Background Pattern
Home
Legal Center
pattern

Compliance Policy (AML & KYC)

Last updated: 30 December 2025

1. PURPOSE AND SCOPE

This Compliance Policy establishes the framework through which FLUR TECHNOLOGY LIMITED, trading as Flur and operating the Flur platform ("Flur", "Company", "we"), ensures adherence to all applicable laws, regulations, and industry standards governing fintech operations, electronic payment services, anti-money laundering, data protection, and consumer protection in the Federal Republic of Nigeria.

This Policy applies to all directors, officers, employees, contractors, agents, and third-party service providers acting on behalf of Flur. All personnel must read, understand, and comply with this Policy. Violation may result in disciplinary action, termination of engagement, and potential criminal or civil liability.

2. REGULATORY FRAMEWORK

Flur operates within a comprehensive regulatory framework and is committed to full compliance with:

2.1 Central Bank of Nigeria (CBN) Regulations

  • CBN Act, 2007
  • Guidelines on Electronic Banking in Nigeria
  • Guidelines on Point of Sale (POS) Card Acceptance Services
  • Regulation on Card Issuance and Usage in Nigeria
  • CBN Guidelines for Mobile Money Services in Nigeria
  • Consumer Protection Framework
  • Cash-less Policy requirements
  • Foreign Exchange Regulations and Guidelines

2.2 Anti-Money Laundering and Counter-Financing of Terrorism

  • Money Laundering (Prevention and Prohibition) Act 2022
  • Terrorism (Prevention and Prohibition) Act 2022
  • Nigeria Financial Intelligence Unit (NFIU) Regulations
  • Economic and Financial Crimes Commission (EFCC) Guidelines
  • Special Control Unit Against Money Laundering (SCUML) Requirements

2.3 Data Protection and Privacy

  • Nigeria Data Protection Act (NDPA) 2023
  • Nigeria Data Protection Regulation (NDPR) 2019
  • Guidelines for Data Protection Compliance Audit
  • Nigeria Data Protection Commission (NDPC) Directives

2.4 Other Applicable Laws and Regulations

  • Companies and Allied Matters Act (CAMA) 2020
  • Federal Competition and Consumer Protection (FCCPC) Act 2018
  • Finance Act and Tax Regulations
  • Cybercrime (Prohibition, Prevention, etc.) Act 2015
  • Nigerian Communications Commission (NCC) Regulations

3. KNOW YOUR CUSTOMER (KYC) AND CUSTOMER DUE DILIGENCE

3.1 KYC Requirements

All customers must complete robust identity verification before accessing financial services. Our tiered KYC framework includes:

  • Tier 1 (Basic): Phone number verification, BVN validation, basic personal information - Limited transaction amounts
  • Tier 2 (Intermediate): Government-issued ID, facial verification, proof of address - Standard transaction limits
  • Tier 3 (Full): Complete documentation, Enhanced Due Diligence, business verification for merchants - Maximum transaction limits

3.2 Enhanced Due Diligence (EDD)

We conduct Enhanced Due Diligence for:

  • High-value transactions or account holders
  • Politically Exposed Persons (PEPs) and their close associates
  • Merchants with unusual transaction patterns
  • Customers from high-risk jurisdictions
  • Complex corporate structures or beneficial ownership arrangements
  • Accounts flagged by transaction monitoring systems

3.3 Ongoing Customer Monitoring

  • Periodic KYC reviews every 12-24 months depending on risk level
  • Continuous screening against sanctions lists, PEP databases, and adverse media
  • Real-time transaction monitoring for unusual activity
  • Behavioral analytics to detect account takeover or fraud
  • Mandatory re-verification upon significant changes (address, bank details, business structure)

4. ANTI-MONEY LAUNDERING (AML) AND COUNTER-FINANCING OF TERRORISM (CFT)

4.1 AML/CFT Program

Our comprehensive AML/CFT program includes:

  • Risk-based approach to customer and transaction risk assessment
  • Automated transaction monitoring systems with configurable rules
  • Sanctions screening against OFAC, UN, EU, and local lists
  • Adverse media screening for reputational risk
  • PEP identification and monitoring
  • Suspicious Activity Report (SAR) procedures
  • Currency Transaction Report (CTR) filing as required
  • Regular AML/CFT training for all personnel

