{"id":"court_sdny_207_3","court":"SDNY","case_no":"23-cr-00118","doc_number":207,"sub_number":3,"doc_type":"TRANSCRIPT","filed_date":null,"title":"Sam Harvey Claydon First 21 December 2023 IN THE MATTER OF UNITED STATES OF AMERICA -V- KWOK ET AL., S1 23 Cr. 118 (AT)","summary_zh":"证人陈述 —— 美国诉 Ho Wan Kwok（郭文贵 / Guo Wengui / Miles Guo）案，SDNY 1:23-cr-00118 ECF #207（2023年12月21日）。Himalaya Group法律代表提出证人陈述，说明Himalaya Exchange作为加密货币交易平台的运营情况、美国司法部调查中资金被没收的事实，及已认证客户根据联邦规则第41(g)条提交的资产返还动议。","summary_en":"Witness Statement —— United States v. Ho Wan Kwok (Miles Guo), SDNY 1:23-cr-00118 ECF #207 (21 December 2023). Legal counsel for Himalaya Group submits witness statement describing Himalaya Exchange's operation as a cryptocurrency trading platform, DOJ seizure of customer funds, and customers' filing of Rule 41(g) motion for return of assets.","body_en":"Sam Harvey Claydon First 21 December 2023\n\n## IN THE MATTER OF UNITED STATES OF AMERICA -V- KWOK ET AL., S1 23 Cr. 118 (AT)\n\n## WITNESS STATEMENT OF SAM HARVEY CLAYDON\n\nI, SAM CLAYDON, partner at CANDEY of 8 Stone Buildings, Lincoln's Inn, London WC2A 3TA WILL SAY AS FOLLOWS:\n\n#### Introduction\n\n- 1. (\"CANDEY\"). CANDEY is regulated by the Solicitors Regulation Authority as a law firm. I am also a solicitor-advocate (having obtained my higher rights certification in 2012), and a member of Lincoln's Inn as I hope to be called to the Bar during 2024. I have spent my career specialising in litigation, arbitration and investigations, with a particular focus on financial disputes. I have worked at a number of highly-regarded City firms on a number of market-leading cases. I am duly authorised to provide this witness statement on behalf of the Himalaya Group (as defined below).\n- 2. Given that this witness statement is not being given in English proceedings, I wish to make clear the significance attached the statement of truth that I have signed at the end of this statement. As a solicitor, I am an officer of the Court. I therefore owe various duties to the Court, including a duty not to mislead the Court in any way. I am also subject to a number of other regulatory duties, including the duties to act with independence, honesty and integrity.\n- 3. and is true. Where a matter is not within my own knowledge, I indicate the source of it and I believe it to be true.\n- 4. Nothing that I say in this witness statement is, or is intended to be, any waiver of privilege whatsoever.\n\n## Background\n\n- 5. Limited and Himalaya International Group Limited (together, the \"Himalaya Group\").\n- 6. Himalaya Exchange is a British Virgin Islands (\"BVI\") registered company, named Himalaya International Clearing Limited, trading as Himalaya Exchange (the \"Exchange\"). It operates a\n\nuser-to-user, centralised cryptocurrency exchange platform that consists of an engine that operates a continuously matched order book. in respect of virtual asset products. It is a platform for clients to trade, store and manage the Himalaya cryptocurrencies, namely the Himalaya Coin (\"HCN\") and the Himalaya Dollar (\"HDO\"). HCN is the Exchange's trading coin, a cryptocurrency priced by supply and demand. HDO is a stable coin, structured with the aim of maintaining its value at 1:1 to the US Dollar. Both coins are Ethereum-based tokens with backwards compatibility with the ERC- 20 standard.\n\n- 7. Himalaya International Reserve, and Himalaya International Financial Group are coin issuers. The HDO is issued by the Himalaya International Reserve and the HCN is issued by the Himalaya International Finance Group.