Cloudswap1. Purpose and scope
This policy describes the measures that [legal entity: to be completed before launch] (“Cloudswap”, “we”, “us”) applies to prevent the Cloudswap service from being used for money laundering, terrorist financing, sanctions evasion, fraud and other financial crime. “AML” means anti-money laundering and “KYC” means “know your customer”, that is, identity verification.
It applies to every swap and to every person who uses the service, with or without an account. It forms part of our Terms of Service. By creating a swap you agree that your deposit will be screened and that the swap may be paused, and verification requested, as described here. The way we handle the personal data involved is explained in our Privacy Policy.
This is a summary for users of how our controls work. It is not a complete description of our internal procedures, some of which are kept confidential so that they cannot be circumvented.
2. Our approach
We apply a risk-based approach guided by the recommendations of the Financial Action Task Force (FATF) and by the anti-money laundering, counter-terrorist financing and sanctions laws that apply to us. In practice this means:
- most swaps, which present a low risk, pass automatically, without an account and without identity documents;
- our attention and stricter measures are directed at the smaller number of swaps that present a higher risk;
- checks are proportionate: we ask only for the information needed to resolve the specific risk identified.
Our controls consist of the following elements, each described in the sections below:
- restrictions on who may use the service;
- automated screening of every incoming deposit;
- manual review of higher-risk deposits, with the swap put on hold;
- identity verification where the risk requires it;
- ongoing monitoring for unusual amounts and patterns;
- record keeping and cooperation with the competent authorities.
Responsibility for this policy lies with our management, which designates a person responsible for compliance, ensures that staff who handle reviews are trained, and reviews the policy periodically and when the law or the risks change.
3. Restricted jurisdictions and persons
Cloudswap does not serve, and the service must not be used by or for the benefit of:
- persons resident in, located in or organised under the laws of a country or territory subject to comprehensive sanctions or embargoes imposed by the United Nations, the European Union, the United States (including those administered by the Office of Foreign Assets Control, OFAC) or the United Kingdom;
- persons, entities and wallet addresses named on a sanctions list maintained by those authorities or by any other authority that applies to us, and anyone owned or controlled by, or acting on behalf of, such a person;
- persons resident or located in any jurisdiction where the service is unlawful, or where offering it would require a licence, registration or authorisation that Cloudswap does not hold.
The countries and territories concerned change over time as sanctions and laws change. It is your responsibility to make sure that you are permitted to use the service. We may restrict access from certain locations by technical means, including on the basis of the approximate country derived from your IP address. Using a VPN, proxy or similar tool to get around these restrictions is a breach of our Terms of Service.
Where we find that a swap involves a restricted person or jurisdiction, we will not complete it and will act as described in section 7.
4. Screening of every deposit
Every incoming deposit is screened automatically by a specialised blockchain analytics provider before the swap is executed. The screening examines the public blockchain history of the funds and of the addresses involved and looks for direct and indirect links to illicit activity, including:
- stolen funds, hacks and exploits;
- darknet markets and the sale of illegal goods or services;
- sanctioned persons, entities, addresses and jurisdictions;
- mixers, tumblers and other services designed to conceal the origin of funds;
- ransomware and extortion;
- fraud, scams and investment schemes;
- terrorist financing;
- child sexual abuse material;
- other categories that the provider identifies as high risk, such as services operating without the required controls.
We may also screen the payout address and the refund address that you provide, and we may refuse to send coins to an address that is sanctioned or associated with illicit activity.
Screening is based on the provider's data and methodology at the time of the check. It is a risk assessment, not a finding of wrongdoing, and we treat it as the starting point for a decision, not as the decision itself where the risk is elevated.
5. Risk levels, review and holds
Low risk. If the screening shows a low risk, the deposit passes automatically and the swap continues. You do not need to do anything.
Higher risk. If the screening shows a higher risk, the swap is paused (put on hold) and passed to a member of our team for manual review. While the swap is on hold, the purchased coins are not sent and the deposit is not returned. The swap page shows that the swap is under review.
During a manual review we look at the nature and strength of the risk indicators, the amounts involved, the history of related swaps and any explanation and documents you provide. The review can end in one of the following ways:
- the risk is resolved and the swap is released and completed;
- we ask you to pass identity verification, and possibly to explain the source of funds, before a decision is made (section 6);
- the swap is not completed and we act as described in section 7.
We aim to complete reviews promptly, but the time needed depends on the complexity of the case, on how quickly you respond and, in some cases, on the authorities. We cannot guarantee a time limit.
If a hold lasts beyond the 15-minute deposit window, the fixed rate no longer applies. A swap that is released is executed at the rate in effect at the time of release, and the swap page shows the amount, unless the deposit is refunded. We are not liable for changes in market price during a hold.
