Risk Management Policy

Home»Risk Management Policy

1. Purpose

AIIONGOLD is committed to maintaining a robust, proportionate, and risk-based framework for identifying, assessing, managing, monitoring, and reporting risks arising from its business activities.

The purpose of this Risk Management Policy is to establish the principles, responsibilities, controls, and processes used by AIIONGOLD to manage risks that may affect:

Clients and users;
Client assets and transactions;
Business operations;
Financial stability;
Information and technology systems;
Compliance with applicable laws and regulations;
The integrity and reputation of AIIONGOLD; and
The continuity and sustainability of the business.

Risk management is an integral part of AIIONGOLD's governance and decision-making processes. The Company seeks to identify material risks at an early stage and implement appropriate controls to reduce the likelihood and potential impact of adverse events.

2. Scope

This Policy applies to AIIONGOLD's directors, officers, employees, contractors, consultants, and other persons acting on behalf of the Company, to the extent applicable.

It covers risks associated with, among other things:

Client onboarding and account management;
Know Your Customer (KYC) and Customer Due Diligence (CDD);
Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT);
Transactions and payments;
Digital gold and related products or services;
Technology and cybersecurity;
Fraud and financial crime;
Third-party and service-provider relationships;
Operational processes;
Legal and regulatory compliance;
Financial and liquidity matters;
Data protection and privacy;
Business continuity and disaster recovery;
Market and product risks;
Reputational risks; and
Strategic and emerging risks.

3. Risk Management Principles

AIIONGOLD's risk management framework is based on the following principles:

3.1 Risk-Based Approach

AIIONGOLD applies a risk-based approach under which the nature, likelihood, and potential impact of identified risks are considered when determining the appropriate level of controls and monitoring.

Higher-risk activities, clients, transactions, jurisdictions, products, or relationships may be subject to enhanced due diligence, additional approval requirements, increased monitoring, or other appropriate controls.

3.2 Proportionality

Risk controls should be proportionate to the nature, scale, complexity, and potential impact of the relevant risk.

3.3 Prevention and Early Detection

AIIONGOLD seeks to prevent avoidable risks while maintaining systems and processes capable of identifying unusual, suspicious, or potentially harmful activity at an early stage.

3.4 Accountability

Risk management is the responsibility of the entire organization. Management and employees are expected to understand the risks relevant to their functions and comply with applicable policies and procedures.

3.5 Continuous Improvement

The Company's risk management framework is periodically reviewed and enhanced to reflect changes in its business, technology, applicable requirements, emerging threats, and lessons learned from incidents or control assessments.

4. Risk Governance

AIIONGOLD maintains appropriate governance arrangements for oversight and management of risk.

4.1 Board and Senior Management

The Board of Directors and/or Senior Management, as applicable, is responsible for providing appropriate oversight of the Company's risk management framework.

Their responsibilities may include:

Approving the Company's overall risk management approach;
Establishing appropriate risk appetite and risk tolerance;
Reviewing material risks and significant incidents;
Ensuring that appropriate resources are available for risk management;
Supporting a strong culture of compliance and risk awareness; and
Reviewing significant changes to the Company's risk profile.

4.2 Compliance and Risk Management Functions

The Compliance and Risk Management functions are responsible for supporting the implementation of the Company's risk framework.

Responsibilities include:

Identifying and assessing material risks;
Developing and maintaining risk controls;
Monitoring compliance with relevant policies and procedures;
Escalating material risks and incidents;
Supporting risk assessments;
Monitoring regulatory and compliance developments;
Coordinating risk reporting; and
Recommending improvements to the Company's control environment.

4.3 Employees and Representatives

All employees and representatives are responsible for:

Following applicable Company policies and procedures;
Completing required training;
Reporting suspected misconduct, fraud, security incidents, or compliance concerns;
Protecting confidential and client information;
Performing assigned control activities; and
Escalating material risks without undue delay.

5. Risk Identification and Assessment

AIIONGOLD identifies risks through ongoing monitoring and periodic risk assessments.

