{"id":"court_sdny_207_1","court":"SDNY","case_no":"23-cr-00118","doc_number":207,"sub_number":1,"doc_type":"UNKNOWN","filed_date":"2023-12-21","title":"Independent forensic review**\\n**of Mazars LLP 21 December 2023","summary_zh":"独立法务审查报告 —— 美国诉 Ho Wan Kwok（郭文贵 / Guo Wengui / Miles Guo）案，SDNY 1:23-cr-00118 ECF #207（2023年12月21日）。Mazars LLP 对 Himalaya Exchange 进行的独立法务审查，涵盖客户onboarding程序、KYC（了解你的客户）流程、客户数据库等内容，用于审查平台的客户身份验证和风控机制。","summary_en":"Independent Forensic Review —— United States v. Ho Wan Kwok (Miles Guo / Guo Wengui), SDNY 1:23-cr-00118 ECF #207 (December 21, 2023). Independent forensic review by Mazars LLP of Himalaya Exchange covering customer onboarding procedures, KYC (know-your-customer) processes, and customer database, examining platform's identity verification and risk control mechanisms.","body_en":"**Independent forensic review**\\n**of Mazars LLP**\n\n21 December 2023\n\n![](_page_0_Picture_4.jpeg)\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n### mazars\n\nIndependent forensic review of Mazars LLP\n\n## Contents\n\n| | 1 Introduction. | |\n|------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|--|\n| | 1.1 This matter | |\n| | 1.2 Our experience | |\n| | 1.3 Our instructions | |\n| | 1.4 Access to the relevant information | |\n| | 1.5 Structure of this report | |\n| | 1.6 Scope of this report | |\n| | 2 Executive Summary.namananahinanananahanananananananananan 10 | |\n| | 2.1 Introduction | |\n| | 2.2 Our instructions | |\n| | 2.3 Summary of our work and findings | |\n| | 3 The HEX Customer Database | |\n| | 3.1 Introduction. | |\n| | 3.2 Our understanding of the information available on the HEX Customer Database
that is relevant to our instructions | |\n| | 4 Instruction 1: Our understanding of the processes and procedures in place
relating to customer onboarding at the Exchange | |\n| | 4.1 Introduction. | |\n| | 4.2 Key stages in the customer onboarding process | |\n| | 5 Instruction 2: Our review of the Relevant Customers' accounts on the HEX
Customer Database | |\n| | 5.1 Introduction. wones were as a many was was while a child and 29 | |\n| | 5.2 The HEX Customer Database Download | |\n| | 5.3 The results of our work. a see a commendo commended on management 32 | |\n| 6 Instruction 3: Our detailed review of the customer onboarding information and
the financial data in respect of a sample of the Relevant Customers 33 | | |\n| | 6.1 Introduction | |\n| | 6.2 Sample selection methodology | |\n| | 6.3 The procedures we performed in respect of the sample of the Relevant
Customers | |\n| | 7 Instruction 4: Illustrative customer onboarding | |\n| 7.1 Introduction | | |\n| 7.2 First illustrative customer onboarding test | | |\n| 7.3 Second illustrative customer onboarding test | | |\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n## mazars\n\nIndependent forensic review of Mazars LLP\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n#### Appendices\n\n| Summary of our meetings with personnel of the service company of the Exchange | Appendix 1.1 |\n|------------------------------------------------------------------------------------------------------------------------------------------|---------------|\n| Documents used in the preparation of this report | Appendix 1.2 |\n| The testing undertaken on the HEX Customer Database (Customer Account
Sample 1) | Appendix 5.1a |\n| The testing undertaken on the HEX Customer Database Download (Customer
Account Sample 2) | Appendix 5.1b |\n| Our review of the Relevant Customers' accounts on the HEX Customer Database | Appendix 5.2 |\n| The testing undertaken on the customer onboarding information and the financial
data in respect of a sample of the Relevant Customers | Appendix 6.1 |\n\n#### Exhibits\n\n| Example excerpts from the HEX Customer Database | Exhibit 3.1 |\n|--------------------------------------------------------|-------------|\n| Onboarding Process Document | Exhibit 4.1 |\n| Excerpts of the \"Risk Scoring\" tab on the HID Database | Exhibit 6.1 |\n| Extracts of bank statements of the Exchange | Exhibit 6.2 |\n| Mercantile Bank Custody Agreement | Exhibit 6.3 |\n| FV Bank Custody Agreement | Exhibit 6.4 |\n| FV Bank Business Account Application | Exhibit 6.5 |\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazaris\n\nIndependent forensic review of Mazars LLP\n\n#### 1. Introduction\n\n#### 1.7 This matter\n\n- 1.1.1 We, Mazars LLP (\"Mazars\"), have been instructed by Candey Limited (\"CANDEY\"), the legal counsel for Himalaya International Clearing Limited (the \"Exchange\" or \"HEX\"). The Exchange is a British Virgin Islands registered company that operates a user-to-user, centralised cryptocurrency exchange platform for clients to trade, store and manage the Himalaya cryptocurrencies, namely the Himalaya Coin (\"HCN\") and the Himalaya Dollar (\"HDO\") ..\n- 1.1.2 The ultimate beneficial owner of the Exchange and its affiliated companies is Mr William Je (\"Mr Je\") against whom (along with two other defendants) criminal charges have been brought by the United States Department of Justice (\"DoJ\"), in the Southern District of New York. It is alleged in those proceedings, inter alia, that Mr Je perpetrated a fraudulent scheme through the Exchange. We understand that those charges are denied by Mr Je.\n- 1.1.3 As a consequence of those charges, we understand that certain assets of the Exchange have been seized by the DoJ, in particular the Exchange's HDO stable coin4 reserve\".\n- 1.14 We are instructed that:\n\t- (a) on 6 December 2023, 3,539 customers of the Exchange filed a motion pursuant to Federal Rule of Criminal Procedure 41(g) for the return of their property seized by the United States (the \"Relevant Customers\" and the \"Customer Action\")\"; and\n\t- (b) on 7 December 2023, the DoJ made representations asking the United States District Court to deny the relief sought by the Relevant Customers in the Customer Action. We are instructed that one of the reasons for this is that the customers in the Customer Action (who are described as \"purported customers\") are not genuine, with the implication that the Customer Action is, itself, a fiction.\n\n#### 1.2 Our experience\n\n1.2.1 The Mazars Group is an international, integrated, and independent organisation specialising in audit, advisory, accounting and tax services, with a direct presence in more than 95\n\n2 Which is held in USD\n\n1 We understand that a \"stable coin\" is a type of cryptocurrency whose value is pegged to another asset class\n\n3 The original number of the Relevant Customers was 3,345 at the time the Oustomer Action was filed. I am instructed that this number has since increased to 3,539\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\ncountries and territories drawing on the expertise of over 47,000 professionals. In the UK, Mazars has approximately 150 Partners and more than 2,500 employees.\n\n1.2.2 This report has been prepared by the Crisis & Disputes team in London. We are routinely instructed in the context of allegations of fraud, accounting irregularities, money laundering and misrepresentation, regulatory investigations and cash and asset tracing assignments. We have acted on behalf of regulators and prosecuting agencies (both in the UK and overseas) as well as on behalf of defendants. Our recent cases include instructions by the Financial Conduct Authority, relating to (i) its investigation into the collapse of a major authorised collective investment fund; and (ii) its decision to discontinue the shares of a UK publicly listed company.\n\n#### 1.3 Our instructions\n\n- 1.3.1 We have been provided with a schedule setting out information in respect of the each of the Relevant Customers (the \"Customer Action Schedule\")4. We understand that the Relevant Customers created their accounts on the Exchange between 23 April 2021 and 22 August 2023 (the \"Relevant Period\").\n- 1.3.2 Using the Customer Action Schedule, we have been instructed to undertake the following:\n\t- (a) conduct a live and independent review of the customer database (the \"HEX Customer Database\") in order to confirm and document the processes and procedures in place relating to customer onboarding at the Exchange (\"Instruction 1\");\n\t- (b) verify that each of the Relevant Customers included in the Customer Action Schedule has an Exchange account on the HEX Customer Database (\"Instruction 2\");\n\t- (c) identify and isolate a sample of the Relevant Customers from the Customer Action Schedule in order to:\n\t\t- (i) verify the existence of \"know your client\" (\"KYC\") onboarding information;\n\t\t- (ii) verify the financial data contained in the Customer Action Schedule against the live data on the HEX Customer Database for this sample; and\n\n4 Which we understand was provided to the legal representative of the Relevant Customers by the Exchange on 10 November 2023\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n- (iii) verify the redemptions made by the Relevant Customers (described as \"redemptions balance\" in the Customer Action Schedule) to the bank statements of the Exchange for this sample (\"Instruction 3\"); and\n- (d) carry out an illustrative onboarding application of choice, including but not limited to the United States (\"US\") (\"Instruction 4\").\n\n#### 1.4 Access to the relevant information.\n\n- 1.4.1 Other than the write-up of our findings in this report, we carried out the majority of our work at the premises of the service company of the Exchange®, which we visited on 14 and 15 December 20236. Our instructing solicitors from CANDEY were also present at the same time. We set out a summary of our meetings with the Exchange and CANDEY in Appendix 1.1.\n- 1.4.2 The Customer Action Schedule does not contain the names of the Relevant Customers. Rather, customers are identified by unique Himalaya account numbers (\"HIDs\"). We are instructed that both the customer information that we have reviewed and the underlying KYC documents against which we have verified them are confidential and subject to data protection considerations. Therefore, whilst we reviewed unredacted information on the HEX Customer Database, we are instructed that it must be presented in redacted form for the purposes of this report.\n\n#### 15 Structure of this report\n\n- 1.5.1 The remainder of this report is structured as follows:\n\t- (a) in Section 2, we set out an Executive Summary of our work and findings;\n\t- (b) in Section 3, we set out an overview of our understanding of the information available on the HEX Customer Database;\n\t- (c) in Section 4, we address Instruction 1 by setting out our understanding of the processes and procedures in place relating to customer onboarding at the Exchange;\n\n4 Hamilton Capital Holding. We have been instructed not to disclose the address of the service company of the purposes of this report or until a protective order is in place by the Court\n\nPouring the course of our work, we undertools rish price of the service company of the Exchange's IT, Legal and Compliance teams. We are instructed to not disclose the names of these individuals for the purpose of this report for data protection and safeguarding the identity of staff\n\n### mazars\n\nIndependent forensic review of Mazars LLP\n\n- (d) in Section 5, we address Instruction 2 by describing the work we have undertaken to identify whether an account exists on the HEX Customer Database for each of the Relevant Customers;\n- (e) in Section 6, we address Instruction 3 by describing the work we have undertaken to confirm the customer onboarding information and the financial data held by the Exchange in respect of a sample of the Relevant Customers; and\n- in Section 7, we address Instruction 4 by describing the illustrative customer (f) onboarding application we have undertaken.\n\n#### 1.6 Scope of this report\n\n- 1.6.1 We set out at Appendix 1.2 a list of the information and documents that we have used in the preparation of this report.\n- 1.6.2 It should be noted that the work we have completed does not constitute an audit and, other than as expressly set out in this report, we have not verified or in any other way checked the information set out in the documents we have reviewed. This is our standard approach in matters of this nature, unless expressly instructed to give an opinion on the authenticity of underlying documents.\n- 1.6.3 We have prepared this report in connection with the Customer Action filed in the US District Court. It is confidential in all respects other than to be made available to CANDEY, the Exchange, the legal representative of the Relevant Customers, the DoJ and the United States District Court. This report should not be used, reproduced or circulated for any other purpose without our prior written consent. \"Mazars accepts no responsibility to third parties in relation to the matters in this report and / or for any breaches of this obligation.\n- 1.6.4 This report reflects our understanding of matters of law but expresses no opinion on them as they are not for us to determine.\n- 1.6.1 We have not been instructed to prepare this report in accordance with the English Civil Procedure Rules (and in particular Part 35), the U.S. Federal Rules of Civil Procedure and the U.S. Federal Rules of Criminal Procedure, which would apply to expert reports adduced in proceedings in England and Wales and the United States respectively. Nevertheless, we have adopted protocols applicable to an expert preparing a report for such purposes. In this regard:\n\n### mazars\n\nIndependent forensic review of Mazars LLP\n\n- (a) the opinions set out in this report reflect our independent opinions based on the evidence provided to us;\n- (b) we have exercised reasonable care and skill in order to be accurate and complete in preparing this report; and\n- (c) we confirm that we have not entered into any arrangement where the amount or payment of our fees is in any way dependent on the outcome of the case.