\n- 8. ultimate beneficial owner of Himalaya Exchange, and others, in which it alleges that the Defendants perpetrated a fraudulent scheme through the Exchange (the \"DoJ Investigation\"). Mr Je and the Himalaya Group vehemently deny any wrongdoing whatsoever and are defending themselves to the full extent permitted by law in the DoJ Investigation.\n- 9. in cash USD in Himalaya Exchange accounts belonging to customers of the Exchange. This has caused hardship to those customers, many of whom were ordinary people who had invested their own money into the Exchange.\n- 10. On 6 December 2023, 3,539 customers of Himalaya Exchange (the \"Customers\") filed a motion pursuant to Federal Rule of Criminal Procedure 41(g) for the return of their property seized by the United States (the \"Customer Action\"). The Customer Action is led by Mr Bradford Geyer, a former employee of the DoJ. A website has been set up at himalayarestoration.com which contains further information regarding the Customer Action. The Customers have given their consent for the Exchange to pass on to Mr Geyer their details, including information pertaining to HDO and HCN balances, deposits and redemption information held in their Exchange account. Due to the serious safeguarding and risk of harm concerns this has been done using their unique Himalaya account number (\"HID\"). The Exchange provided the balances as at 10 November 2023 to Mr Geyer in the form of a schedule (the \"Customer Action Schedule\").\n- 11. The collective position of the Customers is that they are not the victims of any fraud and they have not suffered any losses at the hands of the Himalaya Group. They say that the only losses that they have suffered are as a result of the seizure of Customer deposits undertaken by the DoJ, following which the price of the HCN dropped significantly. Certain Customers have made public statements to the press about the deleterious effect that the seizure has had on their lives, which in certain cases has led to them being unable to access any of their money.\n- 12. The Himalaya Group supports the Customer Action given that it maintains that the DoJ seizure is unlawful and deposits should be returned to the Customers. I understand that the Himalaya Group has instructed two audits of its customer deposits that were undertaken by Armanino, both of which have shown that the Exchange held full reserves equivalent to the HDO they issued to the Customers.\n- 13. to its legal obligations to prevent loss or depreciation of those assets, which includes constant assessment of litigation risk for any failure to act that could result in substantial losses. The Exchange has, at all times, acted with integrity, and has a right to take the necessary steps to ensure that it meets its obligations to its customers.\n- 14. constitutes collusion with the Customer Action. These allegations are unprofessional and are wholly without merit or supporting evidence, as well as being vigorously denied by the Exchange, whose sole objective is to meet its obligations to its genuine customers. The Exchange obtains no benefit from the Customer Actions are influenced or directed by any Defendant or any other third party. Indeed; the Customer Action and Mr Geyer are both independent of the Exchange. The exchange takes any untrue or defamatory allegations seriously, and is prepared to take any steps necessary to defend its reputation.\n\n## CANDEY's Instruction\n\n- 15. exist. The Himalaya Group strenuously denies that allegation and avers that there is no factual basis whatsoever to make it. In relation to that, on 12 December 2023 the Himalaya Group instructed CANDEY to undertake an independent review to establish that, amongst other things and contrary to the incorrect assertions of the Customers do exist and have been onboarded as customers onto the Exchange in compliance with the Himalaya Group's stringent compliance procedures.