Customer Verification & Onboarding (KYC/KYB)

1. Purpose

FinStitch Limited (“FinStitch”, “we”, “our” or “us”) is committed to maintaining a secure platform and preventing fraud, financial crime and unauthorised access. This Customer Verification & Onboarding Policy describes how FinStitch verifies customers, assesses onboarding risk and maintains the integrity of its platform.

2. Scope

This policy applies to:

• all individuals creating a FinStitch account;
• future business customers using FinStitch;
• authorised users of business accounts;
• all employees involved in onboarding or customer support.

3. Objectives

Our onboarding process is designed to:

• verify customer identity where appropriate;
• prevent fraudulent account creation;
• protect customer financial information;
• comply with applicable legal obligations;
• maintain platform security;
• reduce financial-crime risks.

4. Risk-Based Approach

FinStitch applies customer verification measures proportionate to the services being used. Factors considered may include:

• services requested;
• account activity;
• geographic location;
• fraud indicators;
• security signals;
• regulatory requirements.

Higher-risk situations may require additional verification before access is granted.

5. Individual Customer Onboarding

Step 1 — Account registration

Customers provide their name, email address and password. Passwords are securely hashed and never stored in plain text.

Step 2 — Email verification

Customers must verify ownership of their email address before their account becomes active. Accounts with unverified email addresses may have restricted functionality.

Step 3 — Security checks

During onboarding FinStitch may perform automated checks including:

• duplicate account detection;
• fraud prevention checks;
• device risk assessment;
• suspicious IP monitoring;
• abuse prevention.

Step 4 — User profile

Customers may be asked to provide information including country of residence, tax residency, preferred currency, financial goals and investment preferences. This improves the accuracy of the platform and personalises the customer experience.

Step 5 — Connecting financial accounts

Customers choosing to connect financial accounts are securely redirected to an authorised Open Banking provider. FinStitch never requests or stores online banking passwords — customers authenticate directly with their financial institution through secure authorisation flows.

6. Identity Verification

As a personal wealth-tracking platform that does not hold funds or execute transactions, FinStitch does not currently require document-based identity verification to use its services. Where a future product or a legal obligation requires it — for example if required by law or by a regulated service provider for a specific feature — identity verification would be carried out using trusted, regulated third-party verification providers before access to that functionality is granted.

7. Business Customers (KYB)

Where FinStitch provides services to businesses, additional verification may include:

• business registration details;
• company number;
• registered address;
• authorised representatives;
• beneficial ownership information;
• verification of directors;
• additional documentation where appropriate.

8. Customer Due Diligence

Customer Due Diligence (CDD) measures applied today may include:

• verifying customer information;
• confirming account ownership;
• assessing fraud risk.

Where a future product or legal obligation requires it, additional measures such as sanctions screening or identifying Politically Exposed Persons (PEPs) would be carried out through regulated third-party providers. See our AML Policy for more.

9. Open Banking Consent

Where customers connect financial accounts using Open Banking:

• explicit customer consent is required;
• customers authenticate directly with their bank;
• consent can be withdrawn at any time;
• FinStitch only accesses data authorised by the customer;
• access periods are governed by applicable Open Banking regulations.

10. Ongoing Monitoring

Customer accounts may be monitored for:

• fraudulent activity;
• unusual login behaviour;
• account takeover attempts;
• abuse of platform features;
• suspicious activity;
• security incidents.

Monitoring helps protect both customers and the platform.

11. Manual Review

Certain accounts may require manual review before access is granted or restored. Examples include suspected fraud, identity discrepancies, compromised accounts, sanctions matches and repeated abuse of the platform. During review, some functionality may be temporarily restricted.

12. Account Suspension

FinStitch may suspend or restrict accounts where:

• fraudulent activity is suspected;
• verification requirements are not met;
• platform security is at risk;
• legal obligations require action;
• our Terms & Conditions have been breached.

Where appropriate, customers will be informed of the action taken.

13. Data Protection

Customer information collected during onboarding is processed in accordance with our Privacy Policy, our data protection obligations and applicable UK GDPR requirements. Verification data is only retained for as long as necessary to fulfil legal, regulatory or operational obligations.

14. Third-Party Verification Providers

FinStitch may engage trusted third-party providers to assist with identity verification, fraud detection, Open Banking connectivity, sanctions screening and security monitoring. These providers are subject to appropriate contractual, security and data protection requirements.

15. Customer Responsibilities

Customers are responsible for:

• providing accurate information;
• maintaining the security of their account;
• promptly updating inaccurate information;
• protecting login credentials;
• reporting suspected unauthorised access immediately.

16. Policy Review

This policy is reviewed at least annually and whenever there are significant changes to applicable legislation, regulatory guidance, FinStitch's services, onboarding processes, or the technology used for customer verification.

17. Contact

FinStitch Limited, registered in England & Wales (company number 17242791). Questions regarding this policy may be raised via the Support page in the FinStitch app or directed to support@finstitch.com.