The Documents Are Ordinary. The Custody Is Not Described.

What is normally requested

A government photo identity document. A proof of address, often a utility bill or a bank statement. Frequently a photograph of the account holder holding the document, to link the two. Sometimes a screenshot of the payment instrument used to deposit, to link that as well.

Individually each is unremarkable. Collectively they are a complete identity package: name, face, address, date of birth and a financial instrument, assembled in one place and transmitted to a party you have not been able to identify — because the verification step itself is undocumented and no regulator is named anywhere.

The four questions a policy would answer

• 1

  Who receives themThe operator, a processor, or a third-party verification provider. Each has different obligations.

• 2

  How long they are keptRetention is normally bounded and stated. Indefinite storage of an identity package is a different proposition.

• 3

  What else they are used forVerification only, or also marketing, profiling or transfer to affiliates.

• 4

  How to have them deletedWhich requires a route to ask, and no contact is published.

None of the four is answered on the operator’s pages. There is no privacy policy, no data statement and no retention note — the wider picture of what an account here collects covers the rest.

Why the timing makes it harder to refuse

Documents are requested at the withdrawal, not at registration. By then a balance exists, and declining to send them means leaving it behind. That is a materially different decision from declining at the start, and it is the reason the sequence matters as much as the requests.

Anyone who would not hand an identity package to an unidentified party should reach that conclusion before depositing rather than at the point of withdrawal — what is published about getting money out is a range and a speed claim, with no verification step described at all.

What is worth doing

Establish first whether a regulator, a licence and a data policy exist, because all three are checkable in a browser and all three are absent here. Then decide whether the documents are a price worth paying, at a moment when the answer costs nothing.

If documents have already been sent, the ordinary next step is to ask what is held and request deletion — which needs an address to write to, and there is none. What protects the account itself is a related question. The overview explains the sourcing rule here.