Every customer goes through the identity check once, before their first deposit. It's there for three reasons.
It's required of us. As a financial services firm we have to know who our customers are. Anti-money-laundering and know-your-customer rules oblige us to confirm each account holder's identity, age and country of residence before we accept their money, and to make sure the person depositing and withdrawing is the person who owns the account.
It protects you. Because your account is tied to your verified identity, nobody else can open an account in your name, withdraw your funds or take over your account by claiming to be you. If you ever lose access, the check also gives us a reliable way to confirm it's really you before we restore it.
It keeps the platform fair. The check is how we enforce the rules that apply to everyone: one account per person, adults only, and residents of countries where we're allowed to offer our service.
What we check
The check confirms four things: that your ID is genuine, that the person holding the phone is the person on the ID, that you're 18 or over, and that you don't already have an account with us. It runs on your phone, takes a few minutes and is automatic, so in most cases your account is active as soon as it finishes. See How to verify your identity.
What happens to your data
Your photos go to the verification provider, not to us. The check runs inside Sumsub's own secure tool, so your ID photos and selfie travel from your phone to Sumsub over an encrypted connection. What comes back to us is the result of the check, together with the details needed to run your account.
The provider is built for this. Sumsub is a specialist identity-verification company used by banks, payment firms and trading platforms around the world. It holds the main independent security certifications for handling personal data, ISO 27001 and SOC 2 Type 2, encrypts data both in transit and at rest, and follows GDPR, the European data-protection standard.
Your data is used for one purpose. It's used to verify your identity and to meet our legal obligations as a financial services firm, nothing else. It isn't used for marketing and it isn't passed to anyone except where the law requires it.
Few people can see it. Access to identity records is limited to a small number of our staff who need it for compliance, and the records of closed accounts are even more tightly restricted.
It isn't kept forever. The law requires us to keep customer records for seven years. After that they're deleted. You can ask us at any time what we hold about you, and ask for deletion once that period has passed.
We will never ask for your ID any other way. The only place we ever ask for identity documents is the identity check inside the client area. If anyone contacts you by email, chat, LINE or phone asking for photos of your ID or a selfie, it isn't us. Don't reply, and let us know.
Related: How to verify your identity · How long does the identity check take? · Who can open an account? · Can I open more than one account?