KYC / AML policy

1. Introduction

Suretiform applies KYC and AML procedures to every member, without exception, in line with the applicable New Zealand framework, including the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 as it applies to the services we provide. The purpose is threefold: keeping criminal money out of the platform, protecting genuine members from fraud and account takeover, and meeting the obligations that apply to our business. Verification is not a formality we tolerate; it is one of the reasons the platform stays clean.

2. What KYC means

KYC is the process of confirming that you are who you say you are. When you register, we collect your name, date of birth, address and contact details, and then verify them against official documents. Verification confirms the reality of the identity, not just the plausibility of the typing: the document must be genuine, current, and match the details you entered. KYC repeats in a lighter form when important details change, such as a new surname or a new withdrawal account.

3. What AML means

AML is the wider programme around KYC: assessing the risk each customer relationship brings, monitoring activity for patterns associated with money laundering or the financing of unlawful activity, and reporting suspicions to the relevant New Zealand authorities where the law requires. AML is why we sometimes ask a question that seems nosy, such as the source of a large deposit. We ask because we are required to, and because the honest answer protects you as much as us.

4. Why identity verification is required

Verification prevents four specific harms. First, fraud: a stolen card or a hijacked identity cannot easily pass document checks. Second, account takeover: even if credentials leak, a withdrawal to a new destination stalls against verification. Third, criminal abuse: laundering schemes rely on anonymous accounts, and we do not offer them. Fourth, legal compliance: the requirements applicable to our services are not optional for us or for you. A platform that skips these steps is telling you something about how it treats the law, and about how it would treat your problem when you have one.

5. Documents we ask for

For identity: a current passport, or a New Zealand driver licence. For address confirmation: a bank statement, utility bill or government letter issued within the last three months showing your name and residential address. Where a check cannot be completed electronically, we may ask for a short selfie video with your document to confirm liveness, recorded for verification records only. We never ask for documents by email attachment; uploads happen inside the verified platform, and anything requesting documents another way is not us.

6. The verification process, step by step

1. Registration. You create the account with your basic details. No documents yet.
2. Submission. You upload your identity document and proof of address in the verification section, where each field says exactly what is accepted.
3. Automatic check. Our verification provider validates document security features and matches the data, usually within minutes.
4. Manual review. Cases the automatic check cannot clear, such as newly issued documents or name mismatches, go to a compliance officer who reviews them by hand.
5. Result. You receive the outcome in the platform and by email. On approval, all platform functions, including withdrawals, unlock; on refusal, you get the reason and, where fixable, exactly what to correct.

7. Enhanced due diligence

Some situations call for enhanced due diligence (EDD): politically exposed persons and their close family members, complex ownership structures, deposits well above typical patterns, and activities flagged by monitoring. EDD can include questions about the source of funds, additional documentation such as a sale contract or payslips, and a longer review before funds can move. EDD is not an accusation; it is proportionate caution applied to higher-risk situations, exactly as the framework prescribes.

8. How long verification takes

Most standard checks finish within one business day, and many within an hour, because the automatic check does the first pass. Manual review adds one to two business days, and enhanced due diligence can take up to five business days depending on responsiveness to follow-up questions. Timing depends on document quality and clarity: a crisp, uncropped photo of the whole document is the single biggest accelerator, and a glare-drowned corner photo is the single biggest delay.

9. Why verification can be refused

A check can be declined or suspended for: expired, damaged or unreadable documents; details that do not match across documents; documents suspected of alteration; a verification image that cannot be matched; an unexplained gap between the declared identity and available records; or failure to respond to legitimate follow-up requests within the stated period. Where the problem is a correctable document, we say so plainly and let you re-submit. Where the problem is suspicion of fraud, the account stays restricted while we assess our obligations.

10. Transaction monitoring

Verification is the start, not the end. Ongoing monitoring compares activity in your account with your declared profile, watching for patterns associated with laundering, layering and other unlawful activity. If something looks off, we may ask for an explanation, pause particular functions, or in defined cases file a report with the relevant authority. We cannot describe every threshold, because thresholds that criminals can read are thresholds that no longer work; we can promise that questions are asked in good faith and answered in yours.

11. Your responsibilities

You are responsible for providing accurate, current and genuine information, and for updating details that change. Using another person's documents, allowing someone else to operate your account, or splitting deposits to stay under thresholds are violations of this policy and of the law, and they can end with the account closed and funds handled as the framework requires. If you notice an error in your verified details, tell us early; corrections are routine, concealment is not.

12. Storage and protection of data

Verification data is stored encrypted, access-restricted to the compliance staff who need it, and retained only as long as the applicable framework requires. The Privacy Policy describes categories, retention periods and the security measures around them in full, and this policy is designed to operate inside that framework rather than beside it.

13. Who receives data

To run verification and monitoring we share the minimum necessary data with: our identity-verification provider, IT service providers hosting the platform under contractual confidentiality, affiliated companies involved in providing the services, and regulators or government authorities where disclosure is required by New Zealand law. Every recipient is bound by purpose limitation: data flows for verification and compliance, never for sale or advertising.

14. Compliance with applicable requirements

Suretiform complies with the applicable New Zealand requirements for customer due diligence, record keeping, monitoring and reporting, as they apply to the services the platform provides. Where services involve third-party providers, their regulatory position is disclosed during onboarding and confirmed on request, as described on the Licensing & Regulation page. Compliance is reviewed internally at least annually and whenever the framework changes.

15. Questions and support

For anything about verification, documents, or this policy, email [email protected] with "KYC" in the subject line, and the compliance team will answer during Monday to Friday, 9:00–17:30 NZST. If a check of yours is taking longer than the times above, say so in the email and include your registration date; stalled cases are chased the same day.