{"id":"court_sdny_612_5","court":"SDNY","case_no":"23-cr-00118","doc_number":612,"sub_number":5,"doc_type":"UNKNOWN","filed_date":null,"title":"Independent forensic review\\nof Mazars LLP 21 December 2023","summary_zh":"第三方法务会计机构 Mazars LLP 出具的独立取证审查报告（作为附件提交于美国诉 Ho Wan Kwok（郭文贵 / Guo Wengui / Miles Guo）案，SDNY 1:23-cr-00118 ECF #612 项下）。报告落款日期为2023年12月21日，围绕依据联邦刑事诉讼规则41(g)就 Himalaya Exchange（喜马拉雅交易所）客户资金提出的返还动议，审查了 HEX 客户数据库、客户开户/KYC 流程，并对抽样客户的开户与交易记录做了详细核查。","summary_en":"Independent forensic review report by accounting firm Mazars LLP, submitted as an exhibit under ECF #612 in United States v. Ho Wan Kwok (Miles Guo / Guo Wengui), SDNY 1:23-cr-00118. Dated December 21, 2023, the report was prepared in connection with a Fed. R. Crim. P. 41(g) motion for return of Himalaya Exchange (HEX) customer funds, and examines the HEX customer database, customer onboarding/KYC procedures, and a detailed sample review of customer account and transaction records.","body_en":"Independent forensic review\\nof Mazars LLP\n\n21 December 2023\n\n\n\n### Casease3-i23001009-48FAT Dooowneent6202-5 Fitaled20200425Pageagef200f 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n### mazars\n\nIndependent forensic review of Mazars LLP\n\n## Contents\n\n| 1 | Introduction | 5 |\n|--------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------|\n| 1.1 | This matter | 5 |\n| 1.2 | Our experience | 5 |\n| 1.3 | Our instructions | 6 |\n| 1.4 | Access to the relevant information | 7 |\n| 1.5 | Structure of this report | 7 |\n| 1.6 | Scope of this report | 8 |\n| 2 | Executive Summary | 10 |\n| 2.1 | Introduction | 10 |\n| 2.2 | Our instructions | 10 |\n| 2.3 | Summary of our work and findings | 11 |\n| 3 | The HEX Customer Database | 15 |\n| 3.1 | Introduction | 15 |\n| 3.2 | Our understanding of the information available on the HEX Customer Database
that is relevant to our instructions | 15 |\n| 4 | Instruction 1: Our understanding of the processes and procedures in place
relating to customer onboarding at the Exchange | 22 |\n| 4.1 | Introduction | 22 |\n| 4.2 | Key stages in the customer onboarding process | 22 |\n| 5 | Instruction 2: Our review of the Relevant Customers' accounts on the HEX
Customer Database | 29 |\n| 5.1 | Introduction | 29 |\n| 5.2 | The HEX Customer Database Download | 29 |\n| 5.3 | The results of our work | 32 |\n| 6 | Instruction 3: Our detailed review of the customer onboarding information and
the financial data in respect of a sample of the Relevant Customers | 33 |\n| 6.1 | Introduction | 33 |\n| 6.2 | Sample selection methodology | 33 |\n| 6.3 | The procedures we performed in respect of the sample of the Relevant
Customers | 34 |\n| 7 | Instruction 4: Illustrative customer onboarding | 38 |\n| 7.1 Introduction | 38 | |\n| 7.2 First illustrative customer onboarding test | 38 | |\n| 7.3 Second illustrative customer onboarding test | 39 | |\n\n### Casease3-i23001009-48FAT Dooowneent6202-5 Fitaled20200425Pageagef30ff40f\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n### mazars\n\nIndependent forensic review of Mazars LLP\n\n### Casease3-i83001009-48FAT Dooowneent6202-5 Fitaled20200425Pageagef40ff 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n#### Appendices\n\n| Summary of our meetings with personnel of the service company of the Exchange | Appendix 1.1 |\n|---------------------------------------------------------------------------------------------|--------------|\n| Documents used in the preparation of this report | Appendix 1.2 |\n| The testing undertaken on the HEX Customer Database (Customer Account
Sample 1) | Appendix 5.1 |\n| The testing undertaken on the HEX Customer Database Download (Customer
Account Sample 2) | Appendix 5.1 |\n| Our review of the Relevant Customers' accounts on the HEX Customer Database | Appendix 5.2 |\n| The testing undertaken on the customer onboarding information and the financial | Appendix 6.1 |\n\n#### Exhibits\n\ndata in respect of a sample of the Relevant Customers\n\n| Example excerpts from the HEX Customer Database | Exhibit 3.1 |\n|--------------------------------------------------------|-------------|\n| Onboarding Process Document | Exhibit 4.1 |\n| Excerpts of the \"Risk Scoring\" tab on the HID Database | Exhibit 6.1 |\n| Extracts of bank statements of the Exchange | Exhibit 6.2 |\n| Mercantile Bank Custody Agreement | Exhibit 6.3 |\n| FV Bank Custody Agreement | Exhibit 6.4 |\n| FV Bank Business Account Application | Exhibit 6.5 |\n\n#### Case as a season a possible of the do comment of the diff a perfore to of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazaris Independent forensic review of Mazars LLP\n\n#### 1 Introduction\n\n#### 1.1 This matter\n\n- 1.1.1 We, Mazars LLP (\"Mazars\"), have been instructed by Candey Limited (\"CANDEY\"), the legal counsel for Himalaya International Clearing Limited (the \"Exchange\" or \"HEX\"). The Exchange is a British Virgin Islands registered company that operates a user-to-user, centralised cryptocurrency exchange platform for clients to trade, store and manage the Himalaya cryptocurrencies, namely the Himalaya Coin (\"HCN\") and the Himalaya Dollar (\"HDO\").\n- 1.1.2 The ultimate beneficial owner of the Exchange and its affiliated companies is Mr William Je (\"Mr Je\") against whom (along with two other defendants) criminal charges have been brought by the United States Department of Justice (\"DoJ\"), in the Southern District of New York. It is alleged in those proceedings, inter alia, that Mr Je perpetrated a fraudulent scheme through the Exchange. We understand that those charges are denied by Mr Je.\n- 1.1.3 As a consequence of those charges, we understand that certain assets of the Exchange have been seized by the DoJ, in particular the Exchange's HDO stable coin1 reserve®.\n- 1.1.4 We are instructed that:\n\t- (a) on 6 December 2023, 3,539 customers of the Exchange filed a motion pursuant to Federal Rule of Criminal Procedure 41(g) for the return of their property seized by the United States (the \"Relevant Customers\" and the \"Customer Action\")\"; and\n\t- (b) on 7 December 2023, the DoJ made representations asking the United States District Court to deny the relief sought by the Relevant Customers in the Customer Action. We are instructed that one of the reasons for this is that the customers in the Customer Action (who are described as \"purported customers\") are not genuine, with the implication that the Customer Action is, itself, a fiction.\n\n#### 1.2 Our experience\n\n1.2.1 The Mazars Group is an international, integrated, and independent organisation specialising in audit, advisory, accounting and tax services, with a direct presence in more than 95\n\n1 We understand that a \"stable coin\" is a type of cryptocurrency whose value is pegged to another asset class\n\n2 Which is held in USD\n\n3 The original number of the Relevant Customers was 3,345 at the time the Customer Action was filed. I am instructed that this number has since increased to 3,539\n\n## Case as a sea significant Document (2025) Finded 2020/02/25Page and of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars\n\nHazards\n\nIndependent forensic review of Mazars LLP\n\ncountries and territories drawing on the expertise of over 47,000 professionals. In the UK, Mazars has approximately 150 Partners and more than 2,500 employees.\n\n1.2.2 This report has been prepared by the Crisis & Disputes team in London. We are routinely instructed in the context of allegations of fraud, accounting irregularities, money laundering and misrepresentation, regulatory investigations and cash and asset tracing assignments. We have acted on behalf of regulators and prosecuting agencies (both in the UK and overseas) as well as on behalf of defendants. Our recent cases include instructions by the Financial Conduct Authority, relating to (i) its investigation into the collapse of a major authorised collective investment fund; and (ii) its decision to discontinue the shares of a UK publicly listed company.\n\n#### 1.3 Our instructions\n\n- 1.3.1 We have been provided with a schedule setting out information in respect of the each of the Relevant Customers (the \"Customer Action Schedule\")4. We understand that the Relevant Customers created their accounts on the Exchange between 23 April 2021 and 22 August 2023 (the \"Relevant Period\").\n- 1.3.2 Using the Customer Action Schedule, we have been instructed to undertake the following:\n\t- (a) conduct a live and independent review of the customer database (the \"HEX Customer Database\") in order to confirm and document the processes and procedures in place relating to customer onboarding at the Exchange (\"Instruction 1\");\n\t- (b) verify that each of the Relevant Customers included in the Customer Action Schedule has an Exchange account on the HEX Customer Database (\"Instruction 2\");\n\t- (c) identify and isolate a sample of the Relevant Customers from the Customer Action Schedule in order to:\n\t\t- (i) verify the existence of \"know your client\" (\"KYC\") onboarding information;\n\t\t- (ii) verify the financial data contained in the Customer Action Schedule against the live data on the HEX Customer Database for this sample; and\n\n4 Which we understand was provided to the legal representative of the Relevant Customers by the Exchange on 10 November 2023\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP\n\n- (iii) verify the redemptions made by the Relevant Customers (described as \"redemptions balance\" in the Customer Action Schedule) to the bank statements of the Exchange for this sample (\"Instruction 3\"); and\n- (d) carry out an illustrative onboarding application of choice, including but not limited to the United States (\"US\") (\"Instruction 4\").\n\n#### 1.4 Access to the relevant information\n\n- 1.4.1 Other than the write-up of our findings in this report, we carried out the majority of our work at the premises of the service company of the Exchange®, which we visited on 14 and 15 December 2023. Our instructing solicitors from CANDEY were also present at the same time. We set out a summary of our meetings with the Exchange and CANDEY in Appendix 1.1.\n- 1.4.2 The Customer Action Schedule does not contain the names of the Relevant Customers. Rather, customers are identified by unique Himalaya account numbers (\"HIDs\"). We are instructed that both the customer information that we have reviewed and the underlying KYC documents against which we have verified them are confidential and subject to data protection considerations. Therefore, whilst we reviewed unredacted information on the HEX Customer Database, we are instructed that it must be presented in redacted form for the purposes of this report.\n\n#### 1.5 Structure of this report\n\n- 1.5.1 The remainder of this report is structured as follows:\n\t- (a) in Section 2, we set out an Executive Summary of our work and findings;\n\t- (b) in Section 3, we set out an overview of our understanding of the information available on the HEX Customer Database;\n\t- (c) in Section 4, we address Instruction 1 by setting out our understanding of the processes and procedures in place relating to customer onboarding at the Exchange;\n\n5 Hamillon Capital Holding. We heve been instructed not to disclose the address of the Exchange for the purposes of this report or until a protective order is in place by the Court\n\nී During the course of our work, we undertook discussions with personnel of the Exchange's IT, Legal and Compliance teams. We are instructed to not disclose the names of these individuals for the purpose of this report for data protection and safeguarding the identity of staff\n\n- (d) in Section 5, we address Instruction 2 by describing the work we have undertaken to identify whether an account exists on the HEX Customer Database for each of the Relevant Customers:\n- (e) in Section 6, we address Instruction 3 by describing the work we have undertaken to confirm the customer onboarding information and the financial data held by the Exchange in respect of a sample of the Relevant Customers; and\n- (f) in Section 7, we address Instruction 4 by describing the illustrative customer onboarding application we have undertaken.\n\n#### 1.8 Scope of this report\n\n- 1.6.1 We set out at Appendix 1.2 a list of the information and documents that we have used in the preparation of this report.\n- 1.6.2 It should be noted that the work we have completed does not constitute an audit and, other than as expressly set out in this report, we have not verified or in any other way checked the information set out in the documents we have reviewed. This is our standard approach in matters of this nature, unless expressly instructed to give an opinion on the authenticity of underlying documents.\n- 1.6.3 We have prepared this report in connection with the Customer Action filed in the US District Court. It is confidential in all respects other than to be made available to CANDEY, the Exchange, the legal representative of the Relevant Customers, the DoJ and the United States District Court. This report should not be used, reproduced or circulated for any other purpose without our prior written consent. Mazars accepts no responsibility to third parties in relation to the matters in this report and / or for any breaches of this obligation.\n- 1.6.4 This report reflects our understanding of matters of law but expresses no opinion on them as they are not for us to determine.\n- 1.6.1 We have not been instructed to prepare this report in accordance with the English Civil Procedure Rules (and in particular Part 35), the U.S. Federal Rules of Civil Procedure and the U.S. Federal Rules of Criminal Procedure, which would apply to expert reports adduced in proceedings in England and Wales and the United States respectively. Nevertheless, we have adopted protocols applicable to an expert preparing a report for such purposes. In this regard:\n\n## Casease3-23-23-00-1009-19FAT Doogwment6202-5 FFFddd.02/01/25Page2gef9/0f 40 In the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP\n\n- (a) the opinions set out in this report reflect our independent opinions based on the evidence provided to us;\n- (b) we have exercised reasonable care and skill in order to be accurate and complete in preparing this report; and\n- (c) we confirm that we have not entered into any arrangement where the amount or payment of our fees is in any way dependent on the outcome of the case.