AML / KYC policy

1. Introduction

Know Your Customer (KYC) and Anti-Money Laundering (AML) are the standard frameworks financial services use to confirm who their clients are and to prevent their infrastructure being used to disguise the origin of criminal funds. Where our markets use related terminology, such as the French Lutte contre le blanchiment (PLD) or counter-terrorist financing (CTF) obligations, the same principles apply. For you as a user, these procedures translate into a short verification step after registration and occasional follow-up requests later.

This policy describes the checks Lunexora applies across Austria, Australia, Canada, Switzerland, France and Italy, and explains your side of the process. It complements, and does not replace, the Terms of Use and the Privacy Policy, which govern how personal data is handled throughout.

2. What KYC is

KYC is the process of identifying a client and confirming that the details they provided are genuine. In practice it means collecting your legal name, date of birth, address and contact details, and then checking them against an official document. The goal is simple: the person opening the account is the person whose name is on it, and the address given is a real place where you can be reached.

Verification is not a one-time event. Records are refreshed when documents expire, when your details change, and when activity on the account gives reason to update what we know about you. Keeping your profile current avoids friction later, especially at withdrawal time, when verification must be valid before funds can leave the account.

3. What AML / PLD is

AML covers the policies, controls and monitoring that detect and report attempts to move illicit funds through legitimate channels. It starts with a risk assessment of each client and each business relationship, continues with ongoing monitoring of transactions against expected patterns, and ends with defined escalation paths when something looks inconsistent with what we know about the client.

Practically, monitoring means our systems look for behaviour that does not fit your profile: deposit patterns that look structured to avoid thresholds, rapid pass-through of funds without trading activity, or connections to sanctioned parties. Most users never trigger a second look; those who do are asked questions, not automatically accused. The purpose is explanation, not accusation.

4. Why identity verification is required

Verification serves four concrete purposes. It prevents fraud by stopping one person from opening accounts in another person's name. It protects existing accounts, because a convincing impostor cannot get far past a document check. It satisfies the legal obligations that apply to our activity in each of our six markets. And it lowers financial risk for everyone, because clean, verified accounts are harder to use as plumbing for someone else's scheme.

Verification also protects you directly at the moments that matter: only a verified account holder can change withdrawal destinations, and recovery of a locked account runs through the same identity checks. The few minutes the process takes buys the difference between "anyone with the password" and "the person whose document is on file".

5. Documents we ask for

Identity is confirmed with a government-issued photo document: a passport, a national identity card or a driving licence, chosen by you. The document must be current, with all four corners visible, the photograph and dates readable, and no glare or cropping. Address is confirmed with a recent document in your name: a bank statement, a utility bill or an official letter, typically dated within the last three months.

For some accounts we additionally ask for a selfie or a short liveness check, a quick camera capture that confirms the document belongs to the person submitting it. You will be told in advance when this applies and the capture happens in your browser; we never ask for these documents over email, chat or phone, and any request of that kind is fraudulent.

6. The verification process, step by step

Verification runs in five steps. First, registration: you create the account with your basic details. Second, document submission: you upload the identity document and, when requested, the address document and liveness capture. Third, automatic checks: the system reads the document, validates its format and compares it against the details on your profile.

Fourth, manual review where needed: blurry images, name differences (a maiden name, a transliteration variant, a middle name used inconsistently) or address mismatches go to a human reviewer. Fifth, the result: you are notified in the platform, and a successful check lifts the restrictions on deposits and trading. You can watch the status of each step from your account settings page.

7. Enhanced due diligence

Some situations call for a deeper review, known as enhanced due diligence. It applies when the account is connected to a higher-risk country or occupation, when transaction volumes grow well beyond the original profile, when sources of funds need to be understood for larger amounts, or when monitoring flags something the standard file does not explain.

Enhanced checks can include a request for a second address document, evidence of the source of the deposited funds such as a salary or sale documentation, or clarification of the relationship between the account holder and other parties in a payment. These requests are specific and proportionate, and the account continues operating normally unless the applicable rules require temporary limits.

