Effective date: 1 May 2025 · Version 1.2
This policy is reviewed annually and updated as required by applicable regulation.
STO Chain Pte. Ltd. ("STOC") is committed to preventing money laundering, terrorist financing, and other financial crimes. This KYC/AML Policy establishes the framework under which STOC conducts identity verification and monitors platform activity.
This Policy applies to all users who register on the STOC platform, regardless of jurisdiction, and to all staff, agents, and third-party service providers engaged in customer onboarding or transaction monitoring.
Covered activities include:
STOC applies a risk-based Customer Due Diligence process to all users prior to granting investment access. CDD is performed via our regulated KYC provider, Sumsub.
3-step CDD process:
Step 1 — Identity Verification
User submits a government-issued photo ID (passport, national ID card, or driver's license). Sumsub performs liveness detection and document authenticity checks using AI-assisted review.
Step 2 — Personal Data Collection
Full legal name, date of birth, nationality, country of residence, residential address, and contact details are collected and verified against the submitted documents.
Step 3 — Risk Scoring & Screening
Each applicant is screened against global sanctions lists (OFAC SDN, EU Consolidated, UN Security Council) and adverse media databases. A risk score is assigned that determines ongoing monitoring intensity.
Enhanced Due Diligence is mandatory for users seeking Tier 3 (Accredited) or Tier 4 (Institutional) access, and for any user flagged as high-risk during standard CDD.
EDD triggers include:
EDD may require submission of audited financial statements, tax returns, source-of-wealth documentation, and senior management approval before account upgrade is granted.
STOC maintains a continuous transaction monitoring program across all platform activity. Monitoring is automated and supplemented by periodic manual review by our compliance team.
Monitoring controls include:
STOC is legally obligated to report suspicious transactions to the relevant Financial Intelligence Unit (FIU) in each operating jurisdiction. Our compliance team reviews flagged activity and determines whether a Suspicious Activity Report (SAR) must be filed.
SAR obligations:
All KYC records, transaction logs, and compliance documentation are retained for a minimum of seven (7) years from the date of the relevant transaction or the termination of the customer relationship, whichever is later.
Data protection standards:
Compliance Contact
For policy enquiries or data subject requests, contact coo@stochain.io
This policy is reviewed annually. The current version supersedes all previous versions.
