Consumer Consent Disclosure Notice

Opefin Source verifies your identity and produces an AML certificate for the professional (the “reporting entity”) involved in your transaction. To do this, Opefin securely collects information from you, your bank, and an identity verification provider, checks it, and gives the reporting entity a result. Opefin is the organisation responsible for your information during this process.

Opefin uses your information to: verify your identity; analyse and certify your source of funds; help the reporting entity meet its anti-money laundering and counter-terrorism financing obligations; create and maintain your verified record in the Opefin Compliance Network so you do not have to repeat the whole check for future transactions; and, where activated, carry out ongoing monitoring. Opefin also creates anonymised and aggregated data (which no longer identifies you) to operate, improve and build its products and services.

What this means for you

Holding your verified record is what removes the friction of repeat AML checks. Your verification can be kept current and reused, and shared with another reporting entity under the reliance model only with your consent at the time of each new transaction.

Your consent covers Opefin accessing your bank data through open banking and carrying out the biometric identity check. The wider anti-money laundering processing, and the operation of the Compliance Network, are carried out because the law requires them and under Opefin’s legitimate interests, so they do not depend on your consent and continue for the legally required retention period. Use of anonymised, de-identified data does not require your consent because it no longer identifies you.

Your certificate and Compliance Network record are kept for the period the law requires (5 years in New Zealand; 7 years in Australia). Raw bank data not built into your certificate is deleted within 30 days. Anonymised and aggregated data may be kept indefinitely because it no longer identifies you. You can ask to be removed from active Compliance Network queries at any time, although records the law requires Opefin to keep are retained for the statutory period.

You can ask to access or correct your information, ask to be removed from active Compliance Network queries, and complain. Contact privacy@opefin.com for privacy requests or complaints@opefin.com for complaints. You can also complain to the Office of the Privacy Commissioner (New Zealand) or the OAIC (Australia), and to the relevant dispute resolution scheme (FSCL in New Zealand; AFCA in Australia). Full detail is in the Privacy Notice for your country.

Please read and tick each box. Ticking is an active choice; nothing is pre-ticked. You can decline, but the reporting entity may then need to verify you another way.

Acting for a company, trust or partnership? The person completing this flow also confirms: “I am authorised to provide this consent on behalf of the entity, and the entity agrees to the data access described above.”

This consent relates to that singular transaction. Each new request will ask for your consent again if necessary.