\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n### mazars\n\nIndependent forensic review of Mazars LLP\n\n#### re Executive Summary\n\n#### 2-1 Introduction\n\n- 2.1.1 We, Mazars, have been instructed by CANDEY, the legal counsel for the Exchange. The ultimate beneficial owner of the Exchange and its affiliated companies is Mr Je against whom (along with two other defendants) criminal charges have been brought by the DoJ in the Southern District of New York. It is alleged in those proceedings, inter alia, that Mr Je perpetrated a fraudulent scheme through the Exchange. We understand that those charges are denied by Mr Je.\n- 2.1.2 As a consequence of those charges, we understand that certain assets of the Exchange have been seized by the DoJ, including the Exchange's stable coin reserves.\n\n#### 213 We are instructed that:\n\n- (a) on 6 December 2023, the Relevant Customers filed the Customer Action (a motion pursuant to Federal Rule of Criminal Procedure 41(g) for the return of their property seized by the United States; and\n- (b) on 7 December 2023, the DoJ made representations asking the United States District Court to deny the relief sought by the Relevant Customers in the Customer Action. We are instructed that the basis of this is, inter alia, that the customers in the Customer Action are not genuine, with the implication that the Customer Action is, itself, a fiction.\n\n#### 2.2 Our instructions\n\n- 2.2.1 Using the Customer Action Schedule, we have been instructed to undertake the following:\n\t- (a) conduct a live and independent review of the HEX Customer Database in order to confirm and document the processes and procedures in place relating to customer onboarding at the Exchange (\"Instruction 1\");\n\t- (b) verify that each of the Relevant Customers included in the Customer Action Schedule has an Exchange account on the HEX Customer Database (\"Instruction 2\");\n\t- (c) identify and isolate a sample of the Relevant Customers from the Customer Action Schedule in order to:\n\t\t- (i) verify the existence of KYC onboarding information;\n\n### mazars\n\nIndependent forensic review of Mazars LLP\n\n- (ii) verify the financial data contained in the Customer Action Schedule against the live data on the HEX Customer Database for this sample; and\n- (iii) verify the redemptions made by the Relevant Customers (described as \"redemptions balance\" in the Customer Action Schedule) to the bank statements of the Exchange for this sample (\"Instruction 3\"); and\n- (d) carry out an illustrative onboarding application of choice, including but not limited to the US (\"Instruction 4\").\n\n#### 2.3 Summary of our work and findings\n\n- 2.3.1 Other than the write up of our findings in this report, we carried out the majority of our work at the premises of the service company of the Exchange, which we visited on 14 and 15 December 2023. Our instructing solicitors from CANDEY were also present at the same time. During this time, we conducted a live review of the HEX Customer Database, which was undertaken by personnel of the service company of the Exchange who have the relevant system access at our and CANDEY's direction.\n- 2.3.2 A summary of our work and findings is set out below;\n\nInstruction 1: Our understanding of the processes and procedures in place relating to customer onboarding at the Exchange\n\n- 2.3.3 We understand that customer onboarding at the Exchange comprises four key stages:\n\t- (a) \"Stage 1\": Customer registration, whereby the customer provides personal details including name, date of birth, citizenship and country of residence. We understand that it is the Exchange's policy that individuals resident in certain countries are not permitted to open accounts on the Exchange. These \"Restricted Countries\" include the United States ;\n\t- (b) \"Stage 2\": Customer identification, verification and screening, which requires the customer to:\n\t\t- (i) provide and verify their email address and phone number;\n\n&quot; In this regard, we are instructed (i) that the list of Restricled Countries is reviewed on a regular basis to ensure the Exchange is compliant with global regulatory requirements; and (ii) that the US has been included in the list of Restricted Countries since the inception of the Exchange\n\n- (ii) complete a \"KYC Questionnaire\", which consists of numerous® multiple-choice questions relating to, inter alia, the customer's personal details, the source of their funds and their level of experience with cryptocurrency trading; and\n- (iii) submit an identification document and complete certain identity verification checks. In this regard, the Exchange outsources the collection and verification of customer ID documents to a third party, Jumio Corporation (\"Jumio\"). Jurnio services include (i) verifying that the ID document is \"authentic and valid\"; and (ii) verifying the customer's identity by comparing the ID Document provided with a live photo taken by the customer, using artificial intelligence powered facial recognition.\n\nIn addition to this, the Exchange undertakes screening of prospective customers, to identify any individuals that are Politically Exposed Persons, subject to sanctions or subject to adverse media. We understand that the Exchange utilises a third party software provider, \"ComplyAdvantage\" to undertake this screening process;\n\n- (c) \"Stage 3\": Customer risk assessment, where the Exchange will assess the information provided and assign a \"Risk Rating\" to each customer which reflects the Exchange's assessment of the risk associated with onboarding that customer and is derived from. the responses provided by the customer in the KYC Questionnaire; and\n- (d) \"Stage 4\": Customer acceptance approval or escalation, where the involvement of the Exchange's compliance team in the onboarding process for each customer is triggered by the Risk Rating assigned to that customer.\n\n#### Instruction 2: Our review of the Relevant Customers' accounts on the HEX Customer Database\n\n- 2.3.4 We are instructed to verify that each of the Relevant Customers has an Exchange account on the HEX Customer Database. Based on our review of the information contained in the HEX Customer Database, we identified that:\n\t- (a) for each of the Relevant Customers, an account exists in the HEX Customer Database;\n\t- (b) the Relevant Customers:\n\t\t- (i) comprise 3,521 personal accounts and 18 corporate accounts; and\n\nB Between 8 and 16 questions\n\n9 Which is an \"Al-driven identity verification platform\". http\n\n### mazars\n\nIndependent forensic review of Mazars LLP\n\n- (ii) are all \"Tier 1\" customers10; and\n- (c) all of the Relevant Customers' accounts were created between 23 April 2021 and 22 August 2023.\n\nInstruction 3: Our detailed review of the customer onboarding information and the financial data in respect of a sample of the Relevant Customers\n\n- 2.3.5 We are instructed to identify a sample of our choosing of the Relevant Customers from the Customer Action Schedule and, for that sample, to (i) verify the existence of KYC onboarding information; (ii) verify the financial data contained in the Customer Action Schedule against the live data on the HEX Customer Database; and (iii) verify the redemptions made by the Relevant Customers (according to the Customer Action Schedule) to the bank statements of the Exchange.\n- 2.3.6 For each HID that forms part of our sample, we identified:\n\t- (a) in respect of the KYC information obtained by the Exchange:\n\t\t- (i) an account exists in the HEX Customer Database;\n\t\t- (ii) the Exchange holds copies of an ID document, which have been verified by Jumio as being \"authentic\"; and\n\t\t- (iii) a facial recognition test was undertaken by Jumio, the purpose of which is, as noted in paragraph 4.2.11 below, to confirm that the person holding the ID is (i) the same person shown in the ID photo; and (ii) physically present during the onboarding process; and\n\t- (b) in respect of the financial information in respect of these customers:\n\t\t- (i) the HCN balance and HDO balance in the HEX Customer Database agreed to the amounts noted in the Customer Action Schedule 12;\n\n10 Which, based on our understanding of the Exchange's policy reflects customers who have been onboarded as customers of the Exchange, meaning (i) the customer has created an account with the Exchange; (ii) the customer has verfied their contact detalls; (ii) the Exchange has verified their in accordance with its client acceptance procedures; and (iv) the customer has either been auto-approved based on the information they provided or, following escalation to compliance personnel, has been manually approved\n\n11 Via Jumio\n\n12 As at the date the Customer Action Schedule was complied. As explained further in Section 6 below, our work in agreeing the financial data in the Customer Action Schedule was to a \"live\" database. Given there was ongoing trading activity of HCN and HDO balances between the date of the Customer Action (which we are instructed was 10 November 2023) and the date of our work (which was 15 December 2023), for certain customer accounts, there were reconciling items. This is explained futher in Section 6 below\n\n## mazars\n\nIndependent forensic review of Mazars LLP\n\n- (ii) the total deposits and total redemptions in the HEX Customer Database agreed to the amounts noted in the Customer Action Schedule; and\n- (iii) the total redemptions in the HEX Customer Database (and the Customer Action Schedule) agreed to the Exchange's bank statements that were provided to us.\n\n#### Instruction 4: Illustrative customer onboarding\n\n- 2.3.7 We are instructed to carry out an illustrative onboarding application to any jurisdiction of choice, including but not limited to the United States. Our findings in relation to the two illustrative customer registrations and onboardings we undertook is in line with our understanding of the Exchange's customer registration policy. In particular:\n\t- (a) one illustrative customer onboarding test would not permit the creation of an account on the Exchange or progression to the next stage of the onboarding process due to the customer's citizenship and / or country of residence being the United States; and\n\t- (b) one illustrative customer onboarding test permitted the creation of an account on the Exchange, but did not permit progression to the next stage of the onboarding process due to the name on the customer registration forms not matching the identification document provided.\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n#### The HEX Customer Database S\n\n#### 3.1 Introduction\n\n- The HEX Customer Database is the \"back-end\" 13 collection of data in respect of customers of 3.1.1 the Exchange. It contains records of, inter alia:\n\t- (a) the virtual assets held by each customer;\n\t- (b) the deposits, redemptions and trading activity of each customer; and\n\t- (c) the customer's personal information, including records of KYC procedures undertaken in respect of each customer.\n- 3.1.2 As noted in Section 1.4 above, in order to address our instructions, we visited the premises of the service company of the Exchange on 14 and 15 December 2023, along with representatives from CANDEY. During this time, we conducted a live review of the HEX Customer Database in order to provide the necessary context for us to address our instructions. This was undertaken by personnel of the service company of the Exchange who have the relevant system access, at our and CANDEY's direction. The information set out in this Section is based on that live review.\n- 3.1.3 In this Section, we set out an overview of our understanding of the information available on the HEX Customer Database14.\n\n### 3.2 Our understanding of the information available on the HEX Customer Database that is relevant to our instructions\n\n#### The HEX Customer Database Dashboard\n\n3.2.1 We set out in Figure 3.1 below an excerpt of the \"Dashboard\" of the HEX Customer Database (the \"HEX Customer Database Dashboard\") 5. We understand that this is often referred to by the personnel of the service company of the Exchange as the \"admin panel\".\n\n10 Meaning the information that is not directly accessible by the customer, but rather specific individuals within the Exchange who have been granted access to this information\n\n14 Importantly, we have not been instructed (and therefore have not sought) to consider the integrity or operational effectiveness of the HEX Customer Database. Any reference to how the HEX Customer Database operates is therefore based on the information we observed during the course of our work\n\n15 All excerpts from the HEX Customer Database are provided in Exhibit 3.1\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nFigure 3.1: The HEX Customer Database Dashboard16\n\n**Dashboard**\n\nAll this is your exchange admin panel where you can view detailed things like the activity on your exchange, user balances, ongoing transactions and so on. Additionally, you will be able to modify limited features of your exchange from here such as the text contents. The quick links and more below is a brief explanation of what each link can give you.\n\n| Users | This will allow you to see the number of users on your exchange and their details from viewing an email address to enabling/disabling a user. You will also be able to see what cryptocurrency each user is holding and the quantity. |\n|---------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Transactions | The transactions feeder enables you to see all the ongoing and completed/failed transactions. Transactions and failed transactions can be viewed here, as well as their progress and withdrawal. |\n| Markets | This section provides an overview of the ongoing pairs on your exchange and the full order book for them. |\n| Coins | This allows you to see the different cryptocurrencies available on your exchange and their status - viewing of processing for trading, deposit and withdrawal. Coins - Deposit Addresses and Coins - Withdrawal Addresses show you the addresses used for each cryptocurrency and their status. |\n| Settings | Settings will allow you to view your users, as well as edit your domain names to access them. Also, by clicking with mouse down, Additionally, you will be able to set up email templates, time, social logins and other general actions. |\n| Utilities | Utilities - Promotions Management will allow you to modify text on the front end of your exchange. The 'KEY' field will show you a default which is what shows unless you are motivated. Add your own rows, click 'Save' with the call button (shown below). From here, an HTML overview will |\n| Admins | This section will allow you to manage who has access to the admin panel and at what level of control. All settings to do with admin people can only be modified here. |\n\n- 3.2.2 As shown in Figure 3.1, there are a number of functionalities in the HEX Customer Database Dashboard (including the ability to view, inter alia, \"Transactions\", \"Markets\" and \"Coins\"). Of particular relevance to our instructions is the functionality \"Users\" which, as described on the HEX Customer Database Dashboard, \"will allow you to see the number of users on your exchange and their details from username, to email address to exploit attempts. User - > Balances will allow you to see what cryptocurrency each user is holding and the quantity\"17.\n- 3.2.3 We refer to this as the \"User Page\".\n\n#### The User Page\n\n3.2.4 We set out in Figure 3.2 below an excerpt of the User Page.\n\nFigure 3.2: The User Page 18\n\nUsers< Users\n\n|

