KYC / AML Policy
This policy explains how Bright Portmantage verifies clients, prevents its platform from being used for money laundering or the financing of crime, and protects your personal information in the process. It applies to every client of the platform, from the first registration form to account closure.
Introduction
Know Your Client (KYC), Anti-Money Laundering (AML) and counter-terrorist financing procedures exist for one purpose: making sure the people who use this platform are who they say they are, and that the money moving through it has a lawful origin. Verification happens before an account can trade and continues quietly afterwards. This page describes each stage in the order you will encounter it.
What KYC is
KYC is the identification of a client and the confirmation that the data they provided is genuine and current. In practice this means collecting your legal name, date of birth, residential address and a government-issued identity document, then checking that the document is authentic, valid and matches the person presenting it. The "know" in KYC also covers suitability: your account manager asks about your goals and risk tolerance so the platform's features are presented to you in context.
What AML is
Anti-money laundering is the set of measures that stops criminal proceeds from being laundered through legitimate-looking accounts. On our side that means a documented risk assessment of every client relationship, ongoing monitoring of transactions for suspicious patterns, record-keeping that meets Canadian expectations, and mandatory reporting to the appropriate authorities where the law requires it. A parallel set of measures addresses the financing of terrorism specifically.
Why identity verification is required
Verification protects you before it protects us. It prevents fraudsters from opening accounts in your name, blocks stolen payment credentials from being cashed out through the platform, keeps unauthorized third parties out of your funds, and lets us meet the legal obligations that apply to a Canadian financial-technology operation. Without verification, none of the platform's other protections can be relied on, which is why trading is disabled until it completes.
Required documents
To confirm identity, we accept a valid government-issued photo document: a Canadian passport, a provincial driver's license or a provincial photo ID card. To confirm address, we accept a utility bill, a bank or credit union statement, or a tax document issued in your name, dated within the last three months. Where a check requires it, we may also ask for a short selfie or a liveness capture to confirm you are the live holder of the document. We do not request documents we cannot process, and we never ask for full social insurance numbers by email.
The verification process, step by step
Registration: you submit the form with your basic details. Provision of data and documents: your account manager lists exactly what is needed and you upload it through the secure account area, never by email. Automated check: the system validates document format, expiry and data consistency within minutes. Manual review where needed: if anything is unclear, a compliance specialist reviews it. Result: you receive written confirmation, usually the same business day, and trading unlocks.
Enhanced due diligence
Some situations call for a deeper look: clients resident outside Canada, accounts with unusually high expected volumes, politically exposed persons and their family members, or documents that raise a question the automated check cannot answer. Enhanced due diligence can add a source-of-funds request, proof of wealth, or a second identity document. It is not an accusation; it is the standard of care a higher-risk profile legally requires, and it happens before any restriction surprises you mid-trade.
Verification timelines
Standard checks complete within one business day, and most finish within hours of a clear upload. Timelines lengthen only for readable reasons: a document photographed with glare or cropped edges, an address document older than three months, an enhanced-due-diligence file, or verification submitted outside business hours. If your check is taking longer than two business days, write to the address at the bottom of this page and the compliance team will tell you exactly what is missing.
Reasons a verification may be refused or paused
A file can be rejected for: an invalid or expired document; an unreadable scan; a mismatch between the document and the registration data; signs of digital alteration; a name or address that cannot be corroborated; failure to provide requested additional information; or an applicable sanctions match. In each case you receive the reason in writing and, wherever the cause is curable, the chance to submit corrected documents. Where a file is closed, funds belonging to the client are returned to their verified originating account.
Transaction monitoring
Monitoring runs for the life of the account, not just at onboarding. Deposits, withdrawals, transfers between strategies and trading activity are checked against your declared profile and against typologies of known laundering behaviour. Where activity looks inconsistent with what we know about you, the platform may pause specific functions, most commonly withdrawals, until the question is resolved with you. Freezes of this kind are protective, time-limited and communicated.
Your responsibility as a client
You are responsible for providing accurate, current and genuine information, and for updating it when it changes: a move, a legal name change, a new phone number. Registering under another person's identity, submitting altered documents, or routing third-party funds through your account are violations of this policy and of the Terms of Use, and may end in account closure and reporting to the authorities where required.
Storage and protection of data
Verification data is stored encrypted, on segregated systems, with access restricted to the compliance roles that need it and logged on every access. Retention periods follow the limits set out in the Privacy Policy: identity records are kept for the period Canadian law requires, and no longer than it permits. When the retention period ends, records are securely destroyed.
Who your data can be shared with
Verification data is processed by a short, controlled list of recipients: the identity-verification provider that runs the automated document checks, the IT service providers that host the platform, affiliated companies within our group involved in providing the service, and regulators or other government authorities where disclosure is required by law. Each recipient is bound by contract to process data only for the stated purpose. The full list and the legal bases live in the Privacy Policy.
Compliance with Canadian requirements
The programme described here is designed around the requirements that apply to a technology platform serving Canadian clients in digital assets: client identification and record-keeping, risk assessment, monitoring and reporting of suspicious activity, and cooperation with the relevant authorities. The framework we operate under, including the CIRO registration basis and OBSI complaint route, is summarized on the Licensing & regulation page.
Contact for KYC and AML questions
For any question about verification, documents, monitoring or this policy, write to [email protected] with the subject "KYC". The Client Support & Compliance team answers during Monday to Friday, 9:00–17:30 ET (excluding public holidays), and compliance subjects are handled with priority. If you believe a monitoring decision on your account is wrong, the Complaints page explains how to challenge it formally.
Verified in a day, protected for the life of your account
Open a free account, complete verification online, and keep full visibility of what is held and why.