FINANCIAL CRIME, AML/KYC AND IDENTITY ASSURANCE POLICY

This Policy explains how ScoreID B.V. manages financial-crime, impersonation and source-integrity risk within its own operations and distinguishes those controls from customer due diligence (“CDD”), know-your-customer (“KYC”), anti-money laundering (“AML”), sanctions and transaction-monitoring duties that may apply to an Institutional Customer.

The Policy applies to ScoreID personnel, contractors, individual accounts, business-customer onboarding, Connected Sources, Scores, APIs and any separately designated identity-assurance or screening module. It is a public statement of the control framework and does not create a representation that ScoreID is a bank, lender, payment institution, crypto-asset service provider, obliged entity, credit bureau or regulated KYC vendor.

ScoreID’s legal status must be reassessed whenever the Service, funds flow, custody, transaction execution, customer type, jurisdiction or regulatory perimeter changes. A disclaimer cannot override the factual activities performed.

ScoreID separates three distinct layers. First, ScoreID applies controls to its own customers, personnel, vendors and platform where required for sanctions, fraud, security, contracting or legal compliance. Second, ScoreID may use limited identity-assurance controls to protect accounts and bind a Score to an authorised source. Third, a separately contracted and documented module may perform specified identity verification or screening steps for a Customer.

These layers must not be conflated. Platform identity assurance is not full legal KYC. A contracted verification result is not necessarily a complete CDD programme. A Score is not AML clearance, source-of-funds proof, sanctions clearance, fraud determination or regulatory certification. The regulated institution remains responsible for obligations that law assigns to it, including risk assessment, CDD, beneficial ownership, ongoing monitoring, suspicious-activity determination, reporting and recordkeeping.

Where ScoreID is legally classified as an obliged entity for a particular activity, this Policy will be supplemented by a jurisdiction- and activity-specific AML programme approved by competent governance. Until then, no person may describe ScoreID’s general scoring Service as satisfying a Customer’s statutory AML/KYC obligations.

ScoreID may conduct proportionate due diligence on Institutional Customers, beneficial owners, authorised representatives, key vendors and business relationships to establish identity, authority, sanctions status, legitimacy and expected use. The level is risk-based and may include corporate registry evidence, ownership/control information, identification of representatives, business purpose, jurisdiction, regulatory status and source-of-funds information where appropriate.

ScoreID applies access restrictions, credential and administrator controls, monitoring of anomalous account/API activity, investigation of misuse, security response and compliance with sanctions or legal obligations applicable to ScoreID itself. These actions protect ScoreID and the Services and do not convert ScoreID into the Customer’s AML/KYC provider.

ScoreID may decline, restrict or terminate a relationship where identity or authority cannot be reasonably established, information is materially inconsistent, the intended use is prohibited, sanctions or serious financial-crime risk cannot be mitigated, or law or a competent authority requires action.

Individual assurance is proportionate to the account and feature. Ordinary signup should collect only information necessary to create and secure the account and apply regional/age rules. Email OTP is used to confirm control of the stated email address at the relevant time. It does not identify the person behind the address.

Wallet assurance may require a cryptographic message signature or equivalent challenge. The signature demonstrates control of the corresponding signing key at the relevant time, subject to custody, smart-contract and compromise limitations. It does not establish legal ownership, sole control, source of funds, legitimacy of transactions or civil identity.

Exchange or financial-source assurance uses provider OAuth or another approved read-only authorisation. It demonstrates that the authorisation flow granted access to the selected provider account and data scopes. It does not mean ScoreID performed or may rely on the provider’s KYC, identify beneficial ownership or verify every record.

Additional assurance may be requested where necessary to prevent impersonation, data mismatch or unauthorised sharing. ScoreID prefers verification tokens, match results and partial identifiers over retaining full identity documents.

Unless a separate signed service schedule expressly identifies the task, data sources, standards, service levels, allocation of roles and legally permitted reliance, ScoreID does not perform CDD, enhanced due diligence, customer-risk rating, beneficial-owner verification, sanctions/PEP/adverse-media screening, source-of-funds/wealth verification, transaction monitoring, suspicious-activity determination, filing or regulatory reporting on behalf of a Customer.

A Customer may use an Output only as one input within its own risk-based process. The availability of a Score, identity-assurance result or wallet risk flag does not transfer, reduce or satisfy the Customer’s statutory duties. ScoreID will not contractually accept responsibility that cannot lawfully be outsourced or relied upon.

• determine whether it is an obliged entity and identify the law, regulator and programme requirements applicable to each product and jurisdiction;
• maintain enterprise and customer risk assessments, policies, governance, training, independent testing and management information;
• identify and verify customers, representatives and beneficial owners to the standard and timing required by law;
• determine the purpose and intended nature of the relationship and conduct enhanced due diligence where risk requires;
• perform sanctions, PEP and other screening with appropriate lists, matching thresholds, refresh and escalation;
• conduct ongoing monitoring, understand expected activity and investigate anomalies;
• make independent suspicious-activity and regulatory-reporting determinations and preserve confidentiality;
• maintain records and provide notices, lawful basis and rights handling for personal-data processing; and
• ensure competent human review and not rely solely on a Score, vendor alert or automated classification.

If ScoreID offers a separately designated identity-verification module, the product schedule must define the assurance objective; provider; jurisdictions and document coverage; verified attributes; liveness/biometric use, if any; match thresholds; manual review; output and limitations; retention; privacy roles; subprocessors; and Customer reliance conditions.

