Travel Rule Policy

Overview

The "Travel Rule" is a regulatory requirement applied to certain virtual asset transfers. In general, it requires Virtual Asset Service Providers (VASPs) to collect, verify, and share specified originator and beneficiary information when transfer thresholds are met under applicable law.

Scope and Applicability

This policy applies to transfers processed through Malum where Travel Rule obligations may apply based on jurisdiction, transaction amount, transfer type, and counterparty profile. Requirements can vary by country and may change over time as regulations evolve.

Information That May Be Required

Where required by law or risk controls, Malum may request and/or transmit the following data elements in connection with a transfer:

• Originator legal name and account or wallet identifier.
• Beneficiary legal name and account or wallet identifier.
• Business registration and beneficial ownership information (for legal entities).
• Transfer amount, asset type, timestamp, and related transaction references.
• Supplemental information needed for sanctions, AML, and fraud screening.

How Malum Implements Travel Rule Controls

• Risk-based screening: We screen relevant transfers and counterparties using sanctions, AML, and fraud controls.
• Data verification: We may validate merchant and transfer data before allowing settlement or release.
• Counterparty checks: For qualifying transfers, we may require confirmation that the receiving/sending institution can handle Travel Rule data.
• Transfer restrictions: We may delay, reject, or block transfers that do not meet policy, legal, or risk requirements.

Merchant Responsibilities

Merchants using Malum must:

• Provide accurate and complete customer and transfer information when requested.
• Maintain appropriate controls to prevent sanctions evasion, money laundering, and fraud.
• Cooperate with enhanced due diligence, source-of-funds, and source-of-wealth checks where applicable.
• Promptly respond to compliance inquiries and remediation requests.

Data Handling and Retention

Travel Rule data is processed in line with Malum's compliance and privacy obligations. Information may be retained for legally required periods and may be disclosed to authorized counterparties, regulators, or law enforcement where permitted or required by law.

Enforcement and Account Actions

Failure to satisfy Travel Rule requirements may result in controls including transaction holds, settlement delays, account limitations, or account suspension/termination. Malum may also file regulatory reports where required.

Policy Updates

We may update this policy periodically to reflect changes in legal obligations, supervisory guidance, and industry standards. Continued use of Malum services after publication of an update constitutes acceptance of the revised policy.

Last modified 04/19/2026