Anti-Money Laundering Policy

Averipay

This document is a public summary of the measures that Avrepey OOD takes to prevent money laundering and terrorist financing. It explains what merchants and other persons dealing with the Company can expect, and what the Company expects of them.

1. General provisions

1.1. Avrepey OOD, UIC 208357967, which operates under the Averipay brand (hereinafter the "Company"), provides payment services to merchants. The Company is an obliged entity under the Law on Measures against Money Laundering (LMML) and the Law on Measures against the Financing of Terrorism (LMFT) of the Republic of Bulgaria, and applies the requirements of Directive (EU) 2015/849 as transposed into Bulgarian law.

1.2. The Company’s licence or register entry is: —. Payment institutions are supervised by the Bulgarian National Bank in accordance with the Law on Payment Services and Payment Systems (PSPSA); compliance with the anti-money-laundering legislation is supervised by the competent authorities under the LMML.

1.3. This summary does not replace the Company’s internal rules, which are approved by its management and are not published in full for security reasons. The Company may update this document when the law or its internal rules change.

2. Risk-based approach

2.1. The Company applies a risk-based approach. It assesses the risk of every merchant before the contract is concluded and during the business relationship, and applies measures proportionate to that risk.

2.2. The assessment takes into account in particular:

the legal form, ownership structure and jurisdictions connected with the merchant and its beneficial owners;
the nature of the business, the goods and services sold, and the expected volume, average amount and geography of payments;
the sales channels, the method of identification and the length of the relationship;
adverse information, sanctions or politically exposed person (PEP) matches, and fraud or chargeback indicators;
the results of national and supranational money-laundering risk assessments.

2.3. The Company may refuse or restrict the provision of services to categories of merchants and activities that exceed its risk appetite.

3. Identification and due diligence of merchants

3.1. Before the contract is concluded, the Company identifies and verifies each merchant (know your business, KYB) and its representatives (know your customer, KYC). This is done through the application in the merchant account and, where necessary, through external verification providers.

3.2. As a rule, the Company collects and verifies:

the merchant’s name, legal form, UIC or equivalent registration number, registered office and address of operations, checked against the Commercial Register or an equivalent register;
the persons who represent the merchant, their powers and identity documents, including a verification of the person against their identity document (for example a remote check with a liveness test);
the ownership and control structure and the ultimate beneficial owners (UBO);
the nature and purpose of the business relationship, the business activity, the website or app, and the expected payment flows;
the origin of funds and, where the risk requires it, the source of wealth;
a bank account of the merchant used for settlement, to confirm that it belongs to the merchant.

3.3. Beneficial owners are the natural persons who ultimately own or control the merchant, in particular those who hold directly or indirectly more than 25 percent of the shares or voting rights, or who control the merchant in another way. If no such person can be established, the senior managing official is identified. The Company checks the information against the register of beneficial owners and other reliable sources.

3.4. The merchant must provide the documents and information requested and keep them up to date. Where the data in the merchant account changes, the merchant should update it without delay.

3.5. The Company does not provide services to anonymous merchants or to merchants using fictitious names, and does not conclude the contract until the due diligence measures are completed, except in the cases the law allows.

4. Enhanced due diligence

4.1. In higher-risk situations the Company applies enhanced due diligence. These include, for example, merchants established in or connected with high-risk third countries identified by the European Commission, complex or opaque ownership structures, high-risk business activities, politically exposed persons among the beneficial owners or representatives, and unusual transactions.

4.2. Enhanced measures may include:

additional documents and information on the owners, the business and the source of funds;
approval of the business relationship by a senior manager;
a lower payment limit, a longer settlement period or a rolling reserve;
more frequent reviews and closer monitoring of payments.

4.3. Simplified measures may be applied only where the law allows it and the assessed risk is low.

5. Politically exposed persons and sanctions screening

5.1. The Company checks merchants, their representatives, beneficial owners and, where relevant, related persons against sanctions lists (including those of the United Nations, the European Union and the Bulgarian authorities) and against lists of politically exposed persons, their family members and close associates.

5.2. The checks are made before the contract is concluded and repeated during the relationship, including when the lists are updated. The Company does not provide services where this would breach restrictive measures, and freezes funds and reports as the law requires.