\n\n### Case as a sea a comment on of the do and of the di 04/04/25 age alle of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazails\n\nIndependent forensic review of Mazars LLP\n\n#### મા Executive Summary\n\n#### 2.1 Introduction\n\n- 2.1.1 We, Mazars, have been instructed by CANDEY, the legal counsel for the Exchange. The ultimate beneficial owner of the Exchange and its affiliated companies is Mr Je against whom (along with two other defendants) criminal charges have been brought by the DoJ in the Southern District of New York. It is alleged in those proceedings, inter alia, that Mr Je perpetrated a fraudulent scheme through the Exchange. We understand that those charges are denied by Mr Je.\n- 2.1.2 As a consequence of those charges, we understand that certain assets of the Exchange have been seized by the DoJ, including the Exchange's stable coin reserves.\n\n#### 2.1.3 We are instructed that:\n\n- (a) on 6 December 2023, the Relevant Customers filed the Customer Action (a motion pursuant to Federal Rule of Criminal Procedure 41(g) for the return of their property seized by the United States; and\n- (b) on 7 December 2023, the DoJ made representations asking the United States District Court to deny the relief sought by the Relevant Customers in the Customer Action. We are instructed that the basis of this is, inter alia, that the customers in the Customer Action are not genuine, with the implication that the Customer Action is, itself, a fiction.\n\n#### 22 Our instructions\n\n- 2.2.1 Using the Customer Action Schedule, we have been instructed to undertake the following:\n\t- (a) conduct a live and independent review of the HEX Customer Database in order to confirm and document the processes and procedures in place relating to customer onboarding at the Exchange (\"Instruction 1\");\n\t- (b) verify that each of the Relevant Customers included in the Customer Action Schedule has an Exchange account on the HEX Customer Database (\"Instruction 2\");\n\t- (c) identify and isolate a sample of the Relevant Customers from the Customer Action Schedule in order to:\n\t\t- (i) verify the existence of KYC onboarding information;\n- (ii) verify the financial data contained in the Customer Action Schedule against the live data on the HEX Customer Database for this sample; and\n- (iii) verify the redemptions made by the Relevant Customers (described as \"redemptions balance\" in the Customer Action Schedule) to the bank statements of the Exchange for this sample (\"Instruction 3\"); and\n- (d) carry out an illustrative onboarding application to any jurisdiction of choice, including but not limited to the US (\"Instruction 4\").\n\n### 2.3 Summary of our work and findings\n\n- 2.3.1 Other than the write up of our findings in this report, we carried out the majority of our work at the premises of the service company of the Exchange, which we visited on 14 and 15 December 2023. Our instructing solicitors from CANDEY were also present at the same time. During this time, we conducted a live review of the HEX Customer Database, which was undertaken by personnel of the service company of the Exchange who have the relevant system access at our and CANDEY's direction.\n- 2.3.2 A summary of our work and findings is set out below:\n\nInstruction 1: Our understanding of the processes and procedures in place relating to customer onboarding at the Exchange\n\n- 2.3.3 We understand that customer onboarding at the Exchange comprises four key stages:\n\t- (a) \"Stage 1\": Customer registration, whereby the customer provides personal details including name, date of birth, citizenship and country of residence. We understand that it is the Exchange's policy that individuals resident in certain countries are not permitted to open accounts on the Exchange. These \"Restricted Countries\" include the United States :\n\t- (b) \"Stage 2\": Customer identification, verification and screening, which requires the customer to:\n\t\t- (i) provide and verify their email address and phone number;\n\n1 In this regard, we are instructed (i) that the list of Restricled Countries is reviewed on a regular basis to ensure the Exchange is compliant with global regulatory requirements; and (ii) that the US has been included in the list of Restricted Countries since the Inception of the Exchange\n\n- (ii) complete a \"KYC Questionnaire\", which consists of numerous® multiple-choice questions relating to, inter alia, the customer's personal details, the source of their funds and their level of experience with cryptocurrency trading; and\n- (iii) submit an identification document and complete certain identity verification checks. In this regard, the Exchange outsources the collection and verification of customer ID documents to a third party, Jumio Corporation (\"Jumio\")®. Jumio services include (i) verifying that the ID document is \"authentic and valid\"; and (ii) verifying the customer's identity by comparing the ID Document provided with a live photo taken by the customer, using artificial intelligence powered facial recognition.\n\nIn addition to this, the Exchange undertakes screening of prospective customers, to identify any individuals that are Politically Exposed Persons, subject to sanctions or subject to adverse media. We understand that the Exchange utilises a third party software provider, \"ComplyAdvantage\" to undertake this screening process;\n\n- (c) \"Stage 3\": Customer risk assessment, where the Exchange will assess the information provided and assign a \"Risk Rating\" to each customer which reflects the Exchange's assessment of the risk associated with onboarding that customer and is derived from the responses provided by the customer in the KYC Questionnaire; and\n- (d) \"Stage 4\": Customer acceptance approval or escalation, where the involvement of the Exchange's compliance team in the onboarding process for each customer is triggered by the Risk Rating assigned to that customer.\n\nInstruction 2: Our review of the Relevant Customers' accounts on the HEX Customer Database\n\n- 2.3.4 We are instructed to verify that each of the Relevant Customers has an Exchange account on the HEX Customer Database. Based on our review of the information contained in the HEX Customer Database, we identified that:\n\t- (a) for each of the Relevant Customers, an account exists in the HEX Customer Database;\n\t- (b) the Relevant Customers:\n\t\t- (i) comprise 3,521 personal accounts and 18 corporate accounts: and\n\nBetween 8 and 16 questions\n\n9 Which is an \"Al-driven identity verification platform\". http\n\n### Case as a sea a do a loo anneen to of the di 04/04/25 a geal en 20 f 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n- (ii) are all \"Tier 1\" customers 10; and\n- (c) all of the Relevant Customers' accounts were created between 23 April 2021 and 22 August 2023.\n\nInstruction 3: Our detailed review of the customer onboarding information and the financial data in respect of a sample of the Relevant Customers\n\n- 2.3.5 We are instructed to identify a sample of our choosing of the Relevant Customers from the Customer Action Schedule and, for that sample, to (i) verify the existence of KYC onboarding information; (ii) verify the financial data contained in the Customer Action Schedule against the live data on the HEX Customer Database; and (iii) verify the redemptions made by the Relevant Customers (according to the Customer Action Schedule) to the bank statements of the Exchange.\n- 2.3.6 For each HID that forms part of our sample, we identified:\n\t- (a) in respect of the KYC information obtained by the Exchange:\n\t\t- (i) an account exists in the HEX Customer Database:\n\t\t- (ii) the Exchange holds copies 11 of an ID document, which have been verified by Jumio as being \"authentic\"; and\n\t\t- (iii) a facial recognition test was undertaken by Jumio, the purpose of which is, as noted in paragraph 4.2.11 below, to confirm that the person holding the ID is (i) the same person shown in the ID photo; and (ii) physically present during the onboarding process, and\n\t- (b) in respect of the financial information in respect of these customers:\n\t\t- (i) the HCN balance and HDO balance in the HEX Customer Database agreed to the amounts noted in the Customer Action Schedule 12;\n\n10 Which, based on our understanding of the Exchange's policy reflects customers who have been onboarded as customers of the Exchange, meaning (i) the customer has created an account with the Exchange; (ii) the contact, detalls; (ii) the Exchange has vently in accordance with its client acceptance procedures; and (iv) the customer has either been auto-approved based on the information they provided or, following escalation to compliance personnel, has been manually approved\n\n11 Via Jumio\n\n12 As at the date the Customer Action Schedule was complied. As explained further in Section 6 below, our work in agreeing the financial data in the Customer Action Schedule was to a \"live\" database. Given there was ongoing trading activity of HCN and HDO balances between the date of the Customer Action (which we are instructed was 10 November 2023) and the date of our work (which was 15 December 2023), for certain customer accounts, there were reconciling items. This is explained futher in Section 6 below\n\n## Case as a sea a comment on our meent on the de comment of 4 of 40 In the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP\n\n- (ii) the total deposits and total redemptions in the HEX Customer Database agreed to the amounts noted in the Customer Action Schedule; and\n- (iii) the total redemptions in the HEX Customer Database (and the Customer Action Schedule) agreed to the Exchange's bank statements that were provided to us.\n\n#### Instruction 4: Illustrative customer onboarding\n\n- 2.3.7 We are instructed to carry out an illustrative onboarding application to any jurisdiction of choice, including but not limited to the United States. Our findings in relation to the two illustrative customer registrations and onboardings we undertook is in line with our understanding of the Exchange's customer registration policy. In particular:\n\t- (a) one illustrative customer onboarding test would not permit the creation of an account on the Exchange or progression to the next stage of the onboarding process due to the customer's citizenship and / or country of residence being the United States; and\n\t- (b) one illustrative customer onboarding test permitted the creation of an account on the Exchange, but did not permit progression to the next stage of the onboarding process due to the name on the customer registration forms not matching the identification document provided.\n\n#### Case as as a sea a do a meento of the di 04/04/25 age at of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\nmazars\n\nIndependent forensic review of Mazars LLP\n\n#### The HEX Customer Database 3 -\n\n#### 3.1 Introduction\n\n- 3.1.1 The HEX Customer Database is the \"back-end\" 13 collection of data in respect of customers of the Exchange. It contains records of, inter alia:\n\t- (a) the virtual assets held by each customer;\n\t- (b) the deposits, redemptions and trading activity of each customer; and\n\t- (c) the customer's personal information, including records of KYC procedures undertaken in respect of each customer.\n- 3.1.2 As noted in Section 1.4 above, in order to address our instructions, we visited the premises of the service company of the Exchange on 14 and 15 December 2023, along with representatives from CANDEY. During this time, we conducted a live review of the HEX Customer Database in order to provide the necessary context for us to address our instructions. This was undertaken by personnel of the service company of the Exchange who have the relevant system access, at our and CANDEY's direction. The information set out in this Section is based on that live review.\n- 3.1.3 In this Section, we set out an overview of our understanding of the information available on the HEX Customer Database14.\n\n### 3.2 Our understanding of the information available on the HEX Customer Database that is relevant to our instructions\n\n#### The HEX Customer Database Dashboard\n\n3.2.1 We set out in Figure 3.1 below an excerpt of the \"Dashboard\" of the HEX Customer Database (the \"HEX Customer Database Dashboard\") 15. We understand that this is often referred to by the personnel of the service company of the Exchange as the \"admin panel\".\n\n13 Meaning the Information that is not directly accessible by the customer, but rather specific individuals within the Exchange who have been granted access to this information\n\n14 Importantly, we have not been instructed (and therefore have not sought) to consider the integrity or operational effectiveness of the HEX Customer Database. Any reference to how the HEX Customer Database operates is therefore based on the information we observed during the course of our work\n\n15 All excerpts from the HEX Customer Database are provided in Exhibit 3.1\n\n## Casease3-23-23-001008-18FAT Doogwiesn16207-3 FFF4ed 202014025Pagealfoo100f 40 In the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP\n\nFigure 3.1: The HEX Customer Database Dashboard16\n\n| Dashboard
(Alla the nice and consistence program and many manufacturer procession in Mondone in a Monday on manufactures and mailing in university of the million in an allano in unitie | |\n|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------|\n| Clars | |\n| Complete a manufaction on and the lines to the news proventively projects projects (control strans to mail security of the not a new lower to mail and a minist in result sens
Transalana | |\n| The PARINCIPLY BARDY READS PHIL
But Child Charles Planel Starting and Burney Bearing on Be proved from Be votim and WESSED AND
Microsoft | |\n| The factor mystell and more and the program procession of the first and the first for the fall the fall Photos and Philips and Philips per Young
Cenna | |\n| Pre Consistant Corner Corporation Commended and Commend Commend Corp. Don't e entimat Carlinat Carlinat Cori. Partin Corp. Program Pressunt Pressure Pression Proprises (Promo | |\n| SURNER MARK CHOOL BOOK STATE SEAN COLUMN AN VALUE STATUS STATES PORTER BARDER
1998 11991 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 111 111 111 111 111 111 1110 11
Det Selers | |\n| STORES THE PERSONAL PRESERVED PORTERS CONTRACTION TO PERSONAL SECTION PRODUCTION PRODUCTION PRODUCTION PRODUCTION CONSTITUTION PRODUCTION CONSTITUTION PRODUCTION CONSTITUTION
