KYC & AML Policy

Last updated May 16, 2026

Quick summary

EscrowWays is committed to preventing fraud, money laundering, and terrorist financing on our platform. To do this, we verify the identity of our users (KYC — Know Your Customer) and monitor transactions for suspicious activity (AML — Anti-Money Laundering). This page explains what verification we require, when we require it, what we look for in transactions, and how we cooperate with Pakistani authorities. These measures protect you, other users, and the integrity of digital commerce in Pakistan.

What KYC and AML mean

KYC (Know Your Customer) is the process of confirming who you really are. When you sign up or reach certain transaction thresholds, we verify your identity using your CNIC and other documents. This makes sure that real people, not anonymous accounts, are using the platform — which protects everyone from fraud.

AML (Anti-Money Laundering) is the set of rules and monitoring we use to detect and prevent the use of EscrowWays for laundering illegally obtained money. This includes watching for unusual transaction patterns, screening against sanctions lists, reporting suspicious activity to authorities, and refusing transactions that don't make sense.

Both KYC and AML are required by Pakistani law for any platform handling financial transactions. EscrowWays follows guidance from the State Bank of Pakistan (SBP), the Federal Investigation Agency (FIA), the Federal Board of Revenue (FBR), and Pakistan's Anti-Money Laundering Act.

Who needs to complete KYC verification

Our verification requirements scale with what you do on the platform:

Browsing and basic account (no KYC needed)

  1. Creating an account
  2. Browsing listings
  3. Reading reviews and seller profiles
  4. Messaging sellers before buying

Low-value buying (basic verification)

To buy items below PKR 10,000 per transaction and PKR 50,000 per month in total:

  1. Verified email address
  2. Verified mobile number (SMS confirmation)
  3. Two-factor authentication recommended but not required

Higher-value buying (CNIC verification)

For purchases above PKR 10,000 per transaction or total spending above PKR 50,000 per month:

  1. Front and back photo of your CNIC (Computerized National Identity Card)
  2. A clear selfie holding your CNIC next to your face
  3. Name on account must match your CNIC name
  4. Mobile number registered to your CNIC (verified by NADRA where possible)

Selling on the platform (full KYC required)

All sellers must complete full KYC verification before listing items:

  1. All of the above (CNIC + selfie)
  2. Verified bank account or mobile wallet in your name
  3. Address verification (utility bill, lease agreement, or bank statement from the last 3 months)
  4. Source of funds declaration for sellers expected to handle high volumes

Business sellers (enhanced KYC)

If you're selling as a registered business:

  1. Business registration certificate
  2. National Tax Number (NTN) certificate from FBR
  3. Authorized representative's CNIC and selfie
  4. Letter of authorization on company letterhead
  5. Beneficial ownership disclosure if the business has multiple owners

What documents we accept

We accept the following identification documents from Pakistani users:

  1. CNIC (Computerized National Identity Card) — primary accepted ID
  2. NICOP (National Identity Card for Overseas Pakistanis) — for Pakistanis living abroad
  3. Pakistani Passport — accepted when CNIC is being renewed or replaced
  4. POC (Pakistan Origin Card) — for non-Pakistani persons of Pakistani origin

For international users, we may accept:

  1. Valid passport with biometric chip
  2. National ID card from your country (case by case)
  3. Driver's license is generally NOT sufficient as a standalone document

Document quality requirements

Documents must be:

  1. Clear, in focus, and well-lit (no blurry or dark photos)
  2. All four corners visible — no parts cropped off
  3. Original document, not a photocopy or screenshot of a photo
  4. Currently valid (not expired)
  5. Free of glare or reflections covering important details
  6. Color photos only (not black and white)

How the verification process works

When you submit documents for KYC, here's what happens:

  1. Upload — you upload CNIC photos and your selfie through our secure form
  2. Encryption — documents are encrypted immediately on upload and stored in a secure database
  3. Automated checks — our system automatically detects whether the CNIC number is in valid format, whether the photo is clear, and whether the selfie face matches the CNIC face
  4. Manual review — our verification team reviews each submission within 24 to 48 hours during business days
  5. NADRA cross-check — for high-value accounts, we may cross-check your CNIC against NADRA's biometric verification service
  6. Decision — we approve, reject, or request additional information by email

If approved, you get a "Verified" badge on your profile and unlock the corresponding features. If rejected, the email explains why and what you can do to fix it (usually a clearer photo or a different document).

