AML / KYC policy: identity checks, explained
Know Your Customer (KYC) and Anti-Money Laundering (AML) procedures are how we establish who uses the platform and keep it clean. This page sets out the full policy in fifteen short sections: why checks exist, what we ask for, how they run, how long they take, and what happens when something does not add up. It is written for the person going through the process, not for a compliance library.
What we ask for
One identity document, one address confirmation, and in some cases a short selfie check.
How long it takes
Most checks complete automatically within minutes; a minority need a human look.
What it protects
Your account from being opened in your name by someone else, and the platform from criminal money.
01 Introduction: why these procedures exist
The purpose of KYC is to establish and verify the identity of each customer; the purpose of AML, and its counter-terrorist financing counterpart, is to prevent the platform from being used to launder criminal proceeds or move funds for prohibited purposes. The two work together: KYC tells us who you are, and AML processes use that knowledge to assess risk and monitor activity over the life of the account.
Verification is not a formality we tolerate because a regulator insists. An account that cannot be tied to a real, verified person is an account that can be opened fraudulently in your name, used to launder someone else's money, or traded by someone who should not have access to UK markets. The checks described here protect honest users first.
02 What KYC is
KYC is the process of identifying a customer and confirming that the details they have provided are genuine and current. In practice this means collecting your legal name, date of birth and address, confirming them against documents issued by trusted sources, and recording the result so the account has an anchor of verified facts behind it.
The confirmation step matters as much as the collection step. A name typed into a form proves nothing on its own; the same name on a passport photograph, matched to a live likeness of the person submitting it, proves a great deal. That is the standard the process aims for.
03 What AML means here
AML, together with the broader anti-fraud framework, covers the risk assessment and ongoing monitoring that follow onboarding. Each account is assigned a risk profile based on the information collected at verification, and activity on the account is monitored against that profile over time.
Monitoring is looking for patterns, not reading your private life: transactions that do not fit the account's history, structures that look designed to avoid reporting thresholds, or connections to sanctioned parties. Where something raises a question, the process in sections 9 and 10 applies.
04 Why identity verification is required
Identity verification serves four goals. It prevents fraud by making it materially harder to open an account in someone else's name. It protects existing users by keeping stolen identities and criminal funds away from the platform they use. It allows us to meet the legal and regulatory requirements that apply to the services we provide. And it reduces financial risk for everyone by making the population of accounts one that can be accounted for.
None of this is about distrusting you personally. The checks apply identically to every applicant, precisely so that no individual is singled out and no shortcut exists for anyone inclined to misuse the service.
05 Documents we ask for
To confirm identity, we accept current government-issued photographic documents: passports and driving licences are the most common. To confirm address, we accept a bank statement or utility bill issued within the last three months, in your name, at the address you have given us.
Where the automatic checks cannot match you with confidence, or where the risk profile of the application calls for it, we additionally use a selfie-based liveness check: a short camera capture that confirms the person submitting the documents is the person shown in them. We do not use, and do not ask for, documents or biometric data beyond these.
06 The verification process, step by step
Registration creates the account and collects your basic details. You then provide the documents described in section 5 through the secure upload in the dashboard. The first pass is automatic: machine checks read the documents, confirm their format and validity features, and match the details against the account record.
Applications that pass the automatic stage are confirmed immediately. A minority are routed to manual review by a trained specialist, typically because a document image was cropped, glare obscured a corner, or details did not match exactly. After the review, the result is confirmed to you by email, and where an item failed, the message names the item and what to provide instead.
07 Enhanced due diligence
Some accounts call for enhanced due diligence: for example, accounts associated with higher-risk jurisdictions or business structures, politically exposed persons, or applications whose details triggered a monitoring flag. EDD means more evidence, not more suspicion: additional documentation of the source of funds, an explanation of the expected activity, or a live check with a compliance officer.
Enhanced checks run before the account can trade, not after. It is better for everyone, including you, for questions to be answered while deposits can still be returned cleanly than after money has moved.
08 How long verification takes
Most verifications complete within minutes of document upload, because the automatic stage does the bulk of the work. Cases sent for manual review are normally resolved within one working day, and we aim to keep the longest wait under three working days in periods of unusual volume.
Where a check is taking longer, the deciding factors are usually document quality, responsiveness to requests for a replacement item, and whether the case requires enhanced due diligence. The dashboard shows the current status of your verification at all times, so you are never left guessing.
09 Reasons a check can be declined or paused
A verification can be declined or paused for concrete reasons: documents that are expired, unreadable or altered; details on the document that do not match the account record; indications that a document has been forged; or failure to provide requested information within the stated period. A pause can also follow from sanctions screening or from a monitoring flag raised after the account opened.
A declined application is not an accusation. Where the cause is a fixable document problem, the rejection message says exactly that and invites a corrected upload. Where the cause is substantive, we are required to be careful about what we disclose, and you may read restraint in our wording; that restraint is a legal obligation, not an insult.
10 Transaction monitoring
Activity on verified accounts is monitored on an ongoing basis against the account's risk profile and established pattern. The monitoring looks at the size, frequency and direction of transactions, the payment methods and counterparties involved, and changes to account details that affect where money can go.
Where monitoring identifies activity that appears suspicious, we may request an explanation, restrict specific functions such as withdrawals while the review is open, and where required, report to the competent authority. Restrictions of this kind are protective and temporary unless the review substantiates a concern, in which case the account may be terminated under the Terms of Use.
11 Your responsibilities as a user
You are responsible for providing accurate, current and genuine information and documents, and for updating details that change, such as your address or surname. Using the account in your own name, from your own funds, is the foundation the whole framework rests on.
Providing false or misleading information, uploading documents belonging to another person, or structuring activity to avoid checks carries real consequences: verification failure, account suspension, forfeiture of pending transactions, and where the law requires it, reporting to the authorities. It also puts your deposits in a position no one wants them in, frozen in a review.
12 Storing and protecting KYC information
KYC and AML records are stored on encrypted systems with access limited to the compliance and security teams whose roles require it, and every access is logged. Documents are kept only as long as the applicable legal retention periods require, after which they are deleted.
The full picture of how personal data is handled, including retention periods by category and the rights you can exercise, is in our Privacy Policy. This policy and that one are designed to be read together.
13 Who verification data can be shared with
Verification data is shared only with parties who need it for the process to function: the identity verification providers who run the automated document and liveness checks, IT providers operating the secure storage, affiliated companies involved in providing the service, and regulators or other competent authorities where a legal obligation applies.
Sharing is limited to the minimum necessary for each party's role. A document-check provider receives the document; it does not receive your trading history. The categories are listed in the Privacy Policy, which also explains how to ask what has been shared about you.
14 The requirements we work within
Brunevo aligns its procedures with the applicable UK requirements for anti-money laundering and counter-terrorist financing, and with the obligations that follow from the regulatory framework described on the Licensing and regulation page. Where our partners are subject to their own supervisory regimes, the stricter standard applies.
Compliance is maintained as a living process: procedures are reviewed against changes in the legal framework, staff are trained on detection rather than paperwork, and the effectiveness of monitoring is assessed periodically rather than assumed.
15 Contact for KYC and AML questions
Questions about verification, documents or this policy go to [email protected], with the phrase KYC in the subject line so they reach the compliance desk directly. Include your account reference where one exists, but never send passwords, full card numbers or one-time codes by email.
If your question concerns a pending review, quoting the date of your application helps us find the file quickly. The support team answers during Monday to Friday, 9:00–18:00 UK time, and questions about restricted accounts are prioritised within that queue.