Conducting regulatory checks

Once the user has been created, it's time to verify that the user's information is correct.

Regulatory Check types

During user onboarding there are four types of regulatory checks that must be completed before the user can be activated.

These checks do not have to be carried out in the given order.

Check type	Description
`KYC`	Know Your Customer: Verifying the user's identity and address (if possible).
`POR`	Proof Of Residency: Verifying the user's address (if not covered by the documents used for verifying the user's identity; check type `KYC`).
`INSTRUMENT_FIT`	Result of the assessment of the user's instrument appropriateness or suitability.
`COMPLIANCE`	Internal compliance check that will run in the background once the identity verification is successfully passed (check type `KYC`).

In this section we'll run through how to submit evidence for these checks, and how you can see their status via the Upvest Investment API.

1. Know your customer (KYC)

As a regulated investment firm, we must verify the user information. We rely on the identity verification that you perform during the user's onboarding process.

To verify the user's identity, you will need to upload the identity verification documents into a document bucket. We will take the documents from there and securely store them.

We accept video identification, in person identification (e.g., in the post office) as well as electronic identification as approved identification methods. You must indicate the method of identification in your API requests.

For users residing outside of Germany we also accept photo-based identification methods in combination with a liveness check. We can only accept identity verification that meets the KYC Document Requirements.

To provide us with the documents, proceed as follows:

Package all the required documents from your identity verification provider into a download archive.
Include the link to the documents ("data_download_link") for checks of the type the KYC when sending POST /users/{user_id}/checks.

Example request

{
  "type": "KYC",
  "check_confirmed_at": "2019-08-24T14:15:22Z",
  "data_download_link": "https://bucket.customer.com/ident/user3.zip",
  "document_type": "ID_CARD",
  "document_expiration_date": "2030-01-01",
  "nationality": "DE",
  "provider": "KYC provider",
  "method": "VIDEO_ID",
  "confirmed_address": {
    "address_line1": "Rosenweg 221",
    "address_line2": "apt. 33",
    "postcode": "45678",
    "city": "Berlin",
    "state": "BE",
    "country": "DE"
  }
}

2. Proof of residency

Usually, the document used for the "Know Your Customer" identity verification contains the user’s address and this is sufficient to verify the address in the same call. In some cases, the address does not match or is simply not present. When this occurs, we require additional proof of the user's address.

When this occurs we require an additional "Proof of Residency" check using, for example, a recent utility bill or residence permit. See POR Document Requirements for details.

To submit the address verification, proceed as follows:

Collect and validate a proof of residency document from the user.
POST /users/{user_id}/checks

Example request

{
  "type": "POR",
  "check_confirmed_at": "2020-08-24T14:15:22Z",
  "issuance_date": "2020-01-01",
  "data_download_link": "https://bucket.customer.com/por/user3.zip",
  "document_type": "UTILITY_BILL",
  "confirmed_address": {
    "address_line1": "Rosenweg 221",
    "address_line2": "apt. 33",
    "postcode": "45678",
    "city": "Berlin",
    "state": "BE",
    "country": "DE"
  }
}

Parameter	Description
`type`	Required: Specify `POR` for the check type.
`data_download_link`	Required: Include the link to the user's proof of residency documents.

3. User's instrument fit

To offer investment products to your users, you are required to assess their investment experience and knowledge by an appropriateness or suitability check during your user onboarding process. You need to submit the result of that check to us before we can activate the user.

Send the following request:

POST /users/{user_id}/checks

Example request

{
  "type": "INSTRUMENT_FIT",
  "check_confirmed_at": "2020-08-24T14:15:22Z",
  "instrument_suitability": {
    "suitability": true
  }
}

Parameter	Description
`type`	Required: Specify `INSTRUMENT_FIT` for the check type.

4. Internal compliance checks

In addition to the checks you perform, we run an internal compliance check on the user in the background. The results of this COMPLIANCE check are displayed when listing the checks after you have verified the identity of the user. You will also receive webhooks for this type of check.

Listing regulatory checks

After you have posted all the checks, you can see the checks along with their status. Next to the checks you posted, you will find the additional internal compliance check. List the checks as follows:

GET/user/{user_id}/checks.

Example response

{
  "data": [
    {
      "id": "008a82d0-c5a4-4410-9318-d34786429c5a",
      "user_id": "7b39529a-e68c-4688-8242-7549d10d6084",
      "type": "KYC",
      "check_confirmed_at": "2019-08-24T14:15:22Z",
      "data_download_link": "https://bucket.customer.com/ident/user3.zip",
      "document_type": "ID_CARD",
      "document_expiration_date": "2030-01-01",
      "nationality": "DE",
      "status": "PASSED",
      "provider": "KYC provider",
      "method": "VIDEO_ID",
      "confirmed_address": {
        "address_line1": "Rosenweg 221",
        "address_line2": "apt. 33",
        "postcode": "45678",
        "city": "Berlin",
        "state": "BE",
        "country": "DE"
      }
    },
    {
      "id": "a680ff52-3a96-4e82-a2ab-12563bbd1a2e",
      "user_id": "7b39529a-e68c-4688-8242-7549d10d6084",
      "type": "INSTRUMENT_FIT",
      "check_confirmed_at": "2020-08-24T14:15:22Z",
      "status": "PASSED",
      "instrument_suitability": {
        "suitability": true
      }
    },
    {
      "id": "b633a915-ed3c-43d7-afb5-a550f26ccb0d",
      "user_id": "7b39529a-e68c-4688-8242-7549d10d6084",
      "type": "POR",
      "check_confirmed_at": "2020-08-24T14:15:22Z",
      "issuance_date": "2020-01-01",
      "data_download_link": "https: //bucket.customer.com/por/user3.zip",
      "document_type": "UTILITY_BILL",
      "status": "PASSED",
      "confirmed_address": {
        "address_line1": "Rosenweg 221",
        "address_line2": "apt. 33",
        "postcode": "45678",
        "city": "Berlin",
        "state": "BE",
        "country": "DE"
      }
    },
    {
      "id": "76aa72aa-3738-4640-bad5-68c1196dc758",
      "user_id": "7b39529a-e68c-4688-8242-7549d10d6084",
      "type": "COMPLIANCE",
      "check_confirmed_at": "2020-08-24T14:15:22Z",
      "status": "PASSED"
    }
  ]
}

User check status

The following statuses for a user check can be returned:

Status	Description
`IN_PROGRESS`	Check is in progress.
`PASSED`	Check has passed.
`FAILED`	Check has failed.

Webhooks

Due to the asynchronous nature of the user checks, we provide webhooks for the creation of the respective checks as well as the notification of the final status of the check. For more information about the webhooks, please refer to the user check events.

After passing all relevant regulatory checks, the user is activated, and you will receive a USER.ACTIVATED event.