1. Purpose
EXPRESS PEPTIDE CO (“the Company”) is committed to conducting business with integrity and
maintaining a robust, risk-based Know Your Customer (KYC) and Customer Due Diligence (CDD)
program. This policy establishes the standards and procedures for verifying customer identity,
assessing customer risk, and ensuring that the Company’s research-use-only (RUO) products are
supplied exclusively to qualified organizations and professionals engaged in legitimate scientific
research.
The objectives of this policy are to:
• Verify the identity and legitimacy of all customers before establishing a business
relationship.
• Confirm that products are purchased solely for lawful research purposes.
• Prevent sales to prohibited, sanctioned, or otherwise ineligible persons or organizations.
• Apply a risk-based approach to customer onboarding and ongoing monitoring.
• Protect the Company from financial crime, fraud, diversion, misuse, and reputational risk.
• Maintain accurate records demonstrating compliance with applicable laws, regulations,
and internal policies.
This policy supports EXPRESS PEPTIDE CO’s commitment to ethical business practices,
responsible distribution, and effective risk management.
2. Scope
This policy applies to all officers, employees, contractors, and authorized representatives of
EXPRESS PEPTIDE CO who participate in customer onboarding, sales, order processing, customer
service, compliance, finance, or related business activities.
The policy applies to every prospective and existing customer, regardless of geographic location or
purchase volume, including:
• Universities and academic institutions
• Government laboratories
• Biotechnology companies
• Pharmaceutical companies• Contract research organizations (CROs)
• Hospitals and medical research institutions
• Qualified commercial laboratories
• Other organizations or professionals conducting legitimate scientific research
Compliance with this policy is required before any customer account is approved or products are
supplied.
3. Definitions
For purposes of this policy, the following definitions apply:
Customer – Any individual or organization seeking to purchase products from EXPRESS PEPTIDE
CO.
Know Your Customer (KYC) – The process of identifying and verifying a customer’s identity before
establishing or maintaining a business relationship.
Customer Due Diligence (CDD) – The collection and evaluation of information necessary to
understand a customer’s identity, business activities, ownership, intended use of products, and
overall risk profile.
Enhanced Due Diligence (EDD) – Additional investigation and verification performed when a
customer presents elevated compliance, regulatory, financial, geographic, or reputational risk.
Research Use Only (RUO) – Products intended exclusively for laboratory research and scientific
investigation. RUO products are not intended for human consumption, clinical use, therapeutic
treatment, veterinary use, diagnostic procedures, or any other prohibited application.
Beneficial Owner – The natural person(s) who ultimately owns or controls a legal entity or
exercises significant control over its operations.
Sanctions Screening – The process of reviewing customers against applicable government
sanctions, restricted-party, denied-party, and watch lists before approving or continuing a
business relationship.
High-Risk Customer – A customer whose characteristics, location, ownership, transaction
patterns, or intended use of products require Enhanced Due Diligence and management review
before approval.4. Policy Statement
EXPRESS PEPTIDE CO is committed to supplying research-use-only products exclusively to
qualified organizations and professionals engaged in legitimate scientific research.
The Company will establish and maintain a risk-based KYC and CDD program designed to:
• Verify customer identity before establishing a business relationship.
• Understand the customer’s business, research activities, and intended product use.
• Assess customer risk using objective, documented criteria.
• Apply Enhanced Due Diligence when elevated risks are identified.
• Screen customers against applicable sanctions and restricted-party lists.
• Monitor customer relationships for changes in risk or suspicious activity.
• Maintain complete and accurate compliance records.
• Decline or terminate customer relationships that present unacceptable legal, regulatory,
financial, or reputational risk.
EXPRESS PEPTIDE CO will not knowingly sell products to customers who:
• Cannot be adequately identified or verified.
• Refuse to provide requested documentation.
• Intend to use products for human consumption, clinical treatment, veterinary use,
diagnostic procedures, performance enhancement, or other prohibited purposes.
• Appear on applicable sanctions or restricted-party lists.
• Seek to circumvent this policy or provide false or misleading information.
• Present risks that cannot be reasonably mitigated through additional due diligence.
All employees are responsible for complying with this policy and promptly escalating unusual,
suspicious, or high-risk situations to the designated Compliance Officer or authorized
management representative before proceeding with a transaction.
5. Customer Acceptance Standards
5.1 General Requirements
EXPRESS PEPTIDE CO establishes business relationships only with customers that can be
satisfactorily identified, verified, and determined to present an acceptable level of compliance risk.
