AML & KYC Policy

1. AML Compliance Commitment

GiftZO is committed to maintaining the highest standards of Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) compliance within India. We take proactive measures to prevent our Platform from being used for illicit transactions, money laundering, cybercrimes, or the distribution of stolen funds.

2. Identity Verification (KYC)

To maintain security and verify the source of funds, we apply a tiered Know Your Customer (KYC) system:

• Guest Wallets: Temporary guest users are subject to a maximum lifetime transaction limit of ₹10,000. Access is limited until the account is upgraded.
• Registered Users: Upgrading to a registered account requires phone number verification and a valid email address.
• High-Volume Sellers: Users who transact more than ₹50,000 per month are subject to enhanced KYC checks, including PAN and Aadhaar verification.

3. Payout Controls & Identity Matches

To prevent third-party payout fraud and money laundering:

• Payouts will only be processed to Indian Bank Accounts or UPI IDs matching the verified name of the registered user.
• We do not support payouts to international accounts, virtual credit cards, or unverified wallets.
• Payout destinations cannot be modified once a transaction starts verification, to prevent account takeovers.

4. Suspicious Activity & Stolen Cards

Our automated monitoring system flags transactions exhibiting high-risk indicators, including:

• Multiple invalid code entries in a short time frame.
• Submission of codes matching reported databases of stolen or scammed gift cards.
• Discrepancies between the seller's physical location (IP address) and card origin.

⚠️ Warning: Flagged cards are permanently locked, and associated payouts are withheld pending verification. In cases of proven fraud, we share complete user details, IP logs, and payout bank information with the National Cyber Crime Reporting Portal and relevant police departments.

5. Record Keeping

In compliance with local laws, GiftZO stores transaction logs, user identification parameters, and IP histories for a statutory period. This data is kept secure and is only accessed for compliance auditing or upon receipt of a legal warrant from court authorities.