AML / KYC Policy

This policy explains how AfriLegacy AI verifies who its clients are and what it does to prevent its services being used for money laundering or the financing of unlawful activity. It is written for clients, not lawyers: every section tells you what happens, what we need from you and why. The policy is reviewed regularly and updated as the applicable South African requirements change.

Policy / 15 sections

Know Your Client, anti-money laundering and beyond

Introduction

Identity verification (KYC) and anti-money laundering measures (AML, in South African practice often referred to as AML/CTF under the Financial Intelligence Centre framework) exist for one purpose: to make sure that the person opening an account is who they say they are, and that the money moving through the platform has a lawful origin. These procedures protect you as much as they protect the platform, because they are the first obstacle between honest clients and the criminals who would otherwise hide among them.

What KYC is

KYC stands for Know Your Customer. It is the process of establishing and confirming your identity when you open an account, and keeping that information current. At its core it answers three questions: who are you, can you prove it with a reliable document, and does the information you gave us hold together. Verification is done once at onboarding and refreshed when documents expire or details change.

What AML is

AML, anti-money laundering, is the set of controls designed to detect and report attempts to disguise the proceeds of crime as legitimate funds. For the platform this means assessing the risk each client relationship carries, monitoring activity for patterns that do not fit a client's profile, and knowing when a transaction warrants closer review or a report to the competent authority. These are obligations we carry by law, not optional features.

Why identity verification is required

Verification prevents fraudsters from opening accounts in your name, keeps stolen cards and compromised bank accounts out of the system, and satisfies the legal obligations that apply to financial services in South Africa. It also lowers financial risk for everyone: accounts that cannot be tied to a real person are the ones that end up abused, and the cost of that abuse lands somewhere. There is no "skip verification" tier, for any deposit size.

Documents we ask for

For identity: a South African green-barcoded ID book, smart ID card, or a passport, photographed or scanned clearly with all four corners visible. For address: a utility bill, bank statement or municipal account issued within the last three months in your name. Where an automated check cannot match you confidently, we ask for a short selfie or liveness check, a photo or brief video taken at the moment of verification that proves the document and the person holding it belong together. We do not request documents beyond these, and we never ask for your passwords or banking PINs.

The verification process, step by step

Step 1: you register and enter your personal details. Step 2: you upload the documents described above. Step 3: the automated system checks them, matching names, dates, document validity and image quality. Step 4: if anything does not match cleanly, a trained reviewer examines the submission manually. Step 5: you receive the result by email, approved, or with a specific request for what is missing. Most submissions clear at step 3 without a human ever needing to look.

Enhanced due diligence

Some situations call for a deeper look: unusually large first deposits, clients in higher-risk occupations or jurisdictions, structures involving third parties funding an account, or activity that differs sharply from what was declared at onboarding. In those cases we apply enhanced due diligence (EDD), which can mean requesting the source of funds, additional documentation or an explanation of the relationship between the account holder and the payer. EDD is not an accusation; it is the standard of care that larger or unusual activity demands.

How long verification takes

Automated checks usually complete within minutes during business hours. Manual review, where needed, is normally finished within one business day, and can take up to three business days at peak periods or when documents need to be resubmitted. The clock starts when a complete, readable submission is received, so a clear first upload is the fastest route through.

Reasons a verification can be declined or paused

The common ones: documents that are expired, cropped or unreadable; a name or date of birth that does not match across the ID and the registration form; suspicion that a document has been altered; a proof of address older than three months or not in your name; and failure to provide requested information within the given time. A pause is usually curable by resubmitting the right document; a decline for suspected forged documents is final and may carry reporting obligations on our side.

Transaction monitoring

Once your account is active, payments and trading activity are monitored against your declared profile. Patterns that stand out, rapid deposit-and-withdraw cycles with little trading, funding from many unrelated accounts, or transfers that look structured to stay under thresholds, are reviewed. Where a review is inconclusive, certain functions such as withdrawals can be limited while we ask you the necessary questions. We would rather ask an awkward question than process an awkward transaction.

Your responsibility as a client

You are obliged to give accurate, current and genuine information, and to update it when your details change. Verification is done under your name, and only you should operate your account: sharing credentials or letting a third party trade "on your behalf" breaches this policy and can expose you to losses no policy can reverse. Providing false information can lead to suspension, closure of the account and, where the law requires it, a report to the authorities.

Storage and protection of verification data

Identity documents and verification records are stored encrypted, with access limited to the compliance staff who need it and logged in an audit trail. Retention periods follow the applicable legal requirements for client due diligence records. Full detail on what we keep, for how long and under which legal bases is in our Privacy Policy, which governs this data alongside this policy.

Who your data can be shared with

Verification data is processed by the platform and, where a specific step requires it, by service providers that perform identity or liveness checks, IT providers hosting the systems under contract, affiliated companies involved in operating the service, and regulators or competent state authorities where a lawful request or reporting duty applies. Each category receives only what its role requires. We do not sell your documents or your details.

Compliance with applicable requirements

AfriLegacy AI aligns its onboarding and monitoring procedures with the applicable South African anti-money laundering framework, including the obligations associated with the Financial Intelligence Centre Act, and processes personal information in line with the Protection of Personal Information Act (POPIA), as described on the Licences & Regulation page. Where requirements change, this policy and our procedures change with them.

Contact for KYC and AML questions

If a verification step is unclear, a review is taking longer than the stated timeframe, or you want to confirm that a request for documents genuinely came from us, write to [email protected]. Client Support & Compliance responds during Monday to Friday, 08:00–18:00 SAST (excluding public holidays), and questions about verification status always take priority over general enquiries.