Risk assessments may consider:

The nature and complexity of the Company's products and services;
Client and transaction characteristics;
Geographic exposure;
Delivery channels and technologies;
Third-party relationships;
Regulatory and legal requirements;
Historical incidents and control failures;
Cybersecurity threats;
Fraud and financial-crime risks;
Market conditions;
Operational dependencies; and
Emerging risks.

Each material risk should be assessed based on appropriate criteria, including the potential likelihood of occurrence and the potential impact on the Company, clients, operations, finances, compliance position, or reputation.

6. Risk Classification

Where appropriate, AIIONGOLD may classify risks according to their assessed level, such as:

Low Risk – Risks that are unlikely to result in significant harm and can generally be managed through established routine controls.
Medium Risk – Risks requiring additional monitoring, management attention, or enhanced controls.
High Risk – Risks that could result in significant financial, legal, regulatory, operational, cybersecurity, client, or reputational consequences and therefore require enhanced controls, monitoring, escalation, and appropriate management oversight.

Risk classifications may be revised when circumstances change or new information becomes available.

7. Key Risk Categories

7.1 Regulatory and Compliance Risk

Regulatory and compliance risk arises from failure to comply with applicable laws, regulations, regulatory requirements, contractual obligations, or internal policies.

AIIONGOLD seeks to manage this risk through:

Compliance policies and procedures;
Regulatory monitoring;
KYC and CDD controls;
AML/CFT controls;
Employee training;
Compliance reviews;
Record keeping;
Escalation procedures; and
Periodic review of the compliance framework.

The Company may update its policies and procedures when applicable legal or regulatory requirements change.

7.2 Money Laundering and Terrorist Financing Risk

AIIONGOLD maintains controls designed to prevent its services from being misused for money laundering, terrorist financing, fraud, or other financial crime.

These controls may include:

Customer identification and verification;
Beneficial ownership identification, where applicable;
Customer risk classification;
Enhanced Due Diligence for higher-risk relationships;
PEP and sanctions screening, where applicable;
Source-of-funds or source-of-wealth checks where appropriate;
Transaction monitoring;
Suspicious activity escalation and reporting;
Record retention; and
Ongoing employee training.

AIIONGOLD's AML framework should be read together with its separate Anti-Money Laundering Policy.

7.3 Client and Counterparty Risk

Client and counterparty risk includes the possibility that a client or counterparty may provide inaccurate information, fail to meet obligations, engage in prohibited activity, or otherwise expose the Company to financial, legal, or reputational harm.

AIIONGOLD manages this risk through appropriate onboarding, verification, risk classification, monitoring, contractual controls, and escalation procedures.

Where required by the Company's policies or applicable requirements, AIIONGOLD may decline, restrict, suspend, or terminate a relationship where adequate due diligence cannot be completed or where continuing the relationship presents unacceptable risk.

7.4 Market and Product Risk

Gold and other investment-related products may be affected by market conditions, price movements, liquidity conditions, foreign exchange movements, and other economic factors. AIIONGOLD recognizes that market performance cannot be guaranteed and that clients may be exposed to investment-related risks.

The Company seeks to manage product and market risks through appropriate product governance, monitoring, disclosures, internal controls, and periodic review of product-related risks.

Nothing in this Policy should be interpreted as a guarantee of investment performance or returns.

7.5 Operational Risk

Operational risk includes risks arising from inadequate or failed processes, people, systems, controls, or external events.

AIIONGOLD seeks to manage operational risk through:

Documented procedures;
Segregation of duties where appropriate;
Access controls;
Approval and authorization procedures;
Reconciliation and review processes;
Incident management;
Business continuity planning;
Staff training;
Management oversight; and
Periodic control reviews.

Material operational incidents should be documented, investigated, escalated, and addressed through appropriate corrective measures.

7.6 Technology and Cybersecurity Risk

AIIONGOLD recognizes that technology failures, unauthorized access, cyberattacks, malware, data loss, system vulnerabilities, and other technology-related events may affect clients and the Company's operations.