8. How long verification takes

Most straightforward checks complete within one business day of receiving clear documents, and many finish within hours during business hours, Monday to Friday, 9:00–17:30 CET. Automatic checks are immediate; the variable part is the manual review queue and the quality of the uploads.

Delays almost always trace back to document issues: an edge cut off by the camera, an expired document, an address document older than three months, or a legal name on the profile that differs from the document. If your check is taking longer than two business days, write to [email protected] and we will tell you exactly where it stands; you will never be left to guess.

9. Reasons a check can be refused or paused

A verification can be declined or suspended for concrete reasons: documents that are expired, damaged or unreadable; details on the profile that contradict the document; suspicion that a document has been altered; a refusal to provide information requested under this policy; or the appearance of the account in sanctions or adverse-media screening. A pause is sometimes resolved by a single better photograph.

When a check is declined you receive the reason in general terms and the chance to correct the issue where correction is possible, for example by uploading a valid alternative document. We do not provide the internal details of screening tools, but we do provide enough information for you to act. Accounts remain closed to trading and withdrawals while a decline stands.

10. Transaction monitoring

Deposits, trading activity and withdrawals are monitored against the profile we hold: the amounts, the methods, the timing and the counterparties involved. The purpose is to notice activity that contradicts the expected pattern, from the trivial (a new card issued by your bank) to the serious (funds entering and leaving with no trading in between).

Where monitoring raises a question, individual functions can be limited while it is answered: new withdrawal destinations may be blocked, or a large transfer held pending clarification. Limitations are lifted as soon as the explanation resolves the question. We cannot pre-announce every rule, because published thresholds are exactly what laundering techniques are built around, but we can always explain what we need from you and why in general terms.

11. Your responsibilities as a user

You are responsible for the accuracy of everything you provide: real name, current address, working contact details, genuine documents. Information you did not update, such as an address you left behind two years ago, causes the same failures as invented information, only later. Notify us of changes through the account settings rather than assuming the next document upload will fix it.

Providing false or borrowed information has consequences that escalate with intent: a stalled verification for an honest mistake, suspension of the account and forfeiture of processing where deception is established, and reporting to the competent authorities where the law requires it. Your account is also yours alone: lending credentials to a friend or a "manager" who offers to trade on your behalf is a policy violation and a well-known fraud pattern.

12. Storage and protection of verification data

Identity documents and verification records are stored encrypted, with access restricted to the compliance roles that need them, and retained for the periods the applicable anti-money-laundering rules of our markets require. When the retention period ends, documents are deleted and only the fact of the completed check, with its date and outcome, remains.

The technical and organisational measures around this data are described in the Privacy Policy, which remains the authority on retention periods and on your rights regarding your own records. The short version: verification data is treated as the most sensitive category we hold, because it is.

13. Who receives this data

Verification involves a small set of recipients: the identity-verification providers that read the documents you upload, the IT providers that host the encrypted storage, affiliated companies involved in operating the service, and the regulators and public authorities empowered to receive reports or request information under the law of the relevant market. Each category receives only what its function requires.

We do not sell verification data, and we do not share it with marketing partners. Transfers outside your market, where they occur, use the safeguards described in the Privacy Policy. If a request from an authority ever concerns your account, applicable law determines what we may tell you and when; within those limits, we tell you what we can.

14. Compliance with applicable requirements

Lunexora applies the client-onboarding, identity-verification and record-keeping requirements that are applicable to its activity in each market it serves: the framework of the FMA in Austria, of ASIC in Australia with external dispute resolution through AFCA, of CIRO in Canada with complaint escalation through OBSI, of FINMA in Switzerland, of the AMF in France and of CONSOB in Italy. The Licensing & regulation page sets out each row.

Where obligations differ between these markets, we apply the stricter standard to the extent it is practical, because a single consistent process is easier to verify and harder to get wrong than six slightly different ones. Changes in the applicable rules are reflected in this policy without delay, and material changes are announced inside the platform.

15. Contact for KYC / AML questions

Questions about verification status, document requirements, a monitoring query or anything else in this policy go to [email protected], attended by our Client Support & Compliance team, Monday to Friday, 9:00–17:30 CET. A question is always cheaper than a rejected document, so ask early.