Know Your Customer (KYC) Policy

No account, structure or introduction is delivered on an anonymous basis toward Vaulted. Public-register anonymity provided through nominee arrangements is entirely separate from Vaulted's internal file, which always identifies the ultimate beneficial owner and controllers.

• Full legal name, date and place of birth, nationality and country of tax residence.
• Government-issued photo identity document (passport preferred) with a clear machine-readable zone.
• Proof of residential address dated within the last three months (utility bill, bank statement, tax notice, tenancy agreement).
• Selfie or live-video verification linking the individual to the identity document.
• Politically-exposed status declaration and confirmation of source of funds and source of wealth.

• Certificate of incorporation and current extract from the commercial register.
• Memorandum and articles of association (or equivalent constitutional document).
• Register of directors, register of shareholders and, where issued, register of persons with significant control.
• Structure chart identifying every intermediate entity up to the ultimate beneficial owner (any natural person holding 10% or more of ownership or control).
• Evidence of good standing (certificate of good standing or equivalent) for entities older than twelve months.
• Board resolution appointing the authorised representative dealing with Vaulted.

Vaulted identifies and independently verifies every natural person who ultimately owns or controls the applicant, whether through direct or indirect shareholding, voting rights, contractual arrangements or other means of control. Where no individual meets the ownership threshold, the senior managing official is identified in that capacity, with the reason documented on file.

Every file includes a plausible narrative of source of funds (the origin of the specific funds intended to move through the introduced product) and source of wealth (how the client accumulated their overall net worth), supported by documentation such as:

• Recent employer contracts and payslips.
• Audited financial statements of operating businesses.
• Share-sale, dividend or corporate-distribution evidence.
• Sale contracts for real estate or other significant assets.
• Inheritance or gift documentation with supporting probate or notary records.
• Bank statements evidencing the movement of funds from a verified source.

Every file is classified as low, standard or high risk on the basis of geography, industry, product, structure and delivery channel. High-risk files require Enhanced Due Diligence, additional documentary evidence, more frequent review and written sign-off from senior compliance. High-risk categories include PEPs, cash-intensive businesses, complex offshore chains, clients unable to provide independent identity verification and clients from FATF high-risk jurisdictions.

All individuals identified in the file are screened against consolidated UN, EU, UK HMT and US OFAC sanctions lists, against official PEP databases and against adverse-media sources through licensed screening vendors. Screening is repeated at onboarding and on an ongoing basis throughout the relationship.

KYC files are refreshed on a schedule aligned with the risk rating (up to every twelve months for high-risk files) and whenever a material change is reported or detected in ownership, control, activity, volume, counterparties or regulatory status. Vaulted may request updated documentation at any time.

Vaulted reserves the right to refuse onboarding or terminate an existing relationship, at its sole discretion, where any required information cannot be obtained, where verification cannot be completed, where the answers provided are inconsistent or where the file no longer meets Vaulted's risk appetite. Vaulted is not required to disclose the reasons for a refusal or termination beyond what is required by law.

KYC records are stored in a secure, restricted environment, accessed only by authorised compliance personnel, and retained for a minimum of five (5) years after the end of the business relationship. Records are shared with regulated partners strictly on a need-to-know basis, subject to written data-processing terms and lawful requests.