Filter Users by

Email -

Modified Date -

|
User NameRegistered DateStatusRoleTeamLocation

Registered Date is between and

Modified Date is between and

| User Name | Registered Date | Status | Role | Team | Location | | | | | | |

Registered Date is between and

Modified Date is between and

| | | | | |\n|-----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|-----------------|---------------|---------------|------|----------|---------------|---------------|---------------|---------------|---------------|---------------|-----------------------------------------------------------------------------------------------------------------------------------|--|--|--|--|--|\n| User Name | Registered Date | Status | Role | Team | Location | | | | | | | | | | | | | | |\n| | | | | | | | | | | | | | | | | | | | |\n|

Registered Date is between and

Modified Date is between and

| | | | | | | | | | | | | | | | | | | |\n| |
[ ]
| | | | | | | | | | | | | | | | | | |\n\n- 3.2.5 From Figure 3.2 above it can be seen that the User Page provides a number of criteria by which one can search the HEX Customer Database (including, inter alla, the HID, name of the customer, date of creation of the account).\n- 3.2.6 We set out in Figure 3.3 below an example of the type of information available on the User Page for each HID.\n\n16 Exhibit 3.1\n\n17 Exhibit 3.1\n\n18 Exhibit 3.1\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nFigure 3.3: Example of the type of information available on the User Page for each HID19\n\n| person - library
Users | | |\n|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------|\n| 400 - 1 11 (lafev )
- BYTAlian =
Vergist in
( 19 8 8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 | -- RAAm
I have with 2014 1/2 . Boal it . Boad it . Chery and it
· Paul Bropade . L' Fine . Lang La
> lession == [0] [ + ] ( + ] ( ) [ ( ) [ ] ( ) = ) = ( = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = | 100
100 |\n| Colledil L = 0 (B) | Controllin for the religion was in | 1 |\n| | THE PETER PATERIAL PRODUCTS AND THE POLICE PE PERSELLE PROPERTY PROPERTY PRO PASSE PROFESSION PROPERTIERS, PASSE PL | |\n| 10 gr | いつけていたとことです。というときになるときになると | |\n\n- 3.2.7 As demonstrated in Figure 3.3 above, when a HID is input into the User Page, it provides a summary overview of the customer. In particular, it sets out:\n\t- (a) the \"Type\" of account related to that HID. We understand that an account can be either:\n\t\t- (i) \"personal\", meaning the customer is an individual, and using the account for personal purposes; or\n\t\t- (ii) \"corporate\", meaning the account is being used on behalf of a corporate entity.\n\nWe understand that the key difference between these types of accounts, for the purposes of our instructions, is the onboarding procedures that the Exchange undertakes in respect of these customers;\n\n- (b) the name of the customer;\n- (c) the date the account was created (as indicated in the column \"Created\"). We understand that the Exchange website began accepting customers from April 2021;\n- (d) information as to the status of the account, for example if it is \"Enabled\", \"Approved\", \"Locked\" or \"Deleted\":\n- (e) high-level information as to the activity of the account, for example if the customer has deposited funds, traded HCN or HDO or withdrawn funds (as indicated in the columns \"Deposit\", \"Trade\" and \"Withdraw\" respectively);\n- (f) the communication preferences of the customer (for example if they have agreed to be communicated with \"Online\", via \"Newsletter\" or via \"SMS\");\n\n19 Exhibit 3.1\n\n- (g) the permissions on the account in respect of the Exchange's payment application \"Hpay\"20; and\n- (h) the results of the client acceptance procedures undertaken by the Exchange, including:\n\t- (i) the \"Risk Rating\" of the customer; We understand that the Risk Rating reflects the Exchange's assessment of the risk associated with onboarding that customer and is classified as \"low\", \"medium\", \"high\" or \"ultra-high\". The Risk Rating is derived from a \"Risk Score\", which is computed based on the customer's responses to a questionnaire (the \"KYC Questionnaire\"2). We provide a more detailed explanation of the Exchange's risk assessment process in Section 4 below; and\n\t- (ii) the \"Tier\" of the customer: We understand that there are three different \"Tiers\" of customer classification22, which reflect the status of the client acceptance procedures. These include:\n\t\t- · customers who are not yet allocated to a Tier. These are customers who have signed up to create an account with the Exchange, but have not yet verified their contact details;\n\t\t- · Tier 0 customers: These are customers who have signed up to create an account with the Exchange and have verified their contact details (including an email address and a phone number), but client acceptance procedures have not yet been completed. These are not \"active\" accounts 2 at this stage; and\n\t\t- Tier 1 customers: These are customers who have been onboarded as customers of the Exchange, meaning (i) the customer has created an account with the Exchange; (ii) the customer has verified their contact details; (iii) the Exchange has verified their identity in accordance with its client acceptance procedures (further details of which are set out in Section 4 below); and (iv) the customer has either been auto-approved\n\n20 i am instructed that Hpay allows customers to, inter alia: (i) undertake peer to peer transfers to other Exchange customers; and (ii) purchase HDO/HCN gift cards for merchants that have been approved by the Exchange\n\n21 Further delails of the KYC Questionnaire is provided at paragraph 4.2.8 et seq. below\n\n22 We understand the Exchange is considering implementing an additional Tier, \"Tier 2\", in the future\n\n23 Meaning customers cannot deposit or redeem funds or trade HCN or HDO\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nbased on the information they provided or, following escalation to compliance personnel, has been manually approved.\n\nWe understand that the Relevant Customers comprise only Tier 1 customers.\n\n#### The HID Dashboard\n\n- 3.2.8 Further information in respect of the customer can be found by clicking on the HID in the column \"User Name / HID\", which produces a dashboard for each customer (the \"HID Dashboard\").\n- 3.2.9 The HID Dashboard contains a number of tabs which categorise the information available in respect of each customer. Of particular relevance to our instructions are the following tabs:\n\t- (a) \"Profile\": This includes further information in respect of the customer including, inter alia, their name, date of birth, contact details, citizenship, country of residence, ID document number;\n\t- (b) \"Deposits\": This sets out details of deposits made by the customer including, inter alia, (i) the date and time of the deposit; (ii) the amount of the deposit; (iii) the individuals at the Exchange who authorised the deposite4; and (iv) any fees payable to the Exchange in respect of the deposit;\n\t- (c) \"Withdrawals\": This sets out details of withdrawals25 made by the customer including, inter alia, (i) the date and time of the withdrawal requested by the customer; (ii) the amount of the withdrawal; and (iii) any fees payable to the Exchange in respect of the withdrawal; and\n\t- (d) = \"Risk Scoring\": This sets out the Risk Score of the customer (as explained in paragraph 3.2.7(h) above), the customer's completed KYC Questionnaire and comments from the Exchange's compliance team relating to client acceptance decisions in respect of the customer\n- 3.2.10 We set out in Figure 3.4 to Figure 3.7 below an excerpt of each of these four tabs for an example HID26.\n\n24 We understand that every deposit made to the Exchange is subject to a two-step authorisation process, where the deposit is required to be authorised by two individuals in order for the funds to be accepted\n\n25 &quot;Withdrawals\" is synonymous with redemptions\n\n20 As noted in Section 1.4 above, we are instructed that the customer information that we have reviewed is confidential. Therefore, whilst we reviewed unredacted information on the HEX Customer Database, we are instructed that it must be redacted for the purposes of the report. The information in Figure 3.7 is therefore redacted\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nFigure 3.4: Example of the information contained on the \"Profile\" tab of the HID Dashboard27\n\n| User Detals | |\n|--------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| | |\n| 0
DATE CHEATED | SNABLES
trad
1904 |\n| Origin, at made | APPLOVED
Thur
Cashi 415 1 |\n| uses Tree. | COLLED
8600 |\n| DIEST MILEE JUMP | ADCRED OUT False
0 |\n| | STOR DEPOSITS False
1944 14 |\n| LAST fromte | STOP TRADING Falle
**** |\n| PLAS ALAND | STOP
False
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |\n| BATV CHATE | INTHORNIANS
FORCED TO |\n| 1-4522 | Talle

CHANCE PASS |\n| ADDRISS USEMANE | I ERCTOR
We
AUTHERTICATION |\n| MOGLE PHONE | ON INC False |\n| ADDRESS LINE I | ABLE ED ACCESS |\n| ALIDIT):5 LPM 2 | Faller
1 + Gar
ARKEYS |\n| ALSIDENCE COUNTER | |\n| 5 | |\n| | |\n| STATE | |\n| POST CODE | |\n| CITIESSHIP COUNTSY | |\n| ID DUCUMENT NAMBER | |\n| CONSULT I | |\n| LAST CORMENT SY | |\n\nFigure 3.5: Example of the information contained on the \"Deposits\" tab of the HID Dashboard28\n\n![](_page_19_Figure_7.jpeg)\n\nFigure 3.6: Example of the information contained on the \"Withdrawals\" tab of the HID\nDashboard29.30\n\n| * 44 for say 2011 [2] 2010 [2019/10/2019 12:11:13:10 [1] [1] 17/11/2017 [1] 14:14/2017 11/10/20 10/10/2019 10/11/2017 10/11/2017 10/1
read of proget, comersed on the possible production possible production products to farea | | |\n|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------|-------|\n| -----------------------------
and and and the commend of the commend of the comments of the comments of
Tigently of the comments of the commender
Such ( mond Binband
Call Status in In In
Entina Digis From The Station Comments of Childred Califord Camera Camera Comments of Children
1 Welcome and | Carder (R). | 166 |\n| Silepris sug It's I at (C | 14 | |\n| Tap
12 Aller Park
Case of the Market of the Research
