AML / KYC policy

1. Introduction

Know Your Customer (KYC) and Anti-Money Laundering (AML) procedures are how a financial platform confirms the identity of its users and reduces the risk of its services being used to disguise the origin of funds. On SabioTrade these procedures apply at registration, at verification, during ongoing monitoring of account activity, and at withdrawal. They exist for a simple reason: a platform that skips them becomes attractive to exactly the activity no legitimate user wants to be near.

This page describes our practices in general terms. It is written for users, not lawyers, so it favours plain language over exhaustive legal citation. Where Australian requirements apply to our activities, we work within them, and where a specific obligation shapes a step described here, we say so.

2. What KYC is

KYC is identity verification: the process of confirming that you are who you say you are, using documents and details that can be independently checked. It happens once, at the start of the relationship, and is refreshed if anything material changes, such as your legal name or your address.

Verification is not a judgement about you; it is a control that protects everyone on the platform. A verified population is harder for impostors, botnets and recycled fraud scripts to operate in, which in turn keeps the environment cleaner for genuine users.

3. What AML is

AML covers the policies, checks and monitoring designed to prevent, detect and report attempts to move money obtained through crime. In practice it means assessing the risk a customer or transaction presents, watching for activity inconsistent with what is known about the account, and escalating genuinely suspicious cases through the proper internal and, where required, external channels.

AML obligations extend beyond a single check at onboarding. Patterns matter more than moments: a series of transactions that makes sense individually can be problematic in sequence, which is why monitoring continues for the life of the account.

4. Why identity verification is required

Verification serves four purposes. It prevents fraud by making it harder to open accounts in other people's names. It protects existing accounts, because a verified owner is harder to impersonate during a takeover attempt. It supports compliance with the applicable Australian requirements that govern client onboarding. And it reduces financial risk for the platform and its users by screening out the small fraction of activity that carries disproportionate legal exposure.

None of this makes verification pleasant paperwork, and we know it. We have tried to keep the list of what we ask for short, the steps few, and the reasons for each item transparent on this page.

5. Documents we ask for

To confirm identity, we accept current government-issued photo documents: passports and driving licences are the most common. To confirm address, we accept a recent utility bill, bank statement or equivalent official correspondence showing your name and residential address. Documents must be valid, legible and uncropped.

For some accounts we also use a selfie or liveness check: a short, live capture compared against the photo document, which establishes that the person supplying the document is its holder rather than someone with a stolen scan. We do not collect biometric templates beyond what that comparison needs, and the material is handled under the safeguards described in our Privacy policy.

6. The verification process, step by step

Verification follows five stages. First, registration: you create the account with your basic details. Second, submission: you provide the documents and information listed above through the secure upload in your profile. Third, automated checking: the system compares documents against format rules, validity dates and available data sources, typically finishing in minutes. Fourth, manual review: a member of the compliance team examines any case the automated stage flags, such as a smudged scan or a name mismatch. Fifth, the outcome: you are notified of the result, and where something is missing, exactly what is missing.

7. Enhanced due diligence

Some situations call for a deeper look, a process known as enhanced due diligence. Accounts with complex ownership structures, customers associated with higher-risk jurisdictions, unusually large intended volumes, or activity that raises questions during monitoring may be asked for additional documentation or an explanation of source of funds.

Enhanced review is not an accusation. Most cases that go through it resolve routinely, and the extra questions exist so that the small number that should not resolve are caught before harm is done. Cooperation is voluntary in form but necessary in effect: without it, the account cannot continue operating.

8. How long verification takes

Straightforward cases usually clear the automated stage within minutes and, when no manual step is needed, are confirmed the same day. Manual review adds time because a person reads what a machine cannot: expect one to three business days in typical cases, and occasionally longer around public holidays.

Delays beyond that almost always trace back to document quality or a mismatch between the name on the document and the name on the account. Resubmitting a sharper photograph or correcting a transposed letter is usually faster than waiting for a reviewer to ask.

9. Why verification can be declined or paused

Verification fails for concrete reasons: documents that are expired, damaged or partly obscured; details that do not match across documents; signs of tampering; a liveness capture that cannot be matched; or required information simply not being supplied. In these cases the process pauses with a specific request rather than a generic rejection.

It can also be declined outright where fraud is suspected, where sanctions screening returns a match, or where providing further information would itself be unlawful. A decline is communicated with the reason where we are permitted to give one, and the account is closed with any remaining funds returned through the original payment route.

10. Transaction monitoring

Once an account operates, activity is monitored against its expected profile: size, frequency, direction, counterparties and the payment methods used. Deviations do not automatically mean wrongdoing, but they can trigger a request for explanation, a temporary limit on certain functions, or a manual review of recent activity.

Where monitoring identifies genuinely suspicious activity, we take the steps required of us, which can include reporting to the relevant authorities. We do not notify an account holder that a report concerning them has been made, because the law prohibits it.

11. Your responsibilities as a user

You are responsible for the accuracy of everything you provide: your name, address, date of birth, contact details and documents must be current, genuine and yours. Using the account on behalf of someone else, supplying borrowed documents, or constructing transactions to disguise who benefits from them breaches this policy.

The consequences are real. Verified features can be suspended, withdrawals can be held pending review, and accounts can be closed. Where the law requires, matters pass to the authorities. Keeping your details current costs minutes and avoids all of it.

12. Storage and protection of verification data

Identity documents and verification records are stored with restricted access, encrypted at rest, and retained only as long as the applicable requirements and our legitimate operational needs require. Access is limited to the teams that perform verification, compliance and related support functions, and each access serves a logged purpose.

The full picture of what we collect, why, and for how long is set out in our Privacy policy, which this section summarises rather than replaces.

13. Who verification data can be shared with

Verification information is processed by the platform and, where needed to deliver the service, by categories of recipients that include identity-verification providers, IT service providers operating under contractual confidentiality, affiliated companies within our group involved in operating the service, and regulators or other authorities where a legal obligation applies. Each category receives only what its role requires.

We do not sell identity data, and we do not share it for third-party marketing. Providers are bound by contract to process data only on our instructions and to apply security standards at least equivalent to ours.

14. Regulatory alignment

SabioTrade operates within the applicable Australian requirements relevant to its activities, including those covering client onboarding, identity verification and complaint handling. External dispute resolution for consumers is available via AFCA. Details are summarised on the Licensing & regulation page, alongside our general commitments to operational transparency and data protection.

15. Contact for KYC / AML questions

Questions about verification status, document requirements, or this policy generally can be sent to [email protected], which reaches the Client Support & Compliance team during support hours (Monday to Friday, 8:00 am to 6:00 pm AEST). Include your account email and the date of your last submission so the team can find your case quickly. If you feel a verification decision was wrong, the Complaints page explains how to have it reviewed independently of the original decision-maker.