KYC / AML Policy

1. Introduction

KYC/AML measures exist so that financial services are not used to hide the origin of illicit funds or to finance criminal activity. For a platform like ours they mean three permanent tasks: identifying and verifying every user, assessing the risk their activity represents and monitoring operations for unusual patterns.

These checks directly protect the honest user: they are what stop a third party from opening accounts in your name and what support your right to recover your account if you lose access.

2. What KYC is

KYC (know your customer) is the process by which we confirm you are who you say you are. We collect your identification details, cross-check them against official documents and verify the information is coherent and current. Basic verification completes at registration; full verification, with documents, is required before withdrawals are enabled.

KYC is not a one-time formality: data is kept up to date, and certain events (address changes, unusual activity, growing amounts) can require a file update even if you were already verified.

3. What AML is

AML is the set of measures to prevent money laundering and terrorism financing. It includes per-customer risk assessment, continuous transaction monitoring and the obligation to report suspicious operations to the competent authorities under applicable regulations. It also covers staff training and record keeping.

In practice, this means the platform watches for patterns: volumes that do not match the declared profile, rapid deposit-withdrawal cycles with no trading activity, or details that do not add up.

4. Why identity verification is required

Four concrete reasons. Preventing fraud: nobody opens an account with your identity. Protecting your account: verification is the foundation of access recovery and claims. Complying with the law: the applicable regulations in Mexico and Canada require identifying users of financial and digital asset services. And reducing financial risk for everyone: verified customers mean less room for illicit-origin funds on the platform.

5. Required documents

For standard verification we request: a valid official photo ID (passport, driver's licence or permanent resident card), a recent proof of address (utility bill, bank statement or attestation less than three months old) and a liveness check: a short selfie or video confirming the person in the document is present in the application. We do not use facial recognition for any other purpose and do not share it with parties outside the process.

We never, under any circumstance, request passwords for your email or other accounts, verification codes or full card details by phone or chat. If someone asks for them in the name of Groman Pro, it is fraud: report it.

6. The verification process, step by step

1. Registration. You create the account with name, email and phone.
2. Providing data and documents. You upload your ID, proof of address and liveness check from the dashboard, or send them through the secure channel your manager indicates.
3. Automated review. The system cross-checks document validity, data match and liveness; most cases resolve here.
4. Manual review when applicable. If a detail does not match or the image has problems, a specialist reviews the file and, if needed, requests a new document or a clarification.
5. Outcome. You receive confirmation by email and your account status updates: withdrawals enabled once verification is full.

7. Enhanced due diligence (EDD)

For higher-risk profiles we apply enhanced due diligence: customers with complex activity or source of funds, corporate structures as account holders, high operating amounts or links to weakly supervised jurisdictions. EDD may include additional proof of the source of funds and more frequent file updates. It is a longer process, not an accusation: it responds to risk level, not to the person.

8. Verification timelines

Automated review resolves most verifications within minutes. When a file goes to manual review, the typical time is one to three business days, depending on document clarity and how quickly you answer clarifications. Enhanced-diligence cases can take longer. You can check your verification status in the dashboard at any time, and your manager can tell you if anything is missing.

9. Reasons for rejection

A verification may be suspended or rejected for: expired, illegible or altered documents; data that does not match between the form and the document; reasonable suspicion of forgery; refusal to provide requested information; or a liveness check that does not correspond to the document holder. In most of these cases you can correct the reason and resubmit. Definitive rejection prevents operating on the platform.

10. Transaction monitoring

Platform operations are continuously monitored with rules that detect unusual patterns: amounts atypical for the profile, anomalous deposit and withdrawal frequency, fund flows unrelated to trading activity or connections to known risk sources. When an operation raises an alert, an additional check may apply, information on the source of funds may be requested, or an account feature may be temporarily limited while it is resolved.

11. User responsibilities

It is your responsibility to provide truthful, complete and current data; to notify relevant changes (address, phone, email); to use only lawful, own funds; and not to allow third parties to operate an account in your name. False information can lead to account suspension and, where the law requires it, reports to the authorities. If you noticed an unintentional error in your data, tell us: correcting early is always simpler than explaining later.

12. Data retention and protection

KYC/AML data and documents are kept encrypted with restricted access for the periods the applicable regulations require, and securely destroyed when those periods end. The complete handling of your personal data is described in the Privacy Policy, which is an integral part of this document.

13. Data transfers

To run verifications, the platform shares strictly necessary information with: specialized identity verification providers, technology providers operating under confidentiality contracts, group affiliates when they participate in providing the service, and authorities and regulators where applicable law requires it. Every transfer is limited to the minimum necessary and documented. We never sell personal data.

14. Regulatory compliance

Groman Pro operates under the regulatory framework applicable to its activity in each market: in Canada, under the applicable Canadian requirements with complaint escalation through OBSI; in Mexico, within the SHCP and CNBV environment. It complies with the applicable requirements for customer identification, anti-money-laundering, record keeping and complaint handling. The compliance programme is reviewed periodically. You can request written confirmation of compliance status by writing to [email protected].

15. Contact for KYC/AML matters

For questions about your verification, the status of a file or any point of this policy, write to [email protected] with the subject "KYC". The compliance team replies within the next business day. If your request is urgent because a withdrawal depends on the verification, say so in the subject line so it is prioritized.