ANGALAR BHASH LAND STATIST LAND | Charle Sunnel M | Added |\n\n27 Exhibit 3.1\n\n28 Exhibit 3.1\n\n29 The customer selected for this example had not made any withdrawals at the date we completed our work\n\n30 Exhibit 3.1\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nFigure 3.7: Example of the information contained on the \"Risk Scoring\" tab of the HID Dashboard31\n\nFile Menu Info View Reports Admin Settings & Translation Analysis Application Page Risk Scoring Policy Score Management\n\n| EXTERNAL ID | |\n|---------------------------|--|\n| MANUAL RISK SCORE | |\n| TOTAL RISK SCORE | |\n| RISK LEVEL | |\n| COMPLY ADVANTAGE | |\n| MTS | |\n| COMPLY ADVANTAGE | |\n| LNR | |\n| VERIFICATION | |\n| APPLICATION STATUS | |\n| CATEGORY | |\n| NUMBER OF ATTEMPT TO FUND | |\n\nRisk Score Update History\n\n| DATE & TIME | FULL NAME | ROLE | RISK SCORE | RISK LEVEL |\n|-------------|-----------|------|------------|------------|\n|-------------|-----------|------|------------|------------|\n\n31 Exhibit 3.1\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n# 4 Instruction 1: Our understanding of the processes and procedures in place relating to customer onboarding at the Exchange\n\n#### 4.1 Introduction\n\n- 4.1.1 In addition to conducting a review of the HEX Customer Database, we sought to confirm the processes in place at the Exchange in respect of customer onboarding by reference to the Exchange's written documents that relate to the Relevant Period. In this regard, we have been provided with a presentation titled \"Demonstration of the Client Onboarding and Compliance Process\", dated June 2022 (the \"Onboarding Process Document\")22, 33.\n- 4.1.2 Based on the Onboarding Process Document34, we understand that customer onboarding at the Exchange comprises four key stages:\n\t- (a) \"Stage 1\": Customer registration;\n\t- (b) \"Stage 2\": Customer identification, verification and screening;\n\t- (c) \"Stage 3\": Customer risk assessment; and\n\t- (d) \"Stage 4\": Customer acceptance approval or escalation.\n\nWe set out further details of each these key stages in Section 4.2.\n\n#### 4.2 Key stages in the customer onboarding process\n\n#### Stage 1: Customer registration\n\n4.2.1 In order to register with the Exchange, a new customer must first access the Exchange's website 35 and select the \"Register\" tab. We set out in Figure 4.1 below an excerpt of information that a customer has to provide as part of this registration process (the \"Key Registration Information\"):\n\n32 Exhibit 4.1\n\n33 We are instructed that the Exchange's compliance policies are formally documented in a \"Compliance Manual\". This has not been provided to us for the purposes of this report due to the scope of our instructions\n\n34 We are instructed that the Onboarding Process Document was prepared for the purpose of regulatory licence application and is based on the \"Compliance Manual\" and the Exchange's policies and procedures that were in place during the Relevant Period 35 At http\n\nmazars\n\nIndependent forensic review of Mazars LLP\n\n| HIMALAYA EXCHANGE | | | | | Support | Login | Register | 中文 |\n|-------------------|--|--|--|--|---------|-------|----------|----|\n|-------------------|--|--|--|--|---------|-------|----------|----|\n\nCreate your account\n\n• Individual• Corporate\n\n| Legal first & middle name | Legal last name |\n|---------------------------|-----------------|\n|---------------------------|-----------------|\n\n| Date of Birth | DD/MM/YYYY |\n|---------------|------------|\n|---------------|------------|\n\n| Citizenship | Select v |\n|-------------|-----------------|\n|-------------|-----------------|\n\n| Country of Residence | Select v |\n|----------------------|-----------------|\n|----------------------|-----------------|\n\n| Address | |\n|---------|--|\n|---------|--|\n\n| City | Postcode |\n|------|----------|\n|------|----------|\n\nFigure 4.1: Customer registration page on the Exchange's website36\n\n- 4.2.2 Importantly, the questions relating to citizenship and country of residence are multiple choice (and completed by the customer by reference to a dropdown list). We understand that a customer's country of residence is of particular relevance to customer acceptance decisions made by the Exchange and the Exchange's policy is not to accept customers resident in certain countries (including, for example, the United States) (the \"Restricted Countries\")37. The Restricted Countries are not included within this dropdown list, meaning that individuals whose country of residence is a Restricted Country will not be able to register for an account with the Exchange.\n- 4.2.3 Once the customer has provided their Key Registration Information, they are requested to provide answers to three personal questions on the Exchange's secure online portal. The purpose of these security questions is to \"add an extra layer of customer protection to the authentication process\"38.\n\n36 As demonstrated in Figure 4.1, there are separate registration pages for \"Individuals\" (which are also referred to as \"personal\" accounts) and \"Corporates\". Based on our work on this matter, we understand that over 99% of the Relevant Customers are individuals and we have therefore not considered the customer onboarding process in respect of corporates\n\n37 In this regard, we are instructed (i) that the list of Restricted Countries is reviewed on a regular basis to ensure the Exchange is compliant with global regulatory requirements; and (ii) that the US has been included in the list of Restricted Countries since the inception of the Exchange 38 Exhibit 4.1, slide 3\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n## Stage 2: Customer identification, verification and screening\n\n- 4.2.4 The second key stage in the customer onboarding process is described in the Exchange's Onboarding Process Document as \"Identification, Verification and Screening\". It requires the customer to:\n\t- (a) provide and verify their email address and phone number;\n\t- (b) complete the KYC Questionnaire, which consists of numerous multiple-choice questions relating to, inter alia, the customer's personal details, the source of their funds and their level of experience with cryptocurrency trading; and\n\t- (c) submit an identification document (\"ID Document\") and complete certain identity verification checks.\n- 4.2.5 We provide further details on each of these requirements in turn below.\n\n#### Obtaining and verifying the customer's email address and phone number\n\n- 4.2.6 In order to progress the client onboarding process, the customer is required to provide and verify their email address and phone number, via the Exchange's secure online portal. The verification in respect of:\n\t- (a) their email address is completed once the customer activates a verification link that is sent to their email address; and\n\t- (b) their phone number is completed once the customer enters a 6-digit verification code that is sent to them by text message.\n- 4.2.7 In addition, the customer is required to provide confirmation that they are not a resident of the US, Japan, citizen or resident of Canada or any other jurisdiction where the laws of such jurisdiction prohibits the holding or use of cryptocurrencies\n\n#### The KYC Questionnaire\n\n4.2.8 We set out in Figure 4.2 below an example of the questions included in the KYC Questionnaire:\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nFigure 4.2: KYC Questionnaire39\n\n| Place of birth |\n|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Citizenship on the document |\n| Please tell us about your current employment status. |\n| Please tell us about your occupation or business activity. |\n| Please tell us about business you may conduct in other country(s) besides where you are registered for tax purposes? |\n| Is your individual activity or business registered or conducted in preferential tax zone (for instance, free economic zone, offshore jurisdiction)? |\n| Please tell us about your annual turnover, in individual or business activity, which is handled in cash. |\n| Please tell us about your annual turnover, in individual or business activity, which is handled in cryptocurrency. |\n| Please tell us about your source(s) of income funds. Select more than one box if necessary. |\n| Please tell us about your source(s) of wealth? Select more than one box if necessary. |\n| Please select the service(s) you plan to use. Select more than one box if necessary. |\n| How much do you plan to deposit per year (USD and crypto combined)? |\n| Please tell us which countries the funds will be received and/or transferred from. |\n| Let us know what your level of experience is with cryptocurrency trading? Please select one: |\n| How many years of experience do you have in crypto trading? |\n| Are you, an immediate family member or a close associate, entrusted, or have been entrusted, with prominent public functions in any country or international institution? This could be a public office, a government role, a regulatory role or a senior military position, at home or overseas. |\n\n4.2.9 In order to complete the KYC Questionnaire, the customer must answer all questions. Based on the customer's responses to the KYC Questionnaire, the Exchange computes the Risk Score for each customer, which is described in further detail in paragraph 4.2.13 et seq. below.\n\n#### Obtaining documentation evidencing customer identification\n\n- 4.2.10 We understand that the Exchange outsources the collection and verification of customer ID Documents to Jumio. Jumio is an \"Al-driven identity verification platform\"40 that \"uses artificial intelligence, machine learning and biometrics to automate the verification process and help companies improve conversion rates, comply with AML and KYC regulations and better detect fraud - all while delivering a definitive yes/no decision in seconds\"41.\n- 4.2.11 We understand that the ID Document that would be accepted as evidence of customer identification includes a passport, driving licence or identity card. Jumio then verifies 42:\n\t- (a) that the ID document is \"authentic and valid\"; and\n\t- (b) the customer's identity by comparing the ID Document provided with a live photo taken by the customer, using artificial intelligence (\"Al\") powered facial recognition. This includes confirming the \"person holding the ID [is] the same person shown in the ID photo\" and that \"the person holding the ID [is] physically present during the transaction\".\n- 4.2.12 In addition, the Exchange also undertake screening of prospective customers on behalf of the Exchange, to identify any individuals that are Politically Exposed Persons (\"PEP\"), subject to\n\n39 This is an example of the KYC Questionnaire. We understand that during the Relevant Period, the questions (and number of questions) on the questionnaire changed (for example, during this time the number of question ranged from 8 to 16)\n\n40 http\n\n41 http\n\n42 Exhibit 4.1, slide 5\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nsanctions or subject to adverse media. We understand that the Exchange utilises a third party software provider, \"ComplyAdvantage\" to undertake this screening process.\n\n#### Stage 3: Customer risk assessment\n\n4.2.13 On completion of Stages 1 and 2, the Exchange will assess the information provided and assign a Risk Rating to each customer which, as explained in Section 3.2 above, reflects the Exchange's assessment of the risk associated with onboarding that customer and is derived from the customer's Risk Score.\n\n#### Risk Score\n\n- 4.2.14 The Risk Score is a number between 0 and 99 that reflects the Exchange's perceived risk of accepting a customer. The higher the Risk Score, the higher the perceived risk to the Exchange of onboarding that customer.\n- 4.2.15 Each response provided by the customer in the KYC Questionnaire is assigned a Risk Score based on a risk model formulated by the Exchange. We set out an overview of the considerations involved in the Exchange's risk model in Figure 4.3 below.\n\n![](_page_25_Figure_10.jpeg)\n\nFigure 4.3: Risk model assessment43\n\n43 Exhibit 4.1, slide 7\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n#### Risk Rating\n\n- 4.2.16 The Risk Rating is classified as \"low, \"medium\", \"high\" or \"ultra-high\" and corresponds to the Risk Score as follows:\n\t- (a) if the customer's Risk Score is between 0 and 30, the Risk Rating is \"low\" (\"Low Risk\");\n\t- (b) if the customer's Risk Score is between 31 and 59, the Risk Rating is \"medium\" (\"Medium Risk\");\n\t- (c) if the customer's Risk Score is between 60 and 75, the Risk Rating is \"high Risk\"); and\n\t- (d) if the customer's Risk Score is between 76 and 99, the Risk Rating is \"ultra-high\" (\"Ultra-High Risk\").\n\n#### Stage 4: Customer acceptance approval or escalation\n\n- 4.2.17 The involvement of the Exchange's compliance team in the onboarding process for each customer is primarily driven by the Risk Rating assigned to that customer, whereby:\n\t- (a) if the customer is High Risk or Ultra-High Risk, the compliance team are required to manually review the customer's application and accept or reject them; and\n\t- (b) if the customer is Low Risk or Medium Risk, the compliance team are not necessarily required to manually review the customer's application but may do so if compliance issues are identified or as part of the Exchange's quality control procedures and ongoing compliance monitoring.\n- 4.2.18 We set out in Figure 4.4 below the Exchange's approval or escalation process in further detail.\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nFigure 4.4: Approval or escalation process44\n\n![](_page_27_Figure_5.jpeg)\n\n44 Exhibit 4.1, slide 8\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n# 5 Instruction 2: Our review of the Relevant Customers' accounts on the HEX Customer Database\n\n#### 5.1 Introduction\n\n- 5.1.1 As explained in Section 1.3 above, we have been instructed to identify whether an account exists on the HEX Customer Database for each of the Relevant Customers.\n- 5.1.2 Our approach to addressing this instruction was to search the HEX Customer Database for the HIDs listed in the Customer Action Schedule (which, as described in Section 1.4 above, are unique codes attributed to each customer account). In doing so, we:\n\t- (a) obtained an extract of certain information contained in the HEX Customer Database165 (the \"HEX Customer Database Download\"). We explain the process by which we obtained the HEX Customer Database Download and the work undertaken to review the accuracy of this document in Section 5.2; and\n\t- (b) identified the accounts on the HEX Customer Database Download corresponding to the Relevant Customers. We set out the results of our work in Section 5.3.\n\n### 5.2 The HEX Customer Database Download\n\n- 5.2.1 As explained in Section 3.2 above, the User Page provides a number of criteria by which one can search the HEX Customer Database including, inter alia, HID, customer name, type of account 6, Tier of customer and the date the account was created.\n- 5.2.2 Using the User Page, it is possible to extract information from the HEX Customer Database and download this in an Excel47 file.