AML & KYC Compliance Policy

Anti-Money Laundering, Know Your Customer, and Sanctions Compliance Program.

Last updated: 20 September 2025

This policy outlines the Anti-Money Laundering (AML), Counter-Terrorism Financing (CTF), Know Your Customer (KYC), and Sanctions Compliance Program maintained by Nikhat VCloud Solutions L.L.C., trading as Vectaga (Trade License #1540701), with its registered office at Office No. M05-49, Sama Residence, Al Nahda First, Dubai, UAE.

1. Purpose and Scope

Vectaga is committed to preventing the use of its services for money laundering, terrorist financing, or any other financial crime. This policy applies to all business relationships, transactions, and services offered by Vectaga, including subscription-based and project-based engagements.

This program is designed in accordance with:

  • UAE Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Combating the Financing of Terrorism and Financing of Illegal Organisations
  • UAE Cabinet Decision No. 10 of 2019 (Implementing Regulations)
  • Financial Action Task Force (FATF) Recommendations
  • Applicable international sanctions regimes (UN, OFAC, EU, UAE local lists)

2. Compliance Officer

Vectaga has designated a Compliance Officer responsible for:

  • Overseeing the implementation and enforcement of this AML/KYC/CTF policy
  • Ensuring staff awareness and training on compliance obligations
  • Reviewing and updating internal procedures to reflect regulatory changes
  • Filing Suspicious Transaction Reports (STRs) with the UAE Financial Intelligence Unit (FIU) when required
  • Serving as the primary point of contact for regulatory inquiries

Contact: compliance@vectaga.com

3. Know Your Customer (KYC) Procedures

Vectaga performs identity verification on all customers before onboarding. Our KYC process includes:

3.1 Individual Clients

  • Full legal name, date of birth, and nationality
  • Government-issued photo identification (passport, national ID, or Emirates ID)
  • Proof of address (utility bill, bank statement, or official correspondence dated within 3 months)
  • Contact details (email, phone number)

3.2 Corporate / Business Clients

  • Trade license or certificate of incorporation
  • Memorandum and Articles of Association
  • Identification of Ultimate Beneficial Owners (UBOs) holding 25% or more ownership
  • Government-issued ID for all directors, authorised signatories, and UBOs
  • Proof of registered business address
  • Board resolution or power of attorney authorising the signatory

3.3 Enhanced Due Diligence (EDD)

Enhanced due diligence is applied to higher-risk clients, including:

  • Politically Exposed Persons (PEPs) and their relatives or close associates
  • Clients from high-risk jurisdictions as identified by FATF or UAE authorities
  • Unusually complex or large transactions with no apparent economic purpose
  • Clients whose source of funds cannot be readily verified

4. Sanctions and PEP Screening

Vectaga screens all customers and beneficial owners against applicable sanctions lists and PEP databases at the following stages:

  • Onboarding: Prior to establishing any business relationship
  • Ongoing: Periodic re-screening during the term of the business relationship
  • Trigger events: Upon any material change in client information or risk profile

Screening is performed against:

  • United Nations Security Council Consolidated Sanctions List
  • UAE Local Terrorist List and other UAE-designated lists
  • OFAC Specially Designated Nationals (SDN) List
  • EU Consolidated Sanctions List
  • Politically Exposed Persons (PEP) databases

Any positive match or potential match triggers an immediate escalation to the Compliance Officer for review before proceeding with the transaction or relationship.

5. Transaction Monitoring

Vectaga monitors transactions for unusual or suspicious activity, including but not limited to:

  • Payments that are inconsistent with the client's known business profile
  • Rapid successive transactions or unusual payment patterns
  • Attempts to make payments from sanctioned jurisdictions
  • Use of multiple payment methods or accounts without clear business justification
  • Transactions involving high-risk countries or territories

6. Elder Customer Protection

Vectaga takes additional care when engaging with customers aged 60 and over to prevent financial exploitation. Measures include:

  • Additional verification steps when high-value or unusual transactions are initiated by elder customers
  • Staff training to recognise signs of potential financial exploitation or undue influence
  • Escalation procedures when there is concern that an elder customer may be acting under duress or coercion
  • Clear communication of all terms, fees, and cancellation rights in plain language

7. Suspicious Activity Reporting

All employees are required to report any suspicious activity to the Compliance Officer immediately. The Compliance Officer evaluates each report and, where warranted, files a Suspicious Transaction Report (STR) with the UAE Financial Intelligence Unit (FIU) in accordance with Article 15 of UAE Federal Decree-Law No. 20 of 2018.