The Company seeks to mitigate these risks through appropriate measures, which may include:

Authentication and access controls;
Encryption and secure communications;
System monitoring;
Vulnerability management;
Security updates;
Backup and recovery procedures;
Incident detection and response;
Employee cybersecurity awareness; and
Periodic review of technology controls.

Users should also maintain appropriate security practices, including protecting passwords, authentication credentials, and devices used to access AIIONGOLD services.

7.7 Fraud Risk

AIIONGOLD maintains controls designed to prevent, detect, investigate, and respond to fraudulent activity.

Potential indicators of fraud may include:

Unauthorized account activity;
Account takeover attempts;
Identity misuse;
Unusual transaction patterns;
Manipulation of platform processes;
False or misleading information;
Suspicious payment activity; or
Attempts to circumvent Company controls.

Where appropriate, AIIONGOLD may investigate activity, restrict transactions or accounts, request additional information, and report matters to relevant authorities or counterparties as required by applicable law.

7.8 Data Protection and Privacy Risk

AIIONGOLD recognizes the importance of protecting personal and confidential information.

The Company seeks to manage privacy and data-security risks through appropriate administrative, technical, and organizational safeguards, together with access controls, information-security procedures, employee awareness, and applicable privacy requirements.

Personal information should be collected, processed, stored, disclosed, and retained only in accordance with applicable requirements and the Company's Privacy Policy.

7.9 Third-Party and Outsourcing Risk

Third-party service providers may create operational, technology, compliance, financial, or reputational risks.

Where appropriate, AIIONGOLD may assess third parties before engagement and periodically thereafter.

Risk management measures may include:

Due diligence;
Contractual requirements;
Defined responsibilities;
Confidentiality and security requirements;
Service-level monitoring;
Business continuity considerations; and
Periodic performance and risk reviews.

Material third-party risks should be appropriately documented and escalated.

7.10 Business Continuity and Disaster Recovery Risk

AIIONGOLD seeks to maintain appropriate arrangements to support the continued availability of critical business services during significant disruptions.

Business continuity and recovery arrangements may address:

Technology outages;
Cybersecurity incidents;
Loss of critical personnel;
Infrastructure disruptions;
Third-party failures;
Natural disasters;
Communication failures; and
Other significant business interruptions.

Recovery arrangements should be reviewed and tested periodically where appropriate.

7.11 Reputational Risk

Reputational risk may arise from regulatory breaches, poor customer outcomes, operational failures, misconduct, cybersecurity incidents, fraud, inaccurate communications, or other events that may adversely affect stakeholder confidence.

AIIONGOLD seeks to manage reputational risk through strong governance, responsible communications, compliance controls, customer-support processes, incident management, and timely escalation of material issues.

8. Risk Controls and Mitigation

For each material identified risk, AIIONGOLD may implement one or more of the following responses:

Avoid – discontinue or refrain from an activity where the associated risk is unacceptable;
Reduce – implement controls to reduce the likelihood or impact of the risk;
Transfer – allocate appropriate aspects of the risk to a qualified third party or contractual counterparty where appropriate; or
Accept – accept the residual risk where it falls within approved risk tolerance and is appropriately monitored.

Risk mitigation measures should be documented and periodically reviewed for effectiveness.

9. Risk Monitoring and Reporting

Risk monitoring is an ongoing process.

AIIONGOLD may use appropriate risk indicators, management information, compliance reviews, transaction monitoring, incident reports, control assessments, and other relevant information to monitor its risk profile.

Material risks should be escalated to the appropriate management or governance body.

Risk reports may include:

Significant changes in risk exposure;
Material incidents;
Control deficiencies;
Compliance concerns;
Emerging risks;
Remediation activities;
Key risk indicators; and
Recommendations for further action.

10. Incident Management and Escalation

Employees and relevant representatives are expected to promptly report material incidents or suspected breaches.

Examples include:

Suspected fraud;
Cybersecurity incidents;
Unauthorized access;
Significant system failures;
Data breaches;
Suspicious transactions;
Regulatory or compliance breaches;
Material client-impacting incidents; and
Significant operational disruptions.