No customer account may be approved until the Company has completed the applicable customer
identification, verification, due diligence, and sanctions screening requirements described in this
policy.
The Company reserves the right to request additional information or documentation whenever
necessary to verify a customer’s identity, business activities, ownership, intended product use, or
overall risk profile.5.2 Eligible Customers
EXPRESS PEPTIDE CO supplies research-use-only (RUO) products exclusively to qualified
organizations and professionals engaged in legitimate scientific research.
Eligible customers may include:
• Accredited colleges and universities
• Government laboratories and research institutions
• Biotechnology companies
• Pharmaceutical companies
• Contract Research Organizations (CROs)
• Hospitals conducting scientific research
• Independent commercial laboratories
• Other qualified organizations whose activities are consistent with lawful scientific research
Approval of a customer relationship remains subject to satisfactory completion of the Company’s
KYC and CDD requirements.
5.3 Prohibited Customers and Uses
EXPRESS PEPTIDE CO will not knowingly sell products to any customer who:
• Cannot be adequately identified or verified.
• Refuses to provide requested documentation.
• Intends to use products for human consumption.
• Intends to use products for clinical, therapeutic, veterinary, or diagnostic purposes.
• Purchases products for bodybuilding, performance enhancement, cosmetic, or
recreational use.
• Appears on applicable sanctions or restricted-party lists.
• Provides false, misleading, or inconsistent information.
• Attempts to circumvent Company policies or applicable laws.
• Presents an unacceptable legal, regulatory, financial, or reputational risk.
The Company may decline any order or terminate any customer relationship when sufficient
information cannot be obtained to support an informed compliance decision.5.4 Right to Decline or Terminate Business
EXPRESS PEPTIDE CO reserves the right to refuse, suspend, or terminate any customer relationship
when:
• Customer information cannot be independently verified.
• Required documentation is incomplete or inconsistent.
• Product use appears inconsistent with legitimate scientific research.
• The customer refuses to cooperate with reasonable due diligence requests.
• New information materially changes the customer’s risk profile.
• Continued business would expose the Company to unacceptable compliance or
reputational risk.
Business decisions made under this section will be documented and retained in accordance with
the Company’s record retention requirements.
6. Customer Identification & Verification (KYC/CIP)
6.1 Customer Identification
Before establishing a business relationship, EXPRESS PEPTIDE CO will obtain sufficient information
to identify each prospective customer and evaluate the legitimacy of the proposed business
relationship.
As applicable, customer information may include:
• Legal name of the organization
• Business address
• Shipping address
• Billing address
• Business website
• Corporate email address
• Telephone number
• Legal entity type
• State or country of formation• Employer Identification Number (EIN) or equivalent business registration number
• Primary business activities
• Name and title of the authorized purchaser
• Beneficial ownership information, when appropriate
The Company may request additional information based on the customer’s risk profile.
6.2 Identity Verification
Customer information must be verified using reliable and independent sources whenever
reasonably available.
Verification methods may include:
• Review of government-issued business registrations
• Verification of corporate websites
• Public business records
• Professional licensing information
• Academic or institutional affiliations
• Independent commercial databases
• Direct communication with the customer
• Other reliable sources considered appropriate by the Company
Verification procedures will be proportionate to the customer’s assessed level of risk.
6.3 Documentation Requirements
Customers must provide sufficient documentation to support the Company’s verification process.
Depending on the customer relationship, documentation may include:
• Business registration documents
• Tax identification information
• Institutional affiliation
• Purchase authorization
• Research description or intended product use• Professional credentials
• Laboratory information
• Shipping and billing verification
• Additional documents requested during due diligence
The Company may defer account approval until all required documentation has been received and
reviewed.
6.4 Beneficial Ownership
When appropriate, EXPRESS PEPTIDE CO may identify and verify the individuals who ultimately own
or control a customer organization.
Beneficial ownership information may be requested when necessary to:
• Understand ownership structure.
• Evaluate compliance risk.
• Resolve inconsistencies in customer information.
• Support Enhanced Due Diligence.
7. Customer Due Diligence (CDD)
7.1 Purpose
Customer Due Diligence enables EXPRESS PEPTIDE CO to understand each customer’s identity,
research activities, intended product use, and overall compliance risk before establishing or
continuing a business relationship.
CDD is applied using a risk-based approach and is appropriate to the nature of the customer and
the proposed transaction.