Administ | A Social a Firms between in |\n| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | |\n\n- 3.2.2 As shown in Figure 3.1, there are a number of functionalities in the HEX Customer Database Dashboard (including the ability to view, inter alia, \"Transactions\", \"Markets\" and \"Coins\"). Of particular relevance to our instructions is the functionality \"Users\" which, as described on the HEX Customer Database Dashboard, \"will allow you to see the number of users on your exchange and their details from username, to email address to exploit attempts. User - > Balances will allow you to see what cryptocurrency each user is holding and the quantity\"17.\n- 3.2.3 We refer to this as the \"User Page\".\n\n#### The User Page\n\n3.2.4 We set out in Figure 3.2 below an excerpt of the User Page.\n\nFigure 3.2: The User Page 18\n\n| 10\" (2005-1449) -
Users | | |\n|---------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------|\n| 1 1 1 26:00
AAXIIIyasini au
(184) = ( | (-) (-- 1) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) ==
【 】 】 】 【 】 【 】 】 【 】 【 】 】 【 】 【 】 】 】 【 】 【 】 】 】 【 】 】 】 【 】 】 】 【 】 】 】 【 】 】 】 【 】 】 】 【 】 】 】 【 】 】
二、三三四五十六元,五重三五月四十二 | 100 10-500
1944 |\n| Pidesial Calw Fries | M-200/Net-12 | |\n\n- 3.2.5 From Figure 3.2 above it can be seen that the User Page provides a number of criteria by which one can search the HEX Customer Database (including, inter alia, the HID, name of the customer, date of creation of the account).\n- 3.2.6 We set out in Figure 3.3 below an example of the type of information available on the User Page for each HID.\n\n16 Exhibit 3.1\n\n17 Exhibit 3.1\n\n18 Exhibit 3.1\n\n#### Case as a sea a comment on our meent 6 or - Find of 2014 a 2014 a 2017 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nFigure 3.3: Example of the type of information available on the User Page for each HIDTS\n\n| Users | | | | | |\n|-------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------|--|------|---------------|\n| (80,41) Therevi
BOWThilder =
L'allegan an | Carl ( Research)
· Pager or anyant . a fiel The . a summer .
· Includes == 10) = 14,5-7 1,6210 == 17 == 11 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == | I haven' with 2014 11/2 \" . \" Sheet direct per di \" | | | alley
1675 |\n| Contined Close Miller
Commill I == 10 % | a sept of the care | | | 12.7 | |\n\n- 3.2.7 As demonstrated in Figure 3.3 above, when a HID is input into the User Page, it provides a summary overview of the customer. In particular, it sets out:\n\t- (a) the \"Type\" of account related to that HID. We understand that an account can be either:\n\t\t- (i) \"personal\", meaning the customer is an individual, and using the account for personal purposes; or\n\t\t- (ii) \"corporate\", meaning the account is being used on behalf of a corporate entity.\n\nWe understand that the key difference between these types of accounts, for the purposes of our instructions, is the onboarding procedures that the Exchange undertakes in respect of these customers;\n\n- the name of the customer; (b)\n- (c) the date the account was created (as indicated in the column \"Created\"). We understand that the Exchange website began accepting customers from April 2021;\n- (d) information as to the status of the account, for example if it is \"Enabled\", \"Approved\", \"Locked\" or \"Deleted\";\n- (e) high-level information as to the activity of the account, for example if the customer has deposited funds, traded HCN or HDO or withdrawn funds (as indicated in the columns \"Deposit\", \"Trade\" and \"Withdraw\" respectively);\n- (f) the communication preferences of the customer (for example if they have agreed to be communicated with \"Online\", via \"Newsletter\" or via \"SMS\"):\n\n19 Exhibit 3.1\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n- (g) the permissions on the account in respect of the Exchange's payment application \"Hpay\"20; and\n- (h) the results of the client acceptance procedures undertaken by the Exchange, including:\n\t- (i) the \"Risk Rating\" of the customer: We understand that the Risk Rating reflects the Exchange's assessment of the risk associated with onboarding that customer and is classified as \"low\", \"medium\", \"high\" or \"ultra-high\". The Risk Rating is derived from a \"Risk Score\", which is computed based on the customer's responses to a questionnaire (the \"KYC Questionnaire\"21). We provide a more detailed explanation of the Exchange's risk assessment process in Section 4 below; and\n\t- (ii) the \"Tier\" of the customer: We understand that there are three different \"Tiers\" of customer classification22, which reflect the status of the client acceptance procedures. These include:\n\t\t- · customers who are not yet allocated to a Tier. These are customers who have signed up to create an account with the Exchange, but have not yet verified their contact details;\n\t\t- · Tier 0 customers: These are customers who have signed up to create an account with the Exchange and have verified their contact details (including an email address and a phone number), but client acceptance procedures have not yet been completed. These are not \"active\" accounts at this stage; and\n\t\t- Tier 1 customers: These are customers who have been onboarded as customers of the Exchange, meaning (i) the customer has created an account with the Exchange; (ii) the customer has verified their contact details; (iii) the Exchange has verified their identity in accordance with its client acceptance procedures (further details of which are set out in Section 4 below); and (iv) the customer has either been auto-approved\n\n20 I am instructed that Hpay allows customers to, inter alia: (i) undertake peer to peer transfers to other Exchange customers; and (ii) purchase HDO/HCN gift cards for merchants that have been approved by the Exchange\n\n21 Further details of the KYC Questionnaire is provided at paragraph 4.2.8 et seq, below\n\n22 We understand the Exchange is considering implementing an additional Tier. \"Tier 2\", in the future\n\n23 Meaning customers cannot deposit or redeem funds or trade HCN or HDO\n\n#### Case as as a sea a do a meento of the di 04/04/25 a geal for 10\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nbased on the information they provided or, following escalation to compliance personnel, has been manually approved.\n\nWe understand that the Relevant Customers comprise only Tier 1 customers.\n\n#### The HID Dashboard\n\n- 3.2.8 Further information in respect of the customer can be found by clicking on the HD in the column \"User Name / HID\", which produces a dashboard for each customer (the \"HID Dashboard\").\n- 3.2.9 The HID Dashboard contains a number of tabs which categorise the information available in respect of each customer. Of particular relevance to our instructions are the following tabs:\n\t- (a) \"Profile\": This includes further information in respect of the customer including, inter alia, their name, date of birth, contact details, citizenship, country of residence, ID document number;\n\t- (b) \"Deposits\": This sets out details of deposits made by the customer including, inter alia, (i) the date and time of the deposit; (ii) the amount of the deposit; (iii) the individuals at the Exchange who authorised the deposite4; and (iv) any fees payable to the Exchange in respect of the deposit;\n\t- (c) \"Withdrawals\": This sets out details of withdrawals25 made by the customer including, inter alia, (i) the date and time of the withdrawal requested by the customer; (ii) the amount of the withdrawal; and (iii) any fees payable to the Exchange in respect of the withdrawal; and\n\t- (d) \"Risk Scoring\": This sets out the Risk Score of the customer (as explained in paragraph 3.2.7(h) above), the customer's completed KYC Questionnaire and comments from the Exchange's compliance team relating to client acceptance decisions in respect of the customer.\n- 3.2.10 We set out in Figure 3.4 to Figure 3.7 below an excerpt of each of these four tabs for an example HID26.\n\n24 We understand that every deposit made to the Exchange is subject to a two-step authorisation process, where the deposit is required to be authorised by two individuals in order for the funds to be accepted\n\n25 "Withdrawals\" is synonymous with redemptions\n\n20 As noted in Section 1.4 above, we are instructed that the customer information that we have reviewed is confidential. Therefore, whilst we reviewed unredacted information on the HEX Customer Database, we are instructed that it must be redacted for the purposes of the report. The information in Figure 3.4 to Figure 3.7 is therefore redacted\n\n#### Case as as as a la contre in do our en to of the di 04,000 a 25 age age of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nFigure 3.4: Example of the information contained on the \"Profile\" tab of the HID Dashboard27\n\nHome | Setup | Users | Security | Documents | Reports | Audit | System | HelpUser Management | Privileges | Reporting | Temp Login | Session Management | LogoutUser Details\n\n| ID | | ENABLED | True | True |\n|-----------------------|--|-------------------------|-------|-------------------------------------------------------|\n| DATE CREATED | | APPROVED | True | True |\n| DISPLAY NAME | | DELETED | False | False |\n| USER TYPE | | LOCKED OUT | False | |\n| FIRST MIDDLE NAME | | STOP DEPOSITS | False | |\n| LAST NAME | | STOP TRADING | False | |\n| FULL NAME | | STOP WITHDRAWALS | False | |\n| BIRTH DATE | | FORCED TO CHANGE PASS | False | |\n| E-MAIL | | 2 FACTOR AUTHENTICATION | False | |\n| ADDRESS USERNAME | | ONLINE | False | |\n| MOBILE PHONE | | ABLE TO ACCESS API KEYS | False | |\n| ADDRESS LINE 1 | | | | |\n| ADDRESS LINE 2 | | | | |\n| RESIDENCE COUNTRY | | | | |\n| CITY | | | | |\n| STATE | | | | |\n| POST CODE | | | | |\n| CITIZENSHIP COUNTRY | | | | |\n| ID DOCUMENT NUMBER | | | | |\n| COMMENTS | | | | |\n| LAST COMMENT BY | | | | |\n| FAILED LOGIN ATTEMPTS | | | | |\n\nFigure 3.5: Example of the information contained on the \"Deposits\" tab of the HID Dashboard28\n\n| and the locked to the will be security for the street from the new less the new happed been was press
Property and series to the trip to the mail of the state and the state | | | | | | | |\n|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--|----|--|-------------------|----------|-------------|-------|\n| Call - Call - Marin - Posted on Estable - Comments - Comments Connects Concerner - Spiricum Saliment - Province Comments - Province - Province Comments - Province - Province
Incontray to the contract and the Chim Jat \" and the processes | | | | | D | 100 0 | Cours |\n| Pastices (1984) R | | | | | | | |\n| In the liminers . Sul nowledge in the program in and the must to the must to the most the | | | | Park of the Marin | 1 1 1000 | | |\n| | | 1 | | | | Eresterials | > |\n| | | 14 | | | | Calimatio | 1 |\n| | | 11 | | | | 1/1000 | 1 |\n| | | P | | | | -11-944 | 1 |\n| | | m | | | | Linkshi | 4 |\n| | | 18 | | | | Comes | |\n| | | 1 | | | | Concelle | 1 |\n| | | | | | | Create | V |\n| | | 11 | | | | Comments | |\n\nFigure 3.6: Example of the information contained on the \"Withdrawals\" tab of the HID Dashboard29. 30\n\nAsk the user about Operation Withdrawal Redemption/Loan Application Information Policy Amount Redemption Date Tax Options Balance Funds Group Withdrawal Date\n\n| Date of Address | | TIN | | | | Date of | |\n|----------------------|--|-----------|--|--------|--|-----------------------------------------|--|\n| Taxpayer ID | | Account # | | | | Date | |\n| Loan/Redemption Type | | Option | | Option | | Search
| |\n\nDrawings (1 of 1)\n\n| Type | GL Account | Date | Amount | Fee | LID | Bearing Rate | Column | Policy | The Amount | Action |\n|------|------------|------|--------|-----|-----|--------------|--------|--------|------------|--------|\n| | | | | | | | | | | |\n\n27 Exhibit 3.1\n\n28 Exhibit 3.1\n\n29 The customer selected for this example had not made any withdrawals at the date we completed our work\n\n30 Exhibit 3.1\n\n### Casease3-23-23001000-18FAT Dooglement6207-1 Fified 2014/01/25Pageage@110f 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nFigure 3.7: Example of the information contained on the \"Risk Scoring\" tab of the HID Dashboard31\n\n| INTERIM ID | | | | |\n|-------------------------------|-----------|------|------------|--|\n| MANAGED SCORE | | | | |\n| TOTAL RISK SCORE | | | | |\n| RISK LEVEL | | | | |\n| COMPLYADVANTAGE
HITS | | | | |\n| COMPLYADVANTAGE
LINK | | | | |\n| VERIFICATION | | | | |\n| APPLICATION STATUS | | | | |\n| CATEGORY | | | | |\n| NUMBER OF ATTEMPTS TO
SIGN | | | | |\n| Risk Score Update History | | | | |\n| DATE & TIME | FULL NAME | ROLE | RISK SCORE | |\n\n31 Exhibit 3.1\n\n#### Case as a sea a career a do our entre of the de of the de of 2014, 25 age age of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n# 4 Instruction 1: Our understanding of the processes and procedures in place relating to customer onboarding at the Exchange\n\n#### 4.1 Introduction\n\n- 4.1.1 In addition to conducting a review of the HEX Customer Database, we sought to confirm the processes in place at the Exchange in respect of customer onboarding by reference to the Exchange's written documents that relate to the Relevant Period. In this regard, we have been provided with a presentation titled \"Demonstration of the Client Onboarding and Compliance Process\", dated June 2022 (the \"Onboarding Process Document\")22, 33.\n- 4.1.2 Based on the Onboarding Process Document24, we understand that customer onboarding at the Exchange comprises four key stages:\n\t- (a) \"Stage 1\": Customer registration;\n\t- (b) \"Stage 2\": Customer identification, verification and screening:\n\t- (c) \"Stage 3\": Customer risk assessment; and\n\t- (d) \"Stage 4\": Customer acceptance approval or escalation.\n\nWe set out further details of each these key stages in Section 4.2.