Tipping off a customer about a filed or pending STR is strictly prohibited and constitutes a criminal offence under UAE law.

8. Record Keeping

In accordance with UAE law, Vectaga retains the following records for a minimum of five (5) years following the end of the business relationship or the completion of the transaction (whichever is later):

  • All customer identification and verification documents
  • Transaction records, including amounts, dates, and parties involved
  • Internal risk assessments and due diligence reports
  • Correspondence and notes related to suspicious activity evaluations
  • Sanctions and PEP screening results

9. Staff Training

All Vectaga personnel involved in customer onboarding, account management, or payment processing receive regular training on:

  • AML/CTF regulatory requirements applicable in the UAE
  • Recognising red flags and indicators of suspicious activity
  • KYC and customer due diligence procedures
  • Sanctions compliance and PEP identification
  • Internal reporting obligations and escalation procedures
  • Elder customer protection awareness

Training is conducted upon hiring and refreshed annually, or sooner when regulatory changes occur.

10. Risk Assessment

Vectaga conducts periodic risk assessments to evaluate its exposure to money laundering, terrorist financing, and sanctions risks. The risk assessment considers:

  • Nature and complexity of services offered
  • Client base and geographic reach
  • Payment channels and methods accepted
  • Emerging threats and typologies published by FATF, UAE FIU, or other authorities

Findings from the risk assessment inform updates to this policy and related procedures.

11. Prohibited and Restricted Jurisdictions

Vectaga does not knowingly establish business relationships with, or process transactions for, individuals or entities located in countries subject to comprehensive international sanctions, identified as high-risk for money laundering and terrorist financing, or designated by the FATF, United Nations, OFAC, EU, or UAE authorities.

The following jurisdictions are currently restricted or prohibited. Vectaga will not onboard clients, process payments, or provide services to individuals or entities operating from these countries:

Sanctioned and Conflict Jurisdictions

Afghanistan, Belarus, Cuba, Democratic Republic of the Congo, Eritrea, Iran (Islamic Republic of), Iraq, Libya, Myanmar, North Korea, Russian Federation, Somalia, South Sudan, Sudan, Syria, Ukraine (occupied territories), Yemen

FATF High-Risk and Monitored Jurisdictions

Albania, Barbados, Bosnia and Herzegovina, Burkina Faso, Burundi, Cambodia, Cameroon, Central African Republic, Ecuador, Ethiopia, Gambia, Gaza Strip, Guinea, Guinea-Bissau, Haiti, Jamaica, Jordan, Kenya, Kosovo, Lebanon, Liberia, Madagascar, Mali, Morocco, Mozambique, Nepal, Nicaragua, Niger, Nigeria, North Macedonia, Pakistan, Senegal, Seychelles, Slovenia, Solomon Islands, South Africa, Suriname, Tanzania, Togo, Tonga, Trinidad and Tobago, Turkey, Turks and Caicos Islands, Uganda, Vanuatu, Venezuela (Bolivarian Republic of), Viet Nam, West Bank (Palestinian Territory, Occupied), Western Sahara, Zimbabwe

Other Restricted Jurisdictions

Algeria, Bangladesh, Bhutan, Botswana, China, Grenada, Qatar

This list is reviewed and updated periodically based on guidance from the FATF, United Nations Security Council, OFAC, EU, UAE Central Bank, and other relevant regulatory authorities. Vectaga reserves the right to decline or terminate any business relationship where the associated jurisdiction risk is deemed unacceptable.

Any existing client relationship affected by a change to this list will be reviewed by the Compliance Officer within 30 days and, if necessary, wound down in an orderly manner in accordance with applicable law.

12. Licensing and Registration

Nikhat VCloud Solutions L.L.C. is registered and licensed in Dubai, UAE under Trade License #1540701. Vectaga operates in full compliance with applicable UAE commercial and regulatory requirements for the technology and IT consulting services it provides.

13. Policy Review

This AML & KYC Compliance Policy is reviewed at least annually and updated as necessary to reflect changes in legislation, regulatory guidance, business operations, or risk profile.

14. Contact

For questions regarding this policy or to report a compliance concern:

Compliance Officer
Nikhat VCloud Solutions L.L.C.
Office No. M05-49, Sama Residence, Al Nahda First, Dubai, UAE
Email: compliance@vectaga.com
Phone: +971 583080872