Compliance and Fraud Prevention

1. Summary of the regulatory position

2. Role of Stripe (licensed PSP and AML obliged entity)

All payment flows (Buyer payments for top-ups, Marketplace, bounty, Subscription, as well as payouts to Tipsters) are received and settled directly by Stripe. The funds are at all times held in a regulatory client account (segregated client money account) under Irish legislation. The Operator does not directly handle these funds.

Stripe performs its own KYC (Stripe Connect onboarding), including verification of identity documents, bank account and, for legal entities, the ultimate beneficial owner (UBO). The Operator receives only the status (verified / pending / rejected) without access to sensitive documents.

Stripe also performs its own AML monitoring, sanctions screening (EU, UN, OFAC, UK HMT) and regulatory reporting (STR — Suspicious Transaction Report to the Irish FIU) in accordance with the Irish Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 and EU regulations. As an obliged entity, Stripe is entitled to suspend transactions or payouts.

3. Purchased FK — limited network exemption

Purchased FK meet the criteria of the limited network exemption under § 3(3)(c)(4) of Act No. 370/2017 Coll. (Payment Systems Act, "ZPS"):

• They cannot be transferred between users.
• They cannot be used outside the Platform.
• They cannot be redeemed for money other than through a justified complaint or statutory withdrawal (Stripe Refund).
• They serve exclusively to pay for a narrowly defined range of services of the Operator (ČÚZK extracts, Valuo valuations, AI summaries of real estate listings) — the functional link of "real estate data and related analytical services".
• Marketplace, bounty and Subscription are not paid with Purchased FK — these are paid by direct card payment via Stripe Checkout / Stripe Subscription.

The Operator continuously monitors the turnover of Purchased FK and will notify the Czech National Bank if the turnover approaches the threshold of EUR 1 million per 12 months, in accordance with the notification obligation under the ZPS for the limited network exemption.

4. Best-practice measures of the Operator

4.1 Identity verification

• Identity verification via Stripe Connect (the payment service provider performs KYC when payouts are connected) during Tipster onboarding.
• Stripe Connect onboarding (with Stripe's own KYC) is the decisive identity verification for payout purposes and for fraud prevention on the Platform; identity is verified exclusively via Stripe Connect.
• Detection of duplicate accounts and coordinated abuse by technical means.

4.2 Fraud prevention

• Rate limiting of requests at the level of the account as well as network identifiers.
• Behavioural anomaly detection (specific rules are not disclosed to prevent circumvention).
• Detection and blocking of attempts to circumvent the Platform (non-circumvention under § 8 of the Tipster Terms).
• Risky transactions are escalated to manual review; the account may be suspended pending clarification (max. 30 days) pursuant to the Terms and Conditions (Art. 6(1)(b) GDPR) and the legitimate interest in fraud prevention (Art. 6(1)(f) GDPR). In accordance with Art. 22(3) GDPR, the user has the right to human review of the decision.

4.3 Best-practice screening (beyond statutory obligations)

The Operator is not an obliged entity under AML Act No. 253/2008 Coll. Regulatorily binding sanctions and PEP screening is performed by Stripe as an obliged entity by virtue of its payment services within Connect KYC (see § 2). Beyond its statutory obligations, as part of fraud prevention the Operator:

• actively detects unusual transaction patterns and coordinated duplicate accounts, with escalation to manual review;
• is preparing (at roadmap level, not yet active) its own supplementary screening of jurisdictions against FATF lists, screening against the EU consolidated sanctions list (Art. 2 of Regulation (EC) 2580/2001, Art. 2 and Annex I of Regulation (EU) 269/2014) and identification of politically exposed persons (PEP). Until it is activated, the Operator relies fully on Stripe’s licensed screening; if its own screening is activated, this policy will be updated in advance.

The Operator applies these measures voluntarily, without thereby becoming an obliged entity under § 2 of the AML Act. Stripe, as the PSP, continues to perform its own KYC/AML screening within its licensed activity.

5. Automated decision-making — auto-freeze and human review

5.1 Triggers

An account may be automatically suspended upon the following events:

• A compliance signal or suspension by Stripe (e.g. a sanctions match or rejection during Connect KYC onboarding).
• Detection of an unusual transaction pattern or coordinated duplicate accounts.
• Failure or non-completion of identity verification via Stripe Connect (precautionary suspension pending clarification).

5.2 Legal effect

Suspension of the account restricts the user's right to use the Platform. Refunds under § 1829 of the Civil Code remain preserved even during the suspension.

5.3 Right to human review (Art. 22(3) GDPR)

You have the right to request a review of this decision by a human staff member. Submit your request on the account suspension page or by e-mail to [email protected]. Processing period: 7 days.

5.4 Reason masking (anti-tipping-off)

If the reason for the suspension relates to a suspicion of the criminal offence of money laundering or terrorist financing, the Operator, as an intermediary in the AML process (which is carried out by Stripe as an obliged entity bound by confidentiality under § 38 of Act No. 253/2008 Coll.), masks the specific reason for the sake of platform security and the protection of the integrity of AML screening. In such cases you will receive the general information "A compliance review is in progress".

5.5 Appeals

A complaint against an incorrect automated decision may be filed with:

• ÚOOÚ (Office for Personal Data Protection) — the GDPR aspect.
• ČOI (Czech Trade Inspection Authority) — the consumer aspect.

6. Cooperation with the FAÚ and law enforcement authorities

The Operator cooperates with the Police of the Czech Republic, the Financial Analytical Office (FAÚ), the Czech National Bank (ČNB) and the General Financial Directorate (GFŘ) to the extent provided for by law. The Operator responds to requests under § 8 of Act No. 141/1961 Coll. (Code of Criminal Procedure) without undue delay.

Even though the Operator is not an AML obliged entity, in the event of a reasonable suspicion of a criminal offence it submits a tip-off to the Financial Analytical Office (the FAÚ accepts information also from persons who are not obliged entities) and, where appropriate, files a criminal complaint under § 158(2) of the Code of Criminal Procedure. A suspicious transaction report (STR/OPO) under § 18 of Act No. 253/2008 Coll. is filed exclusively by an obliged entity — for payment services this is Stripe. The Operator proceeds in this way if, in the course of its activities, it learns of circumstances indicating the criminal offence of money laundering or terrorist financing.

7. Ongoing review

The Operator reviews the regulatory position of the Platform at least once a year and upon every significant product change (in particular when expanding the range of services payable with Purchased FK, when reaching 70% of the notification threshold of EUR 1 million / 12 months, or when introducing a new money flow). In the event of a change of status (the Operator becoming subject to its own obligations under the AML Act, exceeding the ČNB threshold, etc.), it will amend this document as well as the Terms and Conditions.

8. Contact

Direct compliance enquiries to [email protected]. Maxim Ponomarenko, náměstí Naděje 771, 566 01 Vysoké Mýto.