Anti-Money Laundering and Counter-Terrorist Financing Policy

1 Scope and legal classification

ITSA's ordinary ICT, hosting and support activity does not by its label establish that it is an accountable institution or reporting institution. The Managing Member must assess actual activities against the current FIA schedules, obtain advice or FIC clarification where needed and record the conclusion. Review the assessment annually and before adding financial, payment, trust, asset or second-hand-goods activities.

Schedule 3 includes persons carrying on the business of second-hand goods. A refurbished-equipment or other qualifying second-hand trade therefore requires specific assessment; ITSA must not assume all hardware sales fall outside the FIA. Where a scheduled category applies, complete required registration, customer due diligence, risk management, records, reporting, training and compliance appointments before conducting that activity, taking account of applicable current FIC directives and any lawful simplified measures.

Separate from scheduled-institution duties, section 33 creates suspicious-transaction and activity reporting obligations for relevant persons in business. A conclusion that ITSA is not scheduled does not eliminate those obligations or generally applicable sanctions and criminal-law duties. This policy does not import South Africa's FIC Act, thresholds or institutional categories into Namibia.

2 Governance and risk assessment

The Managing Member is accountable for the classification decision, resources and corrective actions. The Finance Lead coordinates routine verification, payment controls and restricted reporting records. These internal assignments do not replace any statutory compliance-officer appointment required if ITSA is scheduled. Sales, procurement and technical staff must report red flags and may not override a legal restriction for commercial reasons.

Assess risks from customers, ownership, products, payment methods, countries, delivery destinations and unusual transactions. Particular ITSA risks include valuable portable hardware, anonymous bulk infrastructure orders, false purchase orders, compromised business email, third-party payments, overpayment-and-refund schemes and services used to support fraud. Increase checks where facts warrant them rather than judging people solely by nationality or occupation.

3 Verification and enhanced checks

For normal transactions, obtain proportionate customer or supplier identity, contact details, authority and a clear commercial purpose, and match invoices and payment references. Verify significant new counterparties and changed bank accounts using reliable independent sources. Collect only information needed for the assessed risk or law; do not demand unnecessary identity documents through public forms.

For higher-risk transactions, verify ownership and control where relevant, the payer's relationship, source of funds where reasonably necessary, delivery destination and the explanation for unusual structure. Prominent influential persons and connected parties require risk-sensitive review, not an automatic allegation of wrongdoing. If statutory due diligence applies, follow its actual requirements rather than treating these general controls as a substitute.

4 Payments refunds and cash

Prefer traceable payment into a verified ITSA business account. Do not accept payment into an employee's personal account, conceal the payer or split an amount to evade checks or reporting. Review cash, multiple unrelated payers, unsupported third-party payments and unusual crypto or stored-value proposals before acceptance. No employee may introduce a new payment method without approval and an applicable legal and risk review.

Investigate overpayments and do not refund to an unrelated account simply on an email instruction. Refund through the original verified route where lawful and practical, after reconciling cleared funds and checking authority. A payment screenshot is not proof of cleared funds. A suspicious transaction must not be refunded or routed elsewhere in a way that defeats a lawful intervention or alerts the subject improperly.

Cash-threshold reporting and electronic-transfer reporting apply where the FIA and current regulations require them for the relevant institution and activity. Do not apply an arbitrary threshold as a universal ITSA duty, and do not treat a transaction below a threshold as safe from suspicion reporting. The responsible person must verify the current category, threshold, deadline and reporting method whenever such a duty arises.

5 Suspicious transactions and activities

Red flags include reluctance to identify the contracting party; false or inconsistent documents; purchases unrelated to the customer's apparent purpose; pressure for urgent delivery before verification; unexplained payments from many people; large overpayments followed by a different refund account; concealed beneficial ownership; suspiciously undervalued goods; and indications that servers or domains support fraud, laundering or prohibited financing.

Staff must promptly provide facts and supporting records to the Finance Lead or an unconflicted Managing Member, normally the same working day a concern is recognised. Do not wait for proof or a completed transaction. Attempted and suspicious activities may also require reporting. If the intended recipient is implicated, unavailable or would cause a missed legal deadline, contact the FIC directly through its current reporting procedure. Internal routing must not delay or veto a person's legal duty.

6 External reporting and intervention

Assess and file required suspicious transaction or activity reports under section 33 and the applicable regulations. The published Financial Intelligence Regulations prescribe a fifteen-working-day reporting period from the relevant suspicion or belief, subject to the regulation's provisions; this is an outer legal deadline where applicable, not permission to delay an urgent report. Verify current requirements and seek immediate FIC guidance where processing may jeopardise a lawful intervention or where sanctions or another rule requires faster action.

Use the current authorised FIC reporting channel, including its external reporting process for a business not registered as a scheduled institution where appropriate. Record the suspicion date, filing deadline, decision, report reference and follow-up securely. Do not require a criminal conviction, minimum monetary value or management consensus before making a report the law requires. Relevant procedures are published by the Financial Intelligence Centre.

Only the legally competent authority can impose a statutory transaction intervention. ITSA must comply promptly with a valid direction. A voluntary internal pause for verification is not authority to seize a customer's property indefinitely. Obtain urgent guidance on whether to proceed, pause, decline or preserve funds, avoiding a step that violates law or frustrates an investigation.

7 Sanctions and prohibited financing

Apply relevant Namibian targeted-financial-sanctions and prohibited-financing requirements, including applicable FIC and competent-authority notices. Screen proportionately against the legally applicable designations, and investigate apparent matches using more than a similar name. Do not substitute an unrelated foreign list for the applicable Namibian legal framework; additional supplier or foreign restrictions must be identified when contractually or legally relevant.

A confirmed legally designated connection may require immediate freezing without delay, non-dealing and notification under the applicable law. Escalate urgently, follow current FIC guidance and do not notify the affected person if doing so is prohibited. Do not simply reject, return or move funds where a freeze duty applies. Record the authority, action and reporting steps.

8 Confidentiality records and assurance

Do not disclose that a suspicious report has been or will be made, or information likely to prejudice an investigation, where the FIA prohibits disclosure. Customer-service explanations must be neutral and lawful. Protect reporters and permit access to reports only for authorised legal and compliance purposes. Ordinary customer files should not expose restricted report content.

Retain verification, transaction and reporting records for the period the applicable law and activity require; where scheduled-institution rules apply, meet those prescribed retention duties. Apply a documented proportionate retention schedule to other records and preserve a legal hold. Train relevant staff at induction and periodically using ICT-specific examples. Review classification, red flags, decisions, regulatory changes and the effectiveness of controls at least annually and after a material incident.