\n- 16. On 13 December 2023, CANDEY instructed Mazars, in their capacity as forensic accountants, to undertake the following as part of an independent investigation (the \"Independent Review\"):\n\t- (a) Database\") in order to confirm and document the processes and procedures in place relating to customer onboarding at the Exchange;\n\t- (b) account on the HEX Customer Database;\n\t- (c)\n- verify the existence of \"know your client\" (\"KYC\") onboarding information; (i)\n- (II) verify the financial data contained in the Customer Action Schedule against the live data on the HEX Customer Database for this sample; and\n- (iii) rate of rate 1:1) by the Exchange to Customers (according to the Customer Action Schedule) against the bank statements of the Exchange; and\n- (d) limited to the United States.\n- 17. in the following paragraphs the extent to which we have done so. For that purpose, CANDEY attended the offices of a service company to Himalaya Exchange with authority to access the Himalaya Exchange database (\"admin panel\") on 14 and 15 December 2023 (I attended on both days, and a solicitor colleague attended with me on 14 December). The purpose of CANDEY's close supervision has been to ensure the integrity and independence of the Independent Review\n- 18. to all necessary information in order to undertake the Independent Review. No officer, employee or member of the service company, Himalaya Group or of any companies affiliated to the Himalaya Group has in any way influenced CANDEY or Mazar's work and both CANDEY and Mazars have been able to work unimpeded.\n\n#### Live and Independent Review of the Hex Customer Database\n\n- 19. Mazars and CANDEY were provided with access to the Hex Customer Database for the purpose of conducting a live and independent review of it, and to confirm and document the processes and procedures in place relating to customer onboarding at the Exchange, as well as to carry out a mock onboarding. These matters relate to \"Instruction 4\" in Mazars' Report.\n- 20. CANDEY participated in the process of opening an account with the Himalaya Group at http as more particularly described in Mazar's report at section 7.\n- 21. that database. In particular, CANDEY saw how an HID number is inputted and the information that is returned when an HID number is entered into the HEX Customer Database.\n\n22. CANDEY understands that access to the HEX Customer Database is restricted to users with the appropriate access privileges. For instance, the finance department can see top ups, redemption amounts and customer balances but cannot see any other information. Edit privileges are restricted to customer support managers, and senior managers. For other users, any editing button does not work.\n\n## Customer Registration and Verification\n\n- 23. The customer tier system was then explained to CANDEY in the context of the onboarding process. To register and become a customer of the Exchange, one must verify their email address and phone number with two factor authentication (\"2FA\"). Each customer is assigned an HID number1 when they have undergone the 2FA verification. 'No tier' means that the customer has an unverified email address and in such circumstances that customer would not be assigned an HID number.\n- 24. rejected. After that, a customer would be unable to create an account using that email address. A prospective customer would need to get in touch with customer service if they wished to reregister as a customer of the exchange using the same email address.