7.2 Standard Due Diligence
Prior to approving a customer relationship, the Company will evaluate information sufficient to:
• Verify customer identity.
• Confirm legitimate business or research activities.• Understand the intended use of Company products.
• Assess geographic and regulatory risk.
• Review available ownership information, when appropriate.
• Determine whether Enhanced Due Diligence is required.
7.3 Customer Risk Assessment
Each customer will be assigned an initial risk classification based on factors including:
• Customer type
• Nature of research activities
• Geographic location
• Product requested
• Transaction characteristics
• Ownership structure
• Verification results
• Sanctions screening results
• Any other relevant compliance considerations
The assigned risk rating determines the level of due diligence and ongoing monitoring required.
7.4 Ongoing Due Diligence
Customer due diligence does not end when an account is approved.
EXPRESS PEPTIDE CO will periodically review customer information to confirm that it remains
accurate, complete, and consistent with the customer’s business activities, purchasing patterns,
and assessed risk profile.
The frequency and scope of ongoing reviews will be proportionate to the customer’s risk
classification.8. Enhanced Due Diligence (EDD)
8.1 Purpose
Enhanced Due Diligence (EDD) is performed when a prospective or existing customer presents
elevated legal, regulatory, financial, geographic, operational, or reputational risk. EDD enables
EXPRESS PEPTIDE CO to obtain additional information necessary to evaluate the customer
relationship and determine whether the identified risks can be appropriately managed.
EDD supplements, but does not replace, the Company’s standard Customer Due Diligence
procedures.
8.2 When Enhanced Due Diligence Is Required
EDD should be considered whenever one or more of the following conditions exist:
• The customer operates in, or conducts business with, a high-risk jurisdiction.
• Customer ownership or control cannot be readily verified.
• The proposed purchase is inconsistent with the customer’s stated research activities.
• The customer requests unusually large quantities or recurring purchases that cannot be
reasonably explained.
• The customer refuses to provide requested documentation or provides incomplete or
inconsistent information.
• The transaction involves an unrelated third-party payer or other unusual payment
arrangements.
• Sanctions or restricted-party screening identifies a potential match requiring additional
review.
• The customer has previously been declined, suspended, or terminated by the Company.
• Other circumstances indicate elevated compliance or reputational risk.
The Compliance Officer may require EDD whenever additional review is considered appropriate.
8.3 Enhanced Due Diligence Measures
Depending on the identified risk, EDD may include:
• Obtaining additional business registration or organizational documents.
• Verifying beneficial ownership or management information.• Requesting additional information regarding research activities or intended product use.
• Confirming institutional affiliations or laboratory facilities.
• Verifying funding sources or payment arrangements.
• Reviewing publicly available information regarding the customer.
• Conducting additional sanctions or restricted-party screening.
• Performing other verification procedures appropriate to the identified risk.
The scope of EDD will be proportionate to the nature and level of the identified risk.
8.4 Approval of High-Risk Customers
High-risk customer relationships require documented review and approval by the Compliance
Officer or designated management representative before products are supplied.
Approval should consider:
• Results of the due diligence review.
• Remaining compliance or reputational risks.
• Whether identified risks can be appropriately mitigated.
• Whether the proposed relationship is consistent with the Company’s business objectives
and compliance standards.
Where risks cannot be satisfactorily resolved, the customer relationship will be declined or
terminated.
9. Sanctions & Restricted Party Screening
9.1 Policy
EXPRESS PEPTIDE CO will screen prospective and existing customers, when appropriate, against
applicable government sanctions, restricted-party, denied-party, and watch lists before
establishing or continuing a business relationship.
The Company will not knowingly conduct business with any individual or organization that is
subject to applicable legal restrictions or sanctions.9.2 Screening Procedures
Sanctions screening will be conducted:
• Before approving a new customer account.
• When significant customer information changes.
• Before approving high-risk transactions, when appropriate.
• Periodically for existing higher-risk customers.
• Whenever additional review is warranted.
Screening may be performed using commercially available screening tools, government resources,
or other reliable sources.
9.3 Potential Matches
Potential sanctions or restricted-party matches must be reviewed before any transaction proceeds.
Where appropriate, the Company will:
• Verify the identity of the customer.
• Review available supporting information.
• Resolve false-positive matches.
• Escalate confirmed or unresolved matches to the Compliance Officer.
No transaction may proceed while a confirmed or unresolved sanctions concern remains under
review.
