Policy on Accreditation of User-companies and Verification of Authorised Users

1. Purpose and principles

1.1. This Policy sets out the risk-based procedure for the Accreditation of User-companies and the Verification of Authorised Users. Accreditation and Verification are separate procedures with different objects of review and do not replace one another.

1.2. The Operator applies proportionality, data minimisation, non-discrimination, confidentiality, documentation of decisions, and the opportunity to provide explanations or additional materials.

1.3. Accreditation is not a licence, a recommendation, or a guarantee of solvency, availability of goods, good faith or performance.

2. Accreditation of a company

2.1. As part of the Accreditation of a User-company, the Operator may verify, in particular:

• the existence and due registration of the User-company, the current status of its activity, its registered address and declared types of activity
• information about directors, representatives, ownership structure and ultimate beneficial owners
• constituent documents, documents confirming the authority of representatives, and licences, permits, certificates and other documents required for the relevant activity or for the use of individual Platform services
• the presence of sanctions restrictions, information about politically exposed persons (PEP), adverse media, information about insolvency, bankruptcy, cessation of activity, court disputes and enforcement proceedings
• bank details and, where there is a proper basis, the ownership of or right to use the relevant bank account, as well as financial or operational data to the extent necessary to provide the relevant service
• the correspondence of the User-company’s declared role to the requirements of a specific feature, module or service of the Platform
• the origin of goods or funds, or title to the relevant asset — where such verification is reasonably necessary in connection with a specific operation, the level of risk, the requirements of applicable law or of an engaged provider.

The identification of politically exposed person (PEP) status, adverse media or another risk indicator is not in itself an automatic ground for refusing Accreditation. Such information is assessed taking into account its reliability, currency, source, content and the totality of other circumstances.

2.2. The list and scope of documents and information requested as part of Accreditation are determined taking into account the country of registration, the legal form of the User-company, its role on the Platform, the nature and volume of operations, the level of risk, the specifics of the relevant service and the requirements of applicable law. Documents and information are requested only to the extent reasonably necessary to carry out the relevant review. The requirements of a bank, insurer or other third-party provider are taken into account only where that provider is actually engaged in the relevant service or operation.

3. Verification of an individual

3.1. Verification of an Authorised User may include confirmation of an email address and/or telephone number, examination of an identity document, comparison of information against available registers, electronic identification, a liveness check, a photograph of the person (selfie), verification of a qualified electronic signature (QES), and confirmation of the link with the User-company, the position held and the authority granted.

3.2. Verification of an individual does not automatically confirm corporate authority. The right to perform a Legally Significant Action is granted separately by the User-company.

3.3. Biometric or video identification of an Authorised User is used only where there is a proper legal basis, for a clearly defined purpose, with prior notice to the User, to the minimum extent necessary, and in compliance with the established retention periods and protection requirements for the relevant data.

4. Statuses

4.2. A status reflects the result or state of the relevant review only as at the date it was determined and within the scope of the review actually carried out.

4.3. The status names displayed in the Platform interface may differ from those set out in this Policy, provided that their meaning makes it possible to determine unambiguously the object of review, the current state, the date the status was set and the related restrictions.

5. Procedure

• Submission of data and documents.
• Automated and/or manual review.
• Request for additional materials where required.
• Decision on status and access.
• Notification to an extent that does not disclose security, fraud or confidential methodologies.
• Periodic monitoring and re-verification.

6. Re-verification

6.1. Re-accreditation of a User-company or re-verification of an Authorised User may be carried out where registration, corporate or identification data changes, or upon a change of director, ultimate beneficial owner (UBO), bank details, country of registration, licences, permits, type of activity, declared role on the Platform, level of risk or sanctions status, as well as in connection with a higher-risk operation, a justified requirement of an actually engaged third-party provider, or a requirement of applicable law.

6.2. The User-company must promptly notify the Operator of changes to information and documents that may affect the results of Accreditation, access rights or the ability to use individual Platform features, within the period established by the Agreement or by applicable law. Failure to notify such changes may be a ground for carrying out a re-verification and for temporarily restricting the relevant features until it is completed.

