Anti-Money-Laundering & KYC Policy

1. Purpose and scope

SwapRocket is a swap aggregator: it polls integrated liquidity providers for quotes on a user-selected asset pair, ranks them by delivered output, and routes the user to the provider offering the best result. SwapRocket never holds user balances, operates an order book, or settles a transaction on its own books. This policy applies to all crypto-to-crypto swaps routed through SwapRocket and to any fiat on-ramp or off-ramp feature that SwapRocket may offer through regulated third-party partners. It covers the obligations SwapRocket accepts directly, the obligations it delegates to providers, and the standards it requires of every integrated venue.

2. SwapRocket's role and business model

SwapRocket is a technology intermediary, not a Virtual Asset Service Provider (VASP) that holds, receives, or transfers customer funds. When a user initiates a swap, they send cryptocurrency from their own wallet to a deposit address generated and controlled by the selected liquidity provider. The provider executes the exchange and sends the output to the wallet address the user specified. SwapRocket's role is limited to quote aggregation, routing, order tracking, and customer support.

Because SwapRocket does not custody funds, it is not in a position to freeze or seize user assets. Where a liquidity provider's AML screening flags a deposit, the provider may hold the funds pending review; SwapRocket has no control over that decision and cannot override it. SwapRocket's obligations are therefore focused on pre-trade screening, transaction monitoring, record-keeping, and cooperation with providers and authorities.

3. Responsibilities of integrated liquidity providers

Each integrated liquidity provider is an independent business that executes and settles swaps on its own infrastructure. SwapRocket requires every provider to maintain its own AML/KYC compliance programme consistent with the jurisdictions in which it operates. Specifically, SwapRocket expects each provider to:

• Conduct sanctions screening. Screen deposit and payout addresses against applicable sanctions lists (OFAC, EU, UN, and other relevant designations) before and after transaction execution.
• Perform transaction monitoring. Apply risk-based monitoring to detect suspicious patterns, including structuring, chain-hopping, and known-fraud indicators, and hold or reject flagged transactions per the provider's own policy.
• Conduct KYC where required. Implement know-your-customer procedures where mandated by the provider's jurisdiction or where risk indicators are present, including the collection of identity documents and source-of-funds information.
• Maintain records. Retain transaction records, KYC documentation, and screening results for the period required by applicable law (typically five years or more).
• Cooperate with law enforcement. Respond to legitimate and properly scoped law-enforcement and regulatory requests in accordance with the provider's own legal obligations.

4. Address screening and sanctions compliance

Before routing a swap, SwapRocket screens both the user-supplied payout address and the provider-generated deposit address against known sanctions and high-risk address databases. Where a payout address matches a sanctioned entity, SwapRocket declines to route the transaction and informs the user that the swap cannot be completed. This screening is a prevention layer; it is not a guarantee that a sanctioned address will always be detected, because address databases are not exhaustive and new designations appear continuously.

SwapRocket does not screen deposit addresses against the provider's internal AML hold list, because that list is not shared with SwapRocket. A provider may independently flag a deposit that SwapRocket's screening did not catch, and the provider's decision to hold funds takes precedence over SwapRocket's routing.

5. Transaction monitoring and record-keeping

SwapRocket records the metadata necessary to route, track, and support each swap: the asset pair, networks, amounts, timestamps, transaction hashes, deposit and payout addresses, provider exchange identifiers, and order status history. This data is retained for a minimum of five years to meet applicable record-keeping requirements and to support investigations. SwapRocket does not store private keys, seed phrases, or identity documents for crypto-to-crypto swaps.

6. Suspicious activity and service restrictions

SwapRocket monitors aggregate transaction patterns for indicators of abuse, including rapid repeated swaps through the same address, unusual volume relative to a pair's typical liquidity, and routing patterns that suggest structuring or layering. When SwapRocket identifies suspicious activity, it may take the following actions:

• Decline to route a specific swap and return the user to the quote screen with a generic message.
• Block an address or device fingerprint from initiating future swaps through SwapRocket.
• Notify the relevant liquidity provider and share transaction metadata so the provider can apply its own AML controls.

SwapRocket does not have the authority to freeze funds held by a provider. Where a provider reports a hold, SwapRocket will relay the provider's instructions to the user and assist with support, but the resolution timeline is set by the provider, not by SwapRocket.

7. Fiat on-ramp and off-ramp compliance

Where SwapRocket offers fiat-to-crypto or crypto-to-fiat functionality, those services are operated by regulated third-party partners (such as licensed payment processors and money transmitters). Those partners are solely responsible for KYC, identity verification, payment screening, and compliance with the payment and anti-money-laundering regulations of their jurisdiction. SwapRocket does not collect, store, or process identity documents or payment credentials for fiat transactions; the regulated partner handles that directly. SwapRocket's role is limited to displaying the partner's widget and relaying order status.

8. Data sharing with providers

To route and track a swap, SwapRocket shares with the selected provider the minimum data necessary: the asset pair, networks, amounts, and the user-supplied payout address. The provider generates and controls the deposit address. SwapRocket does not share user IP addresses, device fingerprints, or account information with providers unless required to resolve a specific support or compliance issue.

Where a provider requests additional information for an AML investigation on a specific transaction, SwapRocket will share the relevant transaction metadata with that provider. SwapRocket does not share user data with providers for marketing purposes.

9. Risk assessment

SwapRocket categorises its activities as low-to-medium AML risk relative to a custodial exchange, because it does not hold funds and cannot be used to launder proceeds in custody. The primary residual risks are: routing to a provider that subsequently flags a deposit (mitigated by provider-level AML), use of SwapRocket to structure swaps across providers (mitigated by SwapRocket-level pattern monitoring), and use of a sanctioned payout address (mitigated by pre-trade screening). SwapRocket reviews this risk assessment at least annually and after any material change to its provider set or business model.

10. Policy review and governance

This policy is reviewed at least annually and upon any material change to SwapRocket's business model, provider integrations, or applicable regulatory guidance. Material updates are noted on this page with a revised date. Questions about this policy, requests for the full provider compliance checklist, or due-diligence enquiries from prospective partners should be directed to the compliance contact below.

11. Contact

For AML/KYC questions, compliance documentation, or partner due-diligence requests, email compliance@swaprocket.com or write to the address below.