10. Payment Verification
10.1 General Requirements
EXPRESS PEPTIDE CO expects payments to be consistent with the approved customer relationship
and the information obtained during Customer Due Diligence.
Payment methods or arrangements that are inconsistent with normal business practices may
require additional review before an order is approved.10.2 Indicators Requiring Additional Review
Additional verification may be required when:
• Payment is received from an unrelated third party.
• Billing and customer information are materially inconsistent.
• Multiple payment methods are used without reasonable explanation.
• Payment instructions change unexpectedly.
• Transactions appear unusually complex or inconsistent with previous purchasing activity.
• Other circumstances indicate elevated compliance or fraud risk.
The Company may request additional information before accepting payment or fulfilling an order.
11. Customer Risk Classification
11.1 Risk-Based Approach
EXPRESS PEPTIDE CO assigns each customer a risk classification to determine the appropriate
level of due diligence, monitoring, and management oversight.
Risk classifications support consistent decision-making while recognizing that customer risk may
change over time.
11.2 Risk Categories
Low Risk
Customers whose identity, ownership, research activities, and intended product use have been
satisfactorily verified and present minimal compliance concerns.
Standard Customer Due Diligence is generally sufficient.
Moderate Risk
Customers presenting one or more characteristics requiring additional review but not rising to the
level of Enhanced Due Diligence.
Additional documentation or verification may be required before approval.High Risk
Customers presenting elevated legal, regulatory, geographic, operational, financial, or reputational
risk.
Enhanced Due Diligence and management approval are required before establishing or continuing
the business relationship.
11.3 Risk Review
Customer risk classifications will be reviewed whenever:
• Significant customer information changes.
• Purchasing patterns change materially.
• New compliance concerns arise.
• Periodic customer reviews are conducted.
• Other information indicates a change in risk.
Risk classifications may be increased or decreased based on updated information.12. Ongoing Monitoring
12.1 Policy
Customer relationships will be monitored throughout the business relationship to ensure that
customer information remains accurate, purchasing activity remains consistent with legitimate
research purposes, and the customer’s overall risk profile has not materially changed.
Monitoring supports the Company’s ongoing compliance obligations and helps identify
circumstances requiring additional review.
12.2 Monitoring Activities
Monitoring may include:
• Periodic review of customer information.
• Review of purchasing patterns.
• Confirmation of continued research activities, when appropriate.
• Updated sanctions or restricted-party screening.
• Review of unusual orders or transactions.
• Assessment of new compliance or reputational risks.
The frequency and scope of monitoring will be proportionate to the customer’s assigned risk
classification.
12.3 Escalation
If ongoing monitoring identifies information that materially changes the customer’s risk profile,
EXPRESS PEPTIDE CO may:
• Request updated documentation.
• Perform Enhanced Due Diligence.
• Reclassify the customer’s risk level.
• Suspend pending transactions.
• Decline future orders.
• Terminate the customer relationship when appropriate.All material compliance decisions will be documented in accordance with the Company’s record
retention requirements.
13. Suspicious Activity & Escalation
13.1 Policy
EXPRESS PEPTIDE CO is committed to identifying and responding appropriately to customer
activity that may present legal, regulatory, operational, or reputational risk.
Employees are responsible for promptly reporting unusual or suspicious customer activity to the
Compliance Officer before processing the transaction whenever practicable.
13.2 Indicators of Suspicious Activity
Examples of activity that may require additional review include:
• Refusal to provide requested identification or supporting documentation.
• Information that cannot be independently verified.
• Material inconsistencies between customer information and purchasing activity.
• Requests inconsistent with legitimate scientific research.
• Orders involving unusually large quantities or unexpected purchasing patterns.
• Multiple failed attempts to bypass Company procedures.
• Requests to ship products to residential addresses or locations inconsistent with the
customer’s business, unless satisfactorily explained and approved.
• Payments from unrelated third parties without a reasonable business explanation.
• Potential sanctions or restricted-party screening matches.
• Any other activity that appears unusual or inconsistent with the customer’s known business
activities.
The presence of a red flag does not necessarily indicate misconduct; however, it requires
appropriate review before the transaction proceeds.13.3 Escalation Procedures
When suspicious activity is identified, employees must:
1. Suspend processing of the transaction, when appropriate.
2. Notify the Compliance Officer.
3. Document the circumstances supporting the escalation.
4. Cooperate with any additional due diligence or investigation.
Only the Compliance Officer or designated management representative may approve, decline,
suspend, or terminate a customer relationship following an escalation review.