6. Identity verification (KYC)
Cloudswap does not require identity verification for ordinary low-risk swaps. We may ask you to verify your identity when:
- a deposit has been assessed as higher risk and is under manual review;
- a swap is unusually large;
- swaps follow a pattern that suggests an attempt to avoid checks, for example a large amount split into many smaller swaps, or repeated swaps linked by addresses, device or timing;
- we have reason to believe that you may be a restricted person, that the information you gave is false, or that you are acting for someone else;
- the law or a competent authority requires it.
What we may ask for
- a valid government-issued identity document, such as a passport, national identity card or driving licence;
- a selfie or liveness check, to confirm that the document belongs to the person presenting it;
- basic personal details, such as your full name, date of birth, nationality and country of residence;
- in some cases, proof of the source of funds, for example records from the exchange or wallet from which the coins came, purchase records, or an explanation of the transaction supported by documents;
- for a legal entity, documents on its registration, ownership and control, and the identity of the person acting for it.
How verification works
Verification is carried out through a specialised identity verification provider. We give you a secure link to the provider's verification flow, where you submit the documents and complete the selfie or liveness check. Do not send identity documents by email unless we expressly ask you to. We will never ask for your private keys, seed phrase or account password as part of verification.
Verification is voluntary in the sense that you may decline it. If you decline, do not complete it within a reasonable time, or provide information that is false, incomplete or cannot be confirmed, the verification is treated as failed and the swap is not completed (section 7).
We may rely on a verification you completed earlier, and we may ask you to repeat or update it if documents have expired, circumstances have changed or a new risk has appeared.
7. If a swap cannot be completed
A swap is not completed if you refuse verification, if verification fails, if the funds are confirmed to be linked to illicit activity, or if the swap involves a restricted person or jurisdiction. What happens to the deposit depends on what the law allows and requires:
- Refund where the law allows. The deposit is returned in the coin and on the network in which it was received, to the refund address you provided. If you did not provide one, we will ask you for one. Network fees for the refund are deducted. To avoid assisting in the movement of illicit funds, we may return the deposit only to the address from which it was sent, or require evidence that you control the refund address.
- Freeze and report where the law requires. Where the law, a sanctions regime or an order of a competent authority requires it, the funds are frozen and not returned, and the matter is reported to the competent authorities. The funds remain frozen until the law or the authority permits or directs otherwise, and they may be transferred to an authority if so ordered.
In these situations we may be prohibited by law from telling you that a report has been made or from giving the reasons for our decision. We may also restrict or close your account, refuse further swaps and cancel any cashback relating to the swaps concerned.
We are not liable for losses resulting from a hold, a refusal, a refund or a freeze carried out in good faith under this policy or under a legal requirement, to the extent the law allows such an exclusion.
8. Ongoing monitoring
In addition to screening each deposit, we monitor activity on the service for amounts and patterns that are unusual or that have no apparent lawful purpose. Indicators that may lead to a review or to a request for verification include:
- swaps that are unusually large in themselves or in total over a period;
- amounts structured to stay just below a level at which checks would be expected;
- many swaps in a short time that are linked by addresses, device, network or timing;
- rapid movement of funds through several swaps or coins with no evident reason;
- use of tools that conceal location, or access from a restricted jurisdiction;
- new information about an address that was not available at the time of an earlier swap.
Blockchain analytics data is updated continuously. A deposit or address that was assessed as low risk in the past may later be reassessed. In that case we may review related swaps, request verification for future swaps and report where required.
9. Record keeping
We keep records of swaps and of verification for at least five years after the swap, or longer if the law requires. These records include:
- the details of each swap: coins, amounts, deposit, payout and refund addresses, transaction hashes, timestamps and status;
- the results of the screening of each deposit;
- the documents and information obtained during identity verification, and the result of the verification;
- notes of manual reviews, the decisions taken and the reasons for them;
- reports made to the authorities and correspondence with them.
Because of this obligation, a request to delete personal data cannot be carried out for these records until the retention period has ended. Records are stored securely, with access limited to those who need it. See our Privacy Policy for details of your rights.
11. Your obligations, changes and contact
By using the service you confirm that:
- you are not a restricted person as described in section 3;
- the coins you send belong to you and come from a lawful source;
- you act for yourself, or you have told us for whom you act and are authorised to do so;
- you will not use the service to conceal the origin of funds or to avoid checks, including by splitting transactions;
- you will provide true, complete and current information and documents when we ask for them, and will respond to our requests within a reasonable time.
We may update this policy as the law, our providers or the risks change. The current version is always published on this page, with the date of the last update shown at the top, and applies to swaps created after it is published.
If your swap is on hold, or if you have a question about this policy, write to [contact email: to be completed before launch] and include your swap ID. Useful background is also available in the FAQ and on the How it works page.