\n- 25. zero' status. At this stage, no KYC checks have yet been undertaken and even if a customer never undertakes any of those KYC checks, he/she will remain 'tier zero'. Even if the customer goes through KYC and has been rejected, he/she will remain Tier zero.\n\n## KYC Process\n\n- 26. J The KYC process consists of a questionnaire, a face scan of the customer's identification documents (\"ID\") (both scans done using Jumio) and a ComplyAdvantage check.\n- 27. various KYC questions, including points about crypto trading experience, employment status etc. Answers are either selected from a drop down menu or multiple choice. For each answer, a numerical score is given which then, when added up, determines the risk level for that particular customer.\n- Any customer whose risk level is 59 or below is classified as low or medium risk. Those 28. customers (subject to passing their Jumio and ComplyAdvantage checks, as more particularly described below) are automatically approved.\n\n<sup>4 &</sup>quot;HID number\" (which is a unique account number attributed to each customer).\n\n- 29. profiles are escalated to a compliance analyst who must manually review the KYC questionnaire then, if the analyst is satisfied that the customer can be onboarded, the customer's application is escalated for approval to a compliance manager. The analyst must write and record in the system a risk summary statement for all applications requiring manual review by compliance as evidence of the analyst's overall evaluation and understanding of the applicant's risk profile.\n- 30. are escalated to a compliance analyst who must manually review the KYC questionnaire then, if the analyst is satisfied that the customer can proceed, the customer's application is escalated for approval to the Client Review and Onboarding Committee (which comprises senior decisionmakers).\n- 31. Jumio (http) is one of the market leading applications for AML and ID validations. A customer must pass a Jumio check to be onboarded as a customer, for which the customer must first provide a live scan of a government-issued ID. Once the customer inputs their government-issued ID (either using the camera on their PC or mobile device) Jumio also then checks their name using ComplyAdvantage (which is a market-leading tool that checks for any adverse media/online information) and their answers to the KYC questionnaire must match with the corresponding information on their ID. Jumio takes the data from the IDs and populates that information in the customer's profile. When performing the face scan, Jumio also confirms that the scan was being done 'live' rather than by use of a picture.\n\n## Verifying that each Customer has an Exchange account\n\n- 32. CANDEY were provided with the Customer Action Schedule and shared that with Mazars for the purposes of the Independent Review. As part of the experts' work in verifying that each of the Customers had an Exchange account on the HEX Customer Database (referred to as \"Instruction 2\" in Mazars' Report), CANDEY supervised the retrieval of the data for that purpose as I describe in further detail below.\n- 33. customers by way of a live export of data from the HEX Customer Database to an excel spreadsheet. Tier 1 customers are those customers who have passed all KYC and compliance checks and have been onboarded on to the Exchange. CANDEY saw the input of the search parameters into the HEX Customer Database, the corresponding live data that was then retrieved from those searches on screen, and the export which resulted in the creation of seven Excel spreadsheets. At this stage there was no manual intervention involved in the extraction of the data.