AML / KYC & Fraud Policy
Version 2026.05.22. A trusted payment processor and our bank require a documented anti-money-laundering and know-your-customer posture. This is ours.
1. Scope
Applies to all card, ACH bank transfer, and wire transactions, and to wholesale onboarding.
2. Customer due diligence (retail)
- Email + shipping address captured at checkout.
- Triple attestation (21+, RUO, Terms) on the order record.
- Address-to-billing consistency checked; mismatches above a threshold are reviewed.
- Velocity checks: repeated failed payments, many cards on one account, or many accounts on one address are flagged.
3. Enhanced due diligence (wholesale / high-value)
For wholesale or orders above the KYC threshold (set in admin Settings → KYC):
- Collect institution name, role, tax-ID/EIN, and institutional address.
- Run identity verification via Persona / Stripe Identity (config slot live in admin).
- Screen the party against OFAC SDN, BIS Entity List, and the State Department Debarred list (see Export Compliance Policy).
- A flagged party is declined; the decision and reason are logged.
4. Payment specifics
- ACH bank transfer, wire, and direct bank deposit to our U.S. business account are our payment methods. Net-30 is available for verified institutional accounts. We do not accept cryptocurrency.
- Unusually structured payments (many small charges to evade a threshold) are flagged for manual review.
5. Red flags (non-exhaustive)
- Shipping to a freight forwarder that masks a non-US destination.
- Buyer requests to relabel, remove RUO marks, or ship without lot labels.
- Buyer states human-use, clinic, gym, or resale intent.
- Reluctance to provide institutional info for a clearly institutional-volume order.
- Payment from a sanctioned region.
6. Suspicious activity
- Flagged transactions are held, not auto-shipped.
- A manager reviews within one business day.
- If the activity indicates money laundering or sanctions evasion, we decline, refund through the original method where lawful, document the decision, and where legally required, file the appropriate report. We do not "tip off" the customer about a report.
7. Records
- Transaction records, attestation, screening results, and review decisions are retained for 7 years.
- The admin audit log captures every refusal, refund, and KYC action.
8. Roles
- Owner is the AML compliance officer until a dedicated officer is appointed.
- Staff escalate any red flag; they do not clear flagged transactions alone.
9. Training & review
- Annual refresh of this policy and the red-flag list.
- Re-screen wholesale accounts annually.