KYC and AML policy
How we verify who you are, and how we help prevent money laundering and the financing of terrorism.
1. Introduction
This policy explains why Aurora Capital asks you to verify your identity and how that information is handled. KYC (know your customer) is the set of steps we use to confirm who you are. AML (anti-money-laundering) covers the controls that stop an account being used to move money of illegal origin, together with counter-terrorist financing. In Colombia the reference framework is SARLAFT, which we follow as a benchmark in what applies to our activity. The aim is to protect users, the platform and the financial system.
Together, these controls let us know our clients, understand what their activity should look like and react when it does not, which is also what regulators expect from any business that handles client money flows.
2. What KYC is
KYC means identifying the customer and checking that the data they provide is true. It covers your full name, ID number, date of birth, address and economic activity. It is done once when the relationship opens and refreshed when your details change or the law requires it.
For you, that means a short form and uploading a few documents. For us, it is the basis for knowing who we deal with and for spotting in time when someone tries to use the platform under an identity that is not theirs.
3. What AML is
It is the system that combines policies, procedures and tools to detect, assess and reduce the risk of an account being used to move illicit money. It includes risk assessment of each client, monitoring of unusual transactions and reporting to the authorities, in particular to the UIAF, when a transaction is considered suspicious.
4. Why identity verification is required
Verifying identity prevents fraud and impersonation, protects your account if someone tries to use your details, lets us meet the rules that apply to us and reduces financial risk for you and for us. Without it we cannot enable larger deposits or process withdrawals.
It is also a protection for you: if someone tried to open an account with your data, the liveness check and the document comparison would cause the application to be rejected.
5. Documents required
We use only the following documents:
- Identity: a valid cédula de ciudadanía, cédula de extranjería or passport, both sides where applicable.
- Address: a utility bill or bank statement dated in the last three months, in your name.
- Liveness check: a live photo or short video confirming you are the person in the document.
We do not ask for other documents unless an additional review is triggered, described below.
6. Verification process
The process has five stages: registration on the platform, submission of data and documents, automatic review, manual review if needed, and confirmation of the result. You receive an email at each status change. If something is missing, the message says exactly which document to resend and why.
You can follow the status in your dashboard and resume the process where you left off, without repeating steps already approved.
7. Additional checks
In some cases we apply enhanced due diligence (EDD): when the amount is high, when activity does not match your profile, when there are links to politically exposed persons or when system alerts recommend it. We may then ask for information on the source of your funds, such as an employment certificate, a tax return or a contract.
These requests do not imply suspicion about you: they are standard procedure for certain profiles and amounts, and replying quickly shortens the timeline.
8. Verification timelines
The automatic review usually takes a few minutes. If it moves to manual review, it is normally resolved in one to three business days. The time depends on the quality of the images, the complexity of the case, the volume of requests and on the documents being complete and legible.
9. Grounds for rejection
We may reject or suspend a verification because of expired, illegible or cropped documents, data that does not match between the document and the registration, signs of alteration or forgery, failure to answer a request for information or hits on restricted lists. In each case we explain the reason, unless the law prevents us from doing so.
A rejection is not final when it is caused by a fixable error, such as a blurry photo; you can send corrected documents as many times as needed.
10. Transaction monitoring
We review account movements with automatic rules that look for unusual patterns: deposits and withdrawals split into many small pieces, use of third parties, abrupt changes in behaviour or amounts out of proportion to your profile. If we detect something, we may temporarily limit some functions while the situation is cleared up.
These measures are applied with objective criteria and human review; they are not taken on a single automatic alert. If a function is limited, we tell you and indicate what information helps us lift the restriction.
11. User responsibility
You must provide truthful, complete and up-to-date information and tell us if your address, phone or situation changes. Providing false data or documents can lead to closing the account, holding transactions and notifying the authorities, in addition to whatever legal consequences apply.
If any detail changes after verification, update it from your profile. An account with outdated information may see withdrawals delayed until it is confirmed again.
12. Data storage and protection
Verification information is stored encrypted and with restricted access for the time required by anti-money-laundering rules. Its handling is governed by our privacy policy, where you can also find how to exercise your habeas data rights.
13. Data transfers
We may share verification data with providers that validate documents and run the liveness check, with technology providers that host the information, with group companies and with authorities, such as the UIAF, when the law requires it. Only what is necessary is shared, under confidentiality commitments.
Every recipient is bound by contract to use the data only for the purpose stated and to protect it with measures equal to ours. We do not sell verification data to anyone, for any reason.
14. Regulatory compliance
Aurora Capital applies the Colombian provisions on preventing money laundering and terrorist financing that are relevant to it, and international reference practices, such as the FATF recommendations. See the full framework on the licensing and regulation page.
We review this policy regularly and update it when rules or our practices change. The current version is always the one published on this page.
15. Contact and support
For questions about KYC or AML write to [email protected]. If your verification was rejected and you believe there is a mistake, reply to the rejection email with the right document and we will review the case.