\n- 34. The reason that seven Excel spreadsheets were created as a result of the data export was because the HEX Customer Database only allows for a limited number of items to be exported at one time. Under CANDEY's supervision, those seven spreadsheets were combined into one single spreadsheet by copying and pasting the data from each of those seven spreadsheets into one spreadsheet. CANDEY and Mazars verified that the total number of customers listed in the single consolidated spreadsheet added up to the same total as the number of customers in the seven separate spreadsheets.\n- 35. CANDEY then reviewed the columns within the consolidated spreadsheet. We observed that most of the information was irrelevant for the purposes of the Independent Review, but to minimise any manual intervention CANDEY instructed that no columns should be removed simply on the grounds of irrelevance. We then identified the columns that contained personal data that could identify any individual customer. Those columns were the following (the \"Personal Identifiers\"):\n\nusername; displayname; fullname; mobile; birthdate; lastcommentby; addressl1; addressl2; zip;firstmiddlename; iddocnumber; city.\n\n- 36. that deletion. The data still contains Each customer's \"HID\" number: this is a unique numerical identifier for each customer. The Customer Action Schedule also contains the HIDs of the Customers, a point to which I return below.\n- 37. spreadsheet, copying only the values rather than the underlying formulae. Again, CANDEY instructed and supervised this process.\n- 38. J The Customer Action Schedule was then used to identify the Customers from within the composite spreadsheet by using the VLOOKUP function with the customer HIDs. That resulted in the identification of customer HID matches from the Customer Action Schedule within the composite spreadsheet and highlighted them. All of the non-responsive (and thus non-highted) entries were then deleted to leave only the anonymised customer data for the HIDs appearing on the Customer Action Schedule. CANDEY then provided that spreadsheet to Mazars. All of this was done under CANDEY's instruction and supervision.\n\n## Identify and isolate a sample of the Customers to verify certain information in detail\n\n39. J. As part of \"Instruction 3\" in Mazar's Report, they have identified and isolated a sample of Customers to: (i) verify the existence of KYC onboarding information; (ii) verify the financial data contained in the Customer Action Schedule against the live data on the HEX Customer Database for this sample; and (iii) verify the redemptions paid (HDO stable coin redeemed back for USD at the rate of rate 1:1) by the Exchange to Customers (according to the Customer Action Schedule) against the bank statements of the Exchange,\n\n- 40. CANDEY witnessed the process undertaken to do that, which involved the use of the HEX Customer Database to retrieve the information held on each Customer one by inputting HIDs manually for each Customer in the sample.\n- 41. In relation to (i), CANDEY saw the process undertaken to retrieve the KYC onboarding information then to check that against the relevant Customer in the Customer Action Schedule.\n- 42. from the Hex Customer Database and check that against the financial data for that Customer contained in the Customer Action Schedule.\n- 43. contained within the Customer Action Schedule against the bank statements provided by the Exchange (such bank statements then being provided by CANDEY to Mazars).\n\n## Mock customer onboarding\n\n- 44. a mock client onboarding. We undertook a test with France as a country of residence and citizenship.