5.3. A relationship with a politically exposed person requires senior management approval, steps to establish the source of wealth and funds, and enhanced ongoing monitoring.

6. Ongoing monitoring of transactions

6.1. The Company monitors payment transactions throughout the business relationship to check that they are consistent with what it knows about the merchant, its business and its risk profile.

6.2. Monitoring combines automated rules and manual review. It looks in particular at:

volumes, amounts and frequency that differ from the declared profile;
splitting of payments, sudden increases, unusual refund or chargeback levels;
payments with no apparent economic purpose, or connected with high-risk jurisdictions;
a change in the goods or services sold compared with those declared.

6.3. The Company reviews merchant data periodically, at intervals that depend on the risk level, and when a trigger event occurs. It may ask the merchant for explanations and supporting documents about a transaction or a series of transactions.

6.4. While a suspicious transaction is examined, the Company may suspend its execution, hold funds or restrict the merchant account, as the law and the contract allow.

7. Reporting to the Financial Intelligence Directorate

7.1. If the Company suspects or has reason to suspect that funds are the proceeds of crime or are connected with terrorist financing, it notifies without delay the Financial Intelligence Directorate of the State Agency for National Security (SANS, in Bulgarian ДАНС), as required by the LMML, before executing the transaction where possible.

7.2. The Company also submits the other notifications and reports required by law, including on cash payments above the statutory threshold where applicable.

7.3. The law prohibits the Company and its staff from disclosing to the merchant or to third parties that a notification has been or will be sent. The Company is therefore unable to explain the reasons for a restriction when this would amount to such disclosure. Notifications made in good faith do not give rise to liability for breach of confidentiality.

Official website of SANS: www.dans.bg

8. Record keeping

8.1. The Company keeps the documents, data and information obtained through the identification and due diligence of merchants, the results of checks and analyses, and the records of transactions, as the LMML requires.

Retention period for identification data and AML checks:: —

8.2. The competent authorities may require the Company to keep the records for longer where the law provides. Personal data is processed in accordance with the Privacy Policy.

9. Refusal, suspension and termination

9.1. The Company refuses to conclude a contract, or suspends or terminates the services, where:

the merchant does not provide the documents and information required for due diligence, or provides data that is inaccurate or cannot be verified;
the beneficial owners cannot be established or the ownership structure is not transparent;
the risk of money laundering or terrorist financing cannot be reduced to an acceptable level;
there is a match with a sanctions list or the activity breaches restrictive measures;
the merchant’s activity is prohibited or falls outside what the Company serves;
a competent authority so requires.

9.2. In case of termination, the Company settles the funds due to the merchant in accordance with the contract and the law, unless a competent authority has ordered their freezing or seizure.

10. What we expect from merchants

10.1. A merchant using the Company’s services must:

provide complete and accurate information and documents, and notify any change in its data, owners, representatives or activity without delay;
accept payments only for the goods and services it has declared and only for lawful purposes;
not use the services to launder money, finance terrorism, evade sanctions or commit other crimes;
cooperate with checks, answer the Company’s questions and provide supporting documents within the time limit set, including for particular transactions;
inform the Company if it becomes aware of suspicious activity connected with its account.

10.2. Breach of these obligations may lead to the measures in section 9 and is a ground for terminating the contract.

11. Organisation and training

11.1. The management is responsible for the effective application of this policy. The Company has internal rules on the prevention of money laundering and terrorist financing, a specialised function or officer in charge of their application, and an independent internal control.

11.2. Staff dealing with merchants and payments are trained on appointment and regularly afterwards.

11.3. The Company carries out a risk assessment of its own business, including its customers, services, delivery channels and geographic areas, and keeps it up to date.

12. Contact details

Questions on this policy and on the checks under it can be sent to the Company’s AML officer. Complaints are handled under the Complaints and enquiries procedure.

Legal name:: Avrepey OOD
UIC:: 208357967
AML officer:: —
General email:: payments@averipay.com
Postal address:: —

Regulatory information is on the Licensing and regulation page.

Last updated: November 10, 2026

Averipay