AML and KYC policy

1. Introduction

Know Your Customer (KYC) and Anti-Money Laundering (AML) procedures exist to prevent financial crime: stopping the proceeds of crime from passing through legitimate services, keeping stolen identities from being used to open accounts, and protecting clients from fraud. For Gruviona these procedures are a condition of serving UK users: every account is verified before trading activity begins, every transaction is monitored against the risk profile of the account, and records are kept to the standard applicable UK requirements demand. This page sets out the policy in plain terms: what is checked, why, how long it takes and what happens if something does not add up.

2. What KYC is

KYC is the process of confirming that you are who you say you are. When you register, we collect your name, date of birth, address and contact details, and then verify them against official evidence: a government-issued identity document and, where needed, proof of your address. The aim is that the account opened in your name genuinely belongs to you, is controlled by you and can only be paid out to you. Verification is not a one-off gate at the door: details are kept current, and if your information changes, updating it is part of keeping the account safe.

3. What AML is

AML is the wider system around KYC. It starts with a risk assessment of each client and account, continues with monitoring of the transactions that flow through the account, and ends with the obligation to look closely at anything that does not fit the pattern of a normal account. Suspicious activity, in the legal sense, means activity with no obvious lawful explanation given what we know about you: unusual size, unusual frequency, unusual routes or counterparties. Where such a pattern appears, we are required to examine it and, in defined circumstances, to report it to the competent authorities. We are equally prohibited from telling you when such a report has been made, a restriction the law imposes on every regulated business.

4. Why identity verification is required

Verification protects you first. An account that can only be opened with your passport and paid out to your bank account is an account that is much harder for a criminal to profit from if your details leak anywhere else. Verification also protects the platform community: accounts that can be opened anonymously are the raw material of fraud chains, and excluding them keeps the environment cleaner for everyone. And verification is the law: identity verification, record-keeping and suspicious-activity reporting are obligations under the applicable UK anti-money-laundering framework. There is no opt-out, no paid tier that skips checks, and no exception for small accounts.

5. Documents we ask for

For identity: a current passport, or a UK driving licence, in your own name. The document must be in date, with the photograph and all corners visible, and unaltered. For address: a bank statement, building society statement, credit card statement or utility bill issued within the last three months, in your name at the address you gave us. Where a check is inconclusive, we may ask for a short selfie or live image to confirm you are the person in the document, captured through our verification flow rather than by email. That is the complete list: we do not ask for passwords, one-time codes, card numbers or copies of documents we have not named, and any message requesting such details does not come from us, whatever it claims.

6. The verification process

Registration opens the account. You then submit your details and documents through the verification flow in the dashboard. The first pass is automatic: format checks, expiry checks and document integrity checks run immediately, and the majority of straightforward submissions clear at this stage within minutes. Documents that do not clear automatically, for example a photo with glare or an address document older than three months, go to manual review by a trained reviewer, and you are told what to re-submit rather than left guessing. The final step is the written result: verified, or refused with the reason stated. You can follow the status in the dashboard at every stage.

7. Enhanced due diligence

Some accounts call for a deeper look: large initial deposits relative to the information we hold, complex payment routes, connections to higher-risk jurisdictions or business structures, or a transaction pattern that differs materially from the profile on file. In those cases enhanced due diligence (EDD) applies: additional documents such as a source-of-funds statement or evidence of the origin of wealth, and review by a senior compliance reviewer rather than the standard queue. EDD is not an accusation; it is the proportionate response required when risk indicators are present, and most EDD reviews conclude without any limitation on the account.

8. How long verification takes

Automatic checks finish within minutes of a clear submission. Manual review normally completes within one business day, and the overwhelming majority of accounts are fully verified inside 24 hours of submitting usable documents. Three things extend the clock: documents that need re-submission, additional questions that need your answer, and weekends or UK public holidays, which pause business-day counts. The dashboard shows the current stage, so you are never waiting on a screen that says nothing.

9. Why verification can be refused

A submission can be declined where a document is expired, unreadable or damaged; where the details on the document do not match the account information; where there are signs the document has been altered; where required information is not provided after reminders; or where the law prohibits opening or continuing the account. A refusal always states its reason. Many refusals are administrative and are resolved by re-submitting a better photograph or a newer statement; we tell you exactly which case applies. Where a refusal stands, any funds you deposited are returned to their source by the method they arrived.

10. Transaction monitoring

Verification establishes who you are; monitoring watches what happens next. Deposits, withdrawals, transfers and trading patterns are checked against the profile of your account: size, frequency, destinations and counterparties. Most activity raises nothing, because most activity is ordinary. Where activity departs from the profile, a review is opened, and in some cases functions such as withdrawals can be restricted until the review concludes. We know a restriction is inconvenient, and we apply it only where the legal requirement leaves no discretion, explain the reason where the law permits, and lift it the moment the review clears.

11. Your responsibilities

You are responsible for the accuracy of everything you submit: your details, your documents and your answers must be true, current and genuinely yours. You must not open an account on behalf of someone else, accept funds into your account from third parties for onward transmission, or use the account for any purpose other than your own investment activity. Providing false information can lead to suspension or closure of the account and, where the law requires, a report to the authorities, and it can void protections you would otherwise rely on. If your circumstances change, name, address, source of funds, tell us promptly: updating a record takes minutes and prevents the mismatch that would otherwise trigger a review later.

12. Storage and protection of verification data

Identity documents and verification records are stored encrypted, with access limited to the compliance staff who need it and every access logged. Retention periods follow applicable UK requirements: verification records are kept for the statutory period after the end of the relationship, after which they are deleted or anonymised. The full detail of how personal data is handled, including retention by category and your rights, is in the privacy policy, and the security page describes the technical measures in place.

13. Who your data can be shared with

Verification data is processed by Gruviona and, where necessary, by categories of recipient that make the service work: identity-verification and KYC providers who run document and database checks, IT providers who host the encrypted storage, affiliated companies involved in delivering the trading service, payment providers who need to confirm the identity behind a transaction, and regulators or competent authorities where the law requires disclosure. Every recipient category is bound by contractual confidentiality, and data is only ever shared for the purposes described in the privacy policy, never for marketing by third parties.

14. The requirements we comply with

Gruviona complies with applicable UK requirements for client onboarding, identity verification, transaction monitoring, record-keeping and complaint handling for the technology and information services provided to UK users, including the UK anti-money-laundering framework, and with applicable UK data-protection requirements for the personal data processed on this site. The licensing and regulation page sets out the compliance areas in table form, and this policy is the working detail behind the identity-verification row of that table.

15. Questions about verification

If a document is refused and the reason is unclear, if a review is taking longer than the times stated above, or if you cannot produce one of the standard documents, write to [email protected] for the attention of the Client Support & Compliance team. Support operates Monday to Friday, 9:00–17:30 GMT/BST (excluding public holidays) and replies usually under one business hour. There is always a human being at the other end of that address, and no verification question is too small to ask before you submit, rather than after a refusal.