1. Introduction & Scope

Bitsduck is a Money Services Business (MSB) registered with FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).

This AML & KYC Policy sets out how we (Bitsduck) comply with Canadian AML/ATF laws and regulations when providing non-custodial cryptocurrency exchange services to clients.

The policy applies to all users, clients, employees, contractors or third-party service providers working with Bitsduck.

2. Compliance Officer & Governance

Bitsduck appoints a dedicated AML Compliance Officer responsible for:

• Overseeing implementation of this AML & KYC Policy
• Ensuring compliance with PCMLTFA / FINTRAC requirements
• Conducting periodic staff training on AML/ATF obligations
• Submitting required reports (Large Virtual Currency Transaction Reports, Suspicious Transaction Reports, etc.) to FINTRAC

3. Customer Due Diligence (CDD) & Identity Verification

Bitsduck must verify the identity of every client who performs a transaction of virtual currency exchange per FINTRAC guidance.  Required information includes: full name, date of birth, residential address, government-issued photo ID, and additional documentation (e.g., proof of address, proof of funds) where indicated. Bitsduck uses reliable third-party identity verification tools and may supplement with manual review.

4. Enhanced Due Diligence (EDD)

Enhanced due diligence will be triggered where relevant risk factors exist, including but not limited to:

• Politically Exposed Persons (PEPs) or Heads of International Organizations (HIOs)
• High-risk jurisdictions or enhanced risk countries
• Large or unusual transaction volume or patterns
• Complex ownership structures requiring beneficial owner verification

In such cases, Bitsduck may request further documentation (e.g., source-of-funds/source-of-wealth evidence) or additional compliance checks before allowing transactions.

5. Transaction Monitoring & Risk Assessment

Bitsduck maintains automated and manual monitoring tools to flag suspicious or unusual activity, including but not limited to large or frequent transactions, inconsistent transaction patterns, high-risk jurisdiction involvement, and other red flags. Risk assessments (client risk scoring, transactional risk, jurisdiction risk) are regularly updated to reflect evolving threats and regulatory guidance.

6. Large Virtual Currency Transaction Reporting (LVCTR) & Record-Keeping

Bitsduck will file a Large Virtual Currency Transaction Report (LVCTR) with FINTRAC when a client receives virtual currency equivalent to CAD 10,000 or more in a single transaction (or multiple transactions occurring within a 24-hour window that aggregate to CAD 10,000 or more). 

All required supporting records (identity verification, transaction logs, correspondence, wallet addresses, etc.) will be stored for a minimum of 5 years, in compliance with PCMLTFA record-keeping rules. 

7. Sanctions, PEP / HIO Screening & Restricted Jurisdictions

Bitsduck screens all clients and transactions against applicable global sanctions lists and domestic Canadian sanctions regimes. Transactions involving sanctioned persons, entities, or jurisdictions are prohibited. PEP/HIO clients are subject to EDD and ongoing monitoring, in line with PCMLTFA guidance on politically exposed persons.

8. Non-Custodial Exchange Model

Bitsduck operates strictly as a non-custodial crypto exchange:

• Bitsduck does not hold or custody clients’ crypto assets; all funds and crypto must be sent from and returned to self-hosted wallets or same-name external accounts.
• Bitsduck does not provide wallet hosting, storage services, or any custodial services.

Clients remain responsible for the security of their wallets and private keys. Bitsduck is not liable for losses due to incorrect addresses, wallet compromise, blockchain delays, or network-level issues.

9. Client Risk-Awareness & Consent

By using our Services, you acknowledge:

• Cryptocurrency carries inherent risks (volatility, irreversible transactions).
• You understand and accept those risks.

You must provide accurate and truthful information during onboarding and maintain account security.

Failure to comply may result in account suspension or termination.

10. Confidentiality, Reporting & Regulatory Cooperation

Bitsduck will treat your personal information as confidential and only use or disclose it as required under PCMLTFA, in response to lawful requests, or for compliance purposes. Bitsduck may cooperate with law enforcement or regulatory authorities if required under Canadian law.

Bitsduck is legally prohibited from notifying you if a Suspicious Transaction Report (STR) or other regulatory report has been filed.

11. Policy Review & Updates

This AML & KYC Policy will be reviewed at least annually or whenever regulatory changes, business model changes, or compliance requirements require it.

12. Contact Information

For any questions regarding this policy or to request a copy of our compliance procedures, please contact: [email protected]