\n- 5.2.3 The process by which the HEX Customer Database Download was created is as follows®6:\n\n46 In particular, information provided in the User Page relating to all customers that the Exchange classifies as \"Tier \" 46 Elther \"personal\" or \"corporate\"\n\n47 Excel is a spreadsheet program from Microsoft that enables users to format, organize and calculate data in a spreadsheet 48 As explained above, our work in this regard was undertaken by personnel of the Exchange who have the relevant system access at our and CANDEY's direction. We directed and observed this work for the task\n\n- (a) Step 1: We sought to obtain an extract of all customer accounts that were classified as \"Tier 1\" on the HEX Customer Database (i.e. by applying only this filter to the search criteria on the User Page) 49. This produced summary information for 21,005 accounts;\n- (b) Step 2: In order to extract this summary information from the HEX Customer Database, it was necessary to divide the data into smaller sections 60. We filtered the data further by reference to certain time periods (i.e. by applying dates to the filter in respect the date the account was created). These time periods were51, 52:\n\t- (i) from the inception of the Exchange 53 to 28 April 2021. This produced summary information for 3,395 accounts;\n\t- (ii) from 28 April 2021 to 6 May 2021. This produced summary information for 2,989 accounts;\n\t- (iii) from 6 May 2021 to 30 June 2021. This produced summary information for 3,159 accounts;\n\t- (iv) from 30 June 2021 to 7 November 2021. This produced summary information for 3,253 accounts;\n\t- (v) from 7 November 2021 to 30 November 2021. This produced summary information for 2,095 accounts;\n\t- (vi) from 30 November 2021 to 31 March 2022. This produced summary information for 2,821 accounts; and\n\t- (vii) from 31 March 2022 to 15 December 2023 (the date we completed our work), This produced summary information for 3,293 accounts;\n- (c) Step 3: Once the data was downloaded by reference to these time periods, we combined all of the data described in Step 2 above (being all customer accounts that were classified as \"Tier 1\" on the HEX Customer Database) into one spreadsheet; and\n\n49 We understand from our conversations with personnel of the Exchange that all of the Relevant Customers were \"Tier 1\" customers. We sought to verfy this during the course of our work - see Section 5,3 below\n\n50 As the HEX Customer Database could not facilitate the extract of the volume of data related to all \"Tier 1\" customers of the Exchange\n\n51 The time periods listed below were identified by trial and error\n\n52 In order to confirm that we were not \"double counting\" any days by filtering the data into certain time periods, we sought to reconcile (i) the number of accounts for which information was obtained for each period (totalling (i) to (vil) above, which equates to 21,005 accounts); with (Ji) the total number of Tier 1 accounts in the HEX Customer Database (which also equates to 21,005 accounts)\n\n53 This was achieved by not applying a date to the filter \"Created Date From\"\n\n- (d) Step 4: Using Excel analytics 4, we sought to match the HID per the Customer Action Schedule to the HID per the HEX Customer Database Download. We summarise our findings in this regard in Section 5.3.\n- 5.2.4 In order to confirm that our approach to addressing this instruction was appropriate, we undertook a manual check of the HIDs for a sample of 250 of the Relevant Customers. This involved observing personnel of the service company of the Exchange (who has the relevant system access) inputting one HID at a time, at our and CANDEY's direction and confirming that a corresponding account existed for this HID (by viewing this directly on the HEX Customer Database).\n- 5.2.5 The sample of HIDs, which was of our choosing and was first provided to the personnel of the service company of the Exchange at the time of undertaking our work, included 55:\n\t- (a) the first 150 HIDs on the Customer Action Schedule (\"Customer Account Sample 1\"). We had initially planned to undertake this manual process for all HIDs included in the Customer Action Schedule. However, we identified that we would not have been able to complete our work in the available time. We therefore enquired about other approaches to addressing our instructions, which resulted in us obtaining the HEX Customer Database Download (as described above).\n\nFor Customer Account Sample 1, we observed personnel of the service company of the Exchange input one HID at a time into the HEX Customer Database, at our and CANDEY's direction in order to confirm that an account existed for that HID in the HEX Customer Database. We set out the results of this sample testing in Appendix 5.1a; and\n\n(b) a sample of 100 additional HIDs included in the Customer Action Schedule (\"Customer Account Sample 2\"). In order to select this sample of HIDs, we applied a nonstatistical sampling approach using systematic selection, by selecting every 340 HID reference in the Customer Action Schedule (excluding the first 150 items) to sample test.\n\nFor Customer Account Sample 2, we observed personnel of the service company of the Exchange input one HID at a time into the HEX Customer Database, at our and CANDEY's direction in order to confirm that (i) an account existed for that HID in the\n\n54 Specifically, the Excel functionality \"VLOOKUP\" is a search function commonly used in data analytics that identifies and matches specific data vertically across a spreadsheet\n\n65 For present purposes we have tested a total sample of 250 HDs. Should the Court require a more extensive sample to be tested, we could extend our testing\n\nin the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nHEX Customer Database; and (ii) the details in the HEX Customer Database Download matched the information in the HEX Customer Database55. We set out the results of this sample testing in Appendix 5.1b.\n\n5.2.6 In our sample, we did not identify any discrepancy between the information on the HEX Customer Database Download and the information obtained \"manually\" (by searching one HID at a time in the User Page).\n\n#### 5.3 The results of our work\n\n- 5.3.1 Using the HEX Customer Database Download, we sought to confirm:\n\t- (a) that an account exists in the HEX Customer Database for each of the Relevant Customers:\n\t- (b) whether the account is a \"personal\" or \"corporate\" account;\n\t- (c) the Tier classification of that customer57; and\n\t- (d) the date their account was created.\n- 5.3.2 We set out the results of our work in this regard in Appendix 5.2. In summary, based on our review of the information contained in the HEX Customer Database, we identified that:\n\t- (a) for each of the Relevant Customers, an account exists in the HEX Customer Database;\n\t- (b) the Relevant Customers:\n\t\t- (i) comprise 3,521 personal accounts and 18 corporate accounts; and\n\t\t- (ii) are all Tier 1 customers; and\n\t- (c) all of the Relevant Customers' accounts were created between 23 April 2021 and 22 August 2023.\n\n66 in particular, the customer name, account type and \"tier\" of customer\n\n57 As noted in Section 3,2 above, every customer on the HEX Customer Database is classified by reference to the stage of onboarding undertaken\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n### mazars\n\nIndependent forensic review of Mazars LLP\n\n# 6 **Instruction 3:** *Our detailed review of the customer* onboarding information and the financial data in respect of a sample of the Relevant Customers\n\n#### 6.1 Introduction\n\n6.1.1 As explained in Section 1.3 above, we have been instructed to identify and isolate a sample of the Relevant Customers from the Customer Action Schedule and for that sample, to:\n\n- (a) verify the existence of KYC onboarding information;\n- (b) verify the financial data contained in the Customer Action Schedule against the live data on the HEX Customer Database; and\n- (c) verify the redemptions made by the Relevant Customers to the bank statements of the Exchange.\n- 6.1.2 In this Section we set out:\n\t- (a) the methodology we have adopted to select the sample of customers to be reviewed (Section 6.2); and\n\t- (b) the procedures we performed in respect of the customer onboarding information and the financial data in respect of a sample of the Relevant Customers (Section 6.3).\n\n#### 6.2 Sample selection methodology\n\n- 6.2.1 For present purposes we have tested a total sample of 50 HIDs (\"KYC and Financial Data Sample\"). Consistent with the approach described in Section 5 above, the sample we selected was first provided to the personnel of the service company of the Exchange at the time of undertaking our work. Should the Court require a more extensive sample to be tested, we could extend our testing.\n- 6.2.2 In order to select a sample of the Relevant Customers, we applied a non-statistical sampling approach using systematic selection, by following the below steps:\n\t- (a) we first randomised the order of the HID references in the Customer Action Schedule by:\n- (i) allocating a randomly generated number to each HID reference, using the Excel function \"=rand()\", which generates a random number between 0 and 1 to each HID reference in the Customer Action Schedule;\n- (ii) recalculating the formula in (i); and\n\t- (iii) sorting the Customer Action Schedule according to the randomly generated number in (ii) from smallest to largest; and\n- (b) we then selected every 71st HID reference in the Customer Action Schedule in (iii) to form part of our sample.\n- 6.2.3 The Customer Action Schedule contains 3,539 customers, therefore by taking the 71st HID, our sample consists of 50 customers 58.\n\n## 6.3 The procedures we performed in respect of the sample of the Relevant Customers\n\n6.3.1 As explained above, we have been instructed to consider both (i) the KYC information obtained by the Exchange in respect of the sample of Relevant Customers; and (ii) certain financial information in respect of these customers.\n\n#### Our review of the KYC information obtained by the Exchange\n\n- 6.3.2 For each HID included in our sample, we have reviewed the \"Profile\" tab of the HID Dashboard, and considered:\n\t- (a) whether an account exists in the HEX Customer Database for each HID;\n\t- (b) whether the account is enabled;\n\t- the Tier of the account; (C)\n\t- (d) whether the account is \"personal\" or \"corporate\";\n\t- (e) the customer's full name, email address, citizenship and country of residence;\n\t- (f) the customer's source of income and source of wealth;\n\t- (g) the Risk Score and Risk Rating allocated to the customer; and\n\n58 71 x 50 = 3,550\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP\n\n- (h) the ID documents available for each customer and the testing undertaken by Jumio.\n- 6.3.3 We set out the results of our work in this regard in Appendix 6.1. In summary, we identified that for each HID that forms part of our sample:\n\t- (a) an account exists in the HEX Customer Database;\n\t- (b) the Exchange holds copies of an ID document, which have been verified by Jumio as being \"authentic\"60; and\n\t- (c) a facial recognition test was undertaken by Jumio, the purpose of which is, as noted in paragraph 4.2.11 above, to confirm that the person holding the ID is (i) the same person shown in the ID photo; and (ii) physically present during the onboarding process.\n- 6.3.4 In addition, for each customer tested as part of this sample, we also attach at Exhibit 6.1 excerpts of the \"Risk Scoring\" tab on the HID Database, which includes the responses provided by each customer to the KYC Questionnaire and any review comments added to their account by the compliance team.\n\n#### Our review of the financial information in respect of these customers\n\n- 6.3.5 For each HD included in our sample, we have reviewed the \"Deposits\" and \"Withdrawals\" tabs of the HID Dashboard and sought to agree the information in the HEX Customer Database with the information in the Customer Action Schedule in respect of each customer's.\n\t- (a) HCN balance:\n\t- HDO balance; (b)\n\t- (c) total deposits; and\n\t- (d) total redemptions.\n- 6.3.6 In respect of the redemptions effected by customers in this sample, we have also sought to agree the amounts of the redemptions to bank statements of the Exchange®1.\n\n59 Via Jumio\n\n60 For each of our sample, we scught to confirm that the name on the ID Document matches the name on the HEX Customer Database. Whilst we were able to do this for the majority of the sample, there were a number of HIDs which related to Chinese nationals, whose names were included in their ID documents and the HEX Customer Database in Chinese characters. For these individuals, we confirmed that the document number on the ID Document agrees to the document number in the HEX Customer Database. The detail of this work is provided in Appendix 6,1\n\n61 The redacted bank statements in respect of these redemptions were provided to me and are set out at Exhibit 6.2\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n- 6.3.7 We set out the results of our work in Appendix 6.162. In summary, we identified:\n\t- (a) the HCN balance and HDO balance in the HEX Customer Database reconciled to the amounts noted in the Customer Action Schedule (when timing differences are taken into consideration).