AML/CFT and Know Your Customer

Version 1.0 · Effective October 15, 2026 · Public summary

This is a translation. In case of any discrepancy, the Portuguese version prevails.

On this page

Regulatory basis
Governance
Risk-based approach
Know Your Customer
Monitoring
Reporting to COAF
Sanctions and asset freezing
Refusal, limits, and termination
Records
Sharing of fraud indicators
User obligations
Reports

SecurityPag identifies and verifies all of its Users, monitors Transactions according to the risk they represent, and reports suspicious operations to COAF. This is the public summary of the AML/CFT program; the full version is an internal document approved by senior management.

1. Regulatory basis

The program follows Law No. 9,613/1998, Law No. 13,260/2016, Law No. 13,810/2019, BCB Circular No. 3,978/2020, BCB Circular Letter No. 4,001/2020, Joint Resolution No. 6/2023, the rules of the Secretariat of Prizes and Bets on betting transactions, the FATF recommendations, and the AML/CFT rules of the Card Networks and Partner Institutions.

2. Governance

2.1. The AML/CFT program is the responsibility of the Compliance Department (compliance@securitypag.com), which has independence and direct access to senior management.

2.2. SecurityPag maintains an internal risk assessment, reviewed at least every 2 years or whenever there is a relevant change in product or market, and an annual assessment of the program's effectiveness.

2.3. Employees receive AML/CFT training upon hiring and at least once a year.

3. Risk-based approach

Each User receives a low, medium, or high risk rating, considering: activity and category of products; expected and actual volume; payment methods used; countries of the Buyers; corporate structure; status as a politically exposed person; adverse media; and dispute history. The higher the risk, the deeper the verification and the more frequent the review.

4. Know Your Customer

Step	Individual	Legal entity
Identification	Name, CPF, date of birth, address, contact	Corporate name, CNPJ, address, activity, representatives
Verification	Photo ID, selfie with liveness check, Federal Revenue Service lookup	Corporate documents, Federal Revenue Service lookup, verification of representatives
Ultimate beneficial owner	—	Identification of anyone holding 25% or more of the capital or exercising control, down to the natural person
Qualification	Occupation, estimated income or revenue, products, websites	Revenue, products, websites, sector licenses
Lists	UN, OFAC, European Union, and United Kingdom sanctions; politically exposed persons; adverse media	Same, for the company, the partners, and the ultimate beneficial owners

4.1. Politically exposed persons, their family members, and close associates undergo enhanced due diligence, including verification of the source of funds and approval by a higher management level.

4.2. Data is updated at intervals defined by risk and whenever there is an indication of change.

4.3. SecurityPag also assesses its partners, suppliers, and employees, in proportion to the risk of each relationship.

5. Monitoring

5.1. Rules and models flag atypical Transactions and behaviors, such as:

volume incompatible with the declared revenue or with the activity;
splitting of amounts to stay below thresholds;
sales in which Buyer and Seller appear to be the same person or related persons;
many payments from the same origin or to the same destination without justification;
immediate inflow and outflow of funds, including by Crypto Withdrawal;
recurring withdrawals to third-party accounts;
Buyers or access from high-risk or sanctioned jurisdictions;
typical betting patterns, such as spikes on game days and late at night;
products with no apparent delivery or generic sales pages.

5.2. Flagged cases are analyzed by the Compliance team within 45 days, the maximum period provided for in the regulations.

6. Reporting to COAF

6.1. If it concludes that there is suspicion, SecurityPag reports to COAF by the Business Day following the decision.

6.2. The report is confidential. The User is not informed, and SecurityPag neither confirms nor denies its existence.

7. Sanctions and asset freezing

7.1. Users, partners, and ultimate beneficial owners are checked against sanctions lists at registration and on a continuous basis.

7.2. Where there is an asset freezing order from the UN Security Council, SecurityPag complies immediately and notifies the competent authorities, pursuant to Law No. 13,810/2019.

8. Refusal, limits, and termination

SecurityPag may refuse registrations, limit functionalities, withhold amounts as a precaution, and terminate relationships when the risk cannot be mitigated or when the User fails to provide the requested information, pursuant to Clauses 4 and 15 of the Terms of Use.

9. Records

Registration data, Transaction records, and analysis documents are retained for at least 10 years, in accordance with Central Bank of Brazil regulations.

10. Sharing of fraud indicators

SecurityPag shares and consults data on fraud indicators with other institutions in the financial and payments system, pursuant to Joint Resolution No. 6/2023 and the Privacy Policy.

11. User obligations

Provide true, complete, and up-to-date information, including on ultimate beneficial owners and source of funds when requested.
Not use the Account on behalf of third parties nor allow third parties to use it.
Report changes in corporate structure, activity, or control within 10 days.
Respond to requests for documents and clarifications within the stated period.

12. Reports

Suspicions of money laundering, fraud, or misuse of the Platform may be reported, including anonymously, at complaint@securitypag.com. There is no retaliation against anyone who reports in good faith.