The interface must accurately distinguish a document/authenticity check, biometric comparison, database match, address verification, age estimate, account-control check and full KYC. No “KYC complete” status may be returned unless the configured workflow actually satisfies the agreed and legally assessed standard. False acceptance and false rejection risk, document/provider coverage and inability to establish beneficial ownership must be disclosed.

Biometric or special-category processing requires a separate legal assessment, applicable Article 9 condition, DPIA, heightened security, limited retention and jurisdiction-specific notice/consent. It is not enabled merely because a Customer requests it.

A screening module must identify the lists and data sources used, coverage and update frequency, fields compared, transliteration and fuzzy-match rules, thresholds, expected false-positive limitations, status meanings, review and escalation steps, and whether the service is initial, periodic or event-driven. PEP, sanctions, adverse media, fraud and blockchain-exposure results must remain separate classifications.

A potential match is not a final determination. Customer must review identifiers, list context, date and quality, document the resolution and apply applicable ownership/control rules and licensing. ScoreID may support case information but does not make the Customer’s legal decision unless the signed schedule expressly and lawfully assigns a defined review task.

Transaction monitoring, if ever offered, requires a separate scenario/rule inventory, typology coverage, thresholds, calibration, alert workflow, case management, regulatory-reporting allocation, service levels and independent validation. It is not included in ordinary scoring or public-chain analysis.

ScoreID complies with sanctions and restrictive measures applicable to ScoreID, considering entity location, personnel, services, counterparties and transaction nexus. ScoreID may screen Institutional Customers, beneficial owners and representatives and restrict access where necessary. Screening coverage is reviewed as the business expands.

A public-chain address or exposure indicator alone does not prove that a person is sanctioned or that a transaction is prohibited. Attribution, ownership/control, list scope, applicable jurisdiction, licence and factual nexus require review. Customer is responsible for sanctions duties applicable to its own activity and must not treat ScoreID’s general Score as sanctions clearance.

Risk indicators are leads for review, not legal conclusions. Data can be stale, incomplete, incorrectly attributed, manipulated or affected by shared/custodial addresses, mixers, bridges, smart contracts, exchange omnibus wallets and cross-chain analytics. ScoreID documents material limitations and data cut-off.

Material integrity concerns are escalated according to severity. Available actions include requesting information, placing a Score or connection in Disputed/Suspended status, restricting sharing or API access, preserving evidence, correcting attribution, notifying an affected Customer where lawful, and terminating a relationship. Decisions are documented and access to sensitive case information is restricted.

No person may retaliate against an individual merely for disputing a result. Customer must provide a review channel and consider contextual evidence.

Assurance and screening data are limited to what is necessary for the configured control. Gender, race, ethnicity, religion, health, marital status, political opinions, sexual orientation and other protected/sensitive traits must not be collected as ordinary Score or screening inputs. Full address is used only where country/postcode is insufficient for a documented matching, regulatory or service need.

Identity-document copies and government identifiers are avoided where a provider token, pass/fail result or partial identifier is sufficient. If a copy is exceptionally required, access is restricted, transmission is secure and deletion occurs promptly after verification and any mandatory retention period. Seed phrases and private keys are never requested or retained.

Processing follows the Privacy Notice, DPA, applicable lawful basis and retention schedule. Screening or assurance information is not reused for unrelated advertising or general model training. Cross-border provider access requires a documented transfer mechanism and Subprocessor List.

Scores are probabilistic and time-sensitive. They may support a Customer’s contextual risk review but must not be the sole basis for onboarding rejection, account closure, transaction blocking, regulatory reporting or another decision producing significant effects unless the use is lawful, validated and accompanied by required safeguards.

Expired, Superseded, Disputed, Suspended or Refresh Required Scores must not be treated as current. Customer must examine underlying reason information, data quality and context; apply independent CDD/screening evidence; provide meaningful human review; and document its own decision. ScoreID reason factors must not be restated as legal findings.

• Do not state that ScoreID verified a person’s legal identity unless a specifically designated service did so to the stated level.
• Do not describe email OTP, telephone OTP, wallet signature or provider OAuth as KYC.
• Do not represent a Score or wallet indicator as AML clearance, source-of-funds proof, sanctions clearance, fraud finding or compliance certification.
• Do not use ScoreID as a substitute for legally required CDD, beneficial-owner verification, ongoing monitoring or regulatory reporting.
• Do not submit identity documents, biometric data, special-category data, private keys or sensitive case information outside an approved encrypted workflow.
• Do not conceal from an individual that an Output materially affected a decision where law requires explanation, adverse-action notice or human review.
• Do not share alerts or identity data for unrelated, discriminatory, advertising or surveillance purposes.

The Policy is owned by Legal and Compliance with support from Security, Privacy, Product and Model Risk. Material changes to Services, jurisdictions, providers, data sources or screening/assurance functionality require pre-deployment legal and risk review. Higher-risk features require a documented DPIA and, where applicable, AI/fundamental-rights assessment.

Relevant personnel receive role-based training on the limits of assurance, sanctions, financial-crime escalation, data protection, non-discrimination, confidentiality and avoiding automation bias. Controls and vendors are tested at intervals proportionate to risk, including match quality, false positives, access, retention and escalation quality.

This Policy is reviewed at least annually and upon material legal or product change. Incidents, complaints, false matches, regulatory developments and audit findings inform updates. Questions may be directed to …@scoreid.com.