\n\nIn this regard, in undertaking this work, we sought to agree the financial data in the Customer Action Schedule (which we are instructed was compiled as at 10 November 2023) to the \"live\" HEX Database as at the date of our work (15 December 2023). Given there was ongoing trading activity of HCN and HDO balances between 10 November 2023 and 15 December 2023, for certain customer accounts, there were reconciling items (relating to trades that these customers had effected in this time period) - When these trades are taken into consideration, we did not identify any discrepancies between the HCN and HDO balances in the HEX Customer Database compared with the Customer Action Schedule;\n\n- (b) the total deposits and total redemptions in the HEX Customer Database agreed to the amounts noted in the Customer Action Schedule; and\n- (c) the total redemptions in the HEX Customer Database (and the Customer Action Schedule) agreed to the Exchange's bank statements that were provided to use. These bank statements include:\n\t- (i) Mercantile Bank International Corp (\"Mercantile Bank\"), which we understand is a \"Custody Account\"65; and\n\n62 As noted in Section 1.4 above, we are instructed that the customer information that we have reviewed and the underlying KYC documents we have verfied them to are confidential. Therefore, whilst we reviewed unredacted information on the HEX Customer Database, we are instructed that it must be redacted for the purposes of the information in Appendix 6.1 and the supporting documentation (in particular, Exhibits 6.1 and 6.2) is therefore redacted\n\n63 We confirmed each of these reconciling items to the HEX Database. Further details are provided in Appendix 6,1\n\n64 The bank statements provided to us are hard copies of the bank statements held by the Exchange. We are instructed that the Exchange no longer has accounts online as they have been closed as a result of the seizures\n\n65 We are instructed that prior to the seizures, Mercantile Bank was one of the Exchange, where the Exchange had an account holding part of its stable coin reserve (the \"Relevant Mercantile Bank Account\"). We are also instructed that the Relevant Mercantile Bank Account was a \"custodian\" account, rather than a standard bank account, in order to safeguard customer funds. In this regard, we have been provided with a document titled \"MERCANTILE BANK INTERNATIONAL CORP. ONLINE CUSTODY & BANKING SERVICES AGREEMENT, dated September 2022 (the \"Mercantile Bank Custody Agreement\", Exhibit 6.3), which we are instructed sets out the terms and conditions applicable to the Relevant Mercantile Bank Account. We have not read the full terms and conditions of the Mercantile Bank Custody Agreement and we have not been instructed to undertake any further procedures in relation to Relevant Mercantile Bank Account. We have been instructed to review paragraph 6.2 of the Mercantile Custody Agreement which states: \"In furtherance of its responsibilities as Custodian, and subject to the limitetions of this Agreement, Client instructs Custodian to: (i) Safekeep Fiat Currency and Digital Asset amounts transferred into the \"Custodial Funds\") (ii) Monitor and maintain the Custodial Funds; (iii) Manage the Custodial Funds in accordance with Section 6.3 of this Agreement; (iv) Keep timely and accurate records regarding the deposit, disbursement and investment of the Custodial Funds; and, (V) Prepare such periodic statements regarding and access to information pertaining to the Custodial Funds in the frequency and manner contemplated in this Agreement\". We have also been provided with an earlier version of the Mercentile Bank Custody Agreement, dated June 2020.\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n(ii) FV Bank International INC (\"FV Bank\", the \"Relevant FV Bank Account\"), which we understand is also a \"Custody Account\"66.\n\nWe have reviewed paragraph 6.2 of both documents and have not noted any differences in these terms. We are instructed that the DoJ's seizures of the stable coin reserve were (partly) from the Relevant Mercantile Bank Account\n\n60 We are instructed that FV Bank was also one of the Exchange, where the Exchange, where the Exchange had an account holding part of its stable coin reserve (the \"Relevant FV Bank Account\"). We are also instructed that the Relevant FV Bank Account was a \"custodian\" account, rather than a standard bank account, in order to safeguard customer funds. In this regard, we have been provided with (i) a document titled \"Cusofdy Agreement [sic]\", undated (the \"FV Bank Custody Agreement\", Exhibit 6.4), which we are instructed sets out the terms and conditions applicable to the Relevant FV Bank Account, and (i) a document titled \"Business Account Application\" (the \"FV Bank Business Account Application\", Exhibit 6.5) which we are instructed reflects the Exchange's application to open the Relevant. We have not read the full terms and conditions of the FV Bank Custody Agreement and we have not been instructed to undertake any further procedures in relation to Relevant FV Bank Account. We have been instructed to review the Section titled \"Representations, Warranties, and Covenants\" on page 22 of the FV Bank Custody Agreement which states: \"FV Bank will safekeep the Custodial Assets and segregate data of all Custodial Assets from both the (i) property of FV Bank, and (ii) recorded assets of the customers of FV Bank. FV Bank is a custodial Assets stored by you in the Custody Account, and FV Bank has no right, interest, or title in such Custodial Assets, and will not reflect such Custodial Assets as an asset on the balance sheet of FV Bank, except as may be required by regulatory bodies in specified accounting reports. FV Bank may not grant a security interest in your Custodial Assets held in your Custody Account. FV Bank will not, directly, lend, pledge, hypothecate or rehypothecate any Custodial Assets without you accepting an agreement for FV Bank to do so\". With respect to the FV Bank Business Account Application, we have been instructed to review the question \"What is the purpose of opening a bark account with FV Bank?' (set out on page 1). We note that the stated purpose of the account according to this document is \"To hold the proceeds of the sale of our Himalaya Dollar\". We are instructed that the DoJ's seizures of the stable coin reserve were (party) from the Relevant FV Bank Account\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n### mazaris\n\nIndependent forensic review of Mazars LLP\n\n# 7 Instruction 4: Illustrative customer onboarding\n\n#### 7.1 Introduction\n\n- 7.1.1 In this Section, we set out our observations on the two illustrative customer onboarding tests we performed at the Exchange.\n- 7.1.2 We performed these tests to assess the compliance of the customer onboarding process described in Section 4 above. Both tests were conducted at the premises of the service company of the Exchange®, which we visited on 14 and 15 December 2023. Our instructing solicitors from CANDEY were also present at the same time.\n\n### 7.2 First illustrative customer onboarding test\n\n- 7.2.1 The first illustrative customer onboarding test (\"Test 1\") was undertaken using the United States (a Restricted Country) as the country of residence and citizenship. Test 1 comprised the following steps:\n\t- (a) accessing the Exchange's website and selecting the \"Register\" tab;\n\t- (b) entering illustrative Key Registration Information, including:\n\t\t- (i) an illustrative name, date of birth and address:\n\t\t- (ii) trying to select the \"United States\" in the citizenship category dropdown list. However, this was not possible as an option for United States was not on the list; and\n\t\t- (iii) trying to select the \"United States\" in the country of residence category drop down. However, this was not possible as an option for United States was not on the list.\n- 7.2.2 As explained in paragraph 4.2.1 above, it is only once all Key Registration Information has been submitted (which must include the customer's citizenship and country of residence) that the new customer is able to progress to the next stage of the onboarding process.\n- 7.2.3 Therefore, Test 1 did not permit progression to the next stage of the onboarding process, which is in line with our understanding of the Exchange's customer registration policy.\n\n87 We have been instructed not to disclose the address of the service company of the Exchange for the purposes of this report\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n#### 7.3 Second illustrative customer onboarding test\n\n- 7.3.1 The second illustrative customer onboarding test (\"Test 2\") was undertaken using France (which is not considered a Restricted Country) as the country of residence and citizenship. Test 2 comprised of the following steps:\n\t- (a) accessing the Exchange's website and selecting the \"Register\" tab;\n\t- (b) entering illustrative Key Registration Information, including:\n\t\t- (i) an illustrative name, date of birth and address;\n\t\t- (ii) selecting \"France\" in the citizenship category dropdown list; and\n\t\t- (iii) selecting \"France\" in the country of residence category dropdown list.\n- 7.3.2 Once the above illustrative Key Registration Information was submitted, the next steps of Test 2 consisted of:\n\t- (a) providing answers to three security questions;\n\t- (b) providing and verifying an email address, where the email address became verified once we confirmed the activation link;\n\t- (c) providing and verifying a phone number, where the phone number became verified once we inputted the 6-digit verification code; and\n\t- (d) providing confirmation that we were not a resident of the US, Japan, citizen or resident of Canada or any other jurisdiction where the laws of such jurisdiction prohibits the holding or use of cryptocurrencies.\n- 7.3.3 Once the above steps were completed, it is our understanding that the Test 2 illustrative customer would be classified as \"Tier 0\" on the Exchange's HEX Customer Database at this stage in the customer onboarding process. In line with our understanding of the Exchange's onboarding processes, we were not able to make deposits or trade with this illustrative customer account.\n- 734 The next steps of Test 2 consisted of:\n\t- (a) completing the KYC Questionnaire, which involved selecting options from the multiplechoice questions;\n\nPrivate and Confidential\n\n- 39 -\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n- (b) uploading a scan of an ID document (in this case we uploaded a front and back scan of a French driving license68); and\n- (c) uploading a live photo.\n- 7.3.5 The Exchange's onboarding system flagged our Test 2 as \"auto-rejected\" as the name on the Key Registration Information and the ID documents provided were not a match.\n\n68 The personal ID document of a member of the Mazars team","body_zh":"Mazars LLP（玛泽有限责任合伙）之独立司法会计审查\n\n2023年12月21日\n\n[_page_0_Picture_4.jpeg]\n\n涉及 United States v Kwok, et al（美国诉郭文贵等人案），案号 23 CR 118 (SDNY)（纽约南区），关于客户依据第41(g)条请求返还其 Himalaya Exchange（喜马拉雅交易所）资金之诉讼\nmazars\n\nMazars LLP（玛泽有限责任合伙）之独立司法会计审查\n目录\n1 引言\n1.1 本案背景\n1.2 我们的经验\n1.3 我们的受托事项\n1.4 调阅相关信息的情况\n1.5 本报告的架构\n1.6 本报告的范围\n2 执行摘要 10\n2.1 引言\n2.2 我们的受托事项\n2.3 我们的工作及审查结果摘要\n3 HEX客户数据库\n3.1 引言\n3.2 我们对HEX客户数据库中与受托事项相关之可用信息的理解\n4 受托事项1：我们对交易所现行客户入驻流程与程序的理解\n4.1 引言\n4.2 客户入驻流程的关键阶段\n5 受托事项2：我们对HEX客户数据库中相关客户账户的审查\n5.1 引言 29\n5.2 HEX客户数据库下载数据\n5.3 我们的工作结果 32\n6 受托事项3：我们对相关客户样本的客户入驻信息及财务数据的详细审查 33\n6.1 引言\n6.2 样本抽取方法\n6.3 我们针对相关客户样本执行的程序\n7 受托事项4：示范性客户入驻\n7.1 引言\n7.2 第一次示范性客户入驻测试\n7.3 第二次示范性客户入驻测试\n\n涉及 United States v Kwok, et al（美国诉郭文贵等人案），案号 23 CR 118 (SDNY)（纽约南区），关于客户依据第41(g)条请求返还其 Himalaya Exchange（喜马拉雅交易所）资金之诉讼\nmazars\n\nMazars LLP（玛泽有限责任合伙）之独立司法会计审查\n\n涉及 United States v Kwok, et al（美国诉郭文贵等人案），案号 23 CR 118 (SDNY)（纽约南区），关于客户依据第41(g)条请求返还其 Himalaya Exchange（喜马拉雅交易所）资金之诉讼\nmazars\n\nMazars LLP（玛泽有限责任合伙）之独立司法会计审查\n附录\n与交易所服务公司人员之会面摘要 附录 1.1\n编制本报告所使用的文件 附录 1.2\n对HEX客户数据库进行的测试（客户账户样本1） 附录 5.1a\n对HEX客户数据库下载数据进行的测试（客户账户样本2） 附录 5.1b\n我们对HEX客户数据库中相关客户账户的审查 附录 5.2\n对相关客户样本之客户入驻信息及财务数据进行的测试 附录 6.1\n附件\nHEX客户数据库示例摘录 附件 3.1\n入驻流程文件 附件 4.1\nHID数据库中“风险评分”选项卡之摘录 附件 6.1\n交易所银行对账单摘录 附件 6.2\nMercantile Bank（商业银行）托管协议 附件 6.3\nFV Bank（FV银行）托管协议 附件 6.4\nFV Bank（FV银行）商业账户申请表 附件 6.5\n\n涉及 United States v Kwok, et al（美国诉郭文贵等人案），案号 23 CR 118 (SDNY)（纽约南区），关于客户依据第41(g)条请求返还其 Himalaya Exchange（喜马拉雅交易所）资金之诉讼\nmazars\n\nMazars LLP（玛泽有限责任合伙）之独立司法会计审查\n1. 引言\n1.1 本案背景\n\n- 1.1.1 我们，Mazars LLP（“Mazars”），受 Candey Limited（“CANDEY”，即 Himalaya International Clearing Limited（喜马拉雅国际清算有限公司，下称“交易所”或“HEX”）的法律顾问）之委托。交易所系一家在英属维尔京群岛注册的公司，运营着一个用户对用户的中心化加密货币交易平台，供客户交易、存储和管理喜马拉雅加密货币，即 Himalaya Coin（“HCN”，喜币）和 Himalaya Dollar（“HDO”，喜美元）。\n- 1.1.2 交易所及其关联公司的最终实益拥有人为 William Je（余建明先生，下称“余先生”），United States Department of Justice（DoJ，美国司法部）已在 Southern District of New York（纽约南区）对其（以及另外两名被告）提起刑事指控。在这些诉讼程序中被指控的事由除其他外包括，余先生通过交易所实施了一项欺诈计划。我们理解余先生否认了这些指控。\n- 1.1.3 由于这些指控，我们理解交易所的某些资产已被美国司法部扣押，特别是交易所的HDO稳定币[4]储备[2]。\n- 1.1.4 我们受托获悉：\n\t- (a) 2023年12月6日，交易所的3,539名客户依据《联邦刑事诉讼规则》第41(g)条提出动议，请求返还其被美国扣押的财产（下称“相关客户”及“客户诉讼”）[3]；以及\n\t- (b) 2023年12月7日，美国司法部作出陈述，请求美国联邦地区法院驳回相关客户在客户诉讼中所寻求的救济。我们受托获悉，其理由之一是客户诉讼中的客户（被其称为“声称的客户”）并非真实客户，暗示客户诉讼本身纯属虚构。\n1.2 我们的经验\n\n1.2.1 Mazars Group（玛泽集团）是一家国际化、一体化且独立的组织，专门从事审计、咨询、会计和税务服务，在超过95个国家和地区设有分支机构，汇集了超过47,000名专业人员的专业知识。在英国，Mazars拥有约150名合伙人和超过2,500名员工。\n\n2 以美元形式持有\n\n1 我们理解，“稳定币”是一种价值与另一种资产类别挂钩的加密货币\n\n3 在提起客户诉讼时，相关客户的最初人数为3,345人。我受托获悉，该人数此后已增至3,539人\n\n涉及 United States v Kwok, et al（美国诉郭文贵等人案），案号 23 CR 118 (SDNY)（纽约南区），关于客户依据第41(g)条请求返还其 Himalaya Exchange（喜马拉雅交易所）资金之诉讼\nmazars\n\nMazars LLP（玛泽有限责任合伙）之独立司法会计审查\n\n国家和地区，依靠超过47,000名专业人士的专长开展工作。在英国，Mazars拥有约150名合伙人和2,500多名员工。\n\n1.2.2 本报告由伦敦的危机与争议团队编制。我们经常在涉及欺诈指控、会计违规、洗钱和失实陈述、监管调查以及现金和资产追踪等任务中接受委托。我们曾代表监管机构和起诉机构（包括英国及海外）以及代表被告方开展工作。我们最近处理的案件包括受 Financial Conduct Authority（英国金融行为监管局）委托，涉及：(i) 对一家大型获授权集合投资基金倒闭事件的调查；以及 (ii) 其对一家英国上市公司股票终止上市的决定。\n1.3 我们的受托事项\n\n- 1.3.1 我们收到了一份载有每位相关客户信息的明细表（下称“客户诉讼明细表”）[4]。我们理解，相关客户在2021年4月23日至2023年8月22日期间（下称“相关期间”）在交易所开设了账户。\n- 1.3.2 利用该客户诉讼明细表，我们受托开展以下工作：\n\t- (a) 对客户数据库（下称“HEX客户数据库”）进行实时且独立的审查，以确认并记录交易所现行的客户入驻流程与程序（下称“受托事项1”）；\n\t- (b) 核实客户诉讼明细表中所列的每位相关客户是否均在HEX客户数据库中拥有交易所账户（下称“受托事项2”）；\n\t- (c) 从客户诉讼明细表中确定并抽取相关客户的样本，以便：\n\t\t- (i) 核实“了解你的客户”（“KYC”）入驻信息的真实存在；\n\t\t- (ii) 针对该样本，将客户诉讼明细表中所载的财务数据与HEX客户数据库上的实时数据进行核对；以及\n\n4 我们理解该明细表由交易所于2023年11月10日提供给相关客户的法律代表\nmazars\n\nMazars LLP（玛泽有限责任合伙）之独立司法会计审查\n\n- (iii) 针对该样本，将相关客户进行的赎回（在客户诉讼明细表中称为“赎回余额”）与交易所的银行对账单进行核对（下称“受托事项3”）；以及\n- (d) 自行选择进行一次示范性入驻申请测试，包括但不限于针对 United States（US，美国）的测试（下称“受托事项4”）。\n1.4 调阅相关信息的情况\n\n- 1.4.1 除在本报告中撰写审查结果外，我们的大部分工作均在交易所服务公司的营业场所[5]进行，我们于2023年12月14日和15日访问了该场所[6]。我们的委托事务律师 CANDEY 亦同时在场。我们在附录1.1中载列了与交易所及 CANDEY 的会面摘要。\n- 1.4.2 客户诉讼明细表不包含相关客户的姓名。相反，客户是通过唯一的喜马拉雅账户号码（“HID”）进行识别的。我们受托获悉，我们审查的客户信息以及用作核对依据的基础KYC文件均属于保密信息，并受数据保护规定的约束。因此，尽管我们在HEX客户数据库上审查了未经涂黑的信息，但根据委托指示，在编制本报告时必须以隐去敏感信息的形式呈现。\n1.5 本报告的架构\n\n- 1.5.1 本报告的其余部分结构如下：\n\t- (a) 在第2节中，我们载列了工作及审查结果的执行摘要；\n\t- (b) 在第3节中，我们对HEX客户数据库中的可用信息概述了我们的理解；\n\t- (c) 在第4节中，我们通过阐述对交易所现行客户入驻流程与程序的理解，回应受托事项1；\n\n5 Hamilton Capital Holding（汉密尔顿资本控股）。为编制本报告之目的，或在法院出具保护令之前，我们被指示不得披露该服务公司的地址。\n\n6 在工作过程中，我们对交易所服务公司的IT、法务和合规团队进行了访谈。基于数据保护和保护员工身份的考虑，根据委托指示，我们不得为本报告之目的披露这些个人的姓名。