\n\n#### 4.2 Key stages in the customer onboarding process\n\n#### Stage 1: Customer registration\n\n4.2.1 In order to register with the Exchange, a new customer must first access the Exchange's website35 and select the \"Register\" tab. We set out in Figure 4.1 below an excerpt of information that a customer has to provide as part of this registration process (the \"Key Registration Information\"):\n\n32 Exhibit 4.1\n\n33 We are instructed that the Exchange's compliance policies are formally documented in a \"Compliance Manual\". This has not been provided to us for the purposes of this report due to the scope of our instructions\n\n34 We are instructed that the Onboarding Process Document was prepared for the purpose of regulatory licence application and is based on the \"Compliance Manual\" and the Exchange's policies and procedures that were in place during the Relevant Period 35 At http\n\n## Case as a sea a comment on our entre of the de comment of the comment of the first of the first of the first of the first of the first of the first of the first of the first In the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\nmazars\n\nIndependent forensic review of Mazars LLP\n\n| HIMALAYA EXCHANGE | | | Support | Login | Register | 中文 |\n|-------------------|--|--|---------|-------|----------|----|\n|-------------------|--|--|---------|-------|----------|----|\n\nCreate your account\n\n**. Individual**Corporate\n\n| Legal first & middle name | |\n|---------------------------|--|\n| Legal last name | |\n| Date of Birth | |\n| DD/MM/YYYY | |\n| Citizenship | |\n| Select | |\n| Country of Residence | |\n| Select | |\n| Address | |\n| City | |\n| Postcode | |\n\nFigure 4.1: Customer registration page on the Exchange's website36\n\n- 4.2.2 Importantly, the questions relating to citizenship and country of residence are multiple choice (and completed by the customer by reference to a dropdown list). We understand that a customer's country of residence is of particular relevance to customer acceptance decisions made by the Exchange and the Exchange's policy is not to accept customers resident in certain countries (including, for example, the United States) (the \"Restricted Countries\")37. The Restricted Countries are not included within this dropdown list, meaning that individuals whose country of residence is a Restricted Country will not be able to register for an account with the Exchange.\n- 4.2.3 Once the customer has provided their Key Registration Information, they are requested to provide answers to three personal questions on the Exchange's secure online portal. The purpose of these security questions is to \"add an extra layer of customer protection to the authentication process\"38.\n\n36 As demonstrated in Figure 4.1, there are separate registration pages for \"Individuals\" (which are also referred to as \"personal\" accounts) and \"Corporates\". Based on our work on this matter, we understand that over 99% of the Relevant Customers are individuals and we have therefore not considered the customer onboarding process in respect of corporates\n\n37 In this regard, we are instructed (i) that the list of Restricted Countries is reviewed on a regular basis to ensure the Exchange is compliant with global regulatory requirements; and (ii) that the US has been included in the list of Restricted Countries since the inception of the Exchange 38 Exhibit 4.1. slide 3\n\n#### Case as a sea a comment on of the do and of the di 04/04/25 age at of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n### Stage 2: Customer identification, verification and screening\n\n- 4.2.4 The second key stage in the customer onboarding process is described in the Exchange's Onboarding Process Document as \"Identification, Verification and Screening\". It requires the customer to:\n\t- (a) provide and verify their email address and phone number;\n\t- (b) complete the KYC Questionnaire, which consists of numerous multiple-choice questions relating to, inter alia, the customer's personal details, the source of their funds and their level of experience with cryptocurrency trading; and\n\t- (c) submit an identification document\") and complete certain identity verification checks.\n- 4.2.5 We provide further details on each of these requirements in turn below.\n\n#### Obtaining and verifying the customer's email address and phone number\n\n- 4.2.6 In order to progress the client onboarding process, the customer is required to provide and verify their email address and phone number, via the Exchange's secure online portal. The verification in respect of:\n\t- (a) their email address is completed once the customer activates a verification link that is sent to their email address; and\n\t- (b) their phone number is completed once the customer enters a 6-digit verification code that is sent to them by text message.\n- 4.2.7 In addition, the customer is required to provide confirmation that they are not a resident of the US, Japan, citizen or resident of Canada or any other jurisdiction where the laws of such jurisdiction prohibits the holding or use of cryptocurrencies\n\n#### The KYC Questionnaire\n\n4.2.8 We set out in Figure 4.2 below an example of the questions included in the KYC Questionnaire:\n\n#### Case as a sea a dia do anne en to of the di 04/04/25 age affect of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nFigure 4.2: KYC Questionnaire 39\n\n| Place of birth | |\n|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--|\n| Citizenship on the document | |\n| Please tell us about your current employment status. | |\n| Please tell us about your occupation or business activity. | |\n| Please tell us about business you may conduct in other country(s) besides where you are registered for tax purposes? | |\n| Is your individual activity or business registered or conducted in preferential tax zone (for instance, free economic zone, offshore jurisdiction)? | |\n| Please tell us about your annual turnover, in individual or business activity, which is handled in cash. | |\n| Please tell us about your annual turnover, in individual or business activity, which is handled in cryptocurrency. | |\n| Please tell us about your source(s) of income funds. Select more than one box if necessary. | |\n| Please tell us about your source(s) of wealth? Select more than one box if necessary. | |\n| Please select the service(s) you plan to use. Select more than one box if necessary. | |\n| How much do you plan to deposit per year (USD and crypto combined)? | |\n| Please tell us which countries the funds will be received and or transferred from. | |\n| Let us know what your level of experience is with cryptocurrency trading? Please select one: | |\n| How many years of experience do you have in crypto trading? | |\n| Are you, an immediate family member or a close associate, entrusted, or have been entrusted, with prominent public functions in any country or international institution? This could be a public office, a government role, a regulatory role or a senior military position, at home or overseas. | |\n\n4.2.9 In order to complete the KYC Questionnaire, the customer must answer all questions. Based on the customer's responses to the KYC Questionnaire, the Exchange computes the Risk Score for each customer, which is described in further detail in paragraph 4.2.13 et seq. below.\n\n#### Obtaining documentation evidencing customer identification\n\n- 4.2.10 We understand that the Exchange outsources the collection and verification of customer ID Documents to Jumio. Jumio is an \"Al-driven identity verification platform\"40 that \"uses artificial intelligence, machine learning and biometrics to automate the verification process and help companies improve conversion rates, comply with AML and KYC regulations and better detect fraud - all while delivering a definitive yes/no decision in seconds™41.\n- 4.2.11 We understand that the ID Document that would be accepted as evidence of customer identification includes a passport, driving licence or identity card. Jumio then verifies 42:\n\t- (a) that the ID document is \"authentic and valid\"; and\n\t- (b) the customer's identity by comparing the ID Document provided with a live photo taken by the customer, using artificial intelligence (\"Al\") powered facial recognition. This includes confirming the \"person holding the ID [is] the same person shown in the ID photo\" and that \"the person holding the ID [is] physically present during the transaction\".\n- 4.2.12 In addition, the Exchange also undertake screening of prospective customers on behalf of the Exchange, to identify any individuals that are Politically Exposed Persons (\"PEP\"), subject to\n\n39 This is an example of the KYC Questionnaire. We understand that during the Relevant Period, the questions (and number of questions) on the questionnaire changed (for example, during this time the number of question ranged from 8 to 16)\n\n40 http\n\n41 http\n\n42 Exhibit 4.1, slide 5\n\n### Casease3-23-23-001008-18FAT Dooomeent6007-3 FFF4ed 202014025Pagea2fe020f 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nsanctions or subject to adverse media. We understand that the Exchange utilises a third party software provider, \"ComplyAdvantage\" to undertake this screening process.\n\n#### Stage 3: Customer risk assessment\n\n4.2.13 On completion of Stages 1 and 2, the Exchange will assess the information provided and assign a Risk Rating to each customer which, as explained in Section 3.2 above, reflects the Exchange's assessment of the risk associated with onboarding that customer and is derived from the customer's Risk Score.\n\n#### Risk Score\n\n- 4.2.14 The Risk Score is a number between 0 and 99 that reflects the Exchange's perceived risk of accepting a customer. The Risk Score, the higher the perceived risk to the Exchange of onboarding that customer.\n- 4.2.15 Each response provided by the customer in the KYC Questionnaire is assigned a Risk Soore based on a risk model formulated by the Exchange. We set out an overview of the considerations involved in the Exchange's risk model in Figure 4.3 below.\n\n\n\nFigure 4.3: Risk model assessment43\n\n43 Exhibit 4.1, slide 7\n\n### Case as a sea a comment on our entre of the de of the de collect of 40 f 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n#### Risk Rating\n\n- 4.2.16 The Risk Rating is classified as \"low, \"medium\", \"high\" or \"ultra-high\" and corresponds to the Risk Score as follows:\n\t- (a) if the customer's Risk Score is between 0 and 30, the Risk Rating is \"low\" (\"Low Risk\");\n\t- (b) if the customer's Risk Score is between 31 and 59, the Risk Rating is \"medium\" (\"Medium Risk\");\n\t- (c) if the customer's Risk Score is between 60 and 75, the Risk Rating is \"high Risk\"); and\n\t- (d) if the customer's Risk Score is between 76 and 99, the Risk Rating is \"ultra-high\" (\"Ultra-High Risk\").\n\n#### Stage 4: Customer acceptance approval or escalation\n\n- 4.2.17 The involvement of the Exchange's compliance team in the onboarding process for each customer is primarily driven by the Risk Rating assigned to that customer, whereby:\n\t- (a) if the customer is High Risk or Ultra-High Risk, the compliance team are required to manually review the customer's application and accept or reject them; and\n\t- (b) if the customer is Low Risk or Medium Risk, the compliance team are not necessarily required to manually review the customer's application but may do so if compliance issues are identified or as part of the Exchange's quality control procedures and ongoing compliance monitoring.\n- 4.2.18 We set out in Figure 4.4 below the Exchange's approval or escalation process in further detail.\n\n### Case as as as a la contre at do our en to of the di 04,000 a le of 40 of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nFigure 4.4: Approval or escalation process44\n\n\n\n44 Exhibit 4.1, slide 8\n\n#### Casease3-23-23-2011008-18FAT Dooomeent6207-5 Fifted 202014025Pagea8000f 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n### mazars\n\nIndependent forensic review of Mazars LLP\n\n## 5 Instruction 2: Our review of the Relevant Customers' accounts on the HEX Customer Database\n\n#### 5.1 Introduction\n\n- 5.1.1 As explained in Section 1.3 above, we have been instructed to identify whether an account exists on the HEX Customer Database for each of the Relevant Customers.\n- 5.1.2 Our approach to addressing this instruction was to search the HEX Customer Database for the HIDs listed in the Customer Action Schedule (which, as described in Section 1.4 above, are unique codes attributed to each customer account). In doing so, we:\n\t- (a) obtained an extract of certain information contained in the HEX Customer Database 155 (the \"HEX Customer Database Download\"). We explain the process by which we obtained the HEX Customer Database Download and the work undertaken to review the accuracy of this document in Section 5.2; and\n\t- (b) identified the accounts on the HEX Customer Database Download corresponding to the Relevant Customers. We set out the results of our work in Section 5.3.\n\n### 5.2 The HEX Customer Database Download\n\n- 5.2.1 As explained in Section 3.2 above, the User Page provides a number of criteria by which one can search the HEX Customer Database including, inter alia, HID, customer name, type of accounted, Tier of customer and the date the account was created.\n- 5.2.2 Using the User Page, it is possible to extract information from the HEX Customer Database and download this in an Excel47 file.\n- 5.2.3 The process by which the HEX Customer Database Download was created is as follows 16.\n\n45 In particular, information provided in the User Page relating to all customers that the Exchange classifies as \"Tier \" 46 Either \"personal\" or \"corporate\"\n\n41 Excel is a spreadsheet program from Microsoft that enables users to format, organize and calculate data in a spreadsheet 48 As explained above, our work in this regard was undertaken by personnel of the Exchange who have the relevant system access at our and GANDEY's direction. We directed and observed this work for the task\n\n- (a) Step 1: We sought to obtain an extract of all customer accounts that were classified as \"Tier 1\" on the HEX Customer Database (i.e. by applying only this filter to the search criteria on the User Page) 9. This produced summary information for 21,005 accounts;\n- (b) Step 2: In order to extract this summary information from the HEX Customer Database, it was necessary to divide the data into smaller sections60. We filtered the data further by reference to certain time periods (i.e. by applying dates to the filter in respect the date the account was created). These time periods were51, 52:\n\t- (i) from the inception of the Exchange 53 to 28 April 2021. This produced summary information for 3,395 accounts;\n\t- (ii) from 28 April 2021 to 6 May 2021. This produced summary information for 2,989 accounts;\n\t- (ii) from 6 May 2021 to 30 June 2021. This produced summary information for 3,159 accounts;\n\t- (iv) from 30 June 2021 to 7 November 2021. This produced summary information for 3,253 accounts;\n\t- (v) from 7 November 2021 to 30 November 2021. This produced summary information for 2,095 accounts;\n\t- (vi) from 30 November 2021 to 31 March 2022. This produced summary information for 2,821 accounts; and\n\t- (vii) from 31 March 2022 to 15 December 2023 (the date we completed our work). This produced summary information for 3,293 accounts;\n- (c) Step 3: Once the data was downloaded by reference to these time periods, we combined all of the data described in Step 2 above (being all customer accounts that were classified as \"Tier 1\" on the HEX Customer Database) into one spreadsheet; and\n\n49 We understand from our conversations with personnel of the Exchange that all of the Relevant Customers were \"Tier 1\" customers. We sought to verify this during the course of our work - see Section 5, 3 below\n\n50 As the HEX Cusiomer Database could not facilitate the extract of the volume of data related to all \"The 1\" customers of the Exchange\n\n51 The time periods listed below were identified by trial and error\n\n52 In arder to confirm that we were not \"double counting\" any days by filtering the data into cartain time periods, we sought to reconcile (i) the number of accounts for which information was oblained for each period (totalling (i) to (vil) above, which equates to 21,005 accounts); with (i) the total number of Tier 1 accounts in the HEX Customer Database (which also equates to 21,005 accounts)\n\n53 This was achieved by not applying a date to the filter \"Created Date From\"\n\n#### Case as a sea a dia do anne en to of the di 04/04/25 age and of 40 In the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP\n\n- (d) Step 4: Using Excel analytics 4, we sought to match the HID per the Customer Action Schedule to the HID per the HEX Customer Database Download. We summarise our findings in this regard in Section 5.3.