KYC/AML 정책

Covered activities include:

• –User registration and account creation
• –Investment in tokenized real estate and other digital assets
• –Secondary market trading on the STOC marketplace
• –Fiat on-ramp and off-ramp transactions
• –Wallet top-ups and withdrawals exceeding applicable thresholds

3-step CDD process:

EDD triggers include:

• –Politically Exposed Person (PEP) status — current or historical
• –Close family member or known associate of a PEP
• –Residency or nationality from a high-risk jurisdiction
• –Unusual transaction patterns detected post-onboarding
• –Self-certification as an Accredited or Institutional investor

Monitoring controls include:

• –Transaction velocity monitoring — alerts on unusual frequency or volume
• –Structuring detection — identification of potential smurfing patterns
• –Sanctions list screening — re-screened on every transaction
• –Travel Rule compliance — mandatory originator/beneficiary data for transfers exceeding $1,000 USD equivalent
• –Peer-to-peer transfer monitoring — unusual wallet funding sources flagged
• –Geographic anomaly detection — login and transaction location mismatches

SAR obligations:

• –Filing deadline: within 30 calendar days of identifying suspicious activity
• –No-tip-off rule: users must not be informed that a SAR has been, or may be, filed
• –Parallel obligation: STOC may simultaneously freeze or restrict the account pending investigation
• –Safe harbour: STOC staff acting in good faith are protected from civil liability for SAR filings

Data protection standards:

• –AES-256 encryption at rest; TLS 1.3 in transit
• –Access controls: role-based, with audit logging of all access events
• –Compliance with Vietnam Personal Data Protection Decree 2023 (PDPD)
• –Alignment with GDPR principles for EU-resident users
• –Korean Personal Information Protection Act (PIPA) compliance for KR users
• –Right to erasure requests assessed against mandatory retention obligations