\nmazars\n\nMazars LLP（玛泽有限责任合伙）之独立司法会计审查\n\n- (d) 在第5节中，我们通过说明为确定HEX客户数据库中是否存在每位相关客户之账户而开展的工作，回应受托事项2；\n- (e) 在第6节中，我们通过说明为确认交易所持有的相关客户样本之入驻信息及财务数据而开展的工作，回应受托事项3；以及\n- (f) 在第7节中，我们通过说明所开展的示范性客户入驻申请测试，回应受托事项4。\n1.6 本报告的范围\n\n- 1.6.1 我们在附录 1.2 中列出了我们在编制本报告过程中所使用的信息和文件清单。\n\n- 1.6.2 应当指出的是，我们完成的工作并不构成审计，且除本报告中明确载明的内容外，我们并未核实或以任何其他方式核对我们所审阅文件中载明的信息。除非明确受指示对基础文件的真实性发表意见，否则这是我们在处理此类性质事项时的标准做法。\n\n- 1.6.3 我们编制本报告是针对向 US District Court（美国联邦地区法院）提起的 Customer Action（客户诉讼）。除向 CANDEY、Exchange（交易所）、Relevant Customers（相关客户）的法定代表人、DoJ（美国司法部）以及 United States District Court（美国联邦地区法院）提供外，本报告在各方面均属保密。未经我们事先书面同意，本报告不得用于任何其他目的，亦不得进行复制或传播。Mazars（玛泽）对于与本报告所涉事项有关的第三方及/或任何违反该义务的行为不承担任何责任。\n\n- 1.6.4 本报告反映了我们对法律事项的理解，但不对其发表意见，因为该等事项并非由我们作出裁定。\n\n- 1.6.1 我们并未受指示按照 English Civil Procedure Rules（英格兰民事诉讼规则）（特别是第 35 部分）、U.S. Federal Rules of Civil Procedure（美国联邦民事诉讼规则）以及 U.S. Federal Rules of Criminal Procedure（美国联邦刑事诉讼规则）来编制本报告，而上述规则分别适用于在英格兰和威尔士以及美国诉讼程序中出示的专家报告。尽管如此，我们已采纳适用于专家为此类目的编制报告的相关规程。就此而言：\n\nmazars\n\nMazars LLP 独立法务会计审阅\n\n- (a) 本报告中陈述的意见反映了我们基于向我们提供的证据所作出的独立意见；\n\n- (b) 我们在编制本报告时已尽到合理的注意与技能，以确保准确与完整；以及\n\n- (c) 我们确认，我们未达成任何使我们费用的金额或支付在任何程度上取决于本案结果的安排。\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY)（美国诉郭等人案，案号 23 CR 118（纽约南区））中有关要求归还其 Himalaya Exchange（喜马拉雅交易所）资金的 41(g) 客户诉讼事项\n\nmazars\n\nMazars LLP 独立法务会计审阅\n\n关于执行摘要\n\n2-1 引言\n\n- 2.1.1 我们，Mazars，已接受交易所法律顾问 CANDEY 的指示。交易所及其关联公司的最终实益拥有人为 Je（余建明）先生，DoJ 已在 Southern District of New York（纽约南区）对其（连同另外两名被告）提起刑事指控。在该等诉讼程序中被指控称，除其他事项外，Je 先生通过交易所实施了一项欺诈计划。我们获悉，Je 先生否认了这些指控。\n\n- 2.1.2 作为这些指控的后果，我们获悉交易所的某些资产已被 DoJ 查封/扣押，包括交易所的稳定币储备。\n\n2.1.3 我们受指示得知：\n\n- (a) 2023年12月6日，相关客户提起了客户诉讼（依据 Federal Rule of Criminal Procedure 41(g)（联邦刑事诉讼规则第 41(g) 条）提出的要求归还被美国查封/扣押财产的动议）；以及\n\n- (b) 2023年12月7日，DoJ 作出陈述，请求美国联邦地区法院驳回相关客户在客户诉讼中寻求的救济。我们受指示得知，该陈述的依据除其他事项外，在于客户诉讼中的客户并非真实客户，其含义是指该客户诉讼本身即属虚构。\n\n2.2 我们的工作指示\n\n- 2.2.1 使用 Customer Action Schedule（客户诉讼明细表），我们受指示开展以下工作：\n\n\t- (a) 对 HEX Customer Database（HEX 客户数据库）进行实时且独立的审阅，以确认并记录交易所现行的与客户入驻相关的流程和程序（“指示 1”）；\n\n\t- (b) 核实客户诉讼明细表中包含的每位相关客户在 HEX 客户数据库中均拥有交易所账户（“指示 2”）；\n\n\t- (c) 从客户诉讼明细表中确定并抽取相关客户的样本，以便：\n\n\t\t- (i) 核实 KYC（了解你的客户）入驻信息的真实存在；\n\nmazars\n\nMazars LLP 独立法务会计审阅\n\n- (ii) 将客户诉讼明细表中包含的财务数据与 HEX 客户数据库中该样本的实时数据进行核对；以及\n\n- (iii) 将相关客户进行的赎回（在客户诉讼明细表中表述为“赎回余额”）与该样本对应的交易所银行对账单进行核对（“指示 3”）；以及\n\n- (d) 进行一次由所选对象构成的说明性入驻申请操作，包括但不限于美国（“指示 4”）。\n\n2.3 我们的工作与调查发现摘要\n\n- 2.3.1 除在本报告中书面记录我们的调查发现外，我们大部分工作是在交易所的服务公司场所进行的，我们于 2023年12月14日和15日访问了该场所。我们来自 CANDEY 的指示事务律师当时亦在场。在此期间，我们在交易所服务公司拥有相关系统访问权限的人员在我们及 CANDEY 的指导下，对 HEX 客户数据库进行了实时审阅。\n\n- 2.3.2 我们的工作和调查发现摘要如下：\n\n指示 1：我们对交易所现行的与客户入驻相关的流程和程序的理解\n\n- 2.3.3 我们理解交易所的客户入驻包括四个关键阶段：\n\n\t- (a) “阶段 1”：客户注册，客户据此提供包括姓名、出生日期、国籍和居住国在内的个人详细信息。我们理解交易所的政策为不允许居住在某些国家的个人在交易所开立账户。这些“受限制国家”包括美国；\n\n\t- (b) “阶段 2”：客户身份识别、核验及筛查，该阶段要求客户：\n\n\t\t- (i) 提供并验证其电子邮件地址和电话号码；\n\n就此而言，我们受指示得知：(i) 受限制国家名单会定期接受审查，以确保交易所遵守全球监管合规要求；以及 (ii) 自交易所成立以来，美国一直被列入受限制国家名单中。\n\n- (ii) 完成一份“KYC 调查问卷”，该问卷包含多道（8至16道问题）与客户个人详细信息、其资金来源及其加密货币交易经验水平等相关的多项选择题；以及\n\n- (iii) 提交身份证明文件并完成某些身份核验检查。就此而言，交易所将客户身份证明文件的收集和核验外包给第三方 Jumio Corporation（Jumio 公司，下称“Jumio”）。Jumio 的服务包括 (i) 核验身份证明文件是否“真实且有效”；以及 (ii) 通过利用人工智能驱动的面部识别技术，将所提供的身份证明文件与客户拍摄的实时照片进行比对，以核验客户的身份。\n\n除此之外，交易所还会对潜在客户进行筛查，以识别是否存在任何政治公众人物、受制裁人员或受负面媒体报道影响的人员。我们理解交易所使用第三方软件供应商“ComplyAdvantage”来执行该筛查流程；\n\n- (c) “阶段 3”：客户风险评估，交易所将对所提供的信息进行评估，并为每位客户分配一个“风险评级”，该评级反映了交易所对入驻该客户相关风险的评估，并且是根据客户在 KYC 调查问卷中所提供的回答得出的；以及\n\n- (d) “阶段 4”：客户接纳批准或上报升级，其中交易所合规团队对每位客户入驻流程的介入是由分配给该客户的风险评级触发的。\n\n指示 2：我们对 HEX 客户数据库中相关客户账户的审阅\n\n- 2.3.4 我们受指示核实每位相关客户在 HEX 客户数据库中均拥有交易所账户。基于我们对 HEX 客户数据库中所含信息的审阅，我们确定：\n\n\t- (a) 对于每位相关客户，HEX 客户数据库中均存在相应账户；\n\n\t- (b) 相关客户：\n\n\t\t- (i) 包含 3,521 个个人账户和 18 个公司账户；以及\n\n8 介于 8 到 16 道问题之间\n\n9 其为一个“人工智能驱动的身份核验平台”。http\n\nmazars\n\nMazars LLP 独立法务会计审阅\n\n- (ii) 全部为“第一级”（Tier 1）客户10；以及\n\n- (c) 所有相关客户的账户均创建于 2021年4月23日至 2023年8月22日之间。\n\n指示 3：我们对相关客户样本的客户入驻信息及财务数据的详细审阅\n\n- 2.3.5 我们受指示从客户诉讼明细表中确定由我们选择的相关客户样本，并针对该样本：(i) 核实 KYC 入驻信息的真实存在；(ii) 将客户诉讼明细表中包含的财务数据与 HEX 客户数据库中的实时数据进行核对；以及 (iii) 将相关客户进行的赎回（根据客户诉讼明细表）与交易所的银行对账单进行核对。\n\n- 2.3.6 对于构成我们样本组成部分的每个 HID，我们确定：\n\n\t- (a) 关于交易所获取的 KYC 信息：\n\n\t\t- (i) HEX 客户数据库中存在相应账户；\n\n\t\t- (ii) 交易所持有身份证明文件的副本，且已被 Jumio 核验为“真实”；以及\n\n\t\t- (iii) Jumio 开展了面部识别测试，正如文后第 4.2.11 段所述，其目的在于确认持有该身份证明的人员 (i) 与身份证明照片中显示的为同一人；且 (ii) 在入驻流程中亲自在场；以及\n\n\t- (b) 关于该等客户的财务信息：\n\n\t\t- (i) HEX 客户数据库中的 HCN 余额和 HDO 余额与客户诉讼明细表 12 中记载的金额相符；\n\n10 基于我们对交易所政策的理解，这反映了已作为交易所客户入驻的客户，意味着：(i) 客户已在交易所创建账户；(ii) 客户已核验其联系方式；(iii) 交易所已根据其客户接纳程序核验了其身份；以及 (iv) 客户已根据其提供的信息获得自动批准，或在升级上报至合规人员后已获得手动批准\n\n11 通过 Jumio\n\n12 截至编制客户诉讼明细表之日。正如文后第 6 节进一步解释的那样，我们核对客户诉讼明细表中财务数据的工作是针对一个“实时”数据库进行的。鉴于在客户诉讼提起之日（我们受指示获悉为 2023年11月10日）与我们开展工作之日（即 2023年12月15日）之间，HCN 和 HDO 余额存在持续进行的交易活动，对于某些客户账户而言，存在调节对账项目。这在文后第 6 节中进一步解释\n\nmazars\n\nMazars LLP 独立法务会计审阅\n\n- (ii) HEX 客户数据库中的总存款额和总赎回额与客户诉讼明细表中记载的金额相符；以及\n\n- (iii) HEX 客户数据库（及客户诉讼明细表）中的总赎回额与提供给我们的交易所银行对账单相符。\n\n指示 4：说明性客户入驻流程\n\n- 2.3.7 我们受托针对所选的任何司法管辖区（包括但不限于美国）进行示范性入驻申请。我们针对所开展的两项示范性客户注册和入驻测试的调查结果，与我们对该交易所客户注册政策的理解一致。具体而言：\n\t- (a) 一项示范性客户入驻测试因客户的国籍和/或居住国为美国，而不允许在该交易所创建账户或进入入驻流程的下一阶段；且\n\t- (b) 一项示范性客户入驻测试允许在该交易所创建账户，但由于客户注册表单上的姓名与所提供的身份证明文件不一致，而不允许进入入驻流程的下一阶段。\n\nmazars\n\nMazars LLP（玛泽有限责任合伙）独立法证审查报告\nHEX 客户数据库\n3.1 引言\n\n- 3.1.1 HEX 客户数据库是有关该交易所客户的“后台”13数据汇集。其包含的记录尤其包括：\n\t- (a) 各客户持有的虚拟资产；\n\t- (b) 各客户的充值、赎回及交易活动；以及\n\t- (c) 客户的个人信息，包括对各客户执行的 KYC（了解你的客户）程序记录。\n\n- 3.1.2 如上文第 1.4 节所述，为了执行我们的受托工作，我们于 2023 年 12 月 14 日及 15 日与 CANDEY（坎迪律师事务所）的代表一同造访了该交易所服务公司的办公场所。在此期间，我们对 HEX 客户数据库进行了实时审查，以便为我们执行受托工作提供必要的背景信息。此项审查是在我们及 CANDEY 的指导下，由拥有相关系统访问权限的该交易所服务公司人员操作进行的。本节所列信息即基于该实时审查。\n\n- 3.1.3 在本节中，我们将概述我们对 HEX 客户数据库14上可用信息的理解。\n3.2 我们对 HEX 客户数据库上与我们受托工作相关的可用信息的理解\nHEX 客户数据库仪表板\n\n3.2.1 我们在下文图 3.1 中列出了 HEX 客户数据库“仪表板”（“HEX 客户数据库仪表板”）15的摘录。我们理解，该交易所服务公司的人员通常将其称为“管理员控制面板”。\n\n10 指客户无法直接访问，而是交易所内部获得该信息访问权限的特定人员方可访问的信息\n\n14 重要提示：我们并未受托（因此也未试图）考量 HEX 客户数据库的完整性或运营有效性。因此，任何关于 HEX 客户数据库如何运行的表述，均基于我们在工作过程中观察到的信息\n\n15 HEX 客户数据库的所有摘录均在证据 3.1 中提供\nmazars\n\nMazars LLP 独立法证审查报告\n\n图 3.1：HEX 客户数据库仪表板16\n\nDashboard\n\n所有这些都是您的交易所管理员控制面板，您可以在其中查看详细内容，例如交易所的活动、用户余额、正在进行的交易等。此外，您将能够从此处修改交易所的有限功能，例如文本内容。下方的快捷链接及更多内容是关于每个链接可为您提供何种功能的简要说明。\nUsers　这将允许您查看交易所上的用户数量及其详细信息，从查看电子邮件地址到启用/禁用用户。您还将能够看到每个用户持有的加密货币及其数量。\nTransactions　交易提要使您能够查看所有正在进行和已完成/失败的交易。交易和失败的交易可以在此处查看，以及它们的进度和提现。\nMarkets　此部分概述了您交易所上正在进行的交易对及其完整订单簿。\nCoins　这使您可以查看交易所上可用的不同加密货币及其状态——查看交易、充值和提现的处理情况。Coins - Deposit Addresses 和 Coins - Withdrawal Addresses 向您显示用于每种加密货币的地址及其状态。\nSettings　设置将允许您查看用户，以及编辑用于访问它们的域名。此外，通过鼠标点击，您还可以设置电子邮件模板、时间、社交登录和其他常规操作。\nUtilities　实用工具 - 促销管理将允许您修改交易所前端的文本。“KEY”字段将向您显示默认值，除非您进行了修改，否则将显示该默认值。添加您自己的行，点击带有调用按钮的“Save”（如下所示）。从这里，HTML 概览将\nAdmins　此部分将允许您管理谁有权访问管理员控制面板以及具有何种控制级别。所有与管理员人员相关的设置只能在此处修改。\n\n- 3.2.2 如图 3.1 所示，HEX 客户数据库仪表板中具有多项功能（尤其包括查看“Transactions”（交易）、“Markets”（市场）和“Coins”（币种）的能力）。与我们的受托工作特别相关的是“Users”（用户）功能，如 HEX 客户数据库仪表板所述，该功能“将允许您查看交易所上的用户数量及其详细信息，从用户名、电子邮件地址到漏洞利用尝试。User - > Balances 将允许您查看每个用户持有的加密货币及其数量”17。\n\n- 3.2.3 我们将其称为“用户页面”。\n用户页面\n\n3.2.4 我们在下文图 3.2 中列出了用户页面的摘录。\n\n图 3.2：用户页面 18\n\nUsers< Users\nFilter Users by\n Email -\n Modified Date -\nUser NameRegistered DateStatusRoleTeamLocation\n\nRegistered Date is between and\nModified Date is between and\nUser Name　Registered Date　Status　Role　Team　Location　Registered Date is between and\n Modified Date is between and\nUser Name　Registered Date　Status　Role　Team　Location\nRegistered Date is between and\n Modified Date is between and\n[ ]\n\n- 3.2.5 从上文图 3.2 可以看出，用户页面提供了搜索 HEX 客户数据库的若干标准（尤其包括 HID、客户姓名、账户创建日期）。\n\n- 3.2.6 我们在下文图 3.3 中列出了用户页面上针对每个 HID 所提供的信息类型的示例。\n\n16 证据 3.1\n\n17 证据 3.1\n\n18 证据 3.1\n\n关于 United States v Kwok, et al（美国诉郭文贵等案），案号 23 CR 118（SDNY，纽约南区），涉及客户依据第 41(g) 条要求归还其 Himalaya Exchange（喜马拉雅交易所）资金的诉讼\nmazars\n\nMazars LLP 独立法证审查报告\n\n图 3.3：用户页面上针对每个 HID 所提供的信息类型示例19\nperson - library\nUsers | | |\n400 - 1 11 (lafev )\n- BYTAlian =\nVergist in\n( 19 8 8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 | -- RAAm\nI have with 2014 1/2 . Boal it . Boad it . Chery and it\n· Paul Bropade . L' Fine . Lang La\n> lession == [0] [ + ] ( + ] ( ) [ ( ) [ ] ( ) = ) = ( = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = | 100\n100 |\nColledil L = 0 (B)　Controllin for the religion was in　1\nTHE PETER PATERIAL PRODUCTS AND THE POLICE PE PERSELLE PROPERTY PROPERTY PRO PASSE PROFESSION PROPERTIERS, PASSE PL\n10 gr　いつけていたとことです。というときになるときになると\n\n- 3.2.7 如上文图 3.3 所示，当在用户页面中输入 HID 时，它会提供该客户的汇总概览。具体而言，它列出了：\n\t- (a) 与该 HID 相关的账户“Type”（类型）。我们理解账户可以是：\n\t\t- (i) “personal”（个人），指客户为自然人，并将账户用于个人目的；或\n\t\t- (ii) “corporate”（企业），指账户代表企业实体使用。\n\n我们就受托工作的目的理解，这些类型账户之间的关键区别在于该交易所针对这些客户执行的入驻程序；\n\n- (b) 客户姓名；\n- (c) 账户创建日期（如“Created”列所示）。我们理解该交易所网站自 2021 年 4 月起开始接受客户；\n- (d) 有关账户状态的信息，例如是否为“Enabled”（已启用）、“Approved”（已批准）、“Locked”（已锁定）或“Deleted”（已删除）；\n- (e) 有关账户活动的高级概要信息，例如客户是否已充值资金、交易 HCN 或 HDO 或提现资金（分别如“Deposit”、“Trade”和“Withdraw”列所示）；\n- (f) 客户的沟通偏好（例如他们是否同意通过“Online”（在线）、“Newsletter”（通讯简报）或“SMS”（短信）进行沟通）；\n\n19 证据 3.1\n\n- (g) 账户在该交易所支付应用程序“Hpay”20方面的权限；以及\n- (h) 该交易所执行的客户准入程序的结果，包括：\n\t- (i) 客户的“Risk Rating”（风险评级）；我们理解风险评级反映了该交易所对入驻该客户相关风险的评估，分为“low”（低）、“medium”（中）、“high”（高）或“ultra-high”（极高）。风险评级源自“Risk Score”（风险评分），该评分是根据客户对调查问卷（“KYC 调查问卷”21）的回答计算得出的。我们在下文第 4 节中提供了对该交易所风险评估流程的更详细说明；以及\n\t- (ii) 客户的“Tier”（层级）：我们理解客户分类有三个不同的“层级”22，反映了客户准入程序的状态。其中包括：\n\t\t- · 尚未分配层级的客户。这些是已注册创建该交易所账户但尚未验证其联系方式的客户；\n\t\t- · Tier 0（0 级）客户：这些是已注册创建该交易所账户并已验证其联系方式（包括电子邮件地址和电话号码），但尚未完成客户准入程序的客户。在现阶段，这些不是“活跃”账户23；以及\n\t\t- Tier 1（1 级）客户：这些是已成功入驻为该交易所客户的用户，即 (i) 客户已在该交易所创建账户；(ii) 客户已验证其联系方式；(iii) 该交易所已根据其客户准入程序验证了其身份（其进一步详情见下文第 4 节）；且 (iv) 客户已\n\n20 我获告知，Hpay 尤其允许客户：(i) 向其他交易所客户进行点对点转账；以及 (ii) 为该交易所批准的商户购买 HDO/HCN 礼品卡\n\n21 KYC 调查问卷的进一步详情载于下文第 4.2.8 段及后续段落\n\n22 我们理解该交易所正考虑在未来实施一个额外的层级，即“Tier 2”（2 级）\n\n23 意指客户无法充值或赎回资金，亦无法交易 HCN 或 HDO\nmazars\n\nMazars LLP 独立法证审查报告\n\n根据其提供的信息获得自动批准，或者在移交合规人员处理后已获得人工批准。\n\n我们理解，相关客户（Relevant Customers）仅包括第一级（Tier 1）客户。\nHID 仪表板\n\n- 3.2.8 点击「用户名 / HID（User Name / HID）」一栏中的 HID，可查阅关于该客户的进一步信息，系统将为每位客户生成一个仪表板（即「HID 仪表板 / HID Dashboard」）。\n- 3.2.9 HID 仪表板包含若干标签页，用于对有关每位客户的可用信息进行分类。与我们的指示特别相关的标签页包括：\n\t- (a)「个人资料（Profile）」：包括关于该客户的进一步信息，除其他事项外，还包括其姓名、出生日期、联系方式、国籍、居住国、身份证件号码；\n\t- (b)「充值（Deposits）」：列出该客户进行的充值详情，除其他事项外，包括 (i) 充值日期与时间；(ii) 充值金额；(iii) 交易所（Exchange）授权该笔充值24的个人；以及 (iv) 就该笔充值应向交易所支付的任何费用；\n\t- (c)「提现（Withdrawals）」：列出该客户进行的提现25详情，除其他事项外，包括 (i) 客户请求提现的日期与时间；(ii) 提现金额；以及 (iii) 就该笔提现应向交易所支付的任何费用；以及\n\t- (d)「风险评分（Risk Scoring）」：列出该客户的风险评分（如上文第 3.2.7(h) 段所载）、客户填写的 KYC（了解你的客户）问卷，以及交易所合规团队就该客户准入决策所作的批注。\n- 3.2.10 我们在下文图 3.4 至图 3.7 中列出了一个示例 HID26 的上述四个标签页的各自摘录。\n\n24 我们理解，向交易所进行的每笔充值均须经过两步授权程序，即充值须经两名个人授权后资金方可被接受。\n\n25「提现（Withdrawals）」与赎回（redemptions）同义。\n\n26 如上文第 1.4 节所述，我们获指示，我们所审阅的客户信息属于保密信息。因此，尽管我们审阅了 HEX 客户数据库（HEX Customer Database）中未经涂黑的信息，但我们获指示在本报告中必须将其涂黑。图 3.7 中的信息因此已被涂黑。\n\n关于 United States v Kwok, et al（美国 诉 郭文贵 等案）23 CR 118（SDNY / 纽约南区）中客户依据《联邦刑事诉讼规则》第 41(g) 条要求退还其 Himalaya Exchange（喜马拉雅交易所）资金之诉案\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）的独立法务法证审查\n\n图 3.4：HID 仪表板「个人资料」标签页所载信息示例27\n用户详情\n\n创建日期 | 已启用\n交易\n1904 |\n来源 已批准\n星期四\n现金 415 1 |\n用户树 已调用\n8600 |\n直接跳转 已记入 假\n|\n停止充值 假\n1944 14 |\n最后更新 停止交易 假\n**** |\n密码警报 停止\n假\n出生日期 提现授权\n强制要求 |\n1-4522 假\n\n修改密码 |\n地址 用户名 1 错误\n我们\n认证 |\n移动电话 包含 假\n地址行 1 启用访问\n地址行 2 假\n1 + Gar\n密钥 |\n居住国家\n\n州/省\n邮编\n国籍国家\n身份证件号码\n咨询 1\n最后批注人\n\n图 3.5：HID 仪表板「充值」标签页所载信息示例28\n\n![](_page_19_Figure_7.jpeg)\n\n图 3.6：HID 仪表板「提现」标签页所载信息示例29, 30\n* 2011年 [2] 2010 [2019/10/2019 12:11:13:10 [1] [1] 17/11/2017 [1] 14:14/2017 11/10/20 10/10/2019 10/11/2017 10/11/2017 10/1\n项目读取，关于可能生产产品的评论 | | |\n\n以及以及以及评论的评论的评论的评论\n紧迫的评论指挥官\n此类（月 频段\n呼叫状态 处于 处于 处于\n来自车站的输入数字 儿童加州相机相机儿童评论\n1 欢迎与 | 订购人 (R)。 | 166 |\n静音提示 其处于 (C 14\n点击\n12 阿勒公园\n市场研究案\n地区土地统计土地 | 查尔斯·桑内尔·M | 已添加 |\n\n27 证物 3.1\n\n28 证物 3.1\n\n29 为本示例选取的客户在截至我们完成工作之日尚未进行过任何提现。\n\n30 证物 3.1\n\n关于 United States v Kwok, et al（美国 诉 郭文贵 等案）23 CR 118（SDNY / 纽约南区）中客户依据第 41(g) 条要求退还其 Himalaya Exchange（喜马拉雅交易所）资金之诉案\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）的独立法务法证审查\n\n图 3.7：HID 仪表板「风险评分」标签页所载信息示例31\n\n文件 菜单 信息 查看 报告 管理 设置与翻译 分析 申请页面 风险评分 政策评分管理\n外部 ID\n人工风险评分\n总风险评分\n风险等级\nCOMPLY ADVANTAGE\nMTS\nCOMPLY ADVANTAGE\nLNR\n验证\n申请状态\n类别\n注资尝试次数\n\n风险评分更新历史\n日期与时间 姓名 角色 风险评分 风险等级\n\n31 证物 3.1\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）的独立法务法证审查\n4 指示 1：我们对交易所现行客户入驻（onboarding）流程及规程的理解\n4.1 引言\n\n- 4.1.1 除对 HEX 客户数据库进行审阅外，我们还参照交易所与相关期间（Relevant Period）有关的书面文件，力求确认交易所在客户入驻方面的现行流程。就此而言，我们收到了一份日期为 2022年6月、题为「客户入驻与合规流程演示」（即「入驻流程文件 / Onboarding Process Document」）的演示文稿32, 33。\n- 4.1.2 基于该入驻流程文件34，我们理解交易所的客户入驻包括四个关键阶段：\n\t- (a)「第 1 阶段」：客户注册；\n\t- (b)「第 2 阶段」：客户身份识别、核实与筛查；\n\t- (c)「第 3 阶段」：客户风险评估；以及\n\t- (d)「第 4 阶段」：客户准入批准或升级呈报。\n\n我们在第 4.2 节中详细阐述上述各个关键阶段。\n4.2 客户入驻流程的关键阶段\n第 1 阶段：客户注册\n\n4.2.1 为在交易所注册，新客户必须首先访问交易所网站35并选择「注册（Register）」标签页。我们在下文图 4.1 中列出了客户作为该注册流程一部分必须提供的信息摘录（即「关键注册信息 / Key Registration Information」）：\n\n32 证物 4.1\n\n33 我们获指示，交易所的合规政策正式记录在《合规手册》（Compliance Manual）中。由于我们的指示范围所限，该手册未为本报告之目的提供给我们。\n\n34 我们获指示，该入驻流程文件系为申请监管牌照之目的而编制，并基于《合规手册》以及相关期间现行的交易所政策和规程。35 网址为 http\n\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）的独立法务法证审查\nHIMALAYA EXCHANGE（喜马拉雅交易所） 支持 登录 注册 中文\n\n创建您的账户\n\n• 个人 • 企业\n法定名字及中间名 法定姓氏\n出生日期 日/月/年\n国籍 请选择 v\n居住国家 请选择 v\n地址\n城市 邮编\n\n图 4.1：交易所网站上的客户注册页面36\n\n- 4.2.2 重要的是，与国籍和居住国相关的问题为多选题（并由客户参照下拉列表填写）。我们理解，客户的居住国与交易所作出的客户准入决策特别相关，且交易所的政策是不接受居住在特定国家（例如包括美国在内）（即「受限国家 / Restricted Countries」）的客户37。受限国家未包含在上述下拉列表中，这意味着居住国为受限国家的个人将无法在交易所注册账户。\n- 4.2.3 客户提供其关键注册信息后，将被要求在交易所的安全在线门户上回答三个个人安全问题。设置这些安全问题的目的是「为身份验证流程增添一层额外的客户保护」38。\n\n36 如图 4.1 所示，分别有针对「个人（Individuals）」（亦称「个人（personal）」账户）和「企业（Corporates）」的独立注册页面。基于我们在此事项上的工作，我们理解超过 99% 的相关客户为个人，因此我们未考虑针对企业的客户入驻流程。\n\n37 就此而言，我们获指示 (i) 会定期审查受限国家名单，以确保交易所遵守全球监管要求；以及 (ii) 自交易所成立以来，美国一直被列入受限国家名单。38 证物 4.1，幻灯片 3\n\n关于 United States v Kwok, et al（美国 诉 郭文贵 等案）23 CR 118（SDNY / 纽约南区）中客户依据第 41(g) 条要求退还其 Himalaya Exchange（喜马拉雅交易所）资金之诉案\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）的独立法务法证审查\n第 2 阶段：客户身份识别、核实与筛查\n\n- 4.2.4 客户入驻流程中的第二个关键阶段在交易所的《入驻流程文件》中被称为「身份识别、核实与筛查（Identification, Verification and Screening）」。该阶段要求客户：\n\t- (a) 提供并核实其电子邮箱地址和电话号码；\n\t- (b) 填写 KYC 问卷，该问卷包含除其他事项外涉及客户个人详情、资金来源及其加密货币交易经验水平的大量多选题；以及\n\t- (c) 提交身份证件（即「身份证件 / ID Document」）并完成特定身份核实审查。