TOKENSDESK

Anti-Money-Laundering (AML) & Know-Your-Customer (KYC) Policy

How TOKENSDESK verifies clients and prevents financial crime

Document version: 3.0 · Effective: 18 August 2026 · Applies to: every client of the TOKENSDESK platform

This policy explains the checks we are required to carry out, what documents we ask for, how we handle them, and what happens if verification cannot be completed. By opening an account and submitting documents you agree to these checks. This policy forms part of our Terms & Conditions; how we handle the documents themselves is set out in the Privacy Policy.

1. Purpose and commitment

TOKENSDESK is a trading name of CANTERBURY SERVICES LIMITED, a Labuan company licensed by the Labuan Financial Services Authority under money-broking licence no. MB/21/0076. We are committed to preventing the platform from being used for money laundering, terrorism financing, fraud, sanctions evasion or any other financial crime.

Our customer due diligence programme is written to the standards of the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), the AML/CFT policy documents issued by Bank Negara Malaysia, and the Labuan FSA guidelines on anti-money laundering and counter financing of terrorism for Labuan financial institutions; and to the recommendations of the Financial Action Task Force (FATF). Malaysia's financial intelligence unit is the Financial Intelligence and Enforcement Department of Bank Negara Malaysia. The programme operates on a risk-based approach: the depth of the checks is proportionate to the risk a relationship presents.

2. Summary of what this means for you

Obligation	What we do
Identify every client	Government photo identification and proof of address before you can trade or withdraw (section 4)
Source of funds	Requested on a risk-based basis only (section 4)
Restricted jurisdictions	We do not accept clients from four named jurisdictions, or from any sanctioned territory (section 3)
Sanctions screening	Clients are screened at onboarding and on an ongoing basis (section 6)
Ongoing monitoring	Transactions are monitored against your stated profile for the life of the relationship (section 7)
Third-party funding	Not accepted, in either direction (section 8)
Reporting	Suspicious transactions are reported to Bank Negara Malaysia’s Financial Intelligence and Enforcement Department; tipping off is prohibited by law (section 9)
Record keeping	Seven years after the relationship ends (section 11)

3. Restricted jurisdictions

We do not open or maintain accounts for any person who is resident in, located in, a citizen of, or acting from any jurisdiction in which we are not authorised to offer the service, or in which doing so would require an authorisation, registration or self-regulatory membership we do not hold. This includes the United States of America, its territories and possessions, and any “US person”: retail trading of contracts for difference on digital assets is not permitted under the rules of the Commodity Futures Trading Commission and the Securities and Exchange Commission, with neither of which we are registered.

We maintain a restricted-jurisdiction list which is reviewed at least annually and whenever the regulatory position in a market changes. It is applied at onboarding, on every subsequent login, and on an ongoing basis against the client’s stated residence and the location their connection originates from. The list is not published in full.

Jurisdictions subject to a Financial Action Task Force call for action, and jurisdictions subject to comprehensive sanctions, are refused in all circumstances and cannot be onboarded by any route, including where a client’s stated residence is elsewhere.

Separately from the list above, we do not deal with any person or entity subject to sanctions administered by the Ministry of Home Affairs of Malaysia (the Domestic List made under section 66B of AMLA 2001), the United Nations Security Council, the United States Office of Foreign Assets Control, the United Kingdom or the European Union, nor with any person located in a territory subject to comprehensive sanctions.

We also apply enhanced due diligence — not an automatic refusal — to clients connected with jurisdictions the FATF has placed under increased monitoring, and to any jurisdiction our own risk assessment identifies as high risk.

Attempting to conceal your location is a breach of our Terms. Using a VPN, proxy or false address to obtain access will result in the account being closed, positions being closed at the prevailing market price, and the balance being returned to source — except where sanctions law requires funds to be frozen instead, in which case we must comply with that law.

4. Client due diligence: the three levels

Verification is arranged in three levels. Each opens as the one before it is completed.

Level 1 — Identity

A clear photograph or scan of one government-issued photo document, valid and unexpired, with all four corners and every detail legible:

Passport
National identity card
Driving licence
Residence permit

We record your full name, date of birth, nationality and the document number and expiry.

Level 2 — Address

A document dated within the last three months showing your name and residential address:

Bank or credit-card statement
Utility bill — electricity, gas, water
Council tax, telephone or internet bill
A government-issued letter showing your address

A mobile-phone bill alone, a post-office box, or a document from a business address is not accepted. Address verification is how a restricted jurisdiction is identified, so it cannot be skipped.

Levels 1 and 2 are submitted separately and each is reviewed on its own. You may send one before the other, and one may be approved while the other is still being checked or has been asked for again. Until both are approved you cannot trade or withdraw.

