1. Purpose and scope
Skinsflow Limited ("SkinsFlow", "we") is committed to preventing the use of its services for money laundering, terrorist financing, sanctions evasion, fraud and other financial crime. This policy sets out the controls we apply. It covers every merchant account, every person who owns, controls or acts for a merchant, and every transaction processed through SkinsFlow.
Game items carry real market value and can be moved between accounts. We treat them with the same care as any other means of payment.
2. Risk-based approach
We assess the risk of each merchant and apply controls in proportion to it. Factors we consider include:
- the merchant's business model, products, target markets and website content;
- the countries where the merchant is established, operates and where its owners live;
- the ownership and control structure, including complex or opaque arrangements;
- whether the merchant's activity requires a licence (for example in gaming or financial services) and whether it holds one;
- expected and actual transaction volumes, values and patterns; and
- results of sanctions, politically-exposed-person (PEP) and adverse-media screening.
Higher-risk relationships receive enhanced due diligence, such as additional documents, source-of-funds or source-of-wealth information, senior management approval and more frequent reviews. We may decline any application, and we do not onboard businesses whose risk we cannot manage.
3. Business verification (KYB)
Every merchant is verified before it can accept live payments. We collect and verify:
- legal name, trading name, registration number and country of incorporation;
- registered and operating addresses;
- certificate of incorporation or an equivalent registry extract, and where relevant articles of association, a register of directors and a register of shareholders;
- the websites and projects that will use SkinsFlow, and a description of the goods or services sold;
- licences required for the merchant's activity; and
- the identity of directors, authorised representatives and all ultimate beneficial owners: any natural person who directly or indirectly owns or controls 25% or more of the shares or voting rights, or otherwise exercises control over the business.
Projects cannot accept payments until verification is approved.
4. Individual verification (KYC)
We verify the identity of the individuals behind a merchant, namely ultimate beneficial owners, directors and the account owner, and of individual merchants trading in their own name. This includes, where required:
- full name, date of birth, nationality and residential address;
- a valid government-issued photo identity document;
- proof of address issued within the last three months; and
- a selfie or liveness check matched against the identity document.
We may also verify customers who pay through a checkout where risk indicators, transaction size or the law require it, and we may limit or decline checkouts until verification is complete.
5. Sanctions screening
We screen merchants, their beneficial owners, directors and representatives against applicable sanctions lists, including those maintained by the United Nations, the European Union, the United Kingdom and the United States (OFAC), as well as PEP and adverse-media sources. Screening takes place at onboarding and again whenever lists or the merchant's details change.
We do not provide services to sanctioned persons or to entities they own or control, and we block activity that we believe is intended to evade sanctions.
6. Blocked jurisdictions
We do not onboard businesses established in, or owned or controlled by residents of, the following high-risk or sanctioned jurisdictions:
- Afghanistan (AF)
- Belarus (BY)
- Central African Republic (CF)
- Congo (DRC) (CD)
- Cuba (CU)
- Iran (IR)
- Iraq (IQ)
- Libya (LY)
- Mali (ML)
- Myanmar (MM)
- North Korea (KP)
- Russia (RU)
- Somalia (SO)
- South Sudan (SS)
- Sudan (SD)
- Syria (SY)
- Venezuela (VE)
- Yemen (YE)
- Zimbabwe (ZW)
We also restrict the Crimea, Donetsk and Luhansk regions of Ukraine and other regions subject to comprehensive sanctions programmes, and we may restrict further jurisdictions based on our risk assessment, the requirements of our partners, or changes in the law. Merchants must not direct their SkinsFlow checkout at customers in blocked jurisdictions. The current list is also published in our Geographic Restrictions.
7. Ongoing monitoring
After onboarding, we monitor merchant relationships and transactions for activity that does not match the merchant's profile or that indicates financial crime. Examples include:
- unusual spikes in volume or value, or many deposits just below limits;
- repeated deposits from the same Steam accounts across different merchants;
- deposits that are routinely reversed under Steam Trade Protection;
- items or accounts linked to theft, fraud or account takeover;
- market purchases that appear to move value rather than serve customers; and
- changes in ownership, control or business activity that the merchant did not tell us about.
We review merchant information periodically, more often for higher-risk relationships, and ask merchants to update their documents when needed.
8. Suspicious activity
Where we suspect money laundering, terrorist financing, sanctions evasion or fraud, we may, without notice:
- pause or decline deposits and market purchases;
- hold, delay or reverse credits to a balance;
- request further information or documents;
- suspend or close the account; and
- report the activity to the competent authorities, including the Financial Intelligence Unit of Seychelles and authorities in other relevant jurisdictions.
We are not allowed to tell anyone that a report has been made or is being considered, and we will not do so.
9. Record keeping
We keep verification documents, screening results, risk assessments, transaction records and records of internal and external reports for five (5) years after the business relationship ends or after the transaction, whichever is later, or longer if a law or an investigation requires it. Records are stored securely, with access limited to staff who need it.
10. Staff and governance
A designated compliance officer is responsible for this policy and for reporting to the authorities. Staff who handle merchants, verification or payments are trained on financial crime risks when they join and at regular intervals afterwards. Access to verification data is restricted by role, protected by two-factor authentication and logged. We review this policy at least once a year and whenever the law or our risk profile changes.
11. What we expect from merchants
- Provide complete and truthful information, and tell us promptly about changes in ownership, control, activity or licences.
- Run your own customer checks where your activity or the law requires it, and do not let your customers use SkinsFlow to bypass them.
- Do not use SkinsFlow for anything prohibited by our Acceptable Use Policy.
- Cooperate with our requests for information about specific transactions or customers.
12. Contact
Compliance questions and reports: [email protected]. Skinsflow Limited, Office 2841, House of Francis, Ile du Port, Mahe, Seychelles.
Questions about this document? Write to [email protected].
Other policies: Terms of Service · Privacy Policy · Cookie Policy · Acceptable Use Policy · Company details