7. Risk-based restrictions

7.1. Until Accreditation, Verification or a re-verification is completed, the Operator has the right to restrict access to individual Platform features temporarily and proportionately to the risk identified, where without completing the relevant review it is not possible to properly confirm the lawfulness of their use, the User’s authority or an acceptable level of risk. Such features may include, in particular, submitting a Firm Order or a Counter Order, Acceptance, submitting Bids, Signing documents, changing bank details, disposing of assets, automatic generation of Service Orders, and the use of individual financing or insurance services.

7.2. A restriction is not a finding of breach. It is reviewed once materials are received or the risk changes.

8. Refusal, suspension and appeal

8.1. Grounds for refusing Accreditation or Verification, suspending the relevant status or restricting access to individual Platform features may include, in particular:

• provision of materially inaccurate, incomplete or forged data or documents
• inability to confirm a person’s authority to act on behalf of the User-company
• a confirmed sanctions restriction which, under applicable law, prevents the establishment or continuation of the relationship, the provision of the relevant service or the conduct of the operation
• identification of an unacceptable risk of fraud or a threat to information or operational security
• use, or intended use, of the Platform for activity prohibited by applicable law, the Agreement or the Terms of Use
• refusal to provide documents, information or explanations reasonably necessary to complete the relevant review
• a lawful requirement of a competent public authority or another circumstance in which a restriction or refusal is expressly required by applicable law.

8.2. Unless prohibited, the general ground and the means of submitting clarifications or objections are communicated.

8.3. The Operator has the right not to disclose internal risk scoring rules and criteria, the sources of information used to detect fraud (fraud intelligence), or other information where its disclosure could facilitate circumvention of control procedures, create a threat to the security of the Platform, infringe the rights of third parties or conflict with the requirements of applicable law.

9. Third-party providers

9.1. To carry out individual checks, the Operator may engage third-party providers of identification and verification services for individuals and companies (KYC/KYB), sanctions screening, checks of state and other registers, electronic identification and electronic signature. The categories of such providers, their role in the processing of personal data and other information subject to disclosure are set out in the Privacy Policy and, where necessary, in the corresponding register or a separate notice.

9.2. Results of checks obtained from third-party providers or external sources are assessed by the Operator together with other available information. Where a likely false positive, contradictory or incomplete data is identified, the Operator may carry out an additional check and, where necessary, request clarifying documents or explanations.

10. Retention and confidentiality

10.1. Documents, results of checks and related records are retained for the period reasonably necessary to carry out Accreditation, Verification and re-verifications, to comply with applicable law, to perform contractual obligations and to protect the rights and legitimate interests of the Operator and Users. Access to such data is granted only to authorised persons and third-party providers to the extent necessary to perform the relevant functions. After the relevant period expires, the data is deleted, destroyed or anonymised, unless its further retention is required by applicable law or is reasonably necessary to protect rights.

10.2. Documents are not shown to other Users, except for the specific data and statuses necessary for interaction and expressly permitted.

11. User’s responsibility

11.1. The User is responsible for ensuring that the data and documents it provides are accurate, current and lawfully obtained, and must promptly notify any change to them. Accreditation or Verification on the Platform does not replace the User’s own due diligence on a counterparty and does not release the User from assessing the risks of a specific operation.

12. Changes

12.1. Verification methodologies and the list of documents may change on a risk-based basis, taking into account the level of risk, the requirements of the law and the specifics of the relevant service. Material changes affecting the rights or obligations of a User are published before they take effect and apply prospectively.

Sources and legal basis

This document has been prepared taking into account the Accession Agreement to which the User has acceded as the priority source, INBULK public documentation as regards the description of actual or planned workflows, and applicable law. Public pages that conflict with the Agreement do not determine legal consequences.

• The Accession Agreement to which the User has acceded.
• Platform Terms of Use — edition in force: https://help.inbulk.com/en/terms 
• Privacy Policy — edition in force: https://help.inbulk.com/en/policies/privacy-policy 
• Applicable sanctions, data protection, corporate and contract law.

Version history