Compliance: KYC & AML

Last updated: June 11, 2026

⚠️ Draft for review. This document is a working template prepared to cover ForwardOS's operations in Canada and the UAE. It must be reviewed and finalized by qualified legal counsel in each jurisdiction before launch.

ForwardOS facilitates the sale of businesses in Canada and the UAE — markets with strict anti-money-laundering (AML) and know-your-customer (KYC) expectations. This page outlines our compliance program. It is a framework to be finalized with compliance counsel and, where required, registered with the relevant regulators (FINTRAC in Canada; the UAE's goAML / Ministry of Economy and relevant free-zone authorities).

1. Regulatory Framework

Our program is designed to align with:

Canada: the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and FINTRAC guidance.

UAE: Federal Decree-Law No. 20 of 2018 on AML/CFT and its implementing regulations, including goAML reporting.

2. Customer Identification (KYC)

Before transacting, users complete identity verification appropriate to their role and risk:

Individuals: government-issued photo ID and proof of address.

Businesses: trade licence / incorporation documents and beneficial-ownership information.

Documents are verified for authenticity and validity, and screened against the platform’s risk model.

3. Customer Due Diligence & Risk Scoring

Each user receives a risk rating based on identity, geography, transaction profile, and document checks. Higher-risk profiles trigger Enhanced Due Diligence (EDD), including source-of-funds review.

4. Sanctions & PEP Screening

Users and, where applicable, beneficial owners are screened against sanctions lists and politically-exposed-person (PEP) databases at onboarding and on an ongoing basis.

5. Ongoing Monitoring

We monitor activity for unusual or suspicious patterns and periodically re-verify users. KYC records carry expiry dates and must be refreshed.

6. Suspicious Activity Reporting

Where we identify reasonable grounds to suspect money laundering or terrorist financing, we file the required reports (e.g., STRs to FINTRAC in Canada; goAML reports in the UAE) and cooperate with authorities, subject to applicable "tipping-off" prohibitions.

7. Record Keeping

Verification records, risk assessments, and transaction records are retained for the period required by law (generally at least five years) and made available to regulators on request.

8. Governance

A designated Compliance Officer owns the AML/KYC program, staff receive periodic training, and the program is reviewed and independently tested on a regular basis.

9. Contact

Compliance enquiries: compliance@forwardos.ai.

Questions about this policy? Contact legal@forwardos.ai.