Fraud prevention and AML policy

What we accept payments for

TradeDesk sells access to education and software tools. We do not accept investment deposits, hold trading funds, operate an exchange, execute trades or collect money for other merchants. Online checkout remains unavailable until the payment provider connection and access delivery have been tested.

Who is responsible

The TradeDesk operator is responsible for reviewing alerts, deciding what further checks are needed and contacting the payment provider or appropriate authority where required. Adoption and review decisions are recorded in the private owner review page.

Account and payment checks

Customers must use a verified account before starting a subscription payment. Payment amounts and references must come from the server. Payment details, wallet PINs, card numbers and CVV must never be collected in chat or the journal. Payment notifications must pass signature and server-side transaction checks before they can be treated as evidence of payment. Provider connection, customer wallet/card authorisation and automatic subscription fulfilment still require end-to-end verification before checkout is enabled.

Unusual activity and referrals

Server requests are checked for excessive activity. Security events are kept for owner review. Referral controls check self-referrals, repeated payment identities, unexpected conversion bursts, refunds and commission eligibility. Payment-dependent checks require verified provider transactions; they are not a claim that payments or transfers are already live. An IP address or a shared device alone is not proof of fraud.

The proprietor should review unresolved alerts each business day while payments are active, and before approving an exceptional payment or partner payout. Record the reason, evidence checked and decision. Pause disputed or suspicious activity while checking it. Escalate suspected fraud to the provider; make any legally required report through the correct authority and channel. Do not tell a customer that a confidential report has been made.

Sanctions and country restrictions

We keep global access unless an applicable rule or our payment provider requires a restriction. A sanctions list may identify people or organisations anywhere in the world. A high-risk country list is not automatically a ban on every resident. We use written provider instructions to configure country or regional restrictions and record the source and date. IP location can be inaccurate and VPNs can obscure it; location controls do not replace identity screening.

Before a suspicious or higher-risk payment or payout is cleared, the proprietor must check the relevant person or business against the applicable current official sanctions lists, including the UN list and FIA screening tool, and any additional list required by the provider. Record the list date, identity details compared and outcome. A similar name needs investigation; do not accuse or automatically reject someone on a name match alone. Automated sanctions-name or politically exposed person screening is not currently in place.

Higher-risk cases

Unexplained third-party payment, identity conflicts, repeated failed requests, high refund rates, unusually large orders or a possible sanctions match require review. The proprietor may ask for an explanation and only the evidence necessary to resolve the concern, using a secure provider-approved channel. Do not ask customers to upload identity documents into chat. A politically exposed person requires appropriate risk review; it is not proof of wrongdoing.

Records, privacy and complaints

The security log stores event time, route, country where available and a daily pseudonymous network identifier. It excludes passwords, access tokens, wallet PINs, card numbers and journal content. Owner decisions are stored privately. Review resolved routine security events for removal after 90 days; unresolved cases and records needed for disputes or legal obligations are retained only as necessary. Financial or identity records must follow the retention period applicable to the business and provider agreement; that schedule must be confirmed before live checkout.

Customers can contact support to challenge an access restriction or request review. Share relevant records only with authorised service providers, authorities or advisers where necessary and lawful.

Review and limitations

Review this policy when provider requirements, applicable rules or the product change, and at least annually. Anyone given a review role must understand the procedures before handling cases. Training completion, independent AML audits, formal identity verification and regulatory registration must be recorded separately; none is claimed merely because this policy exists.