How long verification takes

  1. Basic verification (email + mobile): instant to 5 minutes
  2. CNIC verification: 24 to 48 hours during business days
  3. Full seller verification: 48 to 72 hours during business days
  4. Business KYC: 3 to 5 business days
  5. Enhanced due diligence cases (high-value or flagged accounts): up to 7 business days

Most verifications are completed faster than these maximum windows. If yours is taking longer, check your email — we may have requested additional information from you.

What we monitor (AML)

Our anti-money-laundering monitoring looks for patterns that don't match normal buyer and seller behavior. We use both automated systems and human review to detect:

Unusual transaction patterns

  1. Sudden spikes in transaction volume from new accounts
  2. Multiple small transactions that together would exceed reporting thresholds (called "structuring")
  3. Round-number transactions that don't match real commercial patterns
  4. Transactions just below KYC verification thresholds (like repeated PKR 9,500 transactions)
  5. Rapid wallet top-ups followed by immediate withdrawals (potentially using EscrowWays as a transit point)
  6. Same payment method used across multiple accounts
  7. High-value transactions with no clear product justification

Suspicious account behavior

  1. Multiple accounts from the same IP address or device
  2. Accounts that immediately attempt high-value transactions after signup
  3. Account information mismatches (name on CNIC vs name on bank account)
  4. Logins from countries inconsistent with the user's stated location
  5. Behavior that pattern-matches known fraud rings
  6. Accounts attempting to bypass our payment, dispute, or messaging systems

Sanctioned parties screening

We screen new accounts and high-value transactions against:

  1. UN Security Council sanctions lists
  2. Pakistan's domestic sanctions and proscribed persons lists
  3. OFAC (US Treasury) sanctions where transactions involve US persons
  4. FATF (Financial Action Task Force) high-risk jurisdiction lists

Accounts matching sanctioned parties are blocked from the platform.

What happens when we detect suspicious activity

Depending on the severity, our response may include:

Tier 1 — soft review

  1. Account is flagged internally for closer monitoring
  2. Transactions can continue normally
  3. Your experience is unaffected

Tier 2 — request for additional information

  1. You receive an email asking for explanation or documentation
  2. Examples: source of funds, business purpose, additional ID, proof of address
  3. Transactions may be temporarily delayed until information is provided
  4. Usually resolved within 24 to 48 hours of your response

Tier 3 — account suspension

  1. Account is suspended pending review
  2. Pending transactions are held
  3. Funds in wallet are protected and not lost — but cannot be withdrawn during the review
  4. You receive an email explaining what's needed to resolve the suspension
  5. Most legitimate cases are resolved within 7 business days

Tier 4 — account closure and reporting

For confirmed money laundering, fraud, terrorist financing, or sanctions violations:

  1. Account permanently closed
  2. Funds frozen pending legal direction
  3. Suspicious Transaction Report (STR) filed with Pakistani financial authorities
  4. Information shared with law enforcement (FIA, SBP, FBR as applicable)
  5. Coordination with payment partners and banks
  6. IP address and device blocked from creating new accounts

Your right to know

If your account is suspended for AML reasons, we will tell you:

  1. That your account is suspended
  2. The general category of concern (e.g., "additional verification needed" or "transaction pattern review")
  3. What documents or information would help resolve the suspension
  4. How to contact our compliance team

However, in certain cases (especially when we've filed a suspicious transaction report with authorities), we are legally prohibited from disclosing specific details about why the report was filed. This is called the "tipping-off" prohibition and applies to AML investigations worldwide. We will tell you what we can without breaking the law.

Data we collect and why

For KYC and AML purposes, we collect:

  1. Identity data: CNIC number, full name, date of birth, nationality, address
  2. Contact data: email, mobile number, residential address
  3. Financial data: bank account or wallet information, transaction history, source of funds (for high-value accounts)
  4. Verification data: CNIC photos, selfie, address proof documents
  5. Behavioral data: IP addresses, device fingerprints, login patterns, transaction patterns
  6. Business data: registration certificates, NTN, beneficial ownership (for business accounts)

This data is collected only for KYC, AML, fraud prevention, and legal compliance purposes. It is not used for marketing, not sold to third parties, and not shared with sellers or other buyers. See our Privacy Policy for full details on data handling.