Source of funds, where we ask for it

There is no third verification level and no document you must file to reach a leverage tier. Source of funds is not a step in onboarding; it is enhanced due diligence we may carry out on a risk-based basis — for example on an unusually large deposit, on activity that does not match what we know of you, or where a sanctions or adverse-media check requires it. Where we do ask, we accept:

A bank statement showing the funds and their origin
Payslips
A tax return or assessment
Evidence of a sale of assets or property
An investment or brokerage statement
Other documentary evidence, considered case by case

We ask for this only where our obligations require it, and we say why when we do. Evidence about where money came from means nothing until we know whose money it is, so it is never sought before identity and address are settled.

Accepted formats

JPG, PNG or PDF, up to 10 MB per file. Screenshots of a document displayed on another screen, photographs with obscured fields, edited images and expired documents are rejected. We may ask for a further document or a clearer copy at any time.

5. Enhanced due diligence

We apply additional checks where the risk is higher, including:

Politically exposed persons (PEPs), their family members and close associates — senior management approval is required before the relationship is established or continued;
clients connected with a FATF-monitored or otherwise high-risk jurisdiction;
unusually large deposits, or activity inconsistent with the profile you gave us;
funding from a wallet with an adverse blockchain-analytics result;
any case where we cannot satisfy ourselves about the source of funds.

Enhanced due diligence may include further documentation, a video verification call, and closer ongoing monitoring.

6. Sanctions screening

Every client is screened at onboarding and on an ongoing basis against the sanctions and watch lists named in section 3, and against PEP and adverse-media data.

A confirmed match means the relationship is refused or terminated, funds are dealt with as the applicable sanctions law requires — which may mean freezing rather than returning them — and the matter is reported where reporting is required. Where the law prohibits us from telling you, we will not tell you.

7. Ongoing monitoring

Verification is not a one-off event. For the life of the relationship we monitor activity against the profile you gave us and investigate what does not fit, including:

deposits or withdrawals that are large relative to your stated means;
funding in, and immediate withdrawal out, with little or no trading in between;
a pattern of transactions structured to stay below a reporting threshold;
a sudden change in trading behaviour, counterparties or funding wallets;
any attempt to route funds to or from a third party.

We may ask you at any time to explain a transaction or to re-verify your identity, and we may suspend activity on the account until you do. Identification records are refreshed periodically and whenever your circumstances change.

8. Funding rules

No third-party funding. Deposits must come from a wallet you control, and withdrawals are paid only to a wallet in your name. We do not accept or make payments for anyone else.
Return to source. Wherever possible, funds are returned by the route they arrived.
Correct network only. Each deposit address is issued per asset and per network. Assets sent on the wrong network are generally unrecoverable.
No cash. We do not accept cash in any form.
Blockchain analytics. Deposit and withdrawal addresses may be screened against known illicit-activity data. A deposit from a sanctioned or high-risk address will be investigated and may be frozen or reported.

9. Reporting

Where we form a suspicion on reasonable grounds that a matter relates to money laundering, terrorism financing or another serious offence, we submit a suspicious transaction report to the Financial Intelligence and Enforcement Department of Bank Negara Malaysia, under section 14 of AMLA 2001, within the time the law allows. We also make any cash threshold reports and any other report required of a reporting institution.

Tipping off. The law makes it an offence to tell a client that a report has been made or is being considered. If we are ever unable to explain why an account has been restricted, that prohibition may be the reason, and it is not a matter on which we can be persuaded.

10. Governance and training

An AML/CFT Compliance Officer is appointed at management level and is responsible for this programme, for reporting to the Financial Intelligence and Enforcement Department and for escalation to the board. The programme is documented, approved by the board, and reviewed at least annually and whenever the business, the law or our risk assessment changes. It is subject to independent review at appropriate intervals.

All staff receive AML/CFT training on appointment and at least annually, covering identification procedures, red flags, escalation and the tipping-off prohibition.

11. Records

We keep identification records, verification documents, transaction records and the reasoning behind decisions for seven years after the end of the client relationship or after the transaction. Section 14 of AMLA 2001 requires at least six years; we keep them for seven.

Documents are stored in a private, access-controlled store, are never published at a public address, and are visible only to authorised staff whose access is logged. See the Privacy Policy for the detail.

12. If verification cannot be completed

If you do not complete verification, or the documents cannot be accepted:

you cannot trade and you cannot withdraw;
any deposit already made is returned to the wallet it came from, unless the law requires otherwise;
the account is closed after a reasonable period, and we tell you so far as we are permitted.

We do not keep a client's funds because verification failed. We return them, subject to the sanctions and reporting obligations above.

13. Contact

Questions about this policy, or about a request we have made of you, go to compliance@tokensdesk.com. Complaints follow the process in section 19 of the Terms & Conditions.

Related documents: Terms & Conditions · Privacy Policy