0

A company's asked me to submit a scan of my passport claiming KYC (Know Your Customer) and AML (Anti-money Laundering) purposes. In times of daily data breaches, what can we ask for a company to be more transparent as to how they protect their clients' PII (personally identifiable information)? For example, by showing a periodically-renewed certificate, auditor report, score sheet, report or conclusion made by an independent company—some evidence of a thoroughly checked infrastructure?

  • 'by showing a periodically-renewed certificate, auditor report, score sheet, report or conclusion made by an independent company' - this is basically the process that is required for PCI compliance, for companies that accept credit card payments at their web site. – mti2935 Jan 1 at 21:38
  • @mti2935: not really. PCI network scans (ASV) are independent, but the rest of your 'audit' can be an external QSA/RoC or an in-house SAQ/AoC depending on your category and transaction volume (and sometimes history). Plus the card brands discourage merchants from requiring any ID beyond that on and related to the card (PAN, expiry, CVV2/etc, billing address and name); KYC/AML/CTF apply mostly to regulated financial institutions or semi-regulated like money transmitters. – dave_thompson_085 Jan 2 at 4:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.