KYC, AML, sanctions, and beneficial owners

A risk-based onboarding and ongoing-monitoring standard for individuals, legal entities, beneficial owners, PEPs, sanctions, source of funds, and account restrictions.

The partner performs customer due diligence and asserts the outcome to MyStocks. That assertion must be backed by retrievable evidence, a risk decision, and ongoing monitoring. A VERIFIED API value is not a substitute for the underlying compliance work.

Risk-based, not checkbox-based

Apply controls in proportion to the customer, product, geography, ownership structure, funding path, and expected activity. A PEP match or higher-risk country is a review trigger, not an automatic finding of wrongdoing.

Control lifecycle

Identify

customer + representatives

↓

Verify

reliable independent evidence

↓

Screen

sanctions · PEP · adverse media

↓

Risk-rate

product · geography · behaviour

↓

Approve

standard or enhanced due diligence

↓

Monitor

events + periodic review

Individuals

At minimum, collect and verify legal name, date of birth, nationality, residential address, government identifier, tax residence, account purpose, occupation, expected funding, and source of funds. Validate that the person accepting terms and placing instructions is the verified customer or an authorised agent.

Use stronger checks where risk warrants them: liveness, document authenticity, database verification, proof of address, bank-account ownership, source-of-wealth evidence, or manual compliance review.

Legal persons and arrangements

Do not stop at the company registration record. Establish:

Legal form, registration number, status, registered office, and operating address.
Nature of business, account purpose, expected activity, and source of funds.
Directors, trustees, partners, authorised signatories, and persons exercising control.
The ownership chain through every intermediate entity to the ultimate natural persons.
Beneficiaries, settlors, trustees, protectors, or equivalent parties for legal arrangements.
Whether ownership/control information is adequate, accurate, current, and supported by independent evidence.

If no natural person meets the locally applicable ownership threshold, identify control through other means and record the senior managing official only where the governing rule permits it. Never treat a registry search alone as conclusive when the ownership structure or risk indicators require corroboration.

Screening and escalation

Result	Required action	API state
Clear, standard risk	Complete documented approval	`VERIFIED`
Potential name match	Hold activity; resolve identity and match quality	`PENDING`
PEP or close associate	Enhanced due diligence and required senior approval	`PENDING` until approved
Sanctions match or legal prohibition	Do not transact; freeze/reject and escalate under applicable law	account restriction
Unexplained ownership/funding	Request evidence or decline relationship	`PENDING` or closed
Suspicious behaviour	Follow confidential reporting process; avoid tipping off	restricted as directed

Screen customers, beneficial owners, controllers, representatives, and relevant payment counterparties. Re-screen on list updates and material events, not only at onboarding.

API assertion

Send the structured result only after completing your control:

{
  "status": "VERIFIED",
  "level": "FULL",
  "riskRating": "MEDIUM",
  "sanctionsResult": "CLEAR",
  "sourceOfFunds": ["SALARY", "INVESTMENTS"],
  "investmentExperience": "MODERATE",
  "reviewedAt": "2026-07-14T09:30:00Z"
}

Keep evidence references and reviewer identity in your compliance system. Do not place suspicious-activity reporting notes or sensitive investigative commentary in fields visible to general support staff.

Ongoing monitoring triggers

Identity, nationality, address, tax residence, controller, or beneficial-owner change.
Dormant account becoming active or a material deviation from expected volume.
Rapid funding and withdrawal, third-party payments, circular flows, or unusual cross-border patterns.
Repeated order cancellation, matched activity, market-abuse indicators, or unexplained losses.
Sanctions/PEP list update, adverse media, law-enforcement request, or internal alert.
Product expansion into higher-risk instruments, private markets, or a new jurisdiction.

Evidence required before production

Control	Evidence
Customer acceptance policy	Approved risk appetite, prohibited relationships, and escalation thresholds
Screening	Provider coverage, list sources, matching logic, review SLA, and audit sample
Beneficial ownership	Ownership-chart standard and verification procedure
Monitoring	Scenarios, alert disposition, case permissions, and management reporting
Regulatory reporting	Named MLRO/compliance owner and confidential escalation channel
Quality assurance	Independent sample review and remediation tracking