AIIONGOLD will assess reported incidents and determine the appropriate response, including investigation, containment, remediation, management escalation, client communication, and regulatory or law-enforcement notification where required.

11. Risk Appetite and Risk Tolerance

AIIONGOLD seeks to maintain risks within levels that are consistent with its business objectives, legal and regulatory obligations, operational capabilities, and responsibilities to its clients and stakeholders.

The Company does not knowingly accept risks that would:

Require violation of applicable law or regulation;
Undermine required KYC/AML controls;
Materially compromise client or personal information;
Expose the Company to unacceptable financial or operational loss; or
Materially threaten the integrity or continuity of the Company's critical operations.

Specific risk appetite thresholds and limits may be established by the Board or Senior Management and reviewed periodically.

12. Employee Training and Risk Awareness

AIIONGOLD promotes a culture in which employees understand their responsibilities for managing risk.

Relevant employees may receive training covering:

KYC and AML/CFT;
Fraud prevention;
Information security;
Data protection;
Operational risk;
Incident reporting;
Compliance requirements; and
Other risks relevant to their roles.

Training requirements may be updated based on changes in applicable requirements, products, systems, or identified risks.

13. Record Keeping

AIIONGOLD maintains appropriate records relating to risk assessments, monitoring, incidents, investigations, controls, training, and other risk-management activities in accordance with applicable requirements and internal retention policies.

Records should be sufficiently detailed to demonstrate the basis for significant risk decisions and actions.

14. Risk Review and Testing

The effectiveness of risk controls may be evaluated through:

Management reviews;
Compliance monitoring;
Control testing;
Internal assessments;
Independent reviews, where appropriate;
Incident and root-cause analysis; and
Other assurance activities.

Where weaknesses are identified, corrective action should be assigned to an appropriate owner and monitored until completion.

15. Emerging Risk Management

AIIONGOLD recognizes that new risks may arise from changes in technology, markets, products, regulations, cyber threats, criminal methods, geopolitical conditions, and customer behavior.

The Company therefore seeks to maintain processes for identifying and evaluating emerging risks and, where appropriate, incorporating them into its risk assessments and control framework.

16. Policy Review

This Policy shall be reviewed periodically and at least annually, or sooner where appropriate.

A review may be triggered by:

Changes in applicable laws or regulations;
Introduction of new products or services;
Significant changes to the Company's business model;
Material incidents;
Significant changes in technology;
Changes in the Company's risk profile; or
Recommendations from management, compliance, audit, or other assurance functions.

Changes to this Policy shall be subject to appropriate approval before implementation.

17. Relationship With Other Policies

This Risk Management Policy should be read together with AIIONGOLD's other applicable policies and procedures, including, where applicable:

Anti-Money Laundering (AML) Policy;
Know Your Customer (KYC) Policy;
Privacy Policy;
Information Security Policy;
Cybersecurity Policy;
Fraud Prevention Policy;
Business Continuity and Disaster Recovery Policy;
Client/Customer Complaints Policy; and
Terms and Conditions.

Where there is a conflict between this Policy and applicable law or regulation, the applicable legal or regulatory requirement shall prevail.

18. No Guarantee of Investment Performance

Risk management controls are intended to identify and mitigate risks; they cannot eliminate all risks.

Investment and market-related activities may involve the risk of loss, including loss arising from changes in market conditions, liquidity, technology, operational events, regulatory developments, or other circumstances.

Nothing in this Policy constitutes investment advice, a guarantee of returns, or a representation that all risks can be eliminated.

Clients should carefully consider the risks associated with any product or service before making an investment decision.

19. Management Statement

AIIONGOLD is committed to maintaining a responsible risk culture supported by effective governance, appropriate controls, transparency, compliance, and continuous improvement.

The Company recognizes that effective risk management is essential to protecting clients, supporting operational resilience, maintaining regulatory compliance, and promoting the long-term sustainability of the business.