Compliance

KYConnect builds identity verification and financial-crime prevention tools that help regulated businesses meet their Know Your Customer (KYC), Know Your Business (KYB), and Anti-Money Laundering (AML) obligations.

Compliance is central to our product design. We maintain internal policies, controls, and governance overseen by a dedicated compliance function, and we review them regularly against evolving regulation and guidance.

This page summarizes our compliance posture for prospective and existing customers. It is informational and does not constitute legal advice or a warranty of regulatory outcomes for your business.

Our platform is designed to support customers operating under major global frameworks, including the Financial Action Task Force (FATF) Recommendations, the EU Anti-Money Laundering Directives (4AMLD, 5AMLD, 6AMLD), and the US Bank Secrecy Act (BSA) as administered by FinCEN.

We also support obligations under the UK Money Laundering Regulations and FCA expectations, and data-protection regimes such as the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA).

Because requirements differ by jurisdiction and sector, our workflows are configurable so you can tailor verification and screening to your specific regulatory obligations.

Our tooling enables risk-based customer due diligence (CDD) and enhanced due diligence (EDD), ongoing monitoring, PEP and adverse-media screening, and risk scoring aligned with a risk-based approach.

We support detection workflows for suspicious activity and provide audit-ready records to assist your reporting obligations, including filing Suspicious Activity Reports (SARs) with the relevant authority.

We maintain our own internal AML governance, training, and independent review appropriate to our role as a technology provider.

For individuals (KYC), we support identity document verification, liveness and biometric face match, and email and phone verification to establish and confirm identity.

For businesses (KYB), we support registry checks, beneficial-owner (UBO) identification, director verification, proof of address, and company due diligence.

Verification standards can be configured per jurisdiction and risk tier so you can apply standard or enhanced measures where appropriate.

We screen against major sanctions and watchlists, including those maintained by OFAC, the United Nations, the European Union, and HM Treasury, with configurable matching and ongoing rescreening.

Screening covers sanctions, politically exposed persons (PEPs), and adverse media, with case-management workflows to review and resolve potential matches.

List coverage and refresh cadence are maintained through reputable data providers; you remain responsible for adjudicating matches and making final decisions.

We process personal data in line with applicable data-protection laws and our Privacy Policy, and we offer a Data Processing Addendum (DPA) for customers who require one.

We apply data minimization, purpose limitation, and defined retention periods aligned with regulatory record-keeping requirements, and we support international transfer safeguards such as Standard Contractual Clauses.

Biometric data is handled with heightened care and only where there is a lawful basis and appropriate consent.

We operate an information-security program aligned with recognized standards and undergo independent assessment. Our controls target the confidentiality, integrity, and availability of sensitive verification data.

Controls include encryption in transit and at rest, role-based access, segregation of duties, logging and monitoring, vulnerability management, and incident response.

Current certification and audit reports (such as SOC 2 and ISO 27001) are available to qualified customers under NDA on request.

We generate tamper-evident audit trails of verification and screening activity to support your record-keeping and examination needs.

Records are retained for periods aligned with AML and sector requirements, which commonly range from five to seven years, subject to your configuration and jurisdiction.

Audit logs and verification evidence can be exported to support regulatory examinations and internal reviews.

We cooperate with lawful requests from regulators and law enforcement and disclose data only where legally permitted or required, applying appropriate review.

We provide the evidence and audit records you need to meet your own reporting obligations, while final regulatory filings remain your responsibility.

We notify affected customers of security incidents in accordance with our contractual and legal obligations.

Compliance is a shared responsibility. KYConnect provides the verification, screening, and audit tooling; you remain the regulated party responsible for your own AML/CFT program and final decisions.

You are responsible for maintaining required licenses and registrations, configuring workflows to your risk appetite and legal obligations, and adjudicating verification and screening outcomes.

We support you with configurable controls, documentation, and expertise, but we do not assume your regulatory obligations.