AML and KYC policy
This page explains the identity verification (KYC) and anti-money-laundering (AML) procedures that apply to every Cerfina account: why they exist, what documents we ask for, how the process runs and what we do with the information. These checks are a legal obligation and a practical protection for every user of the platform.
1. Introduction
Know Your Customer (KYC) procedures verify that you are who you say you are. Anti-money-laundering (AML) procedures are the wider framework around them: monitoring for attempts to disguise the origin of funds, assessing risk and reporting suspicious activity where the law requires it. Together with countering the financing of terrorism (CFT), these checks are a condition of operating a financial platform in the United Kingdom.
In practice, verification happens mostly in the background. Most users experience it as a short document upload at signup and the occasional follow-up question. The purpose never changes: making sure that every account belongs to a real, identifiable person using their own money.
2. What KYC is
KYC is the process of collecting and confirming details that establish your identity: your name, date of birth, address and nationality, supported by documents. It is how the platform ensures that an account is not opened under a false or stolen identity, and that the person withdrawing funds is the same person who deposited them.
Verification is not a one-off event. Details are re-checked when documents expire, when an account changes materially or when activity suggests the original picture is out of date. Keeping your records current is part of the terms you accept when opening an account.
3. What AML means
AML covers the systems that detect and prevent the use of the platform for laundering money or financing crime. It starts with a risk assessment of each customer and each business relationship, continues with ongoing monitoring of transactions against expected patterns, and ends where necessary with a report to the relevant authority.
For you as a user, AML mostly means consistency: deposits and withdrawals through accounts in your own name, plausible explanations if activity departs from your profile, and patience if a payment triggers an additional review. These are legal requirements, not suspicions about you personally.
4. Why identity verification is required
There are four reasons, and all of them protect you. It prevents fraud by making stolen identities useless for opening accounts. It protects existing accounts, because an attacker who cannot pass verification cannot take one over. It keeps the platform compliant with applicable UK requirements, which is what allows the service to operate at all. And it reduces the financial crime risks that ultimately cost every legitimate user through fees and delays.
Verification also underpins the services you would want in an emergency: fast account recovery, correct tax reporting and withdrawals that reach your own bank account rather than someone else's.
5. Documents you will need
Identity is confirmed with one government-issued photo document: a passport, driving licence or national identity card. Address is confirmed with a document in your own name dated within the last three months: a bank statement, utility bill or council tax letter. Screenshots are not accepted; the document must be a photo or scan of the original, with all corners visible and nothing cropped.
For most accounts that is everything. Where a liveness check applies, you will be asked to take a short selfie video or photo in the verification flow, which is matched against your photo document to prove the document belongs to the person submitting it. Biometric data from these checks is used only for this comparison and is stored under the restrictions described in our Privacy Policy.
6. The verification process, step by step
The process has five stages. You register an account with your basic details. You provide the documents described above through the secure verification screen. Automated checks run immediately, comparing documents against issuing-authority data and conducting the selfie match where applicable. Where automated checks are inconclusive, a trained reviewer examines the documents manually. Finally, you receive confirmation of the result by email, usually the same working day for automated approvals.
Until verification completes, an account can be registered and explored, but deposits and trading are not activated. This sequencing is deliberate: it is cheaper for everyone to resolve identity questions before money moves than after.
7. Enhanced due diligence
Some situations call for enhanced due diligence (EDD): accounts classified as higher risk, unusually large deposits, complex ownership where a company is involved, or residency in jurisdictions subject to additional scrutiny. EDD means more documents and more questions, and may include evidence of the source of funds or source of wealth.
Source of funds means showing where the money came from for a specific transaction, for example a property sale or salary history. Source of wealth explains how your overall assets accumulated. Neither is an accusation; they are standard questions asked of many customers, and answering them fully is usually the difference between a quick clearance and a prolonged review.
8. How long verification takes
Standard checks that pass automated review are typically completed within minutes during business hours, and almost always the same working day. Manual reviews take longer because a person examines each document: expect one to two working days. Enhanced due diligence depends entirely on the complexity of the case and the speed of your responses, and can take a week or more.
Delays are most often caused by document quality: glare on a photo, expired documents, or an address document older than three months. Following the guidance in the upload screen the first time is the single best way to be verified quickly.
9. Why verification can be declined
A check can be rejected or paused for concrete reasons: documents that are expired, damaged or unreadable; details that do not match across documents; genuine suspicion of tampering; failure to provide requested follow-up information within the stated window; or sanctions and watchlist matches that must be resolved before any relationship continues.
Most rejections are curable. Where the problem is document quality or an inconsistency, we tell you which document to replace and you can resubmit. Where the problem is a sanctions match or an unresolved integrity concern, the decision is final and the account cannot be activated. A rejected verification is not published to third parties and does not by itself affect your credit record.
10. Transaction monitoring
Payments and trading activity are monitored on an ongoing basis against what would be expected for your profile. Size, frequency, counterparties, geography and patterns relative to your own history all feed the assessment. The point is to notice when an account starts behaving like a very different kind of account.
Where monitoring raises a question, specific features can be limited while it is answered: a withdrawal can be held, a new funding method can be paused, or in serious cases the account can be suspended. Any restriction is communicated to you with as much explanation as the law allows, since some AML obligations specifically restrict what may be disclosed.
11. Your responsibilities as a user
You are responsible for the accuracy of everything you provide. Details must be true, documents must be genuine and unaltered, and you must update your information when it changes. Using the platform in your own name and funding it only from accounts and cards you control are conditions of service.
Providing false information, uploading manipulated documents or transacting on behalf of undisclosed third parties can lead to account closure, forfeiture of pending transactions to the extent the law permits, and where required a report to the authorities. It also voids protections you would otherwise have, because processes like withdrawal verification assume the account details were truthful from the start.
12. Storage and protection of verification data
Identity documents and verification results are stored encrypted, separately from general account data, with access limited to the compliance function and logged in the audit trail. Retention follows legal requirements: verification records are kept for the period required by applicable UK AML rules after the relationship ends, typically five years, and only as long as no legal hold applies.
The full detail of what is collected, on what basis and for how long is set out in our Privacy Policy, which governs this data alongside this page. Where the two documents describe the same data, the Privacy Policy is the controlling statement.
13. Who verification data can be shared with
Verification data is processed by categories of recipients that make the checks possible: identity verification providers that perform document and biometric matching, IT providers that host the encrypted storage under contract, affiliated companies involved in operating the service, and regulators or other authorities entitled to the information by law.
Every recipient is bound by contractual confidentiality and processes data only for the purpose it was shared. We do not sell identity data, and we do not share it with marketing partners under any circumstances. The Privacy Policy lists the categories in force at any time.
14. The requirements we comply with
The procedures on this page are maintained to comply with applicable UK anti-money-laundering and counter-terrorism-financing requirements, including those relating to customer due diligence, ongoing monitoring, record keeping and reporting, together with the UK regulatory framework applicable to the services Cerfina provides for client onboarding, identity verification and complaint handling.
Where guidance changes, procedures are updated, and where the change affects what we ask of you, this page is revised to match. Requirements are met as they apply to a technology platform providing trading tools; nothing on this page should be read as a claim of any specific registration.
15. Contact for AML and KYC questions
If a verification is stuck, a monitor has flagged a payment or you simply want to understand a request before complying with it, write to [email protected] with KYC or AML in the subject line. The compliance team answers these queries in priority order during support hours, and a human reads every message.
If you disagree with a verification decision, the same address handles appeals: set out what you believe was misjudged and include any additional evidence. Appeals are reviewed by a second reviewer who was not part of the original decision.