\n- 4.2.5 我们将在下文依次提供关于上述每项要求的进一步详情。\n获取并核实客户的电子邮箱地址和电话号码\n\n- 4.2.6 为推进客户入职流程，客户须通过交易所（Exchange）的安全在线门户提供并验证其电子邮件地址和电话号码。关于以下内容的验证：\n\t- (a) 客户激活发送至其电子邮件地址的验证链接后，即完成其电子邮件地址的验证；以及\n\t- (b) 客户输入通过短信发送给其的 6 位数验证码后，即完成其电话号码的验证。\n- 4.2.7 此外，客户须确认其非美国、日本居民，非加拿大公民或居民，亦非任何其他其法律禁止持有或使用加密货币的司法管辖区的公民或居民。\nKYC（了解你的客户）问卷\n\n4.2.8 我们在下文图 4.2 中列出了 KYC 问卷中所包含问题的示例：\n\n关于美国诉 Kwok 等人案（United States v Kwok, et al），案号 23 CR 118 (SDNY（纽约南区）)，涉及要求返还其喜马拉雅交易所资金的 41(g) 条客户诉讼\nmazars\n\nMazars LLP（玛泽有限责任合伙）的独立法证审查\n\n图 4.2：KYC 问卷39\n出生地\n证件上的国籍\n请告诉我们您当前的就业状况。\n请告诉我们您的职业或商业活动。\n请告诉我们除您的税务登记地所在国之外，您可能在其他国家开展的业务？\n您的个人活动或业务是否在优惠税区（例如自由经济区、离岸管辖区）注册或开展？\n请告诉我们您以现金处理的个人或商业活动的年营业额。\n请告诉我们您以加密货币处理的个人或商业活动的年营业额。\n请告诉我们您的收入资金来源。如有必要，可勾选多个选项。\n请告诉我们您的财富来源？如有必要，可勾选多个选项。\n请选择您计划使用的服务。如有必要，可勾选多个选项。\n您计划每年存入多少资金（美元和加密货币合计）？\n请告诉我们资金将从哪些国家接收和/或转出。\n请告诉我们您在加密货币交易方面的经验水平？请选择一项：\n您有多少年的加密货币交易经验？\n您、您的直系亲属或密切关系人是否在任何国家或国际机构被赋予或曾被赋予显赫的公职？这可以是国内或海外的公职、政府职务、监管职务或高级军职。\n\n4.2.9 为完成 KYC 问卷，客户必须回答所有问题。根据客户对 KYC 问卷的回答，交易所会计算每位客户的风险评分（Risk Score），下文第 4.2.13 段及后续段落对此进行了更详细的描述。\n获取证明客户身份的文件\n\n- 4.2.10 我们获悉，交易所将客户身份证明文件（ID Documents）的收集和核验外包给了 Jumio。Jumio 是一个“人工智能驱动的身份核验平台”40，该平台“利用人工智能、机器学习和生物识别技术实现核验流程自动化，帮助企业提高转化率、遵守反洗钱（AML）和 KYC 法规并更好地检测欺诈行为——同时在数秒内给出明确的是/否决定”41。\n- 4.2.11 我们获悉，作为客户身份证明予以接受的身份证明文件包括护照、驾照或身份证。Jumio 随后核验 42：\n\t- (a) 身份证明文件为“真实且有效”；以及\n\t- (b) 使用人工智能（“AI”）驱动的人脸识别技术，通过将提供的身份证明文件与客户拍摄的实时照片进行比对，核验客户的身份。这包括确认“持证人[与]身份证件照片中显示的人为同一人”，以及“持证人[在]交易过程中亲自在场”。\n- 4.2.12 此外，交易所还代表交易所对潜在客户进行筛查，以识别是否属于政治公众人物（“PEP”）、受到制裁或存在负面媒体报道的任何个人。我们获悉，交易所使用第三方软件提供商“ComplyAdvantage”来开展此项筛查流程。\n阶段 3：客户风险评估\n\n4.2.13 在完成阶段 1 和阶段 2 后，交易所将评估所提供的信息，并为每位客户指定一个风险评级（Risk Rating），如上文第 3.2 节所述，该评级反映了交易所对接纳该客户入职相关风险的评估，且由客户的风险评分衍生而来。\n风险评分\n\n- 4.2.14 风险评分是一个介于 0 到 99 之间的数字，反映了交易所感知到的接纳某位客户的风险。风险评分越高，交易所感知到的接纳该客户入职的风险就越高。\n- 4.2.15 客户在 KYC 问卷中提供的每个回答都会根据交易所制定的风险模型被赋予一个风险评分。我们在下文图 4.3 中列出了交易所风险模型所涉及考量因素的概述。\n\n![](_page_25_Figure_10.jpeg)\n\n图 4.3：风险模型评估43\n\n43 证据 4.1，幻灯片 7\n\n关于美国诉 Kwok 等人案（United States v Kwok, et al），案号 23 CR 118 (SDNY（纽约南区）)，涉及要求返还其喜马拉雅交易所资金的 41(g) 条客户诉讼\nmazars\n\nMazars LLP（玛泽有限责任合伙）的独立法证审查\n风险评级\n\n- 4.2.16 风险评级分为“低”、“中”、“高”或“极高”，与风险评分的对应关系如下：\n\t- (a) 若客户的风险评分在 0 至 30 之间，则风险评级为“低”（“低风险”）；\n\t- (b) 若客户的风险评分在 31 至 59 之间，则风险评级为“中”（“中风险”）；\n\t- (c) 若客户的风险评分在 60 至 75 之间，则风险评级为“高”（“高风险”）；以及\n\t- (d) 若客户的风险评分在 76 至 99 之间，则风险评级为“极高”（“极高风险”）。\n阶段 4：客户接纳批准或上报\n\n- 4.2.17 交易所合规团队对每位客户入职流程的介入程度主要由分配给该客户的风险评级决定，其中：\n\t- (a) 若客户属于高风险或极高风险，合规团队须人工审查该客户的申请并予以接纳或拒绝；以及\n\t- (b) 若客户属于低风险或中风险，合规团队不一定须人工审查该客户的申请，但若发现合规问题，或作为交易所质量控制程序及持续合规监控的一部分，合规团队可以进行人工审查。\n- 4.2.18 我们在下文图 4.4 中更详细地列出了交易所的批准或上报流程。\n\n关于美国诉 Kwok 等人案（United States v Kwok, et al），案号 23 CR 118 (SDNY（纽约南区）)，涉及要求返还其喜马拉雅交易所资金的 41(g) 条客户诉讼\nmazars\n\nMazars LLP（玛泽有限责任合伙）的独立法证审查\n\n图 4.4：批准或上报流程44\n\n![](_page_27_Figure_5.jpeg)\n\n44 证据 4.1，幻灯片 8\n\n关于美国诉 Kwok 等人案（United States v Kwok, et al），案号 23 CR 118 (SDNY（纽约南区）)，涉及要求返还其喜马拉雅交易所资金的 41(g) 条客户诉讼\nmazars\n\nMazars LLP（玛泽有限责任合伙）的独立法证审查\n5 指示 2：我们对 HEX 客户数据库中相关客户账户的审查\n5.1 引言\n\n- 5.1.1 如上文第 1.3 节所述，我们获指示确认 HEX 客户数据库中是否存在每位相关客户的账户。\n- 5.1.2 我们执行该指示的方法是在 HEX 客户数据库中搜索客户诉讼明细表（Customer Action Schedule）中列出的 HID（如上文第 1.4 节所述，HID 是分配给每个客户账户的唯代码）。在此过程中，我们：\n\t- (a) 获取了 HEX 客户数据库中包含的某些信息的提取件165（“HEX 客户数据库下载件”）。我们在第 5.2 节中解释了我们获取 HEX 客户数据库下载件的过程以及为审查该文件的准确性所开展的工作；以及\n\t- (b) 确认了 HEX 客户数据库下载件上与相关客户对应的账户。我们在第 5.3 节中列出了我们的工作成果。\n5.2 HEX 客户数据库下载件\n\n- 5.2.1 如上文第 3.2 节所述，用户页面（User Page）提供了多项可据以搜索 HEX 客户数据库的标准，其中包括但不限于 HID、客户姓名、账户类型 46、客户层级（Tier）以及账户创建日期。\n- 5.2.2 使用用户页面，可以从 HEX 客户数据库中提取信息并将其下载为 Excel47 文件。\n- 5.2.3 生成 HEX 客户数据库下载件的过程如下 48：\n\n46 特别是用户页面中提供的与交易所归类为“第 1 层级”的所有客户有关的信息 46 为“个人”或“企业”\n\n47 Excel 是微软公司（Microsoft）的一款电子表格程序，使用户能够对电子表格中的数据进行格式化、整理和计算 48 如上文所述，我们在这方面的工作是由在我们和 CANDEY 的指导下具有相关系统访问权限的交易所人员开展的。我们对该任务的工作进行了指导和观察\n\n- (a) 步骤 1：我们试图获取 HEX 客户数据库中所有归类为“第 1 层级”的客户账户的提取件（即仅在用户页面的搜索标准中应用该筛选条件）49。这生成了 21,005 个账户的摘要信息；\n- (b) 步骤 2：为了从 HEX 客户数据库中提取此摘要信息，有必要将数据划分为较小的部分 50。我们根据特定时间段对数据进行了进一步筛选（即在筛选条件中应用账户创建日期的具体日期）。这些时间段为 51, 52：\n\t- (i) 自交易所成立之日 53 起至 2021 年 4 月 28 日。这生成了 3,395 个账户的摘要信息；\n\t- (ii) 自 2021 年 4 月 28 日至 2021 年 5 月 6 日。这生成了 2,989 个账户的摘要信息；\n\t- (iii) 自 2021 年 5 月 6 日至 2021 年 6 月 30 日。这生成了 3,159 个账户的摘要信息；\n\t- (iv) 自 2021 年 6 月 30 日至 2021 年 11 月 7 日。这生成了 3,253 个账户的摘要信息；\n\t- (v) 自 2021 年 11 月 7 日至 2021 年 11 月 30 日。这生成了 2,095 个账户的摘要信息；\n\t- (vi) 自 2021 年 11 月 30 日至 2022 年 3 月 31 日。这生成了 2,821 个账户的摘要信息；以及\n\t- (vii) 自 2022 年 3 月 31 日至 2023 年 12 月 15 日（我们完成工作的日期）。这生成了 3,293 个账户的摘要信息；\n- (c) 步骤 3：按照上述时间段下载数据后，我们将上述步骤 2 中描述的所有数据（即 HEX 客户数据库中归类为“第 1 层级”的所有客户账户）合并到一个电子表格中；以及\n\n49 我们从与交易所人员的交谈中了解到，所有相关客户均为“第 1 层级”客户。我们在工作过程中试图对此予以核实——见下文第 5.3 节\n\n50 由于 HEX 客户数据库无法支持提取与交易所所有“第 1 层级”客户相关的数据量\n\n51 下文列出的时间段是通过反复尝试确定的\n\n52 为确认我们没有因将数据筛选至特定时间段而“重复计算”任何天数，我们力求核对 (i) 每个时间段所获取信息的账户数量（即上述 (i) 至 (vii) 项的总和，相当于 21,005 个账户）；与 (ii) HEX 客户数据库中的 1 级（Tier 1）账户总数（同样相当于 21,005 个账户）。\n\n53 这是通过不在“创建起始日期”（Created Date From）筛选器中应用日期来实现的。\n\n- (d) 步骤 4：使用 Excel 分析功能 54，我们力求将《客户诉讼附表》（Customer Action Schedule）中的 HID 与《HEX 客户数据库下载文件》（HEX Customer Database Download）中的 HID 进行匹配。我们在第 5.3 节总结了我们在这方面的调查结果。\n\n- 5.2.4 为确认我们处理本项指示的方法是恰当的，我们对相关客户（Relevant Customers）中的 250 个样本 HID 进行了人工核对。这涉及观察交易所服务公司的人员（其拥有相关系统访问权限）在我们和 CANDEY 的指导下一次输入一个 HID，并确认该 HID 存在对应的账户（通过直接在 HEX 客户数据库上查看）。\n\n- 5.2.5 HID 样本由我们自行选择，并在开展工作时首次提供给交易所服务公司的人员，包括 55：\n\t- (a) 《客户诉讼附表》中的前 150 个 HID（“客户账户样本 1”）。我们最初计划对《客户诉讼附表》中包含的所有 HID 均执行此人工流程。然而，我们发现我们将无法在可用时间内完成工作。因此，我们询问了处理指示的其他方法，从而促使我们获取了《HEX 客户数据库下载文件》（如上所述）。\n\n对于客户账户样本 1，我们观察了交易所服务公司的人员在我们和 CANDEY 的指导下一次向 HEX 客户数据库中输入一个 HID，以确认 HEX 客户数据库中存在该 HID 的账户。我们在附录 5.1a 中列出了此项样本测试的结果；以及\n\n(b) 《客户诉讼附表》中包含的另外 100 个 HID 的样本（“客户账户样本 2”）。为了选择该 HID 样本，我们采用了使用系统抽样的非统计抽样方法，通过选取《客户诉讼附表》中每隔 34 个 HID 编号（排除前 150 项）来进行样本测试。\n\n对于客户账户样本 2，我们观察了交易所服务公司的人员在我们和 CANDEY 的指导下一次向 HEX 客户数据库中输入一个 HID，以确认 (i) 该 HID 在\n\n54 具体而言，Excel 功能“VLOOKUP”是数据分析中常用的搜索函数，可在电子表格中纵向识别并匹配特定数据。\n\n55 就目前而言，我们总共测试了 250 个 HID 的样本。若法院要求测试更广泛的样本，我们可以扩大测试范围。\n\n涉及 United States v Kwok, et al（美国诉郭文贵等案），案号 23 CR 118 (SDNY)（纽约南区联邦地区法院），关于要求返还其 Himalaya Exchange（喜马拉雅交易所）资金的 41(g) 客户诉讼\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）独立法证审查\n\nHEX 客户数据库中存在账户；以及 (ii) 《HEX 客户数据库下载文件》中的详细信息与 HEX 客户数据库中的信息相符 56。我们在附录 5.1b 中列出了此项样本测试的结果。\n\n5.2.6 在我们的样本中，我们未发现《HEX 客户数据库下载文件》上的信息与“人工”获取的信息（通过在“用户页面”中一次搜索一个 HID）之间存在任何差异。\n\n5.3 我们的工作结果\n\n- 5.3.1 利用《HEX 客户数据库下载文件》，我们力求确认：\n\t- (a) HEX 客户数据库中是否存在每位相关客户的账户；\n\t- (b) 该账户是“个人”账户还是“公司”账户；\n\t- (c) 该客户的级别（Tier）分类 57；以及\n\t- (d) 其账户创建的日期。\n\n- 5.3.2 我们在附录 5.2 中列出了我们在这方面的工作结果。总而言之，基于我们对 HEX 客户数据库中包含信息的审查，我们确认：\n\t- (a) 对于每位相关客户，HEX 客户数据库中均存在一个账户；\n\t- (b) 相关客户：\n\t\t- (i) 包括 3,521 个个人账户和 18 个公司账户；且\n\t\t- (ii) 均为 1 级客户；且\n\t- (c) 所有相关客户的账户均创建于 2021 年 4 月 23 日至 2023 年 8 月 22 日之间。\n\n56 特别是客户姓名、账户类型和客户“级别”。\n\n57 如上文第 3.2 节所述，HEX 客户数据库中的每位客户均参考其进行的客户入职阶段进行分类。\n\n涉及 United States v Kwok, et al（美国诉郭文贵等案），案号 23 CR 118 (SDNY)（纽约南区联邦地区法院），关于要求返还其 Himalaya Exchange（喜马拉雅交易所）资金的 41(g) 客户诉讼\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）独立法证审查\n\n6 指示 3：我们对相关客户样本的客户入职信息和财务数据的详细审查\n\n6.1 引言\n\n6.1.1 如上文第 1.3 节所述，我们获指示从《客户诉讼附表》中识别并抽样分离出一组相关客户样本，并针对该样本：\n\n- (a) 核实是否存在 KYC（了解你的客户）入职信息；\n- (b) 将《客户诉讼附表》中包含的财务数据与 HEX 客户数据库上的实时数据进行核对；以及\n- (c) 将相关客户进行的赎回与交易所的银行对账单进行核对。\n\n- 6.1.2 在本节中，我们列出：\n\t- (a) 我们用于选取待审查客户样本的方法（第 6.2 节）；以及\n\t- (b) 我们针对相关客户样本的客户入职信息和财务数据执行的程序（第 6.3 节）。\n\n6.2 样本选取方法\n\n- 6.2.1 就目前而言，我们总共测试了 50 个 HID 的样本（“KYC 及财务数据样本”）。与上文第 5 节中描述的方法一致，我们选取的样本在开展工作时首次提供给交易所服务公司的人员。若法院要求测试更广泛的样本，我们可以扩大测试范围。\n\n- 6.2.2 为了选取相关客户的样本，我们采用了使用系统抽样的非统计抽样方法，遵循以下步骤：\n\t- (a) 我们首先对《客户诉讼附表》中的 HID 编号顺序进行随机化：\n- (i) 使用 Excel 函数“=rand()”为每个 HID 编号分配一个随机生成的数字，该函数为《客户诉讼附表》中的每个 HID 编号生成一个介于 0 和 1 之间的随机数；\n- (ii) 重新计算 (i) 中的公式；以及\n\t- (iii) 根据 (ii) 中随机生成的数字，按由小到大的顺序对《客户诉讼附表》进行排序；以及\n- (b) 然后，我们在 (iii) 中选取《客户诉讼附表》中每第 71 个 HID 编号，以构成我们样本的一部分。\n\n- 6.2.3 《客户诉讼附表》包含 3,539 名客户，因此通过选取每第 71 个 HID，我们的样本由 50 名客户组成 58。\n\n6.3 我们针对相关客户样本执行的程序\n\n6.3.1 如上文所述，我们获指示同时审查 (i) 交易所针对相关客户样本获取的 KYC 信息；以及 (ii) 针对这些客户的特定财务信息。\n\n我们对交易所获取的 KYC 信息的审查\n\n- 6.3.2 对于我们样本中包含的每个 HID，我们审查了 HID 仪表板的“个人资料”（Profile）标签页，并审查了：\n\t- (a) HEX 客户数据库中每个 HID 是否存在账户；\n\t- (b) 账户是否已启用；\n\t- (c) 账户的级别；\n\t- (d) 账户是“个人”还是“公司”性质；\n\t- (e) 客户的全名、电子邮件地址、国籍和居住国；\n\t- (f) 客户的收入来源和财富来源；\n\t- (g) 分配给客户的风险评分和风险评级；以及\n\n58 71 x 50 = 3,550\n\n涉及 United States v Kwok, et al（美国诉郭文贵等案），案号 23 CR 118 (SDNY)（纽约南区联邦地区法院），关于要求返还其 Himalaya Exchange（喜马拉雅交易所）资金的 41(g) 客户诉讼\nmazars（玛泽）\nMazars LLP（玛泽有限责任合伙）独立法证审查\n\n- (h) 每位客户可用的身份证明文件以及 Jumio 进行的测试。\n\n- 6.3.3 我们在附录 6.1 中列出了我们在这方面的工作结果。总而言之，我们确认，对于构成我们样本一部分的每个 HID：\n\t- (a) HEX 客户数据库中存在账户；\n\t- (b) 交易所持有身份证明文件的副本，且这些文件已被 Jumio 验证为“真实” 60；以及\n\t- (c) Jumio 进行了人脸识别测试，正如上文第 4.2.11 段所述，其目的是确认持有身份证明文件的人 (i) 与身份证明照片中显示的为同一人；且 (ii) 在入职过程中亲自在场。\n\n- 6.3.4 此外，对于作为该样本一部分进行测试的每位客户，我们还在证据表 6.1（Exhibit 6.1）中附上了 HID 数据库上“风险评分”（Risk Scoring）标签页的摘录，其中包括每位客户对 KYC 调查问卷提供的答复，以及合规团队在其账户中添加的任何审查意见。\n\n我们对这些客户财务信息的审查\n\n- 6.3.5 对于我们样本中包含的每个 HID，我们审查了 HID 仪表板的“存款”（Deposits）和“提款”（Withdrawals）标签页，并力求将 HEX 客户数据库中的信息与《客户诉讼附表》中关于每位客户的以下信息核对一致：\n\t- (a) HCN 余额；\n\t- (b) HDO 余额；\n\t- (c) 总存款；以及\n\t- (d) 总赎回。\n\n- 6.3.6 关于此样本中客户执行的赎回，我们还力求将赎回金额与交易所的银行对账单核对一致 61。\n\n59 通过 Jumio\n\n60 对于我们样本中的每一个，我们力求确认身份证明文件上的姓名与 HEX 客户数据库中的姓名相符。虽然我们能够对样本中的大部分做到这一点，但有许多 HID 涉及中国公民，其身份证明文件和 HEX 客户数据库中的姓名均使用汉字。对于这些个人，我们确认了身份证明文件上的证件号码与 HEX 客户数据库中的证件号码相符。这项工作的详细信息见附录 6.1。\n\n61 涉及这些赎回的已涂黑遮蔽银行对账单已提供给我，并列于证据表 6.2。\n\n涉及 United States v Kwok, et al（美国诉郭文贵等案），案号 23 CR 118 (SDNY)（纽约南区联邦地区法院），关于要求返还其 Himalaya Exchange（喜马拉雅交易所）资金的 41(g) 客户诉讼\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）独立法证审查\n\n- 6.3.7 我们在附录 6.1 中列出了我们的工作结果 62。总而言之，我们确认：\n\t- (a) HEX 客户数据库中的 HCN 余额和 HDO 余额与《客户诉讼附表》中记录的金额一致（在考虑时间差异的情况下）。\n\n在这方面，在开展这项工作时，我们力求将《客户诉讼附表》（据指示其编制截止日期为 2023 年 11 月 10 日）中的财务数据与我们开展工作之日（2023 年 12 月 15 日）的“实时”HEX 数据库核对一致。鉴于在 2023 年 11 月 10 日至 2023 年 12 月 15 日期间存在 HCN 和 HDO 余额的持续交易活动，对于某些客户账户，存在调节项（涉及这些客户在此期间进行的交易）——当将这些交易考虑在内时，我们未发现 HEX 客户数据库中的 HCN 和 HDO 余额与《客户诉讼附表》相比存在任何差异；\n\n- (b) HEX Customer Database（喜马拉雅交易所客户数据库）中的总充值额与总赎回额与《Customer Action Schedule》（客户诉讼附表）中注明的金额一致；以及\n- (c) HEX Customer Database（以及《Customer Action Schedule》）中的总赎回额与提供给我们的交易所银行对账单一致。这些银行对账单包括：\n\t- (i) Mercantile Bank International Corp（“Mercantile Bank”，麦卡泰尔国际银行），我们理解其为一个“托管账户”65；以及\n\n62 如上文第 1.4 节所述，我们获指示，我们审阅的客户信息以及我们据以核实的底层 KYC（了解你的客户）文件均属保密信息。因此，虽然我们审阅了 HEX Customer Database 上的未隐匿信息，但我们获指示，就附录 6.1 中的信息而言必须进行隐匿，因此支持性文件（特别是证物 6.1 和 6.2）均已作隐匿处理\n\n63 我们已将上述各项对账项目与 HEX 数据库进行了核对确认。进一步详情载于附录 6.1\n\n64 提供给我们的银行对账单为交易所持有的银行对账单纸质复印件。我们获指示，由于扣押导致账户被关闭，交易所已不再拥有在线账户\n\n65 我们获指示，在扣押之前，Mercantile Bank 是交易所存放部分稳定币储备的合作银行之一（即“相关 Mercantile Bank 账户”）。我们还获指示，为了保障客户资金安全，相关 Mercantile Bank 账户为“托管人”账户，而非标准银行账户。就此而言，我们收到了一份题为《MERCANTILE BANK INTERNATIONAL CORP. ONLINE CUSTODY & BANKING SERVICES AGREEMENT》（麦卡泰尔国际银行在线托管与银行服务协议）、日期为 2022 年 9 月的文件（即“Mercantile Bank 托管协议”，证物 6.3），我们获指示该文件载明了适用于相关 Mercantile Bank 账户的条款与条件。我们未阅读 Mercantile Bank 托管协议的全部条款与条件，亦未接到对相关 Mercantile Bank 账户执行任何进一步程序的指示。我们获指示审阅 Mercantile 托管协议第 6.2 款，其中规定：“为了履行其作为托管人的职责，并在本协议限制的规制下，客户指示托管人：(i) 妥善保管转入‘托管资金’的法定货币和数字资产数额；(ii) 监控并维护托管资金；(iii) 按照本协议第 6.3 节管理托管资金；(iv) 就托管资金的存入、支付和投资保持及时且准确的记录；以及 (v) 按照本协议预期的频率和方式编制有关托管资金的定期报告并提供相关信息的获取途径”。我们还收到了一份日期为 2020 年 6 月的早期版本 Mercantile Bank 托管协议。\nmazars\n\nMazars LLP（玛泽有限责任合伙）独立法证审查\n\n(ii) FV Bank International INC（“FV Bank”，FV 国际银行，即“相关 FV Bank 账户”），我们理解其亦为一个“托管账户”66。\n\n我们已审阅两份文件的第 6.2 款，未发现这些条款存在任何差异。我们获指示，DoJ（司法部）对稳定币储备的扣押（部分）来自相关 Mercantile Bank 账户\n\n66 我们获指示，FV Bank 亦为交易所存放部分稳定币储备的合作银行之一（即“相关 FV Bank 账户”）。我们还获指示，为了保障客户资金安全，相关 FV Bank 账户为“托管人”账户，而非标准银行账户。就此而言，我们收到：(i) 一份题为《Custody Agreement [sic]》（托管协议 [原文如此]）、未注明日期（即“FV Bank 托管协议”，证物 6.4）的文件，我们获指示该文件载明了适用于相关 FV Bank 账户的条款与条件；以及 (ii) 一份题为《Business Account Application》（商业账户申请表）的文件（即“FV Bank 商业账户申请表”，证物 6.5），我们获指示该文件反映了交易所申请开立相关账户的情况。我们未阅读 FV Bank 托管协议的全部条款与条件，亦未接到对相关 FV Bank 账户执行任何进一步程序的指示。我们获指示审阅 FV Bank 托管协议第 22 页题为“陈述、保证与承诺”的章节，其中规定：“FV Bank 将妥善保管托管资产，并将所有托管资产的数据与以下两项进行隔离：(i) FV Bank 的财产，以及 (ii) FV Bank 客户的记录资产。FV Bank 是您存放在托管账户中托管资产的保管方，FV Bank 对该等托管资产不享有任何权利、权益或所有权，亦不会将该等托管资产作为资产反映在 FV Bank 的资产负债表上，但监管机构在特定会计报告中可能要求的除外。FV Bank 不得为您存放在托管账户中的托管资产设定担保物权。未经您签署协议同意 FV Bank 这样做，FV Bank 不得直接借出、质押、抵押或再抵押任何托管资产”。关于 FV Bank 商业账户申请表，我们获指示审阅第 1 页所列问题“在 FV Bank 开立银行账户的目的是什么？”。我们注意到，根据该文件，所声明的账户用途为“存放销售我们的喜马拉雅美元所得款项”。我们获指示，DoJ 对稳定币储备的扣押（部分）来自相关 FV Bank 账户\n\n关于 United States v Kwok, et al（美国诉郭等人案），案号 23 CR 118 (SDNY)（纽约南区），涉及客户依据《联邦刑事诉讼规则》第 41(g) 条要求返还其 Himalaya Exchange（喜马拉雅交易所）资金的诉讼\nmazars\n\nMazars LLP 独立法证审查\n7 指示 4：说明性客户入驻流程\n7.1 引言\n\n- 7.1.1 在本节中，我们阐述了在交易所执行的两项说明性客户入驻测试的观察结果。\n- 7.1.2 我们执行这些测试是为了评估上文第 4 节所述客户入驻流程的合规性。两项测试均在交易所的服务公司场所进行67，我们于 2023 年 12 月 14 日和 15 日访问了该场所。我们在 CANDEY（坎迪律师事务所）的指示事务律师当时亦在场。\n7.2 第一项说明性客户入驻测试\n\n- 7.2.1 第一项说明性客户入驻测试（“测试 1”）使用 United States（美国，受限国家）作为居住国和国籍国进行。测试 1 包括以下步骤：\n\t- (a) 访问交易所网站并选择“注册”标签页；\n\t- (b) 输入说明性关键注册信息，包括：\n\t\t- (i) 说明性姓名、出生日期和地址；\n\t\t- (ii) 尝试在国籍类别下拉列表中选择“美国”。然而，由于列表中没有美国的选项，此操作无法完成；以及\n\t\t- (iii) 尝试在居住国类别下拉列表中选择“美国”。然而，由于列表中没有美国的选项，此操作无法完成。\n- 7.2.2 如上文第 4.2.1 款所述，只有在提交了所有关键注册信息（必须包括客户的国籍和居住国）之后，新客户才能进入入驻流程的下一阶段。\n- 7.2.3 因此，测试 1 无法进入入驻流程的下一阶段，这符合我们对交易所客户注册政策的理解。\n\n67 就本报告而言，我们获指示不得披露交易所服务公司的地址\nmazars\n\nMazars LLP 独立法证审查\n7.3 第二项说明性客户入驻测试\n\n- 7.3.1 第二项说明性客户入驻测试（“测试 2”）使用 France（法国，不被视为受限国家）作为居住国和国籍国进行。测试 2 包括以下步骤：\n\t- (a) 访问交易所网站并选择“注册”标签页；\n\t- (b) 输入说明性关键注册信息，包括：\n\t\t- (i) 说明性姓名、出生日期和地址；\n\t\t- (ii) 在国籍类别下拉列表中选择“法国”；以及\n\t\t- (iii) 在居住国类别下拉列表中选择“法国”。\n- 7.3.2 一旦提交了上述说明性关键注册信息，测试 2 的后续步骤包括：\n\t- (a) 提供三个安全问题的答案；\n\t- (b) 提供并验证电子邮箱地址，在我们确认激活链接后电子邮箱地址即完成验证；\n\t- (c) 提供并验证电话号码，在我们输入 6 位验证码后电话号码即完成验证；以及\n\t- (d) 提供确认函，确认我们不是美国、日本的居民，亦不是加拿大或任何其法律禁止持有或使用加密货币的其他司法管辖区的公民或居民。\n- 7.3.3 完成上述步骤后，据我们理解，在客户入驻流程的此阶段，测试 2 说明性客户在交易所的 HEX Customer Database 上将被归类为“0 级”。根据我们对交易所入驻流程的理解，我们无法使用该说明性客户账户进行充值或交易。\n- 7.3.4 测试 2 的后续步骤包括：\n\t- (a) 完成 KYC 调查问卷，其中包括从多项选择题中选择选项；\n\n机密与秘密\n\n- 39 -\nmazars\n\nMazars LLP 独立法证审查\n\n- (b) 上传身份证件扫描件（在此情况下，我们上传了一份法国驾驶执照的正反面扫描件68）；以及\n- (c) 上传一张实时照片。\n- 7.3.5 交易所的入驻系统将我们的测试 2 标记为“自动拒绝”，因为关键注册信息上的姓名与所提供的身份证件不符。\n\n68 Mazars 团队一名成员的个人身份证件","key_entities":["Himalaya","Himalaya Exchange","Kwok","Je","William Je"],"ecf_references":[],"word_count":13378,"status":"published","published_at":"2023-12-21 00:00:00","created_at":"2023-12-21","updated_at":"2026-08-23 08:22:08"}