Skip to content

Compliance

Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Policy

Version 1.0Effective 23 September 2026Owner: Web Rabbit Media — Compliance Officer

1. Purpose and scope

This policy sets out how Web Rabbit Media (business registration no. BN419900523, Ghana) — operator of Web Rabbit Payments, Web Rabbit Messaging and related services ("we", "us") — prevents, detects and responds to money laundering, terrorist financing, proliferation financing, fraud, sanctions evasion and other suspicious activity.

It applies to every merchant, business and brand on our platform, the people who own, control or act for them (owners, directors, team members), every API integration, and all of our staff. It covers collections, payouts, disbursements, bill payments and messaging wallet top-ups, in both Live and Test mode.

2. Legal and regulatory framework

We operate in Ghana and apply the principles of the Anti-Money Laundering Act, 2020 (Act 1044), related regulations and guidance, and the requirements of the licensed payment service providers, banks and mobile money operators we work with ("Payment Partners").

Web Rabbit Media is a technology provider. We are not a bank, we do not take deposits, and funds are processed and held through our Payment Partners. Our Payment Partners run their own AML programmes; ours sits alongside theirs and does not replace it. Where a law, regulator or Payment Partner sets a stricter requirement than this policy, the stricter requirement applies.

3. Our risk-based approach

We deliberately support some higher-risk but lawful sectors that other providers refuse outright — for example betting tips, licensed gambling operators, Forex education and signals, and on-demand platforms. Accepting a business category does not mean we accept every business within that category. Every merchant is assessed individually. Each one goes through the KYC and, where it applies, KYB checks below and a risk assessment before it can take live payments, and higher-risk merchants face enhanced due diligence.

We may decline, delay, restrict, suspend or offboard any merchant, at onboarding or at any later time, where we are not satisfied with the information provided or the risk it presents. We do not have to give reasons where doing so could prejudice an investigation.

4. Know your business (KYB)

Registered businesses must provide, and we verify:

  • Legal name, trading name, entity type, registration number and date of incorporation.
  • Certificate of incorporation or registration and the company registration form.
  • Tax identification number and supporting tax document.
  • Registered address and proof of address.
  • Website, support email and support phone number.
  • Details of the owner and directors, with Ghana Card copies for the owner and up to two directors.
  • Product information: what is sold, to whom, how customers pay, how and when the product is delivered, expected risks, integrations and acquisition channels.

Individuals and sole traders who are not incorporated go through identity verification (section 5) and product review instead of company checks, and are assessed on the same risk basis.

5. Customer identification (KYC)

For the account holder, and for any owner or director we need to identify, we collect:

  • Full legal name, date of birth and country.
  • Residential address.
  • Government ID type and number, with images of the front and back of the ID (Ghana Card for Ghanaian residents).
  • A selfie, used to match the person to the ID.

Every document is reviewed by a member of our team. Unclear, incomplete or inconsistent submissions are put on hold and the merchant is asked to correct them. The merchant's payout account must be in the name of the verified business or person (section 7).

6. Beneficial ownership

We identify the natural persons who ultimately own or control each business: anyone holding 25% or more of the ownership or voting rights, and anyone who otherwise exercises control (for example a director or a person who directs the business without holding shares). For high-risk merchants, or where a politically exposed person (PEP) is involved, we identify owners at any level of holding.

Each beneficial owner's name, percentage, role and PEP status is recorded in the merchant's risk assessment and screened (section 10). We do not onboard structures designed to hide who owns or controls a business.

7. Payout account verification

  • Funds settle only to the merchant's own verified bank or mobile money account — never to a third party.
  • Account names are checked with the bank or mobile money operator and compared with the verified identity or business name.
  • Every change of payout account is recorded and alerts our team.

8. Risk assessment

Each merchant is rated low, medium or high risk before it can go live. We weigh:

  • Business category and whether it needs a licence.
  • Where the business operates and which markets it sells to.
  • Expected transaction volume and ticket size.
  • Ownership structure and how clearly it can be verified.
  • PEP involvement, sanctions screening results and adverse media.
  • How customers pay, and how and when the product is delivered.
  • Trading history, website quality and how verifiable the product is.

Betting tips and predictions, gambling and games of chance, Forex/trading education and signals, and platforms, marketplaces and on-demand services start at high risk. A PEP or sanctions match always makes a merchant high risk. Each assessment is kept as a permanent, dated record with the reviewer's name and reasons. The rating is revisited at each periodic review (section 17) and whenever something material changes.

9. Prohibited businesses

We do not onboard businesses on our prohibited list, set out in full in the Merchant Acceptance Policy. In summary:

  • NSFW, intimacy & adult content or services
  • Manual digital services
  • Digital products with limited or unclear value
  • Shipped physical merchandise & direct in-person services
  • Illegal or age-restricted goods
  • Categories restricted by our partners
  • Custodial finance & third-party funds
  • Company registration & statutory filing services
  • Tax evasion, shell entities or regulatory arbitrage
  • Regulated professional services
  • Travel, immigration & visa services
  • Health & wellness products
  • Miracle, misleading or unverifiable claims
  • Social matching & interaction services
  • Religious or spiritual services
  • Gaming & virtual goods
  • Virtual asset services
  • Piracy or IP violations
  • IPTV & streaming access services
  • Software resale or licence flipping
  • Privacy violations & surveillance tech
  • Hosting, servers & infrastructure
  • Telecommunication services
  • Spam, mass outreach & scraping tools
  • Proxy, cloaking or anti-terms tools
  • Cheating & manipulation tools
  • Donations
  • Fundraising
  • Payment forwarding & money transmission
  • Ticket resale & speculative reservations
  • Weapons & violence-oriented content

We also refuse any business involved in money laundering, terrorist or proliferation financing, sanctions evasion, fraud, shell or nominee structures, or activity that is unlawful where it operates. These categories are accepted only after enhanced review: Platforms, marketplaces & on-demand services; Betting tips, predictions & handicapping; Gambling & games of chance; Forex, trading education & signals; Financial tools & advice; AI content generation tools (text, image, video, voice); Marketing & outreach tools; Resume, hiring or exam tools; Spiritual & astrology services; Audio, music & chatbot generators; E-books & written digital publications; Productised services.