\n- 5.2.4 In order to confirm that our approach to addressing this instruction was appropriate, we undertook a manual check of the HIDs for a sample of 250 of the Relevant Customers. This involved observing personnel of the service company of the Exchange (who has the relevant system access) inputting one HID at a time, at our and CANDEY's direction and confirming that a corresponding account existed for this HID (by viewing this directly on the HEX Customer Database).\n- 5.2.5 The sample of HIDs, which was of our choosing and was first provided to the personnel of the service company of the Exchange at the time of undertaking our work, included55:\n\t- (a) the first 150 HIDs on the Customer Action Schedule (\"Customer Account Sample 1\"). We had initially planned to undertake this manual process for all HIDs included in the Customer Action Schedule. However, we identified that we would not have been able to complete our work in the available time. We therefore enquired about other approaches to addressing our instructions, which resulted in us obtaining the HEX Customer Database Download (as described above).\n\nFor Customer Account Sample 1, we observed personnel of the service company of the Exchange input one HID at a time into the HEX Customer Database, at our and CANDEY's direction in order to confirm that an account existed for that HID in the HEX Customer Database. We set out the results of this sample testing in Appendix 5.1a; and\n\n(b) a sample of 100 additional HDs included in the Customer Action Schedule (\"Customer Account Sample 2\"). In order to select this sample of HIDs, we applied a nonstatistical sampling approach using systematic selection, by selecting every 340 HID reference in the Customer Action Schedule (excluding the first 150 items) to sample test.\n\nFor Customer Account Sample 2, we observed personnel of the service company of the Exchange input one HID at a time into the HEX Customer Database, at our and CANDEY's direction in order to confirm that (i) an account existed for that HID in the\n\n54 Specifically, the Excel functionality \"VLOOKUP\" is a search function commonly used in data analytics that identifies and matches specific data vertically across a spreadsheet\n\n55 For present purposes we have tested a total sample of 250 HDs. Should the Court require a more extensive sample to be tested, we could extend our testing\n\n### Case as a sea a cara do ame en to of the di 04/04/25 age age of 20 f\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\nHEX Customer Database; and (ii) the details in the HEX Customer Database Download matched the information in the HEX Customer Database55. We set out the results of this sample testing in Appendix 5.1b.\n\n5.2.6 In our sample, we did not identify any discrepancy between the information on the HEX Customer Database Download and the information obtained \"manually\" (by searching one HID at a time in the User Page).\n\n#### The results of our work 5.3\n\n- 5.3.1 Using the HEX Customer Database Download, we sought to confirm:\n\t- (a) that an account exists in the HEX Customer Database for each of the Relevant Customers:\n\t- (b) whether the account is a \"personal\" or \"corporate\" account;\n\t- (c) the Tier classification of that customer57; and\n\t- (d) the date their account was created.\n- 5.3.2 We set out the results of our work in this regard in Appendix 5.2. In summary, based on our review of the information contained in the HEX Customer Database, we identified that:\n\t- (a) for each of the Relevant Customers, an account exists in the HEX Customer Database;\n\t- (b) the Relevant Customers:\n\t\t- (i) comprise 3,521 personal accounts and 18 corporate accounts; and\n\t\t- (ii) are all Tier 1 customers; and\n\t- (c) all of the Relevant Customers' accounts were created between 23 April 2021 and 22 August 2023.\n\n66 In particular, the customer name, account type and \"tier\" of customer\n\n5 As noted in Section 3.2 above, every customer on the HEX Customer Database is classified by reference to the stage of onboarding undertaken\n\nCase as a sea a comment on of the do and of the di 04/04/25 age and of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n### mazars\n\nIndependent forensic review of Mazars LLP\n\n# 6 Instruction 3: Our detailed review of the customer onboarding information and the financial data in respect of a sample of the Relevant Customers\n\n#### 6.1 Introduction\n\n6.1.1 As explained in Section 1.3 above, we have been instructed to identify and isolate a sample of the Relevant Customers from the Customer Action Schedule and for that sample, to:\n\n- (a) verify the existence of KYC onboarding information;\n- (b) verify the financial data contained in the Customer Action Schedule against the live data on the HEX Customer Database; and\n- (c) verify the redemptions made by the Relevant Customers to the bank statements of the Exchange.\n- 6.1.2 In this Section we set out:\n\t- (a) the methodology we have adopted to select the sample of customers to be reviewed (Section 6.2); and\n\t- (b) the procedures we performed in respect of the customer onboarding information and the financial data in respect of a sample of the Relevant Customers (Section 6.3).\n\n#### 6.2 Sample selection methodology\n\n- 6.2.1 For present purposes we have tested a total sample of 50 HIDs (\"KYC and Financial Data Sample\"). Consistent with the approach described in Section 5 above, the sample we selected was first provided to the personnel of the service company of the Exchange at the time of undertaking our work. Should the Court require a more extensive sample to be tested, we could extend our testing.\n- 6.2.2 In order to select a sample of the Relevant Customers, we applied a non-statistical sampling approach using systematic selection, by following the below steps:\n\t- (a) we first randomised the order of the HID references in the Customer Action Schedule by:\n\nPrivate and Confidential\n\n-33 -\n\nCase as a sea a comment on of the do and of the di of the di of 40 for 40 In the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP (i) allocating a randomly generated number to each HID reference, using the Excel function \"=rand()\", which generates a random number between 0 and 1 to each HID reference in the Customer Action Schedule; (ii) recalculating the formula in (i); and (iii) sorting the Customer Action Schedule according to the randomly generated number in (ii) from smallest to largest; and (b) we then selected every 71st HID reference in the Customer Action Schedule in (iii) to form part of our sample.\n\n6.2.3 The Customer Action Schedule contains 3,539 customers, therefore by taking the 71st HID, our sample consists of 50 customers 58.\n\n### 6.3 The procedures we performed in respect of the sample of the Relevant Customers\n\n6.3.1 As explained above, we have been instructed to consider both (i) the KYC information obtained by the Exchange in respect of the sample of Relevant Customers; and (ii) certain financial information in respect of these customers.\n\n#### Our review of the KYC information obtained by the Exchange\n\n- 6.3.2 For each HID included in our sample, we have reviewed the \"Profile\" tab of the HID Dashboard, and considered:\n\t- (a) whether an account exists in the HEX Customer Database for each HID;\n\t- (b) whether the account is enabled;\n\t- the Tier of the account; (c)\n\t- (d) whether the account is \"personal\" or \"corporate\";\n\t- (e) the customer's full name, email address, citizenship and country of residence;\n\t- (f) the customer's source of income and source of wealth;\n\t- (g) the Risk Score and Risk Rating allocated to the customer; and\n\n56 71 x 50 = 3,550\n\n#### Case as a sea a dia do anne en to of the di 04/04/25 age a really of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP\n\n- (h) the ID documents available for each customer and the testing undertaken by Jumio.\n- 6.3.3 We set out the results of our work in this regard in Appendix 6.1. In summary, we identified that for each HID that forms part of our sample:\n\t- (a) an account exists in the HEX Customer Database;\n\t- (b) the Exchange holds copies of an ID document, which have been verified by Jumio as being \"authentic\"60; and\n\t- (c) a facial recognition test was undertaken by Jumio, the purpose of which is, as noted in paragraph 4.2.11 above, to confirm that the person holding the ID is (i) the same person shown in the ID photo; and (ii) physically present during the onboarding process.\n- 6.3.4 In addition, for each customer tested as part of this sample, we also attach at Exhibit 6.1 excerpts of the \"Risk Scoring\" tab on the HID Database, which includes the responses provided by each customer to the KYC Questionnaire and any review comments added to their account by the compliance team.\n\n#### Our review of the financial information in respect of these customers\n\n- 6.3.5 For each HID included in our sample, we have reviewed the \"Deposits\" and \"Withdrawals\" tabs of the HID Dashboard and sought to agree the information in the HEX Customer Database with the information in the Customer Action Schedule in respect of each customer's:\n\t- (a) HCN balance;\n\t- HDO balance; (b)\n\t- total deposits; and (c)\n\t- (d) total redemptions.\n- 6.3.6 In respect of the redemptions effected by customers in this sample, we have also sought to agree the amounts of the redemptions to bank statements of the Exchange®!\n\n59 Via Jumio\n\n60 For each of our sample, we sought to confirm that the name on the ID Document matches the name on the HEX Customer Database. Whilst we were able to do this for the majority of the sample, there were a number of HDs which related to Chinese nationals, whose names were included in their ID documents and the HEX Customer Database in Chinese than these individuals, we confirmed that the document number on the ID Document number in the HEX Customer Database. The detail of this work is provided in Appendix 6,1\n\n61 The redacted bank statements in respect of these redemptions were provided to me and are set out at Exhibit 6.2\n\n#### Case as a sea a cara do ame in tente of the di of the di of the di of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n- 6.3.7 We set out the results of our work in Appendix 6.162. In summary, we identified:\n\t- (a) the HCN balance and HDO balance in the HEX Customer Database reconciled to the amounts noted in the Customer Action Schedule (when timing differences are taken into consideration).\n\nIn this regard, in undertaking this work, we sought to agree the financial data in the Customer Action Schedule (which we are instructed was compiled as at 10 November 2023) to the \"live\" HEX Database as at the date of our work (15 December 2023). Given there was ongoing trading activity of HCN and HDO balances between 10 November 2023 and 15 December 2023, for certain customer accounts, there were reconciling items (relating to trades that these customers had effected in this time period) 3. When these trades are taken into consideration, we did not identify any discrepancies between the HCN and HDO balances in the HEX Customer Database compared with the Customer Action Schedule;\n\n- (b) the total deposits and total redemptions in the HEX Customer Database agreed to the amounts noted in the Customer Action Schedule; and\n- (c) the total redemptions in the HEX Customer Database (and the Customer Action Schedule) agreed to the Exchange's bank statements that were provided to uses These bank statements include:\n\t- (i) Mercantile Bank International Corp (\"Mercantile Bank\"), which we understand is a \"Custody Account\"65; and\n\n62 As noted in Section 1.4 above, we are instructed that the customer information that we have reviewed and the underlying KYC documents we have verified them to are confidential. Therefore, whilst we reviewed unredacted information on the HEX Customer Database, we are instructed that it must be redacted for the purposes of the information in Appendix 6.1 and the supporting documentation (in particular, Exhibits 6.1 and 6.2) is therefore redacted\n\n63 We confirmed each of these reconciling items to the HEX Database. Further details are provided in Append)x 6,1\n\n64 The bank statements provided to us are hard copies of the bank statements held by the Exchange. We are instructed that the Exchange no longer has accounts online as they have been closed as a result of the seizures\n\n65 We are instructed that pror to the seizures, Mercantile Bank was one of the banking partners for the Exchange, where the Exchange had an account holding part of its stable coin reserve (the \"Relevant Mercantile Bank Account\"). We are also instructed that the Relevant Mercantle Bank Account was a \"custodian\" account, rather than a standard bank account, in order to safeguard customer funds. In this regard, we have been provided with a document titled \"MERCANTILE BANK INTERNATIONAL CORP. ONLINE CUSTODY & BANKING SERVICES AGREEMENT, dated September 2022 (the \"Mercantile Bank Custody Agreement\", Exhibit 6.3), which we are instructed sets out the terms and conditions applicable the Relevant Mercantile Bank Account. We have not read the full terms and conditions of the Mercantile Bank Custody Agreement and we have not been instructed to undertake any further procedures in relation to Relevant Mercantile Bank Account. We have been instructed to review paragraph 6.2 of the Mercantile Custody Agreement which states: \"In furtherance of its responsibilities as Custodian, and subject to the limitetions of this Agreement, Client instructs Custodian to: (i) Safekeep Fiat Currency and Digital Asset amounts transferred into the \"Custodial Funds\") (ii) Monitor and maintain the Custodial Funds; (iii) Manage the Custodial Funds in accordance with Section 6.3 of this Agreement; (iv) Keep timely and accurate records regarding the deposit, disbursement and investment of the Custodial Funds; and, (V) Prepare such periodic statements regarding and access to information pertaining to the Custodial Funds in the frequency and manner contemplated in this Agreement\". We have also been provided with an earlier version of the Mercantile Bank Custody Agreement, dated June 2020.