KYC and User Onboarding Policy

Last Updated: November 30, 2025

Landbitt.com is committed to providing a secure and trustworthy platform for trading Non-Fungible Tokens (NFTs). A robust Know Your Customer (KYC) and User Onboarding process is the first and most critical line of defense against financial crime, including money laundering, terrorist financing, and fraud.

This policy outlines the mandatory procedures for verifying the identity of our users, assessing their risk profile, and ensuring a compliant onboarding experience. It operates in conjunction with our broader AML/CFT policy and is designed to comply with applicable laws, including the Prevention of Money Laundering Act (PMLA), 2002.

This policy applies to all new users registering on Landbitt.com and all existing users. Completion of the KYC process is a mandatory condition for accessing the full suite of platform services, including deposits, trades, and withdrawals.

Our onboarding process is guided by the following principles:

• Risk-Based Approach: The depth of verification is proportionate to the user’s risk profile.
• User Convenience: The process is as seamless and digital as possible without compromising security.
• Data Minimization: We only collect data that is necessary for regulatory and security purposes.
• Security & Privacy: All user data is protected with industry-standard security measures and handled as per our Privacy Policy.

The user journey from registration to full verification is outlined below:

Stage 1: Account Registration & Initial Verification

A. Information Collection:
Upon registration, the user must provide:

• Full Legal Name
• A valid email address
• A mobile phone number

B. Initial Verification:

• The email address is verified via a one-time password (OTP).
• The mobile number is verified via an SMS OTP.
• At this stage, the user can browse the platform but cannot deposit, trade, or
  withdraw.

Stage 2: Identity Verification (Core KYC)

To unlock full platform functionality, the user must complete the Identity Verification step.

A. Required Documents:

Users must submit a clear, colored copy of one of the following valid, government-issued photo IDs:

• Passport
• Driver’s License
• Voter ID Card
• Aadhaar Card (with masked first 8 digits as per UIDAI guidelines)

B. Liveness Check and Facial Recognition (may):

• The user may be prompted to take a real-time selfie (a “liveness” check) during the process.
• Our system may compare the facial biometrics from the selfie with the photo on the submitted ID document to ensure the person presenting the ID is its legitimate owner.

C. Automated and Manual Checks::

• Automated Verification: We may use specialized software to check the authenticity of the ID document (holograms, fonts, etc.) and the validity of the liveness check.
• Manual Review: If the automated check fails, is inconclusive, or flags a potential issue, the case is escalated to a trained compliance officer for manual review.

Stage 3: Address Verification

A. Required Documents:

Users must submit one of the following documents, not older than 3 months, that clearly shows their name and residential address:

• Utility Bill (electricity, water, gas)
• Bank Statement
• Credit Card Statement
• Tax Receipt
• A recent rental agreement

Stage 4: Risk Profiling & Enhanced Due Diligence (EDD)

Upon successful KYC, each user is assigned a risk rating (Low, Medium, High).

A. Risk Rating Factors:

• Geographic Location: Users from high-risk jurisdictions are assigned a higher risk rating.
• Political Exposure: Is the user a Politically Exposed Person (PEP)?
• Nature of Business/Occupation.
• Transaction Patterns (monitored post-onboarding).

B. Enhanced Due Diligence (EDD):

Users categorized as ‘High Risk’ are subject to EDD, which includes:

• Requiring additional information about the source of funds and source of wealth.
• Requiring senior management approval for onboarding.
• Subject to more frequent and stringent ongoing monitoring.

5. Ongoing KYC and Transaction Monitoring

KYC is not a one-time event. We are committed to ongoing monitoring:

• Periodic Re-KYC: Users will be required to periodically re-submit and re-verify their KYC information (e.g., every 2 years for standard risk, annually for high risk).
• Trigger-Based Re-KYC: Re-verification will be triggered by certain events, such as a significant change in transaction patterns, a change of address, or a legal requirement.
• Transaction Monitoring: All user activity is continuously monitored for
  suspicious patterns.

6. Data Retention & Privacy

• Retention Period: All KYC records, identification data, and transaction records will be securely stored for a minimum period of five years after the account is closed, as required by law.
• Data Protection: All collected personal data is encrypted, stored securely, and processed in accordance with our Privacy Policy and applicable data protection laws (e.g., India’s Digital Personal Data Protection Act, 2023).

7. Handling of Non-Compliance & Rejection

• Incomplete KYC: Accounts with incomplete KYC will have restricted functionality, limited to browsing only.
• Rejected KYC: If a user’s KYC application is rejected after manual review, they will be notified via email (without disclosing specific security reasons). The user may be permitted to re-apply, depending on the nature of the rejection.
• Suspicious Applications: Applications found to be fraudulent, or where the user is a sanctioned individual/entity, will be rejected immediately, and an internal Suspicious Activity Report (SAR) may be filed.

8. Roles and Responsibilities

• Compliance Officer: Overall responsibility for the KYC program, including manual reviews and EDD.
• Technology Team: Responsible for implementing and maintaining the technical infrastructure for KYC verification.
• Customer Support: Responsible for guiding users through the KYC process and handling related queries.