The verification screen usually arrives at the worst moment: after the deposit, before the first trade, or worse, at the point of a withdrawal. It feels like an obstacle invented by the firm. It is closer to the opposite. A regulated broker or payment institution that opens an account without identifying the customer is breaking the rule it is supervised against, and the penalty falls on the firm rather than on you.
Each document answers a different question
Verification is not one check. It is four or five small ones stacked together, and knowing which is which explains why a firm that already has your passport still asks for a bank statement.
- Government identity document. Establishes who you are: full name, date of birth, nationality, document number and expiry. Passports and national ID cards read cleanly because of the machine readable zone; driving licences vary by country.
- Proof of address. Establishes where you live, usually through a utility bill, bank statement or government letter dated within a recent window. Residence decides which group entity you contract with, which leverage caps apply and whether the firm may serve you at all.
- Liveness or selfie check. Establishes that the person submitting the document is the person in it, rather than someone who found the file. Modern flows ask you to turn your head or follow a prompt precisely because a static photo can be a photo of a photo.
- Payment instrument proof. A card image with the middle digits hidden, or a wallet screenshot, establishing that the funding method belongs to you. This is the anti-fraud half of the process rather than the anti-money-laundering half.
- Source of funds. Establishes where the money came from: salary, a business, a property sale, an inheritance. Triggered by size, by pattern, or by a risk profile that calls for a closer look.
Which of these you meet depends on the tier your account sits in, and the way those tiers are usually built is set out in KYC verification levels.
Why perfectly good documents get rejected
Most rejections have nothing to do with suspicion. Automated document checks read fields and compare them character by character, so anything that blurs the read gets flagged: a cropped corner, glare across the photo page, a finger over the number, a screenshot of a PDF instead of the PDF, a scan at a resolution too low to read the small print.
The other family of rejections comes from mismatches. The account is opened as "Mike" and the passport says "Michael". The address on the bill has an apartment number the registration form left out. The statement is four months old when the firm accepts three. Names that transliterate differently between alphabets cause a lot of this, and none of it is anyone acting in bad faith.
Two practical habits fix most of it. Photograph documents flat, in daylight, with all four corners inside the frame and no flash. And register the account with your name exactly as it appears on the identity document, including middle names, before uploading anything.
Send documents only through the firm's own portal, never by email or chat. A passport image plus a proof of address is enough material for identity fraud, and an inbox is not a controlled environment. If somebody asks for documents over a messaging app, treat that as the warning it is.
When the extra questions start
Enhanced checks are triggered by defined circumstances rather than by mood. A politically exposed person, a residence in a jurisdiction on a heightened-risk list, a deposit size out of line with the profile given at sign-up, funding from a third party, or a pattern of deposits and immediate withdrawals with little trading in between. The framework behind these triggers is described in our overview of the AML directives.
The request that surprises traders most often is source of funds at withdrawal, particularly on a large profit. It is not the firm looking for a reason to refuse. Withdrawals are the point where money leaves the regulated perimeter, so it is the point where documentation has to be complete. Firms that ask early, at onboarding, have fewer of these arguments than firms that leave it until the payout ticket.
Where your data goes
Most trading firms do not build their own document checking. They connect a specialist provider that performs the extraction, the face match and the sanctions screening, then returns a decision and a reference. The firm stores the outcome and, depending on its rules, the documents themselves. Our look at KYC providers covers how those services differ.
That means your data sits with at least two organisations. In the EU and UK, data protection rules give you rights over it: to know what is held, to have inaccuracies corrected, and to be told how long it is kept. Retention is the part people misread. Anti-money-laundering law generally requires records to be held for a set number of years after the relationship ends, so a firm cannot delete your file on request while that obligation runs. Firms operating in Europe have to reconcile both regimes, which is the subject of GDPR for trading firms.
The reasonable questions to ask before uploading: which entity is collecting this, which provider processes it, how long is it kept, and is the connection to the upload page secure. A firm with its house in order answers all four without hesitating.
"Do the verification on day one, before you fund anything. The traders who fight with document uploads are almost always doing it on the day they want their money out."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- ID, proof of address, liveness and payment proof each answer a separate question, which is why one does not replace another.
- Most rejections are mechanical: glare, cropped corners, an out-of-date statement or a name spelled differently from the account.
- Source of funds questions are triggered by size, pattern and risk profile, and are hardest to answer at withdrawal time.
- Upload only through the firm's portal, and expect records to be retained for years after the account closes.
Frequently Asked Questions
Why does a broker need proof of address as well as ID?
The two documents answer different questions. An identity document establishes who you are; a recent utility bill or bank statement establishes where you live, which determines the entity you contract with, the leverage limits that apply and whether the firm may serve you at all.
Why was my document rejected when it looks fine?
Most rejections are mechanical: a cropped corner, glare over the machine readable zone, an expired date, a statement older than the accepted window, or a name spelled differently from the account. Automated checks compare fields character by character and flag anything that does not match.
Can a firm ask where my money came from?
Yes. Source of funds and source of wealth questions are part of the anti-money-laundering obligations placed on regulated firms, and they are usually triggered by deposit size, an unusual funding pattern or a higher risk profile. Refusing to answer generally means the account cannot be funded or the withdrawal cannot be released.