14. Record Retention
14.1 Policy
EXPRESS PEPTIDE CO will maintain complete and accurate records demonstrating compliance
with this policy.
Records must be retained in a manner that protects confidentiality, supports regulatory and
business requirements, and allows for efficient retrieval when needed.
14.2 Records Maintained
As applicable, records may include:
• Customer identification information.
• Verification documentation.
• Customer Due Diligence records.
• Enhanced Due Diligence documentation.
• Risk assessments.
• Sanctions screening results.
• Approval and escalation decisions.
• Customer communications relevant to compliance.
• Documentation supporting declined or terminated customer relationships.14.3 Retention Period
Compliance records will be retained for a minimum of five (5) years following the end of the
customer relationship, or longer if required by applicable law, contractual obligation, or Company
policy.
Records must be protected against unauthorized access, alteration, or destruction.
15. Employee Responsibilities
All employees involved in customer onboarding, sales, customer service, finance, compliance, or
related activities are responsible for complying with this policy.
Employees must:
• Complete required KYC procedures before establishing customer relationships.
• Obtain and review required documentation.
• Escalate unusual or high-risk situations.
• Protect confidential customer information.
• Maintain accurate compliance records.
• Complete required compliance training.
• Cooperate with compliance reviews and internal audits.
Failure to comply with this policy may result in corrective action, up to and including termination of
employment or other appropriate disciplinary measures.
16. Training
EXPRESS PEPTIDE CO will provide appropriate training to employees whose responsibilities
include customer onboarding, sales, compliance, finance, or other functions subject to this policy.
Training will be designed to ensure employees understand:
• Their responsibilities under this policy.
• Customer identification and verification procedures.
• Customer Due Diligence requirements.
• Enhanced Due Diligence procedures.
• Red flags and escalation requirements.
• Recordkeeping responsibilities.
Additional training may be provided when significant regulatory changes, business
changes, or policy revisions occur.17. Compliance Reviews
The Compliance Officer will periodically review the effectiveness of the Company’s KYC and
Customer Due Diligence program.
Reviews may include evaluation of:
• Customer files.
• Documentation quality.
• Risk classifications.
• Escalation decisions.
• Record retention practices.
• Employee adherence to policy requirements.
Recommendations for improvements will be implemented as appropriate to strengthen the
Company’s compliance program.
18. Red Flags
The following circumstances require additional review before approving or continuing a customer
relationship:
Red Flag Required Action
Identity cannot be verified Suspend approval pending verification
Incomplete or inconsistent documentation Request additional information
Sanctions or restricted-party screening match Escalate immediately
Payment from unrelated third party Conduct additional review
Purchase inconsistent with stated research Perform Enhanced Due Diligence
Unusual purchasing patterns Review customer activity
Refusal to cooperate with due diligence Consider declining the relationship
False or misleading information Escalate for management review
The Compliance Officer will determine whether additional due diligence, management approval,
suspension, or termination of the customer relationship is appropriate.Appendix A
Customer Documentation Guide
Depending on the customer’s risk profile and the nature of the business relationship,
EXPRESS PEPTIDE CO may request one or more of the following:
Organizational Information
• Legal Express Peptide Co
• Business address
• Business registration
• Employer Identification Number (EIN) or equivalent
• Corporate website
• Business telephone number
Authorized Representative
• Name
• Title
• Business email address
• Business telephone number
Research Information
• Organization type
• Research activities
• Intended product use
• Laboratory or institutional affiliation
Additional Information (When Required)
• Beneficial ownership information
• Additional organizational documentation
• Payment verification
• Information supporting Enhanced Due Diligence
The Company may request additional information whenever necessary to complete its risk
assessment.Appendix B
Customer Risk Classification Matrix
Risk
Level Characteristics Required Controls
Low
Established research institution or
commercial entity with verified identity
and legitimate research activities
Standard KYC, CDD, sanctions screening
Moderate
High
Minor documentation gaps, higher-
value purchases, new customer, or
limited operating history
Elevated geographic, ownership,
payment, transaction, or reputational
risk
Additional verification and management
review as appropriate
Enhanced Due Diligence, documented
approval by Compliance Officer or designated
management representative, ongoing
monitoring
Risk classifications may be revised whenever new information becomes available or customer
circumstances materially change.Diligence (CDD) Policy