\n\n#### Case as as a season in do our en to of the di 2014 a 2014 a 2014 a 2014 a 19 a 10\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\nmazars\n\nIndependent forensic review of Mazars LLP\n\n(ii) FV Bank International INC (\"FV Bank\", the \"Relevant FV Bank Account\"), which we understand is also a \"Custody Account\"66.\n\nWe have reviewed paragraph 6.2 of both documents and have not noted any differences in these terms. We are instructed that the DoJ's seizures of the stable coin reserve were (partly) from the Relevant Mercantile Bank Account\n\nSo We are instructed that FV Bank was also one of the Exchange, where the Exchange, where the Exchange had an account holding part of its stable coin reserve (the \"Relevant FV Bank Account\"). We are also instructed that the Relevant FV Bank Account was a \"custodian\" account, rather than a standard bank account, in order to safeguard customer funds. In this regard, we have been provided with (i) a document titled \"Cuscidy Agreement (sic]\", undated (the \"FV Bank Custody Agreement\", Exhibit 6 4), which we are instructed sets out the terms and conditions applicable to the Relevant FV Bank Accunt; and (ii) a document titled \"Business Account Application\" (the \"FV Bank Business Account Application\", Exhibit 6.5) which we are instructed reflects the Exchange's application to open the Relevant. We have not read the full terms and conditions of the FV Bank Custody Agreement and we have not been instructed to undertake any further procedures in relation to Relevant FV Bank Account. We have been instructed to review the Section titled \"Representations, Warranties, and Covenants\" on page 22 of the FV Bank Custody Agreement which states: \"FV Bank will safekeep the Custodial Assels and segregate data of all Gustodial Assets from both the (i) property of FV Bank, and (ii) recorded assets of ther customers of FV Bank. FV Bank is a custodial Assets stored by you in the Custody Account, and FV Bank has no right, interest, or title in such Custodiel Assets, and will not reflect such Custodial Assets as an asset of FV Bank, except as may be required by regulatory bodies in specified accounting reports. FV Bank may not grant a security interest in your Custodial Assets held in your Custody Account. FV Bank will not, directly, lend, pledge, hypothecate or rehypothecate any Custodial Assets without you accepting an agreement for FV Bank to do so\". With respect to the FV Bank Business Account Application, we have been instructed to review the guestion \"What is the purpose of opening a bank account with FV Bank?\" (set out on page 1). We note that the stated purpose of the account according to this document is \"To hold the proceeds of the sale of our Himalaya Dollar\". We are instructed that the DoJ's seizures of the stable coin reserve were (partly) from the Relevant FV Bank Account\n\n### Case as a sea a cara do ame en to of the di of the di of the di of 40 of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n## 7 Instruction 4: Illustrative customer onboarding\n\n#### 7.1 Introduction\n\n- In this Section, we set out our observations on the two illustrative customer onboarding tests 7.1.1 we performed at the Exchange.\n- 7.1.2 We performed these tests to assess the compliance of the customer onboarding process described in Section 4 above. Both tests were conducted at the premises of the service company of the Exchange®, which we visited on 14 and 15 December 2023. Our instructing solicitors from CANDEY were also present at the same time.\n\n#### 7.2 First illustrative customer onboarding test\n\n- 7.2.1 The first illustrative customer onboarding test (\"Test 1\") was undertaken using the United States (a Restricted Country) as the country of residence and citizenship. Test 1 comprised the following steps:\n\t- (a) accessing the Exchange's website and selecting the \"Register\" tab;\n\t- (b) entering illustrative Key Registration Information, including:\n\t\t- (i) an illustrative name, date of birth and address;\n\t\t- (ii) trying to select the \"United States\" in the citizenship category dropdown list. However, this was not possible as an option for United States was not on the list; and\n\t\t- (iii) trying to select the \"United States\" in the country of residence category drop down. However, this was not possible as an option for United States was not on the list.\n- 7.2.2 As explained in paragraph 4.2.1 above, it is only once all Key Registration Information has been submitted (which must include the customer's citizenship and country of residence) that the new customer is able to progress to the next stage of the onboarding process.\n- 7.2.3 Therefore, Test 1 did not permit progression to the next stage of the onboarding process, which is in line with our understanding of the Exchange's customer registration policy.\n\n87 We have been instructed not to disclose the address of the service company of the Exchange for the purposes of this report\n\n#### Case as a sea a cara do ame en to of the di 04/04/25 age a food of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\n\n#### mazars\n\nIndependent forensic review of Mazars LLP\n\n#### 7.3 Second illustrative customer onboarding test\n\n- 7.3.1 The second illustrative customer onboarding test (\"Test 2\") was undertaken using France (which is not considered a Restricted Country) as the country of residence and citizenship. Test 2 comprised of the following steps:\n\t- (a) accessing the Exchange's website and selecting the \"Register\" tab;\n\t- (b) entering illustrative Key Registration Information, including:\n\t\t- (i) an illustrative name, date of birth and address;\n\t\t- (ii) selecting \"France\" in the citizenship category dropdown list; and\n\t\t- (iii) selecting \"France\" in the country of residence category dropdown list.\n- 7.3.2 Once the above illustrative Key Registration Information was submitted, the next steps of Test 2 consisted of:\n\t- (a) providing answers to three security questions;\n\t- (b) providing and verifying an email address, where the email address became verified once we confirmed the activation link;\n\t- (c) providing and verifying a phone number, where the phone number became verified once we inputted the 6-digit verification code; and\n\t- (d) providing confirmation that we were not a resident of the US, Japan, citizen or resident of Canada or any other jurisdiction where the laws of such jurisdiction prohibits the holding or use of cryptocurrencies.\n- 7.3.3 Once the above steps were completed, it is our understanding that the Test 2 illustrative customer would be classified as \"Tier 0\" on the Exchange's HEX Customer Database at this stage in the customer onboarding process. In line with our understanding of the Exchange's onboarding processes, we were not able to make deposits or trade with this illustrative customer account\n- 7.3.4 The next steps of Test 2 consisted of:\n\t- (a) completing the KYC Questionnaire, which involved selecting options from the multiplechoice questions;\n\nPrivate and Confidential\n\n-39-\n\n#### Casease3-i23001009-18FAT Dooomeent6007-1 Fifted 044014025Pagea9e0100f 40 In the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP\n\n- (b) uploading a scan of an ID document (in this case we uploaded a front and back scan of a French driving license68); and\n- (c) uploading a live photo.\n- 7.3.5 The Exchange's onboarding system flagged our Test 2 as \"auto-rejected\" as the name on the Key Registration Information and the ID documents provided were not a match.\n\n68 The personal ID document of a member of the Mazars team","body_zh":"Mazars LLP 的独立司法法务审查\n\n2023年12月21日\n\n\nCase 1:23-cr-00118-AT Document 622-5 Filed 04/25/24 Page 2 of 40\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY)（美国诉郭文贵等人案，纽约南区）中有关客户依据第 41(g) 条要求归还其喜马拉雅交易所资金的诉讼事项\nmazars\n\nMazars LLP 的独立司法法务审查\n目录\n1 引言 5\n1.1 本案事项 5\n1.2 我们的经验 5\n1.3 我们的委托指令 6\n1.4 调阅相关信息的途径 7\n1.5 本报告的结构 7\n1.6 本报告的范围 8\n2 执行摘要 10\n2.1 引言 10\n2.2 我们的委托指令 10\n2.3 我们的工作与调查结果摘要 11\n3 HEX 客户数据库 15\n3.1 引言 15\n3.2 我们对 HEX 客户数据库中与我们委托指令相关可用信息的理解 15\n4 指令 1：我们对交易所现行的客户准入流程和程序的理解 22\n4.1 引言 22\n4.2 客户准入流程的关键阶段 22\n5 指令 2：我们对 HEX 客户数据库中相关客户账户的审查 29\n5.1 引言 29\n5.2 HEX 客户数据库下载 29\n5.3 我们的工作结果 32\n6 指令 3：我们对相关客户样本的客户准入信息及财务数据的详细审查 33\n6.1 引言 33\n6.2 样本抽取方法 33\n6.3 我们针对相关客户样本执行的程序 34\n7 指令 4：示例性客户准入 38\n7.1 引言 38\n7.2 第一次示例性客户准入测试 38\n7.3 第二次示例性客户准入测试 39\nCase 1:23-cr-00118-AT Document 622-5 Filed 04/25/24 Page 3 of 40\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY)（美国诉郭文贵等人案，纽约南区）中有关客户依据第 41(g) 条要求归还其喜马拉雅交易所资金的诉讼事项\nmazars\n\nMazars LLP 的独立司法法务审查\nCase 1:23-cr-00118-AT Document 622-5 Filed 04/25/24 Page 4 of 40\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY)（美国诉郭文贵等人案，纽约南区）中有关客户依据第 41(g) 条要求归还其喜马拉雅交易所资金的诉讼事项\nmazars\n\nMazars LLP 的独立司法法务审查\n附录\n我们与交易所服务公司人员会面的摘要 附录 1.1\n编制本报告所使用的文件 附录 1.2\n在 HEX 客户数据库上进行的测试（客户账户样本 1） 附录 5.1\n在 HEX 客户数据库下载数据上进行的测试（客户账户样本 2） 附录 5.1\n我们对 HEX 客户数据库中相关客户账户的审查 附录 5.2\n针对相关客户样本的客户准入信息及财务数据进行的测试 附录 6.1\n物证/附件\n\nHEX 客户数据库示例摘录 物证 3.1\n准入流程文件 物证 4.1\nHID 数据库上“风险评分”标签页的摘录 物证 6.1\n交易所银行对账单摘录 物证 6.2\nMercantile Bank（商业银行）托管协议 物证 6.3\nFV Bank（FV银行）托管协议 物证 6.4\nFV Bank 商业账户申请表 物证 6.5\nCase 1:23-cr-00118-AT Document 622-5 Filed 04/25/24 Page 5 of 40\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY)（美国诉郭文贵等人案，纽约南区）中有关客户依据第 41(g) 条要求归还其喜马拉雅交易所资金的诉讼事项\nmazars\nMazars LLP 的独立司法法务审查\n1 引言\n1.1 本案事项\n\n- 1.1.1 我们，Mazars LLP（“Mazars”），受 Candey Limited（“CANDEY”，Himalaya International Clearing Limited，即“本交易所”或“HEX”的法律顾问）委托。本交易所是一家在英属维尔京群岛注册的公司，运营着一个用户对用户的中心化加密货币交易平台，供客户交易、存储和管理喜马拉雅加密货币，即 Himalaya Coin（“HCN”，喜马拉雅币）和 Himalaya Dollar（“HDO”，喜马拉雅美元）。\n- 1.1.2 本交易所及其关联公司的最终实益所有人是 William Je 先生（“Je 先生”），United States Department of Justice（“DoJ”，美国司法部）已在 Southern District of New York（纽约南区）对他（以及另外两名被告）提起了刑事指控。在这些诉讼中，除其他事项外，指控 Je 先生通过本交易所实施了一项欺诈计划。我们获悉 Je 先生否认这些指控。\n- 1.1.3 作为这些指控的结果，我们获悉本交易所的某些资产已被 DoJ 扣押，特别是本交易所的 HDO 稳定币1储备2。\n- 1.1.4 我们接到的指示如下：\n\t- (a) 2023年12月6日，本交易所的 3,539 名客户根据《联邦刑事诉讼规则》第 41(g) 条提出动议，要求归还被美国扣押的财产（“相关客户”及“客户诉讼”）3；以及\n\t- (b) 2023年12月7日，DoJ 作出陈述，请求美国联邦地区法院驳回相关客户在客户诉讼中请求的救济。我们获悉其原因之一是客户诉讼中的客户（被称为“声称的客户”）并非真实存在，其暗示客户诉讼本身是虚构的。\n1.2 我们的经验\n\n1.2.1 Mazars Group（玛泽集团）是一家国际化、一体化且独立的专业机构，专门从事审计、咨询、会计和税务服务，在超过 95 个国家和地区设有分支机构，依托超过 47,000 名专业人士的专业知识。在英国，Mazars 拥有约 150 名合伙人和超过 2,500 名员工。\n\n1 我们理解“稳定币”是一种其价值与另一类资产挂钩的加密货币\n\n2 其以美元（USD）形式持有\n\n3 在提起客户诉讼时，相关客户最初的人数为 3,345 人。我接到的指示显示，该人数此后已增加至 3,539 人\nCase 1:23-cr-00118-AT Document 622-5 Filed 04/25/24 Page 6 of 40\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY)（美国诉郭文贵等人案，纽约南区）中有关客户依据第 41(g) 条要求归还其喜马拉雅交易所资金的诉讼事项\nmazars\n\nMazars LLP 的独立司法法务审查\n\n1.2.2 本报告由伦敦的危机与争议团队编制。我们经常在涉及欺诈指控、会计违规、洗钱和虚假陈述、监管调查以及资金与资产追查等任务中接受委托。我们曾代表监管机构和起诉机关（包括英国及海外）以及代表被告方开展工作。我们近期处理的案件包括受 Financial Conduct Authority（英国金融行为监管局）委托，涉及：(i) 对一家大型获授权集合投资基金倒闭事件的调查；以及 (ii) 其暂停一家英国上市公司股票交易的决定。\n1.3 我们的委托指令\n\n- 1.3.1 我们收到了一份载有各相关客户信息的明细表（“客户诉讼明细表”）4。我们获悉相关客户于 2021年4月23日 至 2023年8月22日 期间（“相关期间”）在本交易所创建了账户。\n- 1.3.2 使用该客户诉讼明细表，我们受托开展以下工作：\n\t- (a) 对客户数据库（“HEX 客户数据库”）进行实时且独立的审查，以确认并记录本交易所现行的客户准入流程和程序（“指令 1”）；\n\t- (b) 核实客户诉讼明细表中列出的每一位相关客户是否均在 HEX 客户数据库中拥有交易所账户（“指令 2”）；\n\t- (c) 从客户诉讼明细表中识别并抽取相关客户的样本，以便：\n\t\t- (i) 验证“了解你的客户”（“KYC”）准入信息是否存在；\n\t\t- (ii) 将客户诉讼明细表中包含的财务数据与该样本在 HEX 客户数据库上的实时数据进行核对；以及\n\n4 我们获悉该明细表由本交易所于 2023年11月10日 提供给相关客户的法律代表\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY)（美国诉郭文贵等人案，纽约南区）中有关客户依据第 41(g) 条要求归还其喜马拉雅交易所资金的诉讼事项\nmazars\nMazars LLP 的独立司法法务审查\n\n- (iii) 将相关客户进行的赎回（在客户诉讼明细表中称为“赎回余额”）与本交易所针对该样本的银行对账单进行核对（“指令 3”）；以及\n- (d) 自主选择进行示例性准入申请，包括但不限于针对 United States（“US”，美国）的申请（“指令 4”）。\n1.4 调阅相关信息的途径\n\n- 1.4.1 除撰写本报告中的调查结果外，我们的大部分工作是在本交易所的服务公司办公场所进行的5，我们于 2023年12月14日 和 15 日访问了该处。我们来自 CANDEY 的委托事务律师当时也在场。我们在附录 1.1 中列出了我们与本交易所及 CANDEY 会面的摘要。\n- 1.4.2 客户诉讼明细表不包含相关客户的姓名。相反，客户是通过唯一的喜马拉雅账户号码（“HID”）来识别的。我们接到的指示显示，我们审查过的客户信息以及我们用于核对的基础 KYC 文件均属于机密信息，并受数据保护规定的约束。因此，虽然我们审查了 HEX 客户数据库中未经遮盖的信息，但我们接到的指示是，出于本报告的目的，必须以隐去敏感信息的形式呈现。\n1.5 本报告的结构\n\n- 1.5.1 本报告的其余部分结构如下：\n\t- (a) 在第 2 节中，我们列出了我们工作与调查结果的执行摘要；\n\t- (b) 在第 3 节中，我们概述了对 HEX 客户数据库中可用信息的理解；\n\t- (c) 在第 4 节中，我们通过阐述对本交易所现行客户准入流程和程序的理解来响应指令 1；\n\n5 Hamilton Capital Holding。我们接到的指示是，出于本报告的目的或在法院作出保护令之前，不得披露本交易所的地址\n\n6 在我们的工作过程中，我们与本交易所的 IT、法律和合规团队的人员进行了讨论。我们接到的指示是，出于数据保护和保护员工身份的目的，不得在本报告中披露这些人员的姓名\n\n- (d) 在第 5 节中，我们通过描述为核查每位相关客户是否在 HEX 客户数据库中存在账户而开展的工作来响应指令 2；\n- (e) 在第 6 节中，我们通过描述为确认本交易所就相关客户样本所持有的客户准入信息及财务数据而开展的工作来响应指令 3；以及\n- (f) 在第 7 节中，我们通过描述我们所执行的示例性客户准入申请来响应指令 4。\n1.8 本报告的范围\n\n- 1.6.1 我们在附录 1.2 中列出了我们在编制本报告过程中所使用的信息和文件清单。\n\n- 1.6.2 应当指出的是，我们所完成的工作并不构成审计，且除本报告中明确载明的内容外，我们未对所审阅文件中载明的信息进行核实或以任何其他方式进行核对。除非明确获指示就基础文件的真实性发表意见，否则这是我们处理此类性质事项的标准做法。\n\n- 1.6.3 我们系就向 US District Court（美国联邦地区法院）提起的客户诉讼编制本报告。除提供给 CANDEY、Exchange（交易所）、Relevant Customers（相关客户）的法定代理人、DoJ（美国司法部）以及 United States District Court（美国联邦地区法院）外，本报告在各方面均属保密。未经我们事先书面同意，不得将本报告用于任何其他目的、进行复制或传播。Mazars（玛泽）对于本报告中涉及的事项和/或对于违反本项义务的任何行为，对第三方概不承担任何责任。\n\n- 1.6.4 本报告反映了我们对法律事项的理解，但不对其发表意见，因为该等事项并非由我们来裁决。\n\n- 1.6.1 我们未获指示按照 English Civil Procedure Rules（英国民事诉讼规则，特别是第 35 部分）、U.S. Federal Rules of Civil Procedure（美国联邦民事诉讼规则）以及 U.S. Federal Rules of Criminal Procedure（美国联邦刑事诉讼规则）编制本报告，上述规则分别适用于在英格兰和威尔士以及美国诉讼程序中提出的专家报告。尽管如此，我们仍采纳了适用于专家为此类目的编制报告的相关程序规程。就此而言：\n\nCase 1:23-cr-00118-AT Document 202-5 Filed 02/01/24 Page 2 of 40 In the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP（案件号 1:23-cr-00118-AT，文件 202-5，提交日期 02/01/24，第 2 页，共 40 页，关于 United States v Kwok, et al 23 CR 118 (SDNY)〔美国诉郭案，案号 23 CR 118 (SDNY)（纽约南区联邦地区法院）〕中涉及归还其 Himalaya Exchange（喜马拉雅交易所）资金的 41(g) 客户诉讼事项，Mazars LLP 独立法务会计审阅报告）\n\n- (a) 本报告中载明的意见反映了我们基于所获提供的证据而作出的独立意见；\n\n- (b) 我们在编制本报告时已尽到了合理的注意义务并运用了专业技能，以确保准确和完整；以及\n\n- (c) 我们确认，我们未达成任何使我们费用的金额或支付在任何程度上取决于案件结果的安排。