\n- 45. prompted to select three questions from a drop-down list of several questions. All were the usual generic security questions. For instance, name of first school, favourite movie, favourite holiday destination etc.\n- 46. Then the system asked us for an email address and password, and to acknowledge that we are not in the US, Canada or Japan or any other jurisdiction that prohibits the holding of cryptocurrency. At that stage, the Exchange's terms and conditions must then be accepted as well as their privacy policy.\n- 47. Once that was complete, we then received an email asking us to click on it to verify the email address used for registration. When clicked, it took us to a page saying, \"Your account has been activated\".\n- 48. the 2FA process. Otherwise, we would be unable to access any functionality on the website.\n- 49. a confirmation code with six digits, which was valid for a few minutes. Once we entered it into\n\nthe website, we received a message saying that the mobile phone number was successfully verified.\n\n- 50. The website then displayed a 'complete verification' button. At this point the account did not have any functionality. We were then presented with a list of compliance questions. These are detailed questions around business activity/employment to determine the risk compliance score. We had to select where funds will be received and/or transferred from.\n- 51. Jo After that, we had to provide an ID to be scanned into Jumio. A passport, driver's licence or identity card are the only three acceptable options. A customer can use the camera on their PC or scan a QR code and use their phone, and we opted for the latter. Jumio also takes a face photo. The Mazars team member was immediately rejected because her ID did not match the details entered upon registration. The reason given by Jumio (which is only visible to the Exchange and not the customer) was: \"Full name differs from record.\"\n- 52. After that, a notification appeared on the profile and showed that the customer had been rejected. After clicking on the \"rejected\" button, the site then said that the customer failed the ID verification process.\n- 53. full correct name\". Notably, as we saw on the system, her risk score jumped significantly once her ID was rejected.\n- 54. Jumio also complyAdvantage check against her name at the same time. In our case the name entered was shown as having passed the checks and no adverse findings were highlighted.\n- 55. A test was also done to onboard as a US resident. The system did not have a US country selection and therefore no account could be opened.\n\n# STATEMENT OF TRUTH\n\nI believe that the facts stated in this witness statement are true. I understand that proceedings for contempt of court may be brought against anyone who makes, or causes to be made, a false statement in a document verified by a statement of truth without an honest belief in its truth.\n\nIllegible signature.\n\nSigned:\n\nName: Sam Claydon Dated: 21 December 2023","body_zh":"萨姆·哈维·克莱登（Sam Harvey Claydon） 第一份 2023年12月21日\n\n关于美利坚合众国诉郭文贵等人案（UNITED STATES OF AMERICA -V- KWOK ET AL.），案号：S1 23 Cr. 118 (AT)\n\n萨姆·哈维·克莱登的证人陈述书\n\n本人，萨姆·克莱登（SAM CLAYDON），系 CANDEY 律师事务所（地址：8 Stone Buildings, Lincoln's Inn, London WC2A 3TA）合伙人，特此陈述如下：\n\n引言\n\n1. （“CANDEY”）。CANDEY 作为一家律师事务所，受英国事务律师监管局（Solicitors Regulation Authority）监管。本人亦是一名出庭事务律师（于2012年取得高级出庭权认证），且为林肯律师学院（Lincoln's Inn）会员，因本人期望在2024年间取得大律师执业资格。本人的执业生涯一直专攻诉讼、仲裁及调查，尤其专注于金融争议。本人曾就职于数家备受推崇的伦敦金融城律师事务所，办理过多起行业领先的案件。本人已获得正式授权代表喜马拉雅集团（Himalaya Group，定义见下文）出具本证人陈述书。\n\n2. 鉴于本证人陈述书并非用于英国的诉讼程序，本人谨此阐明本人在陈述书末尾签署的真实性声明（statement of truth）所具有的重要意义。作为一名事务律师，本人系法院官员。因此，本人对法院负有各项义务，包括绝不以任何方式误导法院的义务。本人亦须遵守其他多项监管职责，包括保持独立、诚实和恪守诚信的义务。\n\n3. 且属实。对于非本人亲自知悉的事项，本人均已注明其来源，且确信其属实。\n\n4. 本人在本证人陈述书中所作的任何陈述均不构成、亦无意构成对任何特权的放弃。