AML / KYC policy

1. Introduction

Identity verification and financial-crime prevention are part of operating any trading platform responsibly. KYC (know your customer) is the process by which we establish who you are; AML (anti-money-laundering), sometimes called PLD in European usage, is the wider framework of controls designed to prevent the platform being used to disguise the origin of criminal funds, including the financing of terrorism (CFT/CTF). The purpose of these procedures is not to make onboarding difficult but to make it trustworthy: they protect honest users, keep prohibited persons out, and satisfy the applicable Irish requirements that govern our activity.

2. What KYC is

KYC means identifying the client and confirming that the details they gave are genuine. In practice this covers collecting your name, date of birth, address and contact details; checking them against an official identity document; and confirming that the document is current, legible and belongs to the person opening the account. Where anything does not add up, we ask follow-up questions rather than guess. Verification also repeats at intervals or when your details change, so records stay accurate over the life of the account, not just on day one.

3. What AML means here

The AML side of the policy is about behaviour as much as identity. It starts with a risk assessment of each account, considering factors such as the country of residence, the payment methods used and the pattern of deposits and withdrawals. It continues with ongoing monitoring for activity that has no obvious lawful purpose: rapid pass-through of funds, structuring deposits to stay under thresholds, or engagement with sanctioned parties. Where activity looks suspicious, the platform reviews it, may restrict certain functions while the review runs, and makes any reports required under applicable Irish law. We do not disclose to customers when such reports have been made, as the law prohibits it.

4. Why identity verification is required

There are four reasons, and they all serve you. First, fraud prevention: identity checks stop one person from opening accounts in another's name, which is the commonest way accounts are hijacked. Second, account protection: if you ever lose access, verified records are what let us return the account to you safely. Third, compliance: applicable Irish requirements for client onboarding, identity verification and complaint handling apply to the services the platform provides, and verification is how those requirements are met. Fourth, reduced financial risk for everyone: accounts that cannot be traced to real people attract exactly the activity that damages platforms and their users.

5. Documents we ask for

To verify identity, we accept current government-issued documents with a photograph: a passport, a national identity card or an Irish or EU driving licence. To verify address, we accept a utility bill, a bank statement or an official letter issued within the last three months showing your name and residential address. Where an application needs a liveness check, we ask for a short selfie or a live capture taken during the flow, compared against the identity document; biometric data from this check is used only for verification and is stored as described in our privacy policy. We do not request documents we cannot process, and we will never ask you to email passwords or full payment credentials.

6. The verification process, step by step

1. Registration. You create the account with your basic details: name, email and phone number.
2. Submission. Through the secure onboarding flow you provide the required data and upload photographs of your documents.
3. Automatic check. The system validates document format, expiry and readability, and screens your details against sanctions and politically-exposed-person lists.
4. Manual review when needed. If any element is ambiguous, a compliance reviewer examines the file and may request a clearer image or an additional document.
5. Result. You are notified in the platform and by email whether verification is complete or what is still needed. Once approved, deposit and withdrawal functions unlock.

7. Enhanced due diligence

Some accounts receive enhanced due diligence (EDD) before approval. Triggers include residence in higher-risk jurisdictions, complex ownership structures for corporate accounts, sources of funds that are unusual in size or nature relative to the profile, and matches that require human judgment rather than automatic screening. EDD can mean additional documents (for example, evidence of the source of wealth), a structured call with a compliance officer, or refreshed checks on information provided earlier. The extra step is not an accusation; it is the proportionate response to a higher-risk pattern, and most cases conclude with a normal approval.

8. How long verification takes

Straightforward checks usually complete within one working day, and most documents clear automatically within minutes during office hours. Cases that need manual review are typically resolved within one to three working days. Timelines depend on the volume of applications, the quality of the uploads (blurred photographs are the single biggest cause of delay), whether EDD applies, and how quickly you respond to requests for clarification. You can follow the status in your account at any time, and our support desk can tell you which stage your file is at.

9. Reasons a check can be declined or paused

Verification can be rejected or suspended for specific, reviewable reasons: documents that are expired, damaged or unreadable; details that do not match between the form and the document; suspicion that a document has been altered; failure to provide requested information within the stated period; an applicant who appears on sanctions lists or is otherwise legally prohibited; or an attempted account in the name of another person. A rejection is not always final: where the cause is a technicality such as image quality, you can re-submit. Where the cause is substantive, we explain as much as we lawfully can, and any funds you deposited are returned through the original payment route.

10. Transaction monitoring

Approved accounts remain under transaction monitoring, proportionate to their risk level. The monitoring looks at deposit and withdrawal patterns, the relationship between trading activity and money movements, connections with third-party payment accounts and other indicators defined in our internal procedures. When activity raises a flag, individual functions such as withdrawals may be limited while the review concludes, and you may be asked to confirm details of a transaction you initiated. These checks are ordinarily invisible; when they are not, they are a question, not a verdict.

11. Your responsibilities as a user

You are responsible for providing accurate, current and genuine information and documents, and for updating your details when they change. Using invented data, submitting documents that belong to someone else, or allowing a third party to operate your account breaches this policy and the terms of use. The consequences scale with the breach: from re-verification, through suspension of specific functions, to closure of the account and return of funds, and, where the law requires, reporting to the competent authorities. If you notice an error in your own record, tell us early; an honest correction has never been a problem, while a discovered concealment always is.

12. Storage and protection of verification data

KYC and AML records are stored in encrypted form, with access limited to the compliance and support roles that need it for their work, and every access is logged. Retention periods follow the applicable Irish requirements for anti-money-laundering records, which generally means keeping verification files for a period after the relationship ends; the exact periods and your rights over the data are set out in the privacy policy. Documents are never shared with marketing, never used beyond verification and legally required reporting, and are destroyed under controlled procedures when their retention period expires.

13. Who verification data can be shared with

Within the platform's operation, verification data is processed by our identity-verification providers (who run document and liveness checks), our IT service providers (who host and secure the systems), and affiliated companies involved in delivering the trading services. Disclosure to regulators and state authorities happens only where applicable law requires or permits it, and within the applicable Irish framework for such requests. Every recipient category is bounded by contract and by the privacy policy; we do not sell verification data, and we do not pass it to unrelated third parties for their own purposes.

14. Compliance with applicable requirements

Murravyn operates within the applicable Irish regulatory framework, which for onboarding and financial-crime prevention centres on the requirements associated with the Central Bank of Ireland's AML rulebook for the entities it supervises, alongside European anti-money-laundering directives as implemented in Ireland. The platform complies with applicable requirements for client onboarding, identity verification, record-keeping, monitoring and reporting. Where the execution of services involves licensed counterparties, those entities perform their own verification to their own regulatory standard, and registration details of the relevant provider are confirmed during onboarding and on request.

15. Contact and questions

Questions about this policy, your verification status or a document request can be sent to [email protected] with the subject line "KYC". The compliance team answers such queries within one working day during support hours, Monday to Friday, 9:00–17:30 GMT (excluding public holidays). If you believe a decision made under this policy is wrong, the complaints procedure explains how to have it reviewed independently within the company, and how to escalate to the Financial Services and Pensions Ombudsman if we cannot resolve it with you.