How we protect your KYC data

We take security seriously because identity data is sensitive:

  1. Encryption at rest: CNIC photos and personal data are encrypted using industry-standard algorithms
  2. Encryption in transit: all uploads use HTTPS / TLS 1.3
  3. Restricted access: only authorized verification staff can view your documents, and access is logged
  4. Separation of data: identity documents are stored separately from transaction data
  5. Retention limits: we retain KYC data only for as long as legally required (typically 5 years after account closure under Pakistani AML law)
  6. Audit trails: every access to your KYC data is logged and reviewable
  7. Breach response: in the unlikely event of a data breach, we notify affected users within 72 hours per Pakistani data protection rules

We will never ask for your CNIC photos by email, phone, or chat — only through the secure upload form on the EscrowWays website. Anyone asking for KYC documents outside the platform is impersonating us.

Cooperation with authorities

EscrowWays cooperates with Pakistani authorities when legally required:

  1. State Bank of Pakistan (SBP): AML guidance and reporting requirements
  2. Federal Investigation Agency (FIA): investigations into cybercrime, fraud, and money laundering
  3. Federal Board of Revenue (FBR): tax-related inquiries about sellers and business accounts
  4. NADRA: identity verification cross-checks
  5. Courts and prosecutors: in response to valid legal orders
  6. Foreign authorities: in coordination with Pakistani authorities where international cooperation is required

We respond to legitimate legal requests within the timeframes required by law. We do not voluntarily share data without a valid legal basis. When we receive a request, we verify its authenticity and respond with the minimum data necessary.

Sanctions and prohibited countries

We comply with international sanctions and Pakistani regulations on prohibited jurisdictions:

  1. Accounts cannot be opened from countries subject to UN sanctions
  2. High-risk jurisdictions per FATF gray list and black list may face enhanced scrutiny
  3. Transactions involving sanctioned entities are automatically blocked
  4. Users discovered to be in violation of sanctions face account closure and reporting

We do not disclose the specific list of restricted countries publicly, but if you have questions about your specific country, email compliance@escrowways.com.

Your responsibilities

As a user of EscrowWays, you agree to:

  1. Provide accurate, truthful, and up-to-date information during KYC
  2. Use the platform only for legitimate transactions of products and services you have the right to sell or buy
  3. Not attempt to evade transaction limits by structuring (splitting large amounts into smaller ones)
  4. Not use the platform to launder money, finance terrorism, or commit any other financial crime
  5. Not act on behalf of someone else without disclosing this (no "money mule" activity)
  6. Notify us if your name, address, or other registered information changes
  7. Cooperate with reasonable requests for additional information
  8. Not facilitate transactions for sanctioned individuals or organizations

Failure to follow these responsibilities can result in account suspension, closure, and reporting to authorities.

What happens to your KYC data if you close your account

If you close your EscrowWays account:

  1. Your KYC data is retained for at least 5 years after closure, as required by Pakistani AML law
  2. The data is not used for any purpose other than legal compliance and potential investigations
  3. After the legal retention period, identity documents are securely deleted
  4. Transaction records may be retained longer if there are ongoing investigations or disputes
  5. You can request a copy of your data anytime by emailing privacy@escrowways.com
  6. You can request deletion of marketing and behavioral data immediately, even while KYC data is retained for legal reasons

Updates to this policy

We update this KYC and AML Policy as our procedures evolve, as Pakistani laws change, or as we add new payment partners and jurisdictions. When we update:

  1. Material changes are announced at least 14 days before taking effect
  2. Registered users get an email notification
  3. Continued use of the platform after the change date means you accept the updates
  4. If a change materially affects your privacy or verification requirements, we'll explain what's different

The date at the top of this page tells you when it was last updated. Previous versions are archived and available on request.