\n\nCase 1:23-cr-00118-AT Document 202-5 Filed 02/01/24 Page 3 of 40（案件号 1:23-cr-00118-AT，文件 202-5，提交日期 02/01/24，第 3 页，共 40 页）\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY) 中涉及归还其 Himalaya Exchange 资金的 41(g) 客户诉讼事项\nmazars\n\nMazars LLP 独立法务会计审阅报告\n\n执行摘要\n2.1 引言\n\n- 2.1.1 我们，即 Mazars，受交易所的法律顾问 CANDEY 的委托指示。交易所及其关联公司的最终实益所有人为 Je 先生，DoJ 已在 Southern District of New York（纽约南区）对其（连同另外两名被告）提起了刑事指控。在这些诉讼程序中被指控的事项除其他外包括，Je 先生通过交易所实施了一项欺诈计划。我们理解 Je 先生否认了这些指控。\n\n- 2.1.2 作为这些指控的结果，我们理解交易所的某些资产已被 DoJ 扣押，包括交易所的稳定币储备。\n\n2.1.3 我们获指示了解：\n\n- (a) 2023年12月6日，相关客户提起了客户诉讼（一项根据《联邦刑事诉讼规则》第 41(g) 条提出的动议，请求归还被美国扣押的财产）；以及\n\n- (b) 2023年12月7日，DoJ 作出陈述，请求美国联邦地区法院驳回相关客户在客户诉讼中所请求的救济。我们获指示了解，其依据除其他外包括：客户诉讼中的客户并非真实客户，意指该客户诉讼本身就是虚构的。\n\n2.2 我们的委托指示\n\n- 2.2.1 利用《客户诉讼明细表》，我们获指示开展以下工作：\n\t- (a) 对 HEX Customer Database（HEX 客户数据库）进行实时且独立的审阅，以确认并记录与交易所有关客户入驻的现行流程和程序（“指示 1”）；\n\t- (b) 核实《客户诉讼明细表》中包含的每位相关客户在 HEX 客户数据库中均拥有交易所账户（“指示 2”）；\n\t- (c) 从《客户诉讼明细表》中识别并抽取相关客户的样本，以便：\n\t\t- (i) 核实 KYC 入驻信息是否存在；\n- (ii) 将《客户诉讼明细表》中包含的财务数据与 HEX 客户数据库中该样本的实时数据进行核对；以及\n- (iii) 将相关客户进行的赎回（在《客户诉讼明细表》中表述为“赎回余额”）与该样本对应的交易所银行对账单进行核对（“指示 3”）；以及\n- (d) 针对自选的任何司法管辖区（包括但不限于美国）开展一项说明性的入驻申请操作（“指示 4”）。\n\n2.3 我们的工作及调查结果摘要\n\n- 2.3.1 除在本报告中撰写我们的调查结果外，我们的大部分工作均在交易所的服务公司营业场所进行，我们于 2023年12月14日 和 15日 走访了该处。我们来自 CANDEY 的委托指示律师当时亦在场。在此期间，我们对 HEX 客户数据库进行了实时审阅，该审阅由拥有相关系统访问权限的交易所服务公司人员在我们和 CANDEY 的指导下进行。\n\n- 2.3.2 我们的工作及调查结果摘要载列如下：\n\n指示 1：我们对交易所有关客户入驻的现行流程和程序的理解\n\n- 2.3.3 我们理解交易所的客户入驻包含四个关键阶段：\n\t- (a) “阶段 1”：客户注册，客户据此提供包括姓名、出生日期、国籍和居住国在内的个人详细信息。我们理解，交易所的政策规定某些国家的居民不得在交易所开立账户。这些“受限国家”包括美国 1；\n\t- (b) “阶段 2”：客户身份识别、核验及筛查，该阶段要求客户：\n\t\t- (i) 提供并验证其电子邮件地址和电话号码；\n\n1 就此而言，我们获指示了解：(i) 定期对受限国家名单进行审查，以确保交易所遵守全球监管要求；以及 (ii) 自交易所成立以来，美国一直被列入受限国家名单。\n\n- (ii) 完成一份“KYC 问卷”，其中包括若干项 8 多项选择题，涉及（除其他外）客户的个人详细信息、其资金来源及其加密货币交易经验水平；以及\n\n- (iii) 提交身份证明文件并完成某些身份核验检查。就此而言，交易所将客户身份证明文件的收集和核验外包给第三方 Jumio Corporation（“Jumio”）9。Jumio 的服务包括 (i) 核验身份证明文件是否“真实有效”；以及 (ii) 利用人工智能驱动的人脸识别技术，将所提供的身份证明文件与客户拍摄的实时照片进行比对，以核验客户身份。\n\n除此之外，交易所还会对潜在客户进行筛查，以识别任何属于政治公众人物、受到制裁或存在负面媒体报道的个人。我们理解交易所利用第三方软件提供商“ComplyAdvantage”来执行此项筛查流程；\n\n- (c) “阶段 3”：客户风险评估，交易所将对所提供的信息进行评估，并为每位客户分配一个“风险评级”，该评级反映了交易所对入驻该客户相关风险的评估，且是根据客户在 KYC 问卷中提供的回答得出的；以及\n\n- (d) “阶段 4”：客户接纳批准或上报，在此阶段，交易所合规团队对每位客户入驻流程的介入是由分配给该客户的风险评级触发的。\n\n指示 2：我们对 HEX 客户数据库中相关客户账户的审阅\n\n- 2.3.4 我们获指示核实每位相关客户在 HEX 客户数据库中是否均拥有交易所账户。基于我们对 HEX 客户数据库中所含信息的审阅，我们确认：\n\t- (a) 对于每位相关客户，HEX 客户数据库中均存在一个账户；\n\t- (b) 相关客户：\n\t\t- (i) 包括 3,521 个个人账户和 18 个公司账户；以及\n\n8 介于 8 到 16 个问题之间\n\n9 其为一个“人工智能驱动的身份核验平台”。\n\nCase 1:23-cr-00118-AT Document 202-5 Filed 02/01/24 Page 4 of 40（案件号 1:23-cr-00118-AT，文件 202-5，提交日期 02/01/24，第 4 页，共 40 页）\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY) 中涉及归还其 Himalaya Exchange 资金的 41(g) 客户诉讼事项\nmazars\n\nMazars LLP 独立法务会计审阅报告\n\n- (ii) 均为“第 1 级别”客户 10；以及\n\n- (c) 所有相关客户的账户均创建于 2021年4月23日 至 2023年8月22日 之间。\n\n指示 3：我们对相关客户样本的客户入驻信息及财务数据的详细审阅\n\n- 2.3.5 我们获指示从《客户诉讼明细表》中选取由我们自行决定的相关客户样本，并针对该样本：(i) 核实 KYC 入驻信息是否存在；(ii) 将《客户诉讼明细表》中包含的财务数据与 HEX 客户数据库中的实时数据进行核对；以及 (iii) 将相关客户进行的赎回（根据《客户诉讼明细表》）与交易所的银行对账单进行核对。\n\n- 2.3.6 对于构成我们样本一部分的每个 HID，我们确认：\n\t- (a) 关于交易所获取的 KYC 信息：\n\t\t- (i) HEX 客户数据库中存在账户；\n\t\t- (ii) 交易所持有身份证明文件的副本 11，且已由 Jumio 核验为“真实”；以及\n\t\t- (iii) Jumio 进行了人脸识别测试，如文后第 4.2.11 段所述，其目的在于确认持证人 (i) 与身份证明文件照片中显示的为同一人；且 (ii) 在入驻流程期间本人亲自在场；以及\n\t- (b) 关于涉及这些客户的财务信息：\n\t\t- (i) HEX 客户数据库中的 HCN 余额和 HDO 余额与《客户诉讼明细表》中所载金额相符 12；\n\n10 根据我们对交易所政策的理解，这反映了已作为交易所客户入驻的客户，即：(i) 客户已在交易所创建账户；(ii) 联系方式详细信息；(iii) 交易所已根据其客户接纳程序进行核验；以及 (iv) 客户已根据其提供的信息获得自动批准，或在上报合规人员后获得了手动批准。\n\n11 通过 Jumio\n\n12 截至编制《客户诉讼明细表》之日。如下文第 6 节中进一步解释的，我们核对《客户诉讼明细表》中财务数据的工作是针对“实时”数据库进行的。鉴于在客户诉讼之日（我们获指示为 2023年11月10日）与我们开展工作之日（即 2023年12月15日）之间，HCN 和 HDO 余额存在持续的交易活动，因此对于某些客户账户存在调节项。这将在下文第 6 节中进一步解释。\n\nCase 1:23-cr-00118-AT Document 202-5 Filed 02/01/24 Page 4 of 40 In the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP（案件号 1:23-cr-00118-AT，文件 202-5，提交日期 02/01/24，第 4 页，共 40 页，关于 United States v Kwok, et al 23 CR 118 (SDNY) 中涉及归还其 Himalaya Exchange 资金的 41(g) 客户诉讼事项，Mazars LLP 独立法务会计审阅报告）\n\n- (ii) HEX客户数据库中的充值总额和赎回总额与《客户诉讼附表》中所记录的金额一致；以及\n- (iii) HEX客户数据库（以及《客户诉讼附表》）中的赎回总额与提供给我们的交易所银行对账单一致。\n指示4：示范性客户入职流程\n\n- 2.3.7 我们受指示针对任何选定的司法管辖区（包括但不限于美国）进行示范性入职申请。我们对所开展的两项示范性客户注册及入职测试的调查结果，符合我们对交易所客户注册政策的理解。具体而言：\n\t- (a) 一项示范性客户入职测试由于客户的国籍和/或居住国为美国，而不允许在交易所创建账户，也不允许进入入职流程的下一阶段；以及\n\t- (b) 一项示范性客户入职测试允许在交易所创建账户，但由于客户注册表单上的姓名与所提供的身份证明文件不符，而不允许进入入职流程的下一阶段。\nCase 1:23-cr-00118-AT Document 267-3 Filed 04/04/24 Page 10 of 40\n\n关于 United States v Kwok, et al（美国诉郭文贵等人案）23 CR 118 (SDNY)（纽约南区），涉及要求归还其 Himalaya Exchange（喜马拉雅交易所）资金的第41(g)条客户诉讼\n\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）的独立法务审查\nHEX客户数据库 3 -\n3.1 引言\n\n- 3.1.1 HEX客户数据库是关于交易所客户的数据的“后端”13归集库。其中包含（其中包括）以下各项的记录：\n\t- (a) 每位客户持有的虚拟资产；\n\t- (b) 每位客户的充值、赎回和交易活动；以及\n\t- (c) 客户的个人信息，包括针对每位客户执行的KYC（了解你的客户）程序记录。\n- 3.1.2 如上文第1.4节所述，为了执行我们的指示，我们于2023年12月14日和15日与来自CANDEY的代表一同走访了交易所服务公司的办公场所。在此期间，我们对HEX客户数据库进行了现场审查，以便为我们执行指示提供必要的背景情况。该操作是由交易所服务公司具有相关系统访问权限的人员在我们和CANDEY的指导下进行的。本节所列信息均基于该现场审查。\n- 3.1.3 在本节中，我们对我们所理解的HEX客户数据库14上可用信息进行了概述。\n3.2 我们对HEX客户数据库上与我们的指示相关的可用信息的理解\nHEX客户数据库仪表板\n\n3.2.1 我们在下文图3.1中列出了HEX客户数据库“仪表板”（即“HEX客户数据库仪表板”）15的摘录。我们了解到，交易所服务公司的人员通常将其称为“管理面板”（admin panel）。\n\n13 指客户无法直接访问，而是交易所内已被授予访问权限的特定个人才能访问的信息\n\n14 重要提示：我们未受指示（因此也未试图）考量HEX客户数据库的完整性或操作有效性。因此，凡提及HEX客户数据库的运行方式，均基于我们在工作过程中观察到的信息\n\n15 来自HEX客户数据库的所有摘录均在附件3.1中提供\nCase 1:23-cr-00118-AT Document 267-3 Filed 04/04/24 Page 10 of 40 关于 United States v Kwok, et al 23 CR 118 (SDNY) 涉及要求归还其 Himalaya Exchange 资金的第41(g)条客户诉讼 mazars Mazars LLP 的独立法务审查\n\n图3.1：HEX客户数据库仪表板16\nDashboard（仪表板）\n(Alla the nice and consistence program and many manufacturer procession in Mondone in a Monday on manufactures and mailing in university of the million in an allano in unitie\nClars\nComplete a manufaction on and the lines to the news proventively projects projects (control strans to mail security of the not a new lower to mail and a minist in result sens\nTransalana\nThe PARINCIPLY BARDY READS PHIL\nBut Child Charles Planel Starting and Burney Bearing on Be proved from Be votim and WESSED AND\nMicrosoft\nThe factor mystell and more and the program procession of the first and the first for the fall the fall Photos and Philips and Philips per Young\nCenna\nPre Consistant Corner Corporation Commended and Commend Commend Corp. Don't e entimat Carlinat Carlinat Cori. Partin Corp. Program Pressunt Pressure Pression Proprises (Promo\nSURNER MARK CHOOL BOOK STATE SEAN COLUMN AN VALUE STATUS STATES PORTER BARDER\n1998 11991 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 111 111 111 111 111 111 1110 11\nDet Selers\nSTORES THE PERSONAL PRESERVED PORTERS CONTRACTION TO PERSONAL SECTION PRODUCTION PRODUCTION PRODUCTION PRODUCTION CONSTITUTION PRODUCTION CONSTITUTION PRODUCTION CONSTITUTION\nAdminist | A Social a Firms between in\n\n- 3.2.2 如图3.1所示，HEX客户数据库仪表板中包含多项功能（其中包括查看“Transactions”（交易）、“Markets”（市场）和“Coins”（币种）等的功能）。与我们的指示特别相关的是“Users”（用户）功能，正如HEX客户数据库仪表板上所描述的那样，该功能“将允许您查看交易所上的用户数量及其详细信息，包括用户名、电子邮件地址以及攻击尝试。用户 -> 余额 将允许您查看每个用户持有什么加密货币及其数量”17。\n- 3.2.3 我们将其称为“用户页面”（User Page）。\n用户页面\n\n3.2.4 我们在下文图3.2中列出了用户页面的摘录。\n\n图3.2：用户页面18\n10\" (2005-1449) -\nUsers\n1 1 1 26:00\nAAXIIIyasini au\n(184) = ( | (-) (-- 1) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) == (- ) ==\n【 】 】 】 【 】 【 】 】 【 】 【 】 】 【 】 【 】 】 】 【 】 【 】 】 】 【 】 】 】 【 】 】 】 【 】 】 】 【 】 】 】 【 】 】 】 【 】 】 】 【 】 】\n二、三三四五十六元,五重三五月四十二 | 100 10-500\n1944 |\nPidesial Calw Fries M-200/Net-12\n\n- 3.2.5 从上文图3.2可以看出，用户页面提供了许多据以搜索HEX客户数据库的标准（其中包括HID（喜马拉雅交易所标识符）、客户姓名、账户创建日期等）。\n- 3.2.6 我们在下文图3.3中列出了用户页面上针对每个HID所提供的可用信息类型的示例。\n\n16 附件3.1\n\n17 附件3.1\n\n18 附件3.1\nCase 1:23-cr-00118-AT Document 267-3 Filed 04/04/24 Page 11 of 40\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY) 涉及要求归还其 Himalaya Exchange 资金的第41(g)条客户诉讼\nmazars\n\nMazars LLP 的独立法务审查\n\n图3.3：用户页面上针对每个HID所提供的可用信息类型示例19\nUsers\n(80,41) Therevi\nBOWThilder =\nL'allegan an | Carl ( Research)\n· Pager or anyant . a fiel The . a summer .\n· Includes == 10) = 14,5-7 1,6210 == 17 == 11 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == 1 == | I haven' with 2014 11/2 \" . \" Sheet direct per di \" | | | alley\n1675 |\nContined Close Miller\nCommill I == 10 % | a sept of the care | | | 12.7 | |\n\n- 3.2.7 如上文图3.3所示，当在用户页面中输入HID时，它会提供客户的概要概览。具体而言，它列出了：\n\t- (a) 与该HID相关的账户“Type”（类型）。我们了解到账户可以是以下任一种：\n\t\t- (i) “personal”（个人），指客户为自然人，并将账户用于个人目的；或\n\t\t- (ii) “corporate”（企业），指代表企业实体使用该账户。\n\n我们了解到，就我们的指示而言，这些类型账户之间的关键区别在于交易所针对这些客户所执行的入职程序；\n\n- (b) 客户的姓名；\n- (c) 账户创建日期（如“Created”列所示）。我们了解到交易所网站自2021年4月起开始接受客户；\n- (d) 有关账户状态的信息，例如其是否为“Enabled”（已启用）、“Approved”（已批准）、“Locked”（已锁定）或“Deleted”（已删除）；\n- (e) 有关账户活动的高级概要信息，例如客户是否已充值资金、交易HCN或HDO或提取资金（分别如“Deposit”（充值）、“Trade”（交易）和“Withdraw”（提现）列所示）；\n- (f) 客户的通信偏好（例如其是否已同意通过“Online”（在线）、“Newsletter”（简报）或“SMS”（短信）进行沟通）：\n\n19 附件3.1\nmazars\n\nMazars LLP 的独立法务审查\n\n- (g) 针对交易所支付应用程序“Hpay”的账户权限20；以及\n- (h) 交易所执行的客户接纳程序的结果，包括：\n\t- (i) 客户的“Risk Rating”（风险评级）：我们了解到风险评级反映了交易所对接纳该客户相关风险的评估，并被归类为“低”（low）、“中”（medium）、“高”（high）或“极高”（ultra-high）。风险评级源自“Risk Score”（风险分值），该分值是根据客户对调查问卷（即“KYC调查问卷”21）的回答计算得出的。我们在下文第4节中对交易所的风险评估流程提供了更详细的解释；以及\n\t- (ii) 客户的“Tier”（层级）：我们了解到客户分类共有三个不同的“层级”22，用以反映客户接纳程序的状态。其中包括：\n\t\t- · 尚未分配层级的客户。这些是已注册在交易所创建账户但尚未验证其联系方式的客户；\n\t\t- · 0级（Tier 0）客户：这些是已注册在交易所创建账户并已验证其联系方式（包括电子邮件地址和电话号码），但客户接纳程序尚未完成的客户。在此阶段，这些账户不属于“活跃”账户；以及\n\t\t- 1级（Tier 1）客户：这些是已作为交易所客户完成入职的客户，即：(i) 客户已在交易所创建账户；(ii) 客户已验证其联系方式；(iii) 交易所已根据其客户接纳程序验证了其身份（其进一步详情载于下文第4节）；以及(iv) 客户已获得自动批准\n\n20 我获指示得知，Hpay 允许客户进行（其中包括）：(i) 向其他交易所客户进行点对点转账；以及 (ii) 为经交易所批准的商户购买 HDO/HCN 礼品卡\n\n21 关于 KYC 问卷的进一步详情，见下文第 4.2.8 段及后续内容\n\n22 我们理解交易所正在考虑在未来推行额外的层级，即“第 2 层级”\n\n23 意指客户不能存入或赎回资金，也不能交易 HCN 或 HDO\n案号 1:23-cr-00118-AT 文件 207-1 归档日期 04/04/25 第 10 页，共 40 页\n\n关于 United States v Kwok, et al（美国 诉 郭文贵等案），案号 23 CR 118 (SDNY)（纽约南区），涉及客户要求返还其 Himalaya Exchange（喜马拉雅交易所）资金的 41(g) 规则诉讼\nMazars\n\nMazars LLP 独立法务会计审查\n\n系基于其所提供的信息，或者在呈报合规人员后已获手动批准。\n\n我们理解相关客户仅包含第 1 层级客户。\nHID 仪表板\n\n- 3.2.8 有关该客户的进一步信息，可通过点击“User Name / HID”（用户名 / HID）栏中的 HID 获取，点击后会生成针对每位客户的仪表板（下称“HID 仪表板”）。\n- 3.2.9 HID 仪表板包含多个标签页，对有关每位客户的可用信息进行分类。与我们的指示特别相关的标签页如下：\n\t- (a) “Profile”（个人资料）：这包括有关该客户的进一步信息，其中包括姓名、出生日期、联系方式、国籍、居住国、身份证件号码；\n\t- (b) “Deposits”（充值）：这载明了客户充值的详情，其中包括 (i) 充值的日期和时间；(ii) 充值金额；(iii) 交易所内部批准该充值的人员24；以及 (iv) 就该充值应向交易所支付的任何费用；\n\t- (c) “Withdrawals”（提现）：这载明了客户提现25的详情，其中包括 (i) 客户申请提现的日期和时间；(ii) 提现金额；以及 (iii) 就该提现应向交易所支付的任何费用；以及\n\t- (d) “Risk Scoring”（风险评分）：这载明了客户的风险评分（如上文第 3.2.7(h) 段所述）、客户填写的 KYC 问卷以及交易所合规团队就该客户作出的客户接纳决定的意见。\n- 3.2.10 我们在下文图 3.4 至图 3.7 中列出了一个 HID 示例26对应的这四个标签页中每一个的摘录。\n\n24 我们理解向交易所进行的每笔充值均需经过两步授权流程，即充值需要由两名人员授权方可接纳资金\n\n25 “Withdrawals”（提现）与赎回同义\n\n26 如上文第 1.4 节所述，我们获指示得知我们审查的客户信息属于保密信息。因此，虽然我们在 HEX 客户数据库上审查了未隐去的信息，但我们获指示在本报告中必须予以隐去。图 3.4 至图 3.7 中的信息因此已被隐去\n案号 1:23-cr-00118-AT 文件 207-1 归档日期 04/04/25 第 11 页，共 40 页\n\n关于 United States v Kwok, et al（美国 诉 郭文贵等案），案号 23 CR 118 (SDNY)（纽约南区），涉及客户要求返还其 Himalaya Exchange（喜马拉雅交易所）资金的 41(g) 规则诉讼\nMazars\n\nMazars LLP 独立法务会计审查\n\n图 3.4：HID 仪表板“Profile”（个人资料）标签页所包含信息的示例27\n\n首页 | 设置 | 用户 | 安全 | 文档 | 报表 | 审计 | 系统 | 帮助 用户管理 | 权限 | 报告 | 临时登录 | 会话管理 | 退出登录 用户详情\nID 已启用 是 是\n创建日期 已批准 是 是\n显示名称 已删除 否 否\n用户类型 已被锁定 否\n名及中间名 停止充值 否\n姓氏 停止交易 否\n全名 停止提现 否\n出生日期 强制更改密码 否\n电子邮件 双重身份验证 否\n地址用户名 在线 否\n移动电话 能够访问 API 密钥 否\n地址第 1 行\n地址第 2 行\n居住国家\n城市\n州/省\n邮政编码\n国籍国家\n身份证件号码\n备注\n最后备注人\n登录失败尝试次数\n\n图 3.5：HID 仪表板“Deposits”（充值）标签页所包含信息的示例28\n以及锁定的将是安全从街道新较少新发生被媒体\n财产与系列前往邮件之州与州\n呼叫 - 呼叫 - 马林 - 发布于 建立 - 备注 - 备注 连接 关注者 - 精神 清算 - 省份 备注 - 省份 - 省份 备注 - 省份 - 省份\n相反于合同与嵌件以及流程 | D | 100 0 | 法庭 |\n做法 (1984) R\n在限制中。计划中的全部知识且必须至必须至最至 马林公园 1 1 1000\n1 资格证明 >\n14 校准 1\n11 1/1000 1\nP -11-944 1\nm 链接 4\n18 来\n1 取消 1\n创建 V\n11 备注\n\n图 3.6：HID 仪表板“Withdrawals”（提现）标签页所包含信息的示例29, 30\n\n询问用户关于操作 提现 赎回/贷款申请信息 政策 金额 赎回日期 税务选项 余额 资金组 提现日期\n地址日期 纳税人识别号 日期\n纳税人识别号 账号 日期\n贷款/赎回类型 选项 选项 搜索\n\n提款（第 1 项，共 1 项）\n类型 总账账户 日期 金额 费用 LID 计息率 列 政策 该金额 操作\n\n27 证据 3.1\n\n28 证据 3.1\n\n29 为本示例选取的客户截至我们完成工作之日尚未进行过任何提现\n\n30 证据 3.1\n案号 1:23-cr-00118-AT 文件 207-1 归档日期 04/04/25 第 12 页，共 40 页\n\n关于 United States v Kwok, et al（美国 诉 郭文贵等案），案号 23 CR 118 (SDNY)（纽约南区），涉及客户要求返还其 Himalaya Exchange（喜马拉雅交易所）资金的 41(g) 规则诉讼\nMazars\n\nMazars LLP 独立法务会计审查\n\n图 3.7：HID 仪表板“Risk Scoring”（风险评分）标签页所包含信息的示例31\n临时 ID\n管理评分\n总风险评分\n风险等级\nCOMPLYADVANTAGE\n命中结果\nCOMPLYADVANTAGE\n链接\n验证\n申请状态\n类别\n尝试签名次数\n风险评分更新历史\n日期与时间 全名 角色 风险评分\n\n31 证据 3.1\n案号 1:23-cr-00118-AT 文件 207-1 归档日期 04/04/25 第 13 页，共 40 页\n\n关于 United States v Kwok, et al（美国 诉 郭文贵等案），案号 23 CR 118 (SDNY)（纽约南区），涉及客户要求返还其 Himalaya Exchange（喜马拉雅交易所）资金的 41(g) 规则诉讼\nMazars\n\nMazars LLP 独立法务会计审查\n4 指示 1：我们对交易所现有客户入驻相关流程与程序的理解\n4.1 引言\n\n- 4.1.1 除对 HEX 客户数据库进行审查外，我们还试图参考交易所与相关期间有关的书面文件，以核实交易所现有与客户入驻相关的流程。就此而言，我们收到了题为“客户入驻与合规流程演示”的演示文稿，日期为 2022 年 6 月（下称“入驻流程文件”）32, 33。\n- 4.1.2 根据入驻流程文件34，我们理解交易所得客户入驻包含四个关键阶段：\n\t- (a) “阶段 1”：客户注册；\n\t- (b) “阶段 2”：客户身份识别、核实与筛查；\n\t- (c) “阶段 3”：客户风险评估；以及\n\t- (d) “阶段 4”：客户接纳批准或呈报。\n\n我们在第 4.2 节中列出上述各关键阶段的进一步详情。\n4.2 客户入驻流程的关键阶段\n阶段 1：客户注册\n\n4.2.1 为在交易所注册，新客户必须首先访问交易所网站35并选择“Register”（注册）标签页。我们在下文图 4.1 中列出了作为该注册流程的一部分客户必须提供的信息（下称“关键注册信息”）的摘录：\n\n32 证据 4.1\n\n33 我们获指示得知，交易所的合规政策正式记录在《合规手册》中。鉴于我们指示的范围，未就本报告之目的向我们提供该手册\n\n34 我们获指示得知，入驻流程文件系为申请监管牌照之目的而编制，并基于《合规手册》及交易所于相关期间内实施的政策和程序 35 网址为 http\n案号 1:23-cr-00118-AT 文件 207-1 归档日期 04/04/25 第 14 页，共 40 页\n\n关于 United States v Kwok, et al（美国 诉 郭文贵等案），案号 23 CR 118 (SDNY)（纽约南区），涉及客户要求返还其 Himalaya Exchange（喜马拉雅交易所）资金的 41(g) 规则诉讼\n\nMazars\n\nMazars LLP 独立法务会计审查\nHIMALAYA EXCHANGE（喜马拉雅交易所） 支持 登录 注册 中文\n\n创建您的账户\n\n个人 企业\n法定名及中间名\n法定姓氏\n出生日期\n日/月/年\n国籍\n请选择\n居住国家\n请选择\n地址\n城市\n邮政编码\n\n图 4.1：交易所网站上的客户注册页面36\n\n- 4.2.2 重要的是，有关国籍和居住国家的问题是多项选择题（并由客户参考下拉列表进行填写）。我们理解，客户的居住国家与交易所作出的客户接纳决定特别相关，且交易所的政策是不接纳居住在特定国家（例如包括美国）的客户（下称“受限国家”）37。受限国家未包含在上述下拉列表中，这意味着居住国家为受限国家的个人将无法注册交易所账户。\n- 4.2.3 客户提供其关键注册信息后，将被要求在交易所的安全在线门户上回答三个个人问题。这些安全问题的目的是“为身份验证流程增加一层额外的客户保护”38。\n\n36 如图 4.1 所示，“Individuals”（个人，亦称“个人”账户）和“Corporates”（企业）具有单独的注册页面。根据我们在此事项上的工作，我们理解超过 99% 的相关客户为个人，因此我们未考虑针对企业的客户入驻流程\n\n37 就此而言，我们获指示得知 (i) 会定期审查受限国家名单，以确保交易所遵守全球监管要求；以及 (ii) 自交易所成立以来，美国一直被列入受限国家名单 38 证据 4.1，幻灯片 3\n案号 1:23-cr-00118-AT 文件 207-1 归档日期 04/04/25 第 15 页，共 40 页\n\n关于 United States v Kwok, et al（美国 诉 郭文贵等案），案号 23 CR 118 (SDNY)（纽约南区），涉及客户要求返还其 Himalaya Exchange（喜马拉雅交易所）资金的 41(g) 规则诉讼\nMazars\n\nMazars LLP 独立法务会计审查\n阶段 2：客户身份识别、核实与筛查\n\n- 4.2.4 客户入职流程中的第二个关键阶段在交易所的《入职流程文件》中被称为“身份识别、核实与筛查”。该阶段要求客户：\n\t- (a) 提供并验证其电子邮件地址和电话号码；\n\t- (b) 完成 KYC（了解你的客户）调查问卷，其中包括诸多多选题，涉及（除其他事项外）客户的个人详细信息、资金来源以及加密货币交易的经验水平；以及\n\t- (c) 提交一份身份证件，并完成某些身份核实检查。\n\n- 4.2.5 我们在下文中依次详细说明上述各项要求。\n\n获取并验证客户的电子邮件地址和电话号码\n\n- 4.2.6 为推进客户入职流程，客户须通过交易所的安全在线门户提供并验证其电子邮件地址和电话号码。关于以下方面的验证：\n\t- (a) 电子邮件地址：客户激活发送至其电子邮件地址的验证链接后即完成验证；以及\n\t- (b) 电话号码：客户输入通过短信发送给他们的 6 位数验证码后即完成验证。\n\n- 4.2.7 此外，客户须确认其并非美国、日本的居民，亦非加拿大或任何其他依据当地法律禁止持有或使用加密货币的司法管辖区的公民或居民。