KYC Policy
Overview
This KYC Policy describes when identity verification is required on Descrimen and how the process works. KYC is required only for personal cashout. Researchers who elect charity payout or who keep payouts on-platform are not subject to KYC.
KYC is performed by a third-party provider. Descrimen does not collect, store, or transmit identity documents. The provider is contractually restricted from using submitted data for any purpose other than verification.
When KYC Is Required
KYC is required when a researcher requests cashout to a personal bank account or personal wallet, and cumulative payouts to that researcher exceed USD 1,000 in a rolling 12-month period.
Below the threshold, KYC is not required. The threshold is calculated from the sum of all validated payouts to the researcher across all programs in the trailing 12 months.
Programs that pay bounties through Descrimen's payout rails are subject to the same threshold on behalf of their researchers. Programs that pay researchers directly off-platform are responsible for their own KYC obligations.
KYC Provider
KYC is performed by a third-party provider configured by the operator. The provider name, jurisdiction, and contact details are disclosed in the researcher settings page at the time of KYC initiation. Descrimen may change providers and will notify affected users in advance.
The provider conducts document verification, biometric checks, and sanctions screening. The provider returns a verification result to Descrimen. Descrimen receives only the result (verified, rejected, in review) and the expiration date, not the underlying documents.
Required Documents
Government-issued photo ID: passport, driver's license, or national ID card. Must be unexpired and legible.
Selfie: a live capture during the verification session, matched to the ID photo.
Proof of address: required when cumulative payouts exceed USD 10,000 in a rolling 12-month period. Acceptable documents include utility bill, bank statement, or government letter dated within the last 90 days.
All documents must be in English or accompanied by a certified translation. The provider may request additional documentation in edge cases. Failure to provide requested documents within 14 days results in rejection.
Sanctions Screening
Every KYC session includes screening against:
- OFAC SDN list (United States)
- EU consolidated sanctions list
- UN Security Council Consolidated List
- HMT UK sanctions list
A match—including a partial or fuzzy match—results in automatic rejection. The researcher is notified that verification failed and is offered the charity path described below. Descrimen does not provide the specific match reason.
Sanctions screening runs at KYC initiation and again at each cashout above the threshold. A researcher who is sanctioned after initial verification will be blocked from further cashout.
Prohibited Jurisdictions
Researchers residing in, or cashing out to wallets linked to, the following jurisdictions are prohibited from personal cashout:
- Iran
- North Korea
- Syria
- Cuba
- Crimea region
- Donetsk People's Republic
- Luhansk People's Republic
This list reflects current sanctions exposure and is reviewed quarterly. Descrimen may add or remove jurisdictions in response to changes in sanctions regimes. Researchers affected by an addition will be notified and offered the charity path for pending payouts.
IP addresses from prohibited jurisdictions at login or cashout are flagged for review. Flags may result in temporary hold of payout until the researcher provides evidence of relocation.
KYC Status
A researcher's KYC status is one of:
- Not started: KYC has not been initiated. Cashout is blocked above the threshold.
- In review: documents submitted, provider has not returned a result. Cashout is blocked until resolution.
- Verified: provider has confirmed identity. Cashout is permitted up to the threshold and expiration date.
- Rejected: provider has declined verification. Cashout is blocked; charity path is available.
Status is visible in the researcher settings page. The status does not appear on the researcher's public profile or in submissions.
Rejected Users and Charity Path
Researchers whose KYC is rejected for any reason—sanctions, jurisdiction, document failure, or fraud indicators—retain the right to withdraw pending payouts to a vetted charity wallet. The charity path requires no KYC.
The charity wallet list is curated by Descrimen and includes registered nonprofits vetted for sanctions compliance. Researchers select a charity from the list at payout time. The selection is final and irreversible.
The charity path is also available to researchers who do not wish to complete KYC for privacy reasons. Choosing the charity path does not affect account standing or ability to submit findings.
Data Handling
KYC data is stored by the KYC provider, not Descrimen. Descrimen does not receive copies of identity documents, selfies, or proof of address. Descrimen stores only the verification result, expiration date, and the timestamp of verification.
Researchers may request deletion of their KYC record from the provider. Deletion requests are routed through the provider's process, not Descrimen. Descrimen retains the verification result for the retention period defined in the Privacy Policy.
If the provider suffers a breach, the provider is responsible for notification under its own privacy policy. Descrimen will coordinate with the provider to notify affected researchers on the platform side.
Expiration and Re-verification
KYC verification expires after 12 months for accounts that have received more than USD 10,000 in cumulative payouts. For accounts below that threshold, verification does not expire but may be re-verified at the provider's discretion.
Researchers with expired verification are notified 30 days before expiration. Cashout is blocked once verification expires until re-verification is complete. Pending payouts are held during the gap.
Re-verification follows the same document requirements as initial verification. The provider may simplify re-verification for accounts with unchanged identity, at its discretion.
Changes
Descrimen may update this KYC Policy in response to legal, regulatory, or operational changes. Material changes—including changes to thresholds, jurisdictions, or required documents—will be announced 30 days before they take effect.