority and compliance with applicable law.

Violation of this section is a material breach of our Terms and EULA and will result in immediate license termination.

7. Customer Due Diligence (CDD) We Perform

Because Gixodia does not handle customer funds, we apply light-touch customer due diligence tailored to our risk profile. Our controls include:

Email verification — every customer must verify a working email address before receiving a license key.
Geo-IP screening — access from IP addresses associated with comprehensively sanctioned jurisdictions is blocked at the edge (Cloudflare).
Sanctions screening — billing names and email domains are screened against OFAC, EU, UN, and UK consolidated sanctions lists at the point of purchase and on a recurring basis.
Payment provider reliance — all payments are processed by PCI-DSS and AML-regulated payment processors that perform their own KYC on cardholders.
Broker KYC reliance — our software runs on the customer's own broker account. The broker, as a regulated financial institution, is responsible for full KYC/CDD on its clients under applicable law.
Affiliate vetting — affiliates and resellers must accept our Terms and are screened in the same manner as customers, with enhanced checks where volumes or commissions exceed agreed thresholds.
Reasonable commercial inquiries — for unusually large or unusually structured orders, we may request additional information before approving a license.

We do not collect government IDs, utility bills, or other KYC documents, because doing so is neither necessary nor proportionate to our risk profile and would create an unjustified privacy impact.

8. Red Flags We Monitor

Our team is trained to recognise and escalate the following indicators of potential financial crime:

Purchase attempts from sanctioned jurisdictions or using sanctioned names.
Unusual order patterns inconsistent with individual retail use (e.g., bulk license orders with no business rationale).
Payment methods associated with higher ML risk, or repeated chargebacks.
Requests to route licenses or communications through third parties in high-risk jurisdictions.
Customers who provide inconsistent, false, or obviously evasive information.
Requests to disable logging, compliance features, or sanctions blocks.
Pressure to complete a transaction faster than normal or outside normal channels.
Offers of payment in unusual forms or from unrelated third-party accounts.
Any reference to concealing the identity of the true beneficial owner.

Any employee encountering a red flag is required to escalate immediately to the Compliance Contact (Section 12) and must not "tip off" the subject of the concern.

9. Reporting Suspicious Activity

Because Gixodia is not a regulated financial institution, we are generally not subject to mandatory Suspicious Activity Report (SAR / STR) filing obligations. Nonetheless:

We will promptly file a voluntary report with the appropriate Financial Intelligence Unit (FIU) — FinCEN, NCA (UKFIU), or the relevant EU FIU — where we have a good-faith belief that doing so is lawful and appropriate.
We will respond to all valid legal process (subpoenas, court orders, MLA requests) in accordance with applicable law.
We will not "tip off" any person who is the subject of a suspicious-activity review.
Employees are protected from retaliation for reporting concerns in good faith.

10. Record Keeping

We retain records relevant to this Policy for a minimum of five (5) years after the end of the business relationship or the date of the transaction, whichever is later, in line with FATF Recommendation 11. Records may include:

Customer account and license records.
Billing and invoice records.
Sanctions-screening results and evidence of clearance.
Red-flag escalations and internal investigations.
Correspondence with customers regarding compliance matters.
Training records.

Records are stored securely, access-controlled, and deleted in accordance with our Privacy Policy once the retention period ends, unless legal obligations require longer retention.

11. Employee Training

All Gixodia employees and relevant contractors receive AML/CTF awareness training:

At onboarding.
At least annually.
Whenever material changes to this Policy, applicable law, or our risk profile occur.

Training covers the basics of money laundering and terrorism financing, the red flags listed in Section 8, how to escalate concerns, the duty not to tip off, and the protections available to whistleblowers.

12. Designated Compliance Contact

Gixodia has designated a Compliance Contact responsible for:

Maintaining and updating this Policy.
Overseeing sanctions screening.
Receiving internal escalations of red flags and suspicious activity.
Being the point of contact for law-enforcement and regulatory inquiries.
Coordinating employee training.

Compliance Contact email: support@gixodia.com (subject line: "AML/Compliance — [topic]")

13. Sanctions Screening Tools and Process

We rely on a combination of:

Maintained, regularly updated consolidated sanctions lists (OFAC SDN, EU, UN, UK OFSI).
Automated screening at the point of order submission and affiliate onboarding.
Periodic re-screening of active customer records.
Manual review for ambiguous matches, with documented clear-or-block decisions.

False positives are resolved in favour of blocking the transaction until identity is satisfactorily clarified.

14. Relationship with Broker KYC/AML

Our customers always open and fund their own accounts with independent, regulated brokers. Those brokers apply their own KYC/CDD/AML obligations under the laws of their home jurisdiction (e.g., MiFID II, EMIR, FCA rules, ASIC rules, CFTC/NFA rules, FINRA rules, MAS rules). Gixodia relies on this broker-level due diligence as the primary line of defense against illicit use of financial markets, consistent with a risk-based approach that places AML responsibility at the point where customer funds actually enter the financial system.

15. Annual Review and Updates

This Policy is reviewed by the Compliance Contact at least once every 12 months, and whenever:

Applicable laws or regulations change materially.
Our products, services, or customer base change materially.
An incident or near-miss suggests that controls need strengthening.
A regulator, auditor, or significant customer requests a review.

The next scheduled review is no later than 15 April 2027.

16. No Legal Advice; No Regulated Service

This Policy is published for transparency only. It does not constitute legal, tax, or investment advice, it does not create any contractual or fiduciary duty beyond what is expressly set out in our Terms and EULA, and it does not represent that Gixodia is a regulated financial institution.

17. Contact

Questions, reports, or law-enforcement requests relating to this Policy should be directed to:

Email: support@gixodia.com Subject line: AML/CTF — [topic]

Version History

v1.0 — 2026-04-15 — Initial publication. Voluntary AML/CTF program aligned with FATF Recommendations and best industry practice.