\n\nKYC 调查问卷\n\n4.2.8 我们在下文图 4.2 中列出了 KYC 调查问卷中所含问题的示例：\n\n关于 United States v Kwok, et al（美国诉郭案等）23 CR 118 (SDNY)（纽约南区）涉及客户依据第 41(g) 条要求归还其 Himalaya Exchange（喜马拉雅交易所）资金之诉讼事项\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）的独立法务审查\n\n图 4.2：KYC 调查问卷 39\n出生地\n证件所载国籍\n请告知我们您目前的就业状况。\n请告知我们您的职业或业务活动。\n请告知您除税务登记所在国之外可能在其他国家开展的业务？\n您的个人活动或业务是否在优惠税区（例如自由经济区、离岸管辖区）注册或开展？\n请告知您在个人或业务活动中以现金结算的年营业额。\n请告知您在个人或业务活动中以加密货币结算的年营业额。\n请告知您的收入资金来源。必要时可勾选多个选项。\n请告知您的财富来源？必要时可勾选多个选项。\n请选择您计划使用的服务。必要时可勾选多个选项。\n您计划每年存入多少金额（美元与加密货币合计）？\n请告知将从哪些国家接收和/或转移资金。\n请告知您在加密货币交易方面的经验水平？请选择一项：\n您有多少年的加密货币交易经验？\n您本人、直系亲属或密切关联人是否在任何国家或国际机构中被委任、或曾经被委任显要公共职务？这包括本国或海外的公职、政府职务、监管职务或高级军职。\n\n4.2.9 为完成 KYC 调查问卷，客户必须回答所有问题。根据客户对 KYC 调查问卷的回答，交易所会计算每位客户的风险评分，下文第 4.2.13 款及后续内容对此有更详细的说明。\n\n获取证明客户身份的文件\n\n- 4.2.10 我们获悉，交易所将客户身份证件的收集和核实工作外包给了 Jumio。Jumio 是一个“人工智能驱动的身份核实平台”40，该平台“利用人工智能、机器学习和生物识别技术实现核实流程自动化，帮助企业提高转化率、遵守反洗钱（AML）和 KYC 法规并更好地检测欺诈行为——同时在数秒内给出明确的是/否裁定”41。\n\n- 4.2.11 我们获悉，可作为客户身份证明予以接受的身份证件包括护照、驾照或身份证。随后 Jumio 将核实 42：\n\t- (a) 该身份证件“真实且有效”；以及\n\t- (b) 通过使用人工智能（“AI”）驱动的人脸识别技术，将所提供的身份证件与客户拍摄的实时照片进行比对，以核实客户的身份。这包括确认“持证人[即为]证件照片上显示的人员”，并且“持证人在交易期间[本人亲身]在场”。\n\n- 4.2.12 此外，交易所还代表交易所对潜在客户进行筛查，以识别任何属于政治公众人物（“PEP”）、受到\n\n39 此处为 KYC 调查问卷的一个示例。我们获悉，在相关期间，问卷上的问题（及问题数量）发生过变化（例如，在此期间问题数量在 8 到 16 个之间不等）\n\n40 http\n\n41 http\n\n42 证据 4.1，幻灯片 5\n\n关于 United States v Kwok, et al（美国诉郭案等）23 CR 118 (SDNY)（纽约南区）涉及客户依据第 41(g) 条要求归还其 Himalaya Exchange（喜马拉雅交易所）资金之诉讼事项\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）的独立法务审查\n\n制裁或受到负面媒体报道的个人。我们获悉，交易所使用第三方软件提供商“ComplyAdvantage”来执行该筛查流程。\n\n第 3 阶段：客户风险评估\n\n4.2.13 在完成第 1 和第 2 阶段后，交易所将评估所提供的信息并为每位客户分配一个风险评级。如上文第 3.2 节所述，该评级反映了交易所对吸纳该客户入职相关风险的评估，并源自客户的风险评分。\n\n风险评分\n\n- 4.2.14 风险评分是一个介于 0 到 99 之间的数字，反映了交易所对接纳某位客户所感知的风险。风险评分越高，交易所感知的吸纳该客户入职的风险就越高。\n\n- 4.2.15 客户在 KYC 调查问卷中提供的每项回答均会根据交易所制定的风险模型被赋予一个风险评分。我们在下文图 4.3 中概述了交易所风险模型所涉及的考量因素。\n\n图 4.3：风险模型评估 43\n\n43 证据 4.1，幻灯片 7\n\n关于 United States v Kwok, et al（美国诉郭案等）23 CR 118 (SDNY)（纽约南区）涉及客户依据第 41(g) 条要求归还其 Himalaya Exchange（喜马拉雅交易所）资金之诉讼事项\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）的独立法务审查\n\n风险评级\n\n- 4.2.16 风险评级分为“低”、“中”、“高”或“超高”，并与风险评分对应如下：\n\t- (a) 若客户的风险评分介于 0 至 30 之间，则风险评级为“低”（“低风险”）；\n\t- (b) 若客户的风险评分介于 31 至 59 之间，则风险评级为“中”（“中风险”）；\n\t- (c) 若客户的风险评分介于 60 至 75 之间，则风险评级为“高”（“高风险”）；以及\n\t- (d) 若客户的风险评分介于 76 至 99 之间，则风险评级为“超高”（“超高风险”）。\n\n第 4 阶段：客户接纳批准或上报升级\n\n- 4.2.17 交易所合规团队在每位客户入职流程中的参与程度主要由分配给该客户的风险评级决定，其中：\n\t- (a) 若客户为高风险或超高风险，合规团队须手动审查该客户的申请并予以接纳或拒绝；以及\n\t- (b) 若客户为低风险或中风险，合规团队不一定须手动审查该客户的申请，但若发现合规问题，或作为交易所质量控制程序及持续合规监控的一部分，合规团队亦可进行手动审查。\n\n- 4.2.18 我们在下文图 4.4 中更详细地列出了交易所的批准或上报升级流程。\n\n关于 United States v Kwok, et al（美国诉郭案等）23 CR 118 (SDNY)（纽约南区）涉及客户依据第 41(g) 条要求归还其 Himalaya Exchange（喜马拉雅交易所）资金之诉讼事项\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）的独立法务审查\n\n图 4.4：批准或上报升级流程 44\n\n44 证据 4.1，幻灯片 8\n\n关于 United States v Kwok, et al（美国诉郭案等）23 CR 118 (SDNY)（纽约南区）涉及客户依据第 41(g) 条要求归还其 Himalaya Exchange（喜马拉雅交易所）资金之诉讼事项\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）的独立法务审查\n\n5 指示 2：我们对 HEX 客户数据库中相关客户账户的审查\n\n5.1 引言\n\n- 5.1.1 如上文第 1.3 节所述，我们已接到指示，要求核实 HEX 客户数据库中是否存在各相关客户的账户。\n\n- 5.1.2 我们执行该指示的方法是在 HEX 客户数据库中检索《客户诉讼附表》中列出的 HID（如上文第 1.4 节所述，HID 是分配给每个客户账户的唯一代码）。在执行过程中，我们：\n\t- (a) 提取了 HEX 客户数据库中包含的某些信息 45（即“HEX 客户数据库下载文件”）。我们在第 5.2 节中解释了获取该 HEX 客户数据库下载文件的流程以及为审查该文件的准确性所开展的工作；以及\n\t- (b) 识别了 HEX 客户数据库下载文件中对应于相关客户的账户。我们在第 5.3 节中列出了我们的工作成果。\n\n5.2 HEX 客户数据库下载文件\n\n- 5.2.1 如上文第 3.2 节所述，“用户页面”提供了多种可用于检索 HEX 客户数据库的检索标准，除其他事项外，包括 HID、客户姓名、账户类型 46、客户层级以及账户创建日期。\n\n- 5.2.2 通过使用“用户页面”，可以从 HEX 客户数据库中提取信息并将其下载至 Excel 47 文件中。\n\n- 5.2.3 生成 HEX 客户数据库下载文件的流程如下 48。\n\n45 特别是“用户页面”中提供的与交易所归类为“层级”的所有客户相关的信息 46 即“个人”或“企业”\n\n47 Excel 是 Microsoft（微软）推出的一款电子表格程序，使用户能够在电子表格中对数据进行排版、整理和计算 48 如上文所述，我们在这方面的工作是由具有相关系统访问权限的交易所人员在我们的指示及 GANDEY 的指示下开展的。我们针对该任务对该项工作进行了指导和监督\n\n- (a) 步骤 1：我们力求获取在 HEX（喜马拉雅交易所）客户数据库上被归类为“Tier 1”（一级）的所有客户账户的提取数据（即仅在“用户页面”的搜索条件中应用此筛选条件）49。这生成了 21,005 个账户的汇总信息；\n- (b) 步骤 2：为了从 HEX 客户数据库中提取该汇总信息，有必要将数据划分为较小的部分50。我们参照特定时间段对数据进行了进一步筛选（即就账户创建日期向筛选器应用日期）。这些时间段为51, 52：\n\t- (i) 自 Exchange（交易所）成立之日起53至 2021年4月28日。这生成了 3,395 个账户的汇总信息；\n\t- (ii) 2021年4月28日至 2021年5月6日。这生成了 2,989 个账户的汇总信息；\n\t- (iii) 2021年5月6日至 2021年6月30日。这生成了 3,159 个账户的汇总信息；\n\t- (iv) 2021年6月30日至 2021年11月7日。这生成了 3,253 个账户的汇总信息；\n\t- (v) 2021年11月7日至 2021年11月30日。这生成了 2,095 个账户的汇总信息；\n\t- (vi) 2021年11月30日至 2022年3月31日。这生成了 2,821 个账户的汇总信息；以及\n\t- (vii) 2022年3月31日至 2023年12月15日（我们完成工作的日期）。这生成了 3,293 个账户的汇总信息；\n- (c) 步骤 3：一旦按照上述时间段下载了数据，我们便将上述步骤 2 中描述的所有数据（即 HEX 客户数据库中被归类为“Tier 1”的所有客户账户）合并到一个电子表格中；以及\n\n49 我们从与交易所工作人员的谈话中了解到，所有相关客户均为“Tier 1”客户。我们在工作过程中力求核实这一点——见下文第 5.3 节\n\n50 因为 HEX 客户数据库无法支持提取与交易所所有“Tier 1”客户相关的数据量\n\n51 下列时间段是通过反复试错确定的\n\n52 为了确认我们在将数据筛选到特定时间段时没有“重复计算”任何天数，我们力求核对 (i) 每个时间段获得信息的账户数量（即上述 (i) 至 (vii) 的总和，相当于 21,005 个账户）；与 (ii) HEX 客户数据库中 Tier 1 账户的总数（也相当于 21,005 个账户）\n\n53 这是通过不在“创建日期自”（Created Date From）筛选器中应用日期来实现的\nCase as a sea a dia do anne en to of the di 04/04/25 age and of 40 In the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP\n\n- (d) 步骤 4：使用 Excel 分析工具54，我们力求将《客户诉讼附表》中的 HID 与《HEX 客户数据库下载件》中的 HID 进行匹配。我们在第 5.3 节中总结了这方面的调查结果。\n- 5.2.4 为了确认我们处理该指示的方法是适当的，我们对 250 名相关客户的样本进行了 HID 手动检查。这包括在我们和 CANDEY 的指导下，观察交易所服务公司的人员（其拥有相关系统访问权限）一次输入一个 HID，并确认该 HID 存在对应的账户（通过直接在 HEX 客户数据库中查看）。\n- 5.2.5 HID 样本由我们自行选定，并在开展工作时首次提供给交易所服务公司的人员，包括55：\n\t- (a) 《客户诉讼附表》中的前 150 个 HID（“客户账户样本 1”）。我们最初计划对《客户诉讼附表》中包含的所有 HID 进行此手动流程。然而，我们发现我们无法在可用时间内完成工作。因此，我们询问了处理指示的其他方法，从而获得了《HEX 客户数据库下载件》（如上所述）。\n\n对于客户账户样本 1，在我们和 CANDEY 的指导下，我们观察了交易所服务公司的人员一次向 HEX 客户数据库输入一个 HID，以确认 HEX 客户数据库中存在该 HID 的账户。我们在附录 5.1a 中列出了该样本测试的结果；以及\n\n(b) 《客户诉讼附表》中包含的另外 100 个 HID 样本（“客户账户样本 2”）。为了选择该 HID 样本，我们采用了使用系统抽样的非统计抽样方法，通过在《客户诉讼附表》中每隔 34 个 HID 编号（排除前 150 项）选取一个进行样本测试。\n\n对于客户账户样本 2，在我们和 CANDEY 的指导下，我们观察了交易所服务公司的人员一次向 HEX 客户数据库输入一个 HID，以确认 (i) 该 HID 在\n\n54 具体而言，Excel 功能“VLOOKUP”是数据分析中常用的搜索函数，可在电子表格中纵向识别并匹配特定数据\n\n55 就目前而言，我们总共测试了 250 个 HID 的样本。若法院要求测试更广泛的样本，我们可以扩大测试范围\nCase as a sea a cara do ame en to of the di 04/04/25 age age of 20 f\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\nmazars\n\nIndependent forensic review of Mazars LLP\n\nHEX 客户数据库中存在账户；以及 (ii)《HEX 客户数据库下载件》中的详细信息与 HEX 客户数据库中的信息相符56。我们在附录 5.1b 中列出了该样本测试的结果。\n\n5.2.6 在我们的样本中，我们没有发现《HEX 客户数据库下载件》上的信息与“手动”（通过在用户页面中一次搜索一个 HID）获取的信息之间存在任何差异。\n我们工作的结果 5.3\n\n- 5.3.1 利用《HEX 客户数据库下载件》，我们力求确认：\n\t- (a) HEX 客户数据库中是否存在每位相关客户的账户；\n\t- (b) 该账户是“个人”账户还是“公司”账户；\n\t- (c) 该客户的 Tier（层级）分类57；以及\n\t- (d) 其账户创建的日期。\n- 5.3.2 我们在附录 5.2 中列出了我们在这方面的工作结果。总而言之，根据我们对 HEX 客户数据库中所含信息的审查，我们确认：\n\t- (a) 对于每位相关客户，HEX 客户数据库中均存在账户；\n\t- (b) 相关客户：\n\t\t- (i) 包含 3,521 个个人账户和 18 个公司账户；且\n\t\t- (ii) 均为 Tier 1 客户；以及\n\t- (c) 所有相关客户的账户均创建于 2021年4月23日至 2023年8月22日之间。\n\n56 特别是客户名称、账户类型和客户的“层级”（tier）\n\n57 如上文第 3.2 节所述，HEX 客户数据库中的每位客户均参照所进行的入职审核阶段进行分类\n\nCase as a sea a comment on of the do and of the di 04/04/25 age and of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds\nmazars\n\nIndependent forensic review of Mazars LLP\n6 指示 3：我们对相关客户样本的客户入职审核信息和财务数据的详细审查\n6.1 引言\n\n6.1.1 如上文第 1.3 节所述，我们收到指示，需从《客户诉讼附表》中识别并隔离出相关客户的样本，并针对该样本进行以下工作：\n\n- (a) 验证 KYC（了解你的客户）入职审核信息的存在性；\n- (b) 根据 HEX 客户数据库上的实时数据，验证《客户诉讼附表》中包含的财务数据；以及\n- (c) 根据交易所的银行对账单，验证相关客户进行的赎回。\n- 6.1.2 在本节中，我们列出：\n\t- (a) 我们为选择要审查的客户样本所采用的方法（第 6.2 节）；以及\n\t- (b) 我们针对相关客户样本的客户入职审核信息和财务数据执行的程序（第 6.3 节）。\n6.2 样本选择方法\n\n- 6.2.1 就目前而言，我们总共测试了 50 个 HID 的样本（“KYC 和财务数据样本”）。与上文第 5 节中描述的方法一致，我们选择的样本在开展工作时首次提供给交易所服务公司的人员。若法院要求测试更广泛的样本，我们可以扩大测试范围。\n- 6.2.2 为了选择相关客户的样本，我们采用了使用系统抽样的非统计抽样方法，按照以下步骤进行：\n\t- (a) 我们首先通过以下方式将《客户诉讼附表》中的 HID 编号顺序进行随机化：\n\nPrivate and Confidential\n\n-33 -\n\nCase as a sea a comment on of the do and of the di of the di of 40 for 40 In the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP (i) 使用 Excel 函数“=rand()”为每个 HID 编号分配一个随机生成的数字，该函数向《客户诉讼附表》中的每个 HID 编号生成一个介于 0 和 1 之间的随机数；(ii) 重新计算 (i) 中的公式；以及 (iii) 按照 (ii) 中随机生成的数字从小到大对《客户诉讼附表》进行排序；以及 (b) 然后我们选择 (iii) 中《客户诉讼附表》中每隔第 71 个 HID 编号构成我们样本的一部分。\n\n6.2.3 《客户诉讼附表》包含 3,539 名客户，因此通过选取第 71 个 HID，我们的样本由 50 名客户组成58。\n6.3 我们针对相关客户样本执行的程序\n\n6.3.1 如上所述，我们收到指示，需审查 (i) 交易所就相关客户样本获取的 KYC 信息；以及 (ii) 与这些客户相关的特定财务信息。\n我们对交易所获取的 KYC 信息的审查\n\n- 6.3.2 对于我们样本中包含的每个 HID，我们审查了 HID 仪表板的“个人资料”（Profile）标签页，并审查了：\n\t- (a) 每个 HID 是否在 HEX 客户数据库中存在账户；\n\t- (b) 该账户是否已启用；\n\t- (c) 账户的 Tier（层级）；\n\t- (d) 账户是“个人”账户还是“公司”账户；\n\t- (e) 客户的全名、电子邮件地址、国籍和居住国家/地区；\n\t- (f) 客户的收入来源和财富来源；\n\t- (g) 分配给客户的风险评分和风险评级；以及\n\n58 71 x 50 = 3,550\nCase as a sea a dia do anne en to of the di 04/04/25 age a really of 40\n\nIn the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP\n\n- (h) 每位客户可用的身份证明文件以及 Jumio 进行的测试。\n\n- 6.3.3 我们在附录 6.1 中列出了我们在这方面的工作结果。总括而言，我们确认对于构成我们样本一部分的每个 HID：\n\t- (a) 在 HEX 客户数据库（HEX Customer Database）中存在一个账户；\n\t- (b) 该交易所持有身份证明文件的副本，且这些文件已被 Jumio 验证为“真实的”60；以及\n\t- (c) Jumio 进行了人脸识别测试，如上文第 4.2.11 段所述，该测试的目的是确认持有该身份证明的人员 (i) 与身份证明照片中所示人员为同一人；且 (ii) 在入驻流程期间亲身在场。\n\n- 6.3.4 此外，对于作为该样本一部分接受测试的每位客户，我们还在证据 6.1（Exhibit 6.1）中附上了 HID 数据库中“风险评分”（Risk Scoring）标签页的摘录，其中包括每位客户对 KYC 调查问卷（KYC Questionnaire）提供的答复以及合规团队添加到其账户中的任何审核意见。\n\n我们对这些客户相关财务信息的审查\n\n- 6.3.5 对于包含在我们样本中的每个 HID，我们审查了 HID 仪表板（HID Dashboard）的“存款”（Deposits）和“提款”（Withdrawals）标签页，并力求在以下方面使 HEX 客户数据库中的信息与《客户诉讼附表》（Customer Action Schedule）中的信息一致：\n\t- (a) HCN 余额；\n\t- (b) HDO 余额；\n\t- (c) 总存款；以及\n\t- (d) 总赎回额。\n\n- 6.3.6 关于本样本中客户进行的赎回，我们还力求使赎回金额与该交易所的银行对账单相符61。\n\n59 通过 Jumio。\n\n60 对于我们样本中的每个对象，我们力求确认身份证明文件上的姓名与 HEX 客户数据库中的姓名一致。虽然我们能够对样本中的大部分做到这一点，但有相当数量的 HID 涉及中国籍人员，他们的姓名在身份证明文件和 HEX 客户数据库中均是以中文列出的，针对这些人员，我们确认了身份证明文件上的证件号码与 HEX 客户数据库中的证件号码相符。这项工作的详情见附录 6.1。\n\n61 有关这些赎回的经隐去处理的银行对账单已提供给我，并列于证据 6.2。\n\nCase 1:23-cr-00118-TOR Document Filed [OCR乱码行]\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY)（美国诉郭等案，案号 23 CR 118，纽约南区）案中关于要求归还其喜马拉雅交易所资金的第 41(g) 条客户诉讼事宜\n\nmazars（玛泽）\n\nMazars LLP（玛泽有限责任合伙）的独立法务审查\n\n- 6.3.7 我们在附录 6.1 中列出了我们的工作结果62。总括而言，我们确认：\n\t- (a) HEX 客户数据库中的 HCN 余额和 HDO 余额与《客户诉讼附表》中所述金额相符（在将时间差考虑在内的情况下）。\n\n在这方面，在开展此项工作时，我们力求使《客户诉讼附表》（根据我们的指示，该附表系截至 2023年11月10日 编制）中的财务数据与我们开展工作之日（2023年12月15日）的“实时”HEX 数据库相符。鉴于在 2023年11月10日 至 2023年12月15日 期间存在正在进行的 HCN 和 HDO 余额交易活动，对于某些客户账户，存在调节项（涉及这些客户在此期间进行的交易）63。在将这些交易考虑在内后，我们未发现 HEX 客户数据库与《客户诉讼附表》相比在 HCN 和 HDO 余额之间存在任何差异；\n\n- (b) HEX 客户数据库中的总存款和总赎回额与《客户诉讼附表》中所载金额相符；以及\n\n- (c) HEX 客户数据库（及《客户诉讼附表》）中的总赎回额与提供给我们的交易所银行对账单相符64。这些银行对账单包括：\n\t- (i) Mercantile Bank International Corp（“Mercantile Bank”），我们理解这是一个“托管账户”65；以及\n\n62 如上文第 1.4 节所述，根据我们的指示，我们审查的客户信息以及我们据以核对的底层 KYC 文件属于机密信息。因此，虽然我们审查了 HEX 客户数据库上未经隐去的信息，但根据指示，出于附录 6.1 中信息的目的必须进行隐去，因此支持文件（特别是证据 6.1 和 6.2）已被隐去。\n\n63 我们对照 HEX 数据库确认了这些调节项中的每一项。进一步详情见附录 6.1。\n\n64 提供给我们的银行对账单是交易所持有的银行对账单纸质副本。根据我们的指示，由于查封，交易所已不再拥有在线账户，因为这些账户已被关闭。\n\n65 根据我们的指示，在查封之前，Mercantile Bank 是该交易所的银行合作伙伴之一，该交易所在该行开设了一个账户，持有其稳定币储备的一部分（“相关 Mercantile Bank 账户”）。我们还获悉，相关 Mercantile Bank 账户是一个“托管”账户，而非标准银行账户，以保障客户资金。在这方面，我们已收到一份题为《MERCANTILE BANK INTERNATIONAL CORP. 在线托管与银行服务协议》、日期为 2022年9月 的文件（“Mercantile Bank 托管协议”，证据 6.3），根据我们的指示，该文件列出了适用于相关 Mercantile Bank 账户的条款和条件。我们尚未阅读 Mercantile Bank 托管协议的全部条款和条件，也未被指示就相关 Mercantile Bank 账户开展任何进一步程序。我们被指示审查 Mercantile 托管协议第 6.2 款，其中规定：“为了履行其作为托管人的职责，并在遵守本协议限制的前提下，客户指示托管人：(i) 妥善保管转入‘托管资金’的法定货币和数字资产金额；(ii) 监控和维护托管资金；(iii) 按照本协议第 6.3 节管理托管资金；(iv) 及时且准确地记录有关托管资金的存入、拨付和投资情况；以及 (v) 按照本协议所设想的频率和方式，编制与托管资金有关的定期报表并提供访问权限。”我们还收到了一份日期为 2020年6月 的早期版本的 Mercantile Bank 托管协议。\n\nCase 1:23-cr-00118-TOR Document Filed [OCR乱码行]\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY) 案中关于要求归还其喜马拉雅交易所资金的第 41(g) 条客户诉讼事宜\n\nmazars\n\nMazars LLP 的独立法务审查\n\n(ii) FV Bank International INC（“FV Bank”，即“相关 FV Bank 账户”），我们理解这也是一个“托管账户”66。\n\n我们审查了两份文件的第 6.2 款，未发现这些条款存在任何差异。根据我们的指示，DoJ（美国司法部）对稳定币储备的查封（部分）来自相关 Mercantile Bank 账户。\n\n66 根据我们的指示，FV Bank 也是该交易所的银行合作伙伴之一，该交易所在该行开设了一个账户，持有其稳定币储备的一部分（“相关 FV Bank 账户”）。我们还获悉，相关 FV Bank 账户是一个“托管”账户，而非标准银行账户，以保障客户资金。在这方面，我们已收到 (i) 一份题为《托管协议 [原文如此]》、未具日期的文件（“FV Bank 托管协议”，证据 6.4），根据指示，该文件列出了适用于相关 FV Bank 账户的条款和条件；以及 (ii) 一份题为《商业账户申请表》的文件（“FV Bank 商业账户申请表”，证据 6.5），根据指示，该文件反映了该交易所开设相关账户的申请。我们尚未阅读 FV Bank 托管协议的全部条款和条件，也未被指示就相关 FV Bank 账户开展任何进一步程序。我们被指示审查 FV Bank 托管协议第 22 页题为“陈述、保证与承诺”的章节，其中规定：“FV Bank 将妥善保管托管资产，并将所有托管资产的数据与 (i) FV Bank 的财产，以及 (ii) FV Bank 其他客户的记录资产相隔离。FV Bank 是您存放在托管账户中的托管资产的保管方，FV Bank 对此类托管资产不享有任何权利、权益或所有权，且不会将此类托管资产反映为 FV Bank 的资产，除非监管机构在指定会计报告中可能有所要求。FV Bank 不得对存放在您托管账户中的托管资产设定担保权益。未经您接受允许 FV Bank 这样做的协议，FV Bank 不会直接借出、质押、抵押或再抵押任何托管资产。”关于 FV Bank 商业账户申请表，我们被指示审查“在 FV Bank 开立银行账户的目的是什么？”这一问题（列于第 1 页）。我们注意到，根据该文件，所声明的开户目的是“用于存放销售我们喜马拉雅美元所得的收益”。根据我们的指示，司法部对稳定币储备的查封（部分）来自相关 FV Bank 账户。\n\nCase 1:23-cr-00118-TOR Document Filed [OCR乱码行]\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY) 案中关于要求归还其喜马拉雅交易所资金的第 41(g) 条客户诉讼事宜\n\nmazars\n\nMazars LLP 的独立法务审查\n\n7 指示 4：说明性客户入驻\n\n7.1 引言\n\n- 7.1.1 在本节中，我们列出了我们在该交易所进行的两次说明性客户入驻测试的观察结果。\n\n- 7.1.2 我们进行这些测试是为了评估上文第 4 节所述客户入驻流程的合规性。两项测试均在该交易所的服务公司场所进行67，我们于 2023年12月14日 和 15日 走访了该场所。指示我们的 CANDEY 事务律师当时也在场。\n\n7.2 第一次说明性客户入驻测试\n\n- 7.2.1 第一次说明性客户入驻测试（“测试 1”）是以美国（一个受限制国家）作为居住国和国籍国进行的。测试 1 包含以下步骤：\n\t- (a) 访问该交易所的网站并选择“注册”（Register）标签页；\n\t- (b) 输入说明性关键注册信息，包括：\n\t\t- (i) 说明性姓名、出生日期和地址；\n\t\t- (ii) 尝试在国籍类别下拉列表中选择“美国”。然而，这是不可能的，因为列表中没有美国的选项；以及\n\t\t- (iii) 尝试在居住国类别下拉列表中选择“美国”。然而，这是不可能的，因为列表中没有美国的选项。\n\n- 7.2.2 如上文第 4.2.1 段所述，只有在提交了所有关键注册信息（其中必须包括客户的国籍和居住国）之后，新客户才能进入入驻流程的下一阶段。\n\n- 7.2.3 因此，测试 1 不允许进入入驻流程的下一阶段，这符合我们对该交易所客户注册政策的理解。\n\n67 根据指示，出于本报告的目的，我们不披露该交易所服务公司的地址。\n\nCase 1:23-cr-00118-TOR Document Filed [OCR乱码行]\n\n关于 United States v Kwok, et al 23 CR 118 (SDNY) 案中关于要求归还其喜马拉雅交易所资金的第 41(g) 条客户诉讼事宜\n\nmazars\n\nMazars LLP 的独立法务审查\n\n7.3 第二次说明性客户入驻测试\n\n- 7.3.1 第二次示例性客户入驻测试（“测试2”）是以 France（法国，不属于限制国家）作为居住国及国籍国进行的。测试2包括以下步骤：\n\t- (a) 访问该交易所网站并选择“注册”标签页；\n\t- (b) 输入示例性关键注册信息，包括：\n\t\t- (i) 示例性姓名、出生日期及地址；\n\t\t- (ii) 在国籍类别下拉列表中选择“France（法国）”；以及\n\t\t- (iii) 在居住国类别下拉列表中选择“France（法国）”。\n\n- 7.3.2 上述示例性关键注册信息提交后，测试2的后续步骤包括：\n\t- (a) 对三个安全问题提供答案；\n\t- (b) 提供并验证电子邮箱地址，我们在确认激活链接后，该电子邮箱地址即通过验证；\n\t- (c) 提供并验证电话号码，我们在输入6位数验证码后，该电话号码即通过验证；以及\n\t- (d) 提供确认，确认我们并非 US（美国）、Japan（日本）居民，亦非 Canada（加拿大）或法律禁止持有或使用加密货币的任何其他司法管辖区的公民或居民。\n\n- 7.3.3 上述步骤完成后，根据我们的理解，在此客户入驻流程阶段，测试2的示例性客户将在该交易所的 HEX 客户数据库中被归类为“0级”（Tier 0）。根据我们对该交易所入驻流程的理解，我们无法使用该示例性客户账户进行充值或交易。\n\n- 7.3.4 测试2的后续步骤包括：\n\t- (a) 完成 KYC（了解你的客户）问卷调查，其中包括从多项选择题中选择选项；\n\n机密与保密\n\n-39-\nCase 1:23-cr-00118-AT Document 607-1 Filed 04/01/24 Page 39 of 40 In the matter of United States v Kwok, et al 23 CR 118 (SDNY) with respect to 41(g) Customer Action for the return of their Himalaya Exchange Funds mazars Independent forensic review of Mazars LLP（涉及 United States（美国）诉 Kwok（郭文贵）等人案 23 CR 118 (SDNY)（纽约南区），关于客户依据第41(g)条要求退还其 Himalaya Exchange（喜马拉雅交易所）资金的诉讼 Mazars LLP（玛泽有限责任合伙）之独立取证审查）\n\n- (b) 上传身份证件扫描件（在此情况下，我们上传了一张法国驾照的正反面扫描件68）；以及\n- (c) 上传一张实时照片。\n\n- 7.3.5 该交易所的入驻系统将我们的测试2标记为“自动拒绝”，原因是关键注册信息上的姓名与所提供的身份证件不符。\n\n68 Mazars（玛泽）团队一名成员的个人身份证件","key_entities":["Himalaya","Himalaya Exchange","Kwok","Je","William Je"],"ecf_references":[],"word_count":14410,"status":"published","published_at":null,"created_at":null,"updated_at":"2026-08-23 08:21:54"}