How to contact us

  1. KYC and verification questions: verify@escrowways.com
  2. AML and compliance inquiries: compliance@escrowways.com
  3. Account suspension appeals: compliance@escrowways.com
  4. Privacy and data requests: privacy@escrowways.com
  5. Law enforcement inquiries: legal@escrowways.com
  6. General support: support@escrowways.com

Frequently asked questions

Why do I need to verify my CNIC just to buy something online?

For low-value purchases (under PKR 10,000), you don't. CNIC verification is only required for higher-value transactions, total spending above PKR 50,000 per month, and for sellers. This is required by Pakistani anti-money-laundering law and protects everyone from fraud.

How long does CNIC verification take?

Most CNIC verifications are completed within 24 to 48 hours during business days. Some cases requiring additional review may take up to 72 hours. You'll receive an email notification when verification is complete or if we need additional information.

What if my CNIC photo is rejected?

The rejection email tells you exactly why — usually it's a blurry photo, glare on the card, or all four corners not visible. Just upload a better photo and verification continues. There's no penalty for resubmitting.

Is my CNIC information safe?

Yes. CNIC photos and data are encrypted at rest using industry-standard algorithms. Only authorized verification staff can access them, and every access is logged. We never share CNIC data with sellers, other users, or marketing partners. The only exception is when legally required to share with authorities.

Why was my account suspended for "AML review"?

This means our system detected something that needs human review — it doesn't necessarily mean you did anything wrong. Common triggers include unusual transaction patterns, a sudden change in behavior, or information that doesn't match our records. Most cases resolve within a few business days after we receive any requested information.

Can I refuse to do KYC verification?

You can, but you'll be limited to small-value transactions (under PKR 10,000) and won't be able to sell or withdraw above the unverified threshold. KYC is required by Pakistani law for higher-value transactions and for sellers — we can't make exceptions.

Will EscrowWays share my data with the FBR?

Only if FBR makes a legitimate legal request related to your activity on the platform. We don't automatically share data with FBR or any other authority. However, sellers' earnings on EscrowWays are taxable income under Pakistani law — you should report your earnings to FBR yourself when filing taxes.

What if my CNIC has expired?

You'll need to renew it at NADRA and then submit the new CNIC. As a temporary measure, we may accept a valid Pakistani passport while you renew your CNIC, but full verification requires the new CNIC.

I'm an overseas Pakistani — can I use EscrowWays?

Yes. You can verify using your NICOP (National Identity Card for Overseas Pakistanis) or your Pakistani passport. Payment methods may be limited depending on your country, and certain features may not be available for users outside Pakistan.

What is a "Suspicious Transaction Report"?

It's a report we're legally required to file with Pakistani authorities when we detect transaction patterns that may indicate money laundering, terrorism financing, or other financial crimes. The user being reported is not informed (this is called the "tipping-off" prohibition). Most STRs don't result in action against the user — they're investigated by authorities.

How long do you keep my KYC documents?

At least 5 years after your account closes, as required by Pakistani AML law. After that, identity documents are securely deleted. Transaction records may be retained longer if there are ongoing investigations.

Can someone hack into my KYC data?

Our security measures (encryption, restricted access, audit logging) are designed to prevent this. No system is 100% secure, but we use industry best practices. In the unlikely event of a breach, we'd notify you within 72 hours and work to mitigate any harm.

What's the difference between KYC and KYB?

KYC (Know Your Customer) verifies individual identities. KYB (Know Your Business) verifies business entities. For business sellers on EscrowWays, we do both — we verify the business through its registration documents AND the individual representative through their CNIC.

Why does EscrowWays need to know my source of funds?

For high-value accounts and large transactions, knowing where the money came from is part of AML compliance. It helps us distinguish between legitimate business income and potentially laundered money. We only ask for source of funds documentation when our risk-based monitoring flags an account for review — not from everyone.

Does EscrowWays follow international standards or just Pakistani ones?

We follow Pakistani law as our primary framework (SBP regulations, AML Act, NADRA verification), but our procedures also align with international best practices from FATF, FinCEN guidance, and major correspondent banking standards. This is partly because our payment partners (banks, card processors) require it, and partly because it protects users wherever they're located.

By using EscrowWays.com, you agree to our KYC and AML procedures as described in this policy.

These measures exist to protect honest users, prevent fraud, and ensure EscrowWays remains a trustworthy platform for Pakistan's digital economy.