\n\n背景\n\n5. 有限公司与喜马拉雅国际集团有限公司（Himalaya International Group Limited，统称“喜马拉雅集团”）。\n\n6. 喜马拉雅交易所（Himalaya Exchange）是一家在英属维尔京群岛（British Virgin Islands，简称“BVI”）注册的公司，法定名称为喜马拉雅国际清算有限公司（Himalaya International Clearing Limited），以喜马拉雅交易所（下称“本交易所”）名义开展业务。该交易所运营一个用户对用户的中心化加密货币交易平台，该平台包含一个就虚拟资产产品运行持续撮合订单簿的引擎。该平台供客户交易、存储和管理喜马拉雅加密货币，即喜马拉雅币（Himalaya Coin，简称“HCN”）和喜马拉雅美元（Himalaya Dollar，简称“HDO”）。HCN 是本交易所的交易币，是一种根据供求关系定价的加密货币。HDO 是一种稳定币，其结构旨在将其价值保持在与美元 1:1 的水平。这两种代币均为基于以太坊（Ethereum）的代币，并向后兼容 ERC-20 标准。\n\n7. 喜马拉雅国际储备（Himalaya International Reserve）和喜马拉雅国际金融集团（Himalaya International Financial Group）为发币方。HDO 由喜马拉雅国际储备发行，HCN 由喜马拉雅国际金融集团发行。\n\n8. 喜马拉雅交易所的最终实益拥有人及其他人，其中指控被告通过本交易所实施了欺诈计划（下称“司法部调查”，DoJ Investigation）。余建明（Mr Je）先生及喜马拉雅集团坚决否认存在任何不当行为，并在法律允许的最大范围内在司法部调查中进行辩护。\n\n9. 存放在属于本交易所客户的喜马拉雅交易所账户中的美元现金。这给这些客户造成了困境，其中许多人是将自己的资金投入该交易所的普通人。\n\n10. 2023年12月6日，喜马拉雅交易所的 3,539 名客户（下称“客户群体”）依据《联邦刑事诉讼规则》（Federal Rule of Criminal Procedure）第 41(g) 条提起动议，要求归还被美国查扣的财产（下称“客户诉讼”，Customer Action）。该客户诉讼由美国司法部（DoJ）前雇员布拉德福德·盖耶（Bradford Geyer）先生带头提起。相关网站 himalayarestoration.com 已经建立，其中包含有关客户诉讼的更多信息。客户群体已同意本交易所将他们的详细信息转交给盖耶先生，包括其在交易所账户中持有的 HDO 和 HCN 余额、存款及赎回信息。出于对人身安全保护和受伤害风险的严重关切，此项工作是通过使用其唯一的喜马拉雅账号（“HID”）进行的。本交易所于 2023年11月10日 以明细表（下称“客户诉讼明细表”，Customer Action Schedule）的形式向盖耶先生提供了截至该日的余额情况。\n\n11. 客户群体的集体立场是：他们并非任何欺诈行为的受害者，亦未因喜马拉雅集团而遭受任何损失。他们表示，他们所遭受的唯一损失是司法部查扣客户存款所致，在此之后 HCN 的价格大幅下跌。部分客户已向媒体公开发表声明，陈述查扣行为对其生活造成的有害影响，在某些情况下已导致他们无法取用自己的任何资金。\n\n12. 喜马拉雅集团支持客户诉讼，因为该集团坚称司法部的查扣是不合法的，存款应退还给客户。据本人了解，喜马拉雅集团曾委托由阿玛尼诺（Armanino）对其客户存款进行过两次审计，两次审计均表明本交易所持有与其向客户发行的 HDO 等额的充足储备。\n\n13. 履行其防止这些资产遭受损失或贬值的法律义务，其中包括对因不作为而可能导致重大损失的诉讼风险进行持续评估。本交易所始终恪守诚信行事，并有权采取必要措施确保其履行对客户的义务。\n\n14. 构成与客户诉讼的串通。这些指控是不专业的，完全毫无根据或缺乏支持证据，且遭到了本交易所的坚决否认；本交易所的唯一目标是履行对其真实客户的义务。本交易所未从客户诉讼中获取任何利益，亦未受任何被告或任何其他第三方的施压或指使。事实上，客户诉讼和盖耶先生均独立于本交易所。本交易所严肃对待任何不实或诽谤性指控，并随时准备采取一切必要措施维护其声誉。\n\nCANDEY 接受委托情况\n\n15. 存在。喜马拉雅集团坚决否认该指控，并严正声明该指控完全没有任何事实依据。就此，2023年12月12日，喜马拉雅集团委托 CANDEY 进行一项独立审查，以查明（除其他事项外）与不实断言相反的是，客户确实存在，并且是按照喜马拉雅集团严格的合规程序注册成为本交易所客户的。\n\n16. 2023年12月13日，CANDEY 委托玛泽（Mazars）以法务会计师的身份开展以下工作，作为独立调查（下称“独立审查”，Independent Review）的一部分：\n(a) 数据库”），以确认并记录本交易所现行的与客户注册相关的流程和程序；\n(b) HEX 客户数据库上的账户；\n(c)\n(i) 核实“了解你的客户”（know your client，简称“KYC”）注册信息是否存在；\n(ii) 将该样本在客户诉讼明细表中包含的财务数据与 HEX 客户数据库上的实时数据进行核对验证；以及\n(iii) 将本交易所向客户（根据客户诉讼明细表）以 1:1 汇率兑换的款项与本交易所的银行对账单进行核对验证；以及\n(d) 仅限于美国。\n\n17. 在以下各段中阐述我们在多大程度上做到了这一点。为此，CANDEY 于 2023年12月14日 和 15日 前往喜马拉雅交易所的一家服务公司的办公地点，该公司拥有访问喜马拉雅交易所数据库（“管理后台”，admin panel）的权限（本人两天均出席，且一名事务律师同事于 12月14日 与本人一同出席）。CANDEY 进行严密监督的目的在于确保独立审查的完整性与独立性。\n\n18. 获取为开展独立审查所需的所有必要信息。该服务公司、喜马拉雅集团或喜马拉雅集团任何关联公司的任何高级管理人员、员工或成员均未以任何方式影响 CANDEY 或玛泽的工作，CANDEY 和玛泽均得以不受阻碍地开展工作。\n\n对 HEX 客户数据库的实时与独立审查\n\n19. 玛泽和 CANDEY 获得了访问 HEX 客户数据库的权限，以便对其进行实时且独立的审查，确认并记录本交易所现行的与客户注册相关的流程和程序，并进行模拟注册。这些事项涉及玛泽报告中的“第4项指令”（Instruction 4）。\n\n20. CANDEY 参与了在 http 网址开设喜马拉雅集团账户的过程，具体详见玛泽报告第 7 节中的描述。\n\n21. 该数据库。特别是，CANDEY 观察了 HID 号码的输入方式，以及当将 HID 号码输入 HEX 客户数据库时返回的信息。\n\n22. CANDEY 获悉，对 HEX 客户数据库的访问权限仅限于具有相应访问权限的用户。例如，财务部门可以看到充值、赎回金额和客户余额，但看不到任何其他信息。编辑权限仅限于客户支持经理和高级管理人员。对于其他用户，任何编辑按钮均不可用。\n\n客户注册与验证\n\n23. 随后，相关人员在注册流程的背景下向 CANDEY 解释了客户层级系统。要注册并成为本交易所的客户，必须通过双重身份验证（two factor authentication，简称“2FA”）验证其电子邮件地址和电话号码。每位客户在完成 2FA 验证后都会被分配一个 HID 号码。处于“无层级”（No tier）状态意味着该客户的电子邮件地址未经核实，在此种情况下该客户不会被分配 HID 号码。\n\n24. 被拒绝。此后，客户将无法使用该电子邮件地址创建账户。如果潜在客户希望使用同一电子邮件地址重新注册为本交易所的客户，则需要联系客户服务部门。\n\n25. 处于“零级”（tier zero）状态。在此阶段，尚未开展任何 KYC 审查，即使客户从未进行过任何此类 KYC 审查，其仍将保持为“零级”。即使客户进行了 KYC 审查且被拒绝，其仍将保持为“零级”。\n\nKYC 流程\n\n26. KYC 流程包括一份问卷、对客户身份证件（identification documents，简称“ID”）进行的人脸扫描（两项扫描均通过 Jumio 完成）以及 ComplyAdvantage 审查。\n\n27. 各种 KYC 问题，包括有关加密货币交易经验、就业状况等要点。回答方式为从下拉菜单中选择或单项/多项选择。每个回答都会赋予一个分值，汇总后即可确定该特定客户的风险等级。\n\n28. 任何风险等级在 59 分或以下的客户均被归类为低风险或中风险。这些客户（在通过 Jumio 和 ComplyAdvantage 审查的前提下，具体详见下文描述）将获得自动批准。