1. Why KYC matters
We take Know-Your-Customer ("KYC") seriously to protect our customers, our Partners, and the financial system from fraud, money laundering, terrorism financing, sanctions evasion, and other illicit activity. Verifying who is using the Services is also a precondition for offering regulated products such as wallets, cards, transfers, securities, prediction markets, and crypto-asset features.
2. Regulatory framework
Our program is designed to comply with applicable AML, CTF, and sanctions laws, including:
- the U.S. Bank Secrecy Act and FinCEN regulations, including customer-identification and customer-due-diligence requirements, and OFAC sanctions programs;
- U.S. state money-transmitter regulations applicable through our banking and payments Partners;
- EU and UK AML directives and regulations (including the Money Laundering, Terrorist Financing and Transfer of Funds Regulations) and HM Treasury and EU sanctions regimes;
- local AML and CTF laws of the jurisdictions in which the Services are offered (including financial-intelligence-unit reporting where applicable);
- card-network and Partner rules that themselves require KYC and ongoing monitoring.
3. What we collect
Depending on your jurisdiction, account type, and risk profile, we (and where applicable our verification Partner, including Bridge) may collect the following:
- full legal name, date of birth, residential address, country of nationality;
- government-issued identification (passport, national ID, driver's license, or residence permit), including front and back images, document number, country of issuance, and expiration date;
- tax-identification number (for example, U.S. Social Security Number) where required;
- email address and verified phone number;
- a selfie or short live video for liveness and face-matching;
- for higher-risk activity, source-of-funds and source-of-wealth information, occupation, employer, expected transaction volume, and supporting documentation (for example, bank statements, tax returns, or contracts);
- for business or organizer accounts (events, fundraising, certain Jangi roles), business name, registration number, jurisdiction of incorporation, beneficial-owner identification, and authority documents.
4. Biometric processing
To prevent impersonation and document fraud, we generate face-template embeddings from your selfie and from your identity document and compare them. Biometric data is used solely for identity verification and fraud prevention; we do not sell it, and we do not use it for marketing or analytics. See section 8 of our Privacy Policy for full detail, including state-specific notices (Illinois BIPA, Texas CUBI, Washington).
5. Sanctions, PEP & adverse-media screening
We screen customers and certain transactions against sanctions lists (including OFAC, U.K. HM Treasury, EU consolidated, U.N., and other applicable lists), politically-exposed-person registries, and adverse-media databases at onboarding and on an ongoing basis. Where a screening result requires action, we may pause activity, request additional information, or decline to do business.
6. Enhanced due diligence (EDD)
We apply enhanced due diligence to customers, transactions, and relationships that present higher risk, including:
- politically exposed persons and their close associates and family members;
- customers in higher-risk jurisdictions;
- activity inconsistent with the customer profile (large, rapid, or unusual flows);
- complex ownership structures or unusual entity types;
- activity involving high-risk products or counterparties (for example, certain crypto categories).
7. Ongoing monitoring
We monitor customer activity over time using automated and manual review, transaction-scoring models, device and behavioral signals (including VPN-detection and impossible-travel signals), and case-management workflows. We may periodically re-verify identity, request updated documents, or ask follow-up questions. Failure to respond can result in account restrictions or closure.
8. Decisions about your account
Based on KYC, screening, and monitoring outcomes, we may at any time:
- open or decline to open an account;
- set transaction, balance, or product limits;
- require additional information or documentation;
- pause or reverse a transaction;
- file a regulatory report or freeze funds where required;
- restrict, suspend, or close an account.
Where a decision is based wholly or partly on automated processing and produces a legal or similarly significant effect on you, you may request human review and contest the decision as described in our Privacy Policy.
9. Retention
AML and CTF rules require us (and our Partners) to retain customer-due-diligence records, transaction records, and related communications for at least five (5) years after the end of the customer relationship or the completion of an occasional transaction (longer where local law requires, for example seven (7) years in some jurisdictions, or where ordered by a regulator or court). See section 15 of our Privacy Policy.
10. Your rights & how to exercise them
You have the right to access, correct, and (subject to legal exceptions) delete personal information we hold about you in connection with KYC. Some KYC and AML records cannot be deleted while we are legally required to retain them. To exercise your rights, contact privacy@victoi.com.
11. Suspicious-activity reporting
We are required by law to file reports with financial-intelligence units (such as FinCEN in the United States and the National Crime Agency in the United Kingdom) when activity meets certain criteria. We are generally prohibited by law from disclosing the existence of such reports to the customer involved.
12. Contact us
For questions about KYC, sanctions screening, or AML matters, contact legal@victoi.com. For privacy questions, contact privacy@victoi.com.