Skip to main content
Version: v1
Legacy — API v1

This documents the legacy v1 API. New integrations should use API v2.

KYC/AML Policy

Nexchange operates a Know Your Customer (KYC) and Anti-Money Laundering (AML) program. Compliance is enforced at the transaction level: transactions are screened in real time, assessed on a risk basis, and restricted where they involve prohibited activities or jurisdictions.

Overview​

Our KYC/AML program is designed to:

  • Prevent Financial Crimes: Block money laundering, terrorist financing, and other illicit activities
  • Ensure Regulatory Compliance: Meet international AML/KYC standards and regulations
  • Protect Users: Safeguard legitimate users and their funds
  • Maintain Service Integrity: Preserve the security and reputation of our platform

API Integration and Compliance​

No Direct KYC Required​

No User Registration

The Nexchange API does not require user registration or direct KYC collection through the API. However, compliance measures are applied at the transaction level.

Applies to DeFi Orders

This policy also applies to DeFi orders created with is_defi=true.

Because DeFi execution uses permissionless protocol infrastructure, protocol-level compliance controls are not present by default. Integrators are still responsible for complying with all applicable AML/sanctions laws in their jurisdictions.

Transaction Monitoring​

All transactions processed through the Nexchange API are subject to:

  • Real-time screening against international sanctions lists
  • Transaction pattern analysis for suspicious activity detection
  • Risk-based assessments based on transaction amounts and frequency
  • Blockchain analysis to identify high-risk sources and destinations

Risk-Based Approach​

We apply a risk-based approach to transaction processing:

Low Risk Transactions​

  • Standard processing times
  • Automated approval for most transactions
  • Minimal additional verification required

Medium Risk Transactions​

  • Additional verification may be required
  • Longer processing times possible
  • Enhanced transaction monitoring

High Risk Transactions​

  • Manual review process
  • Extended verification procedures
  • Potential transaction rejection

Prohibited Activities​

The following activities are strictly prohibited when using Nexchange API:

Forbidden Use Cases​

❌ Money Laundering: Using the service to obscure the origin of illicit funds

❌ Terrorist Financing: Providing financial support to terrorist organizations

❌ Sanctions Evasion: Circumventing international economic sanctions

❌ Fraud: Using stolen or fraudulently obtained funds

❌ Dark Web Activities: Processing funds from illegal marketplace transactions

❌ Ransomware: Laundering proceeds from ransomware attacks

Prohibited Jurisdictions​

Transactions may be restricted or prohibited for users from:

  • Countries under international sanctions
  • High-risk jurisdictions identified by FATF
  • Regions with inadequate AML frameworks
Compliance Monitoring

All transactions are monitored for compliance violations. Suspicious activity will result in transaction holds, account freezes, and reporting to relevant authorities.

Developer Compliance Responsibilities​

Integration Requirements​

When integrating Nexchange API, developers must:

1. Implement Proper Controls​

Pre-Transaction Validation:

  • Verify user jurisdiction compliance
  • Screen withdrawal addresses against blocklists
  • Implement transaction size limits
  • Apply velocity controls

2. Maintain Audit Trails​

Required Logging:

  • All transaction attempts (successful and failed)
  • User IP addresses and geolocation data
  • Risk assessment results for each transaction
  • Compliance decisions and their justifications
  • Any suspicious activity detected

3. Address Screening Requirements​

Mandatory Checks:

  • Screen addresses and IPs against sanctions and illicit-activity sources. The specific data sources, lists and risk criteria are not published.
  • Verify address ownership when possible
  • Monitor for high-risk address indicators

Record Keeping Requirements​

Maintain records of:

  • All transaction attempts (successful and failed)
  • User IP addresses and geolocation data
  • Risk assessment results for each transaction
  • Compliance decisions and their justifications
  • Any suspicious activity detected

Reporting Obligations​

Suspicious Activity Reporting​

When suspicious activity is detected, developers must:

  1. Immediately halt the transaction
  2. Document the suspicious activity with detailed records
  3. Report to relevant authorities within required timeframes
  4. Preserve all related records for investigation

Transaction Limits and Thresholds​

Limits apply per user/IP and per transaction, and large or unusual transactions trigger enhanced due diligence.

The concrete thresholds are risk-based and change without notice — they are not published as fixed numbers and are not exposed as API fields. Use POST /pre_screening/ with the actual amount to check whether a specific transaction is eligible, and handle the PENDING KYC order status gracefully in your integration.

Data Protection and Privacy​

Privacy Principles​

  • Data Minimization: Collect only necessary information
  • Purpose Limitation: Use data only for compliance purposes
  • Retention Limits: Retain records only as required by law
  • Security Measures: Implement appropriate technical safeguards

Data Retention​

Records are retained as required by applicable law.

Regulatory Compliance​

International Standards​

Our AML/KYC program complies with:

  • FATF Recommendations: Financial Action Task Force guidelines
  • EU AML Directives: European Union anti-money laundering laws
  • Local Jurisdictions: Applicable local regulations

Ongoing Monitoring​

We continuously monitor:

  • Regulatory Changes: Updates to AML/KYC requirements
  • Sanctions and illicit-activity sources: Addresses and IPs are screened against sanctions and illicit-activity sources. The specific data sources, lists and risk criteria are not published.
  • Risk Indicators: Emerging threats and typologies
  • Best Practices: Industry standards and recommendations

Support and Compliance Assistance​

For Developers​

If you need assistance with compliance implementation:

  • Technical Support: Help with compliance-related integration issues
  • Documentation: Additional guidance on regulatory requirements
  • Best Practices: Recommendations for compliant integration patterns

Contact Information​

For compliance-related inquiries:

Compliance Checklist​

Before launching your integration:

  • Jurisdiction Check: Verify service availability in your jurisdiction
  • Transaction Limits: Implement and respect API transaction limits
  • Address Validation: Validate withdrawal addresses before order creation
  • Error Handling: Properly handle compliance-related error responses
  • Audit Logging: Maintain comprehensive transaction logs
  • Suspicious Activity: Implement detection and reporting procedures
  • Record Keeping: Establish compliant record retention policies
  • Staff Training: Ensure team understands compliance requirements

API Integration Best Practices​

Pre-Transaction Checks​

  1. Validate Currency Pairs: Ensure trading pair is active
  2. Check Amount Limits: Verify amount is within allowed range
  3. Screen Addresses: Validate withdrawal address format and compliance
  4. Rate Verification: Confirm rates are current and valid

During Transaction​

  1. Monitor Status: Track transaction progress through API
  2. Handle Delays: Account for compliance review delays
  3. Log Everything: Maintain detailed audit trails
  4. Error Recovery: Implement proper error handling for compliance issues

Post-Transaction​

  1. Confirmation Monitoring: Track final transaction status
  2. Record Retention: Store transaction records per retention requirements
  3. Reporting: Generate compliance reports as needed
Legal Disclaimer

This document provides general information about our compliance practices. It does not constitute legal advice. Consult with qualified legal counsel for specific compliance requirements in your jurisdiction.

Next Steps​

  • FAQ - Common compliance questions answered

Questions about compliance? Contact support@n.exchange for guidance on implementing compliant integrations.