10. Sanctions and PEP screening

Before a merchant is approved for Live, a member of our compliance team manually screens the business and every owner, director and beneficial owner against:

  • the United Nations Security Council Consolidated List;
  • lists and designations published by the Financial Intelligence Centre (FIC) of Ghana;
  • the US OFAC Specially Designated Nationals (SDN) List;
  • the UK HM Treasury (OFSI) Consolidated List;
  • the EU Consolidated Financial Sanctions List;
  • public sources for politically exposed persons (PEPs) and adverse media.

The lists checked, the result and how any potential match was resolved are recorded. A confirmed sanctions match means the merchant is not onboarded (or is offboarded) and the case goes to the Compliance Officer for reporting. A PEP is not refused automatically, but triggers enhanced due diligence and needs the Compliance Officer's approval. Screening is repeated at every periodic review and whenever ownership changes.

11. Enhanced due diligence (EDD)

High-risk merchants, and any merchant involving a PEP, must also provide and pass:

  • The licences required for their activity — for example a Gaming Commission of Ghana licence (or the equivalent regulator in each market served) for gambling operators.
  • Source of funds and, where relevant, source of wealth for the owners.
  • Customer-facing safeguards: 18+ gating and responsible-gambling or risk disclaimers where relevant, honest performance claims, and published refund and complaint terms.
  • A walkthrough of the live product, pricing and delivery (for example access to a paid community) to confirm customers receive what they pay for.
  • Approval by the Compliance Officer before going live.
  • Closer ongoing monitoring and a review at least every 6 months.

12. Ongoing transaction monitoring

We monitor activity across the platform with a mix of automated controls and human review, including:

  • Staff alerts for large payments (default threshold GHS 5,000), large payouts and large wallet top-ups.
  • Alerts for payout account changes, failed or rejected payment callbacks, and payments that stay pending too long.
  • Every settlement is checked with the Payment Partner before funds are credited, with daily reconciliation.
  • Tracking of the websites and apps each API key is used from, with the ability to block a site from live traffic.
  • Hard limits on test-mode amounts, tiered disbursement limits, and the ability to block refunds or payouts on an account.
  • Human review at activation, before the first payout, when a product or domain changes, and periodically.

13. Red flags

Indicators our team looks for include:

  • Many payments just below a threshold, or split into small amounts, with no business reason.
  • A sudden jump in volume or ticket size that doesn't match the business.
  • Unusually high numbers of failed attempts.
  • Payer names or numbers that don't fit the business or its customers.
  • Money collected and withdrawn straight away with little trading activity.
  • Repeated payout account changes.
  • Traffic from websites or apps that were never declared, or that sell something different.
  • Signs of a prohibited activity, a sanctions or PEP concern, or complaints from customers or partners.

14. Handling suspicious activity

Any member of staff who notices a red flag opens a confidential compliance case, which records the facts, the related merchant and payments, and the red flags. The case then moves through:

  1. Open — logged and assigned.
  2. Investigating — records reviewed; we may ask the merchant for information in the normal course of business.
  3. Escalated — sent to the Compliance Officer for a decision.
  4. Reported — reported to the authorities where the law requires it (section 15).
  5. Closed — with a recorded decision and the action taken.

While a case is open we may hold settlement or payouts, restrict features, ask for more information, or suspend the account. We only withhold or reverse settled funds for fraud, money laundering, serious chargeback exposure or a lawful order, and we contact the merchant first unless doing so would tip them off. We never tell a merchant or anyone else that a report has been made or is being considered.

15. Reporting and escalation

The Compliance Officer decides whether a case must be reported. Where the law requires it, we report suspicious transactions to the Financial Intelligence Centre of Ghana promptly — within the 24-hour period Act 1044 sets for suspicious transaction reports — and notify the relevant Payment Partner. The date and reference of each report are recorded on the case. We cooperate fully with lawful requests from the FIC, law enforcement, courts and regulators.

16. Record keeping

  • KYC and KYB documents, beneficial ownership details, screening results, risk assessments and compliance cases are kept for at least 5 years after the business relationship ends.
  • Transaction, payout and settlement records are kept for at least 5 years from the date of the transaction.
  • Longer periods apply where a law, regulator, investigation or legal claim requires it.
  • Records are stored securely, access is limited to authorised staff, and staff actions are written to an audit log.

17. Ownership, training and review

This policy is owned by the Web Rabbit Media — Compliance Officer, who is responsible for putting it into practice, approving high-risk and PEP merchants, deciding on escalated cases, reporting to the authorities and keeping records. Staff who review merchants or payments are trained on this policy when they join and whenever it changes.

The policy is reviewed at least every 12 months, and sooner after a change in law or guidance, a new product or rail, or a significant incident. Merchants are re-reviewed every 24 months (low risk), 12 months (medium) or 6 months (high), and whenever their ownership, product or activity changes.

18. Merchant obligations

Merchants must give accurate information, tell us promptly about changes to their ownership, product, website or payout account, respond to information requests, and not use our services for anything prohibited by this policy, our Terms or the Merchant Acceptance Policy. How we handle personal data collected for these checks is described in our Privacy Policy.

19. Contact

Questions about this policy, or to report a concern: hello@webrabbitmedia.com or +233 59 896 9229. Mark your message "Compliance".