\n\n“HID 号码”（分配给每位客户的唯一账号）。\n\n- 29. 档案将上报给合规分析师，分析师必须手动审查 KYC（了解你的客户）问卷；然后，如果分析师确信该客户可以入驻，该客户的申请将上报给合规经理进行审批。分析师必须为所有需要合规部门手动审查的申请在系统中撰写并记录一份风险总结陈述，作为分析师对申请人风险状况进行总体评估和理解的证据。\n\n- 30. 上报给合规分析师，分析师必须手动审查 KYC 问卷；然后，如果分析师确信该客户可以继续进行，该客户的申请将上报给 Client Review and Onboarding Committee（客户审查与入驻委员会，由高级决策者组成）进行审批。\n\n- 31. Jumio（http）是市场上用于 AML（反洗钱）和身份验证的领先应用程序之一。客户必须通过 Jumio 审查才能作为客户入驻，为此客户必须首先提供政府签发身份证件的实时扫描件。一旦客户输入其政府签发的身份证件（使用其个人电脑或移动设备上的摄像头），Jumio 随后还会使用 ComplyAdvantage（一种用于检查任何负面媒体/在线信息的市场领先工具）检查其姓名，并且其对 KYC 问卷的回答必须与身份证件上的相应信息相匹配。Jumio 从身份证件中获取数据并将该信息填入客户档案。在执行人脸扫描时，Jumio 还会确认扫描是“实时”进行的，而不是通过使用照片。\n\n核实每位客户均拥有交易所账户\n\n- 32. CANDEY 获提供了 Customer Action Schedule（客户诉讼明细表），并将其分享给 Mazars（玛泽）以用于 Independent Review（独立审查）。作为专家核实每位客户在 HEX Customer Database（HEX 客户数据库）上均拥有交易所账户的工作的一部分（在 Mazars 的报告中被称为“指令 2”），CANDEY 监督了为此目的而进行的数据调取，具体细节如下所述。\n\n- 33. 客户，通过将数据从 HEX 客户数据库实时导出到 Excel 电子表格的方式。1 级客户是那些已通过所有 KYC 和合规审查并已入驻交易所的客户。CANDEY 见证了搜索参数输入到 HEX 客户数据库的过程、随后在屏幕上从这些搜索中检索到的相应实时数据，以及最终生成七份 Excel 电子表格的导出过程。在此阶段，数据的提取没有涉及任何手动干预。\n\n- 34. 数据导出生成七份 Excel 电子表格的原因是 HEX 客户数据库每次仅允许导出有限数量的条目。在 CANDEY 的监督下，通过将这七份电子表格中每份的数据复制并粘贴到一个电子表格中，这七份电子表格被合并为一个单一的电子表格。CANDEY 和 Mazars 核实了在单一合并电子表格中列出的客户总数与七份独立电子表格中的客户数量总和相符。\n\n- 35. CANDEY 随后审查了合并电子表格中的各列。我们注意到大部分信息对于独立审查的目的而言是不相关的，但为了尽量减少任何手动干预，CANDEY 指示不得仅以不相关为由删除任何列。随后我们确定了包含可识别任何个别客户的个人数据的列。这些列如下（即“个人身份标识”）：\n\nusername（用户名）；displayname（显示名称）；fullname（全名）；mobile（手机号）；birthdate（出生日期）；lastcommentby（最后评论人）；addressl1（地址行 1）；addressl2（地址行 2）；zip（邮编）；firstmiddlename（名和中间名）；iddocnumber（身份证件号码）；city（城市）。\n\n- 36. 该删除。数据中仍然包含每位客户的“HID”编号：这是每位客户的唯一数字标识符。客户诉讼明细表也包含客户的 HID，关于这一点我将在下文再次提及。\n\n- 37. 电子表格，仅复制数值而非底层公式。CANDEY 再次指导并监督了这一过程。\n\n- 38. 随后，通过将客户 HID 与 VLOOKUP 函数结合使用，客户诉讼明细表被用于从复合电子表格中识别出客户。这使得复合电子表格中来自客户诉讼明细表的客户 HID 匹配项被识别并高亮显示。所有不相符（因此未高亮显示）的条目随后被删除，仅留下出现在客户诉讼明细表上的 HID 所对应的匿名化客户数据。CANDEY 随后将该电子表格提供给 Mazars。所有这些均是在 CANDEY 的指示和监督下完成的。\n\n识别并隔离客户样本以详细核实某些信息\n\n39. 作为 Mazars 报告中“指令 3”的一部分，他们已经识别并隔离了一组客户样本，以：(i) 核实 KYC 入驻信息的真实存在；(ii) 对照该样本在 HEX 客户数据库上的实时数据，核实客户诉讼明细表中包含的财务数据；以及 (iii) 对照交易所的银行对账单，核实交易所向客户支付的赎回款项（根据客户诉讼明细表，HDO 稳定币按 1:1 的汇率赎回为美元）。\n\n- 40. CANDEY 见证了为执行此操作而采取的过程，该过程涉及使用 HEX 客户数据库，通过手动输入样本中每位客户的 HID，逐一检索每位客户所保存的信息。\n\n- 41. 关于 (i)，CANDEY 见证了调取 KYC 入驻信息并对照客户诉讼明细表中的相关客户进行核对的过程。\n\n- 42. 从 HEX 客户数据库中，并对照客户诉讼明细表中该客户的财务数据进行核对。\n\n- 43. 包含在客户诉讼明细表中的数据与交易所提供的银行对账单进行核对（此类银行对账单随后由 CANDEY 提供给 Mazars）。\n\n模拟客户入驻\n\n- 44. 模拟客户入驻。我们进行了以法国作为居住国和国籍国的测试。\n\n- 45. 提示从包含若干问题的下拉列表中选择三个问题。全部都是常见的通用安全问题。例如，第一所学校的名称、最喜欢的电影、最喜欢的度假胜地等。\n\n- 46. 随后系统要求我们提供电子邮件地址和密码，并确认我们不在美国、加拿大或日本或任何其他禁止持有加密货币的司法管辖区。在那个阶段，必须接受交易所的条款与条件以及其隐私政策。\n\n- 47. 一旦完成，我们随后收到了一封电子邮件，要求我们点击它以验证用于注册的电子邮件地址。点击后，它将我们带到一个页面，上面写着“您的账户已激活”。\n\n- 48. 2FA（双重身份验证）过程。否则，我们将无法访问网站上的任何功能。\n\n- 49. 一个包含六位数字的确认码，有效期为几分钟。一旦我们将其输入到网站中，我们收到一条消息，称手机号码已成功验证。\n\n- 50. 随后网站显示了一个“完成验证”按钮。此时该账户没有任何功能。随后系统向我们展示了一份合规问题清单。这些是关于业务活动/就业的详细问题，以确定合规风险评分。我们必须选择资金将从何处接收和/或转出。\n\n- 51. 在此之后，我们必须提供一份身份证件以扫描进 Jumio。护照、驾驶执照或身份证是仅有的三种可接受的选项。客户可以使用其个人电脑上的摄像头，或扫描二维码并使用其手机，我们选择了后者。Jumio 还会拍摄一张面部照片。Mazars 团队成员立即被拒绝，因为她的身份证件与注册时输入的详细信息不符。Jumio 给出的理由（仅交易所可见，客户不可见）为：“全名与记录不符。”\n\n- 52. 在此之后，档案上出现了一条通知，显示该客户已被拒绝。点击“已拒绝”按钮后，该网站随后显示该客户未通过身份验证流程。\n\n- 53. 完整正确的姓名”。值得注意的是，正如我们在系统上看到的那样，一旦她的身份证件被拒绝，她的风险评分便大幅上升。\n\n- 54. Jumio 同时还对其姓名进行了 ComplyAdvantage 审查。在我们的案例中，输入的姓名显示已通过审查，且未被标记出任何负面调查结果。\n\n- 55. 还进行了一次作为美国居民入驻的测试。系统没有美国这一国家选项，因此无法开设账户。\n\n真实性声明\n\n我相信本证人陈述书中所述的事实是真实的。我理解，任何人如在由真实性声明所证实的文书中作出或致使作出其并不诚实确信其为真实的虚假陈述，均可能被提起藐视法庭的诉讼程序。\n\n签名处字迹无法辨认。\n\n签署：\n\n姓名：Sam Claydon 日期：2023年12月21日","key_entities":["Himalaya","Je","Himalaya Exchange","Geyer","Kwok","Bradford Geyer","CIPA"],"ecf_references":[],"word_count":3351,"status":"published","published_at":null,"created_at":null,"updated_at":"2026-08-23 07:33:22"}