4.2 Suspicious Activity Detection and Reporting

We maintain vigilance for indicators of money laundering and terrorist financing, including:

  • Structuring of transactions to avoid reporting thresholds
  • Unusually large or frequent cash transactions
  • Transactions inconsistent with customer profile or business
  • Multiple accounts used by same individual without clear purpose
  • Rapid movement of funds through accounts
  • Customer reluctance to provide required documentation
  • Geographic anomalies suggesting higher risk

Suspicious activity is reported to the Nigeria Financial Intelligence Unit (NFIU) within 48 hours of detection as required by law.

4.3 Record Keeping

  • All KYC documentation retained for minimum 5 years after account closure
  • Transaction records maintained for minimum 5 years
  • AML/CFT investigation files retained for minimum 7 years
  • SAR and CTR filings documented and archived
  • Audit trails for all access to customer data and transaction records

5. CONSUMER PROTECTION

5.1 Transparency and Disclosure

  • Clear disclosure of all fees, charges, and transaction costs upfront
  • Plain language Terms of Service accessible to all users
  • Transaction confirmation and receipts provided immediately
  • Monthly account statements available on demand
  • Advance notice of fee changes (minimum 30 days)

5.2 Fair Treatment and Non-Discrimination

  • Equal access to services regardless of ethnicity, religion, gender, or background
  • Risk-based rather than discriminatory account restrictions
  • Reasonable accommodations for customers with disabilities
  • Multilingual customer support where feasible

5.3 Dispute Resolution

  • Clear dispute resolution procedures accessible via customer support
  • Investigation of customer complaints within 14 business days
  • Escalation path to senior management for unresolved issues
  • Cooperation with FCCPC and CBN consumer protection departments

6. DATA PROTECTION AND CYBERSECURITY

Full compliance with NDPA 2023 and NDPR 2019, including:

  • Qualified Data Protection Officer (DPO)
  • ISO 27001 aligned Information Security Management System
  • Regular penetration testing and vulnerability assessments
  • Incident response plan with 72-hour breach notification to NDPC

7. THIRD-PARTY RISK MANAGEMENT

  • Due diligence assessment before engaging vendors or partners
  • Contractual obligations for data protection and security
  • Regular monitoring of vendor compliance and performance
  • Right to audit provisions in vendor agreements
  • Termination rights for non-compliance

8. TRAINING AND AWARENESS

  • Mandatory compliance training for all new employees within 30 days
  • Annual refresher training on AML/CFT, data protection, and consumer protection
  • Role-specific training for compliance, customer service, and technical teams
  • Training effectiveness testing and certification

9. MONITORING, TESTING, AND AUDIT

  • Quarterly internal compliance reviews
  • Annual independent compliance audit by qualified external auditors
  • Regulatory examination cooperation and response
  • Key risk indicators (KRIs) monitoring and reporting

10. GOVERNANCE AND ACCOUNTABILITY

Dedicated compliance function including:

  • Chief Compliance Officer (CCO) reporting to CEO/Board
  • Confidential whistleblowing hotline for reporting violations
  • Protection against retaliation for good-faith reporting
  • Quarterly compliance reports to Board of Directors

11. REGULATORY REPORTING AND COOPERATION

  • Timely submission of all required regulatory reports
  • Accurate and complete reporting of material incidents
  • Full cooperation with regulatory examinations and inspections
  • Prompt response to regulatory inquiries
  • Proactive disclosure of compliance issues to regulators

12. POLICY REVIEW AND UPDATES

This Compliance Policy is reviewed and updated:

  • Annually as part of scheduled policy review cycle
  • Upon changes in applicable laws or regulations
  • Following significant compliance incidents or findings
  • Based on internal audit recommendations
  • In response to regulatory guidance or examination findings

13. CONTACT INFORMATION

Compliance Department

FLUR TECHNOLOGY LIMITED (trading as Flur)

Chief Compliance Officer: compliance@flurfinance.com

Compliance Department: compliance-team@flurfinance.com

Whistleblowing Email: whistleblower@flurfinance.com

Whistleblowing Hotline: [Phone Number]