Opefin Network Terms

1. What Opefin is, and isn’t

• Opefin is a data infrastructure company. It verifies people’s identities at their request, keeps each person’s verified information as that person’s Opefin Passport, and shares information from the Opefin Passport with a business when the person approves that business’s request.
• The Opefin Passport is not an official document. It is not a government passport or travel document, and it is not issued, approved or accredited by any government or other authority. It is a collection of a person’s verified information, kept with Opefin in one place because that person chose to. You do not have to accept it: you decide for yourself whether the information a person shares is enough for your own purposes.
• Opefin is not a reporting entity under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (NZ) or the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), does not conduct customer due diligence for you or on your behalf, is not your agent, is not a person relied on by you, and is not a member of your designated business group or reporting group.
• Opefin does not decide whether you should accept, continue with or decline a client, and does not set a client’s risk rating. Those decisions are yours.
• You must not misrepresent Opefin, the Platform, a Verification Pack or the Opefin Network, or describe any of them to a client in terms inconsistent with this section. Nothing in these terms restricts anything you say or disclose to a supervisor, regulator, auditor, court or tribunal, to your professional indemnity insurer, or to your own legal advisers, or anything you are required by law or by a professional obligation to say.

Businesses with and without anti-money laundering obligations

Some businesses in the Opefin Network are reporting entities with anti-money laundering obligations of their own, and some are not. Where these terms refer to your customer due diligence, your anti-money laundering programme, your compliance officer or your supervisor, those references apply to you only if you have those obligations. Everything else in these terms applies to every business in the Opefin Network. Opefin Source is available only to a business that has anti-money laundering obligations.

Words used in these terms

The Platform is the Opefin software and services your business accesses, including Opefin Source where your Mandate or Order Form records that you use it. An Opefin Passport is everything Opefin holds for a person under that person’s own agreement with Opefin. The Opefin Network is the infrastructure through which your business may receive information from a person’s Opefin Passport where that person approves your request. A Mandate is the letter by which your business appoints your managed service provider and accepts these terms, and which Opefin countersigns. An Order Form is the form by which your business orders from Opefin directly and accepts these terms. An Online Order is the order your business places and accepts online, without signing, when it sets up its account with Opefin. Where these terms refer to your Order Form, they refer to your Online Order too where that is how you accepted them. Opefin Source is the Opefin service described in the Schedule to these terms, and the Opefin Source Schedule is that Schedule. The Consumer Data Right is the Australian regime of that name. Where these terms use a word your Mandate or Order Form also uses, it carries the same meaning in both.

2. What you receive

When a person approves your request, Opefin makes a Verification Pack available to you. It contains the information from that person’s Opefin Passport that the person approves. That usually means their verified details, identity document image, verification result and, where their Opefin Passport holds one, their facial image, together with the results of any checks you have asked for, and it may include documents the person provided earlier for an Opefin service, including source of funds documents of any kind, the analysis produced from them, and bank information within the limits in section 6. Where you use Opefin Source, the Opefin Source Schedule sets out what that service adds.

Some of what you receive may have been provided for an earlier business. You decide whether it is current enough, complete enough and relevant enough for your own purposes, and you ask the person for more if it is not. Opefin makes no judgement about that and does not hold information back because it might not suit you. The verification result is Opefin’s own conclusion from its checks on whether the person is who they say they are. It is produced fresh for each request. Opefin does not pass on the response of the organisation that issued the identity document or that keeps the official record.

3. The person’s approval is the basis

• The person gives their agreement directly to Opefin, on Opefin’s screens or on Opefin’s own signed form, before any photograph is taken. Opefin gives the person the information privacy law requires and keeps the record of what they approved.
• You must not seek, give or pass on that agreement for a person, and you must not tell a person or anyone else that you do. You are not required to obtain or renew it.
• Opefin makes information available only where the person approves your request at the time it is made. A request the person does not approve is not fulfilled, and you receive nothing.
• Each request must carry a genuine purpose for a real matter, stated in the purpose field. Keep the purpose general: no amounts, addresses or matter details. Opefin shows that text to the person exactly as you write it and does not review it first, so you are responsible for its accuracy and for making sure it reveals nothing you are not entitled to disclose.

What you confirm when you send a request. Each time you send a request you confirm that:

• you have a current or prospective engagement with the person, and a lawful reason to ask for verification;
• the country your business operates from, and the details you have given Opefin about your regulatory status and your supervisor, are accurate and current, and you will tell Opefin promptly if they change. Opefin uses them to decide which checks may lawfully run for you;
• the purpose you give is accurate, and is the purpose you will use the information for;
• the person is 18 or over;
• the contact details you give are the person’s own current details, and you are authorised to send a request to them;
• you have told the person that you are asking Opefin to verify them;
• you will not complete Opefin’s screens for the person, or open the request link on their behalf; and
• where the request concerns a company, trust or partnership, the individual completing the check has authority to act for it.

What you never confirm. You do not confirm, and Opefin does not act on any statement by you about, a person’s agreement with Opefin, their agreement to an identity record check or a check with a credit reporting agency, or their agreement to information being made available to another business. Those are given by the person to Opefin, on Opefin’s screens, or they are not given at all. A consent you hold under your own client terms is your agreement with your client, for your own purposes, and does not operate as the person’s agreement with Opefin, whatever its wording.

Where a person needs help, or will not use the flow. You may sit with the person and help them through Opefin’s screens, including reading them aloud, as long as the person taps through the screens themselves. Where a person cannot or will not complete the flow, the request screen offers a route that does not involve Opefin: the person gives you certified copies and you verify them yourself under your own programme. Opefin collects nothing on that route, so no agreement with Opefin arises from it. That is not a door closing. The person can still join the Opefin Network afterwards, under People you verify yourself below, and the work you have already done is not wasted: once the person has agreed with Opefin directly, the identity document you verified can be added to their Opefin Passport. Most people want that, so it is worth offering. Opefin does not accept an Opefin Passport set up by anyone other than the person themselves. Where a person lacks capacity and someone else acts for them under an enduring power of attorney, a guardianship order, a property order or a similar authority, no Opefin route is available for that person: verify them under your own programme. That person’s attorney or guardian may of course hold an Opefin Passport of their own, in their own name, for their own dealings.

People you verify yourself. Where you verify a person’s identity yourself, from certified copies or in person, you may still bring that person into the Opefin Network, and most people want that: the point of the Network is not repeating the same exercise for the next business. Three things happen, in this order, and a fourth if the person declines.

1. You tell the person what an Opefin Passport is, using the summary Opefin gives you for that purpose, and you give Opefin their name and contact details with the person’s authority to do so. You confirm that authority, and that you gave them the summary, when you send the details. Do not send the identity document at this stage.
2. Opefin contacts the person itself, gives the person its own notice in its own words, and takes the person’s agreement directly. There is no camera in this step: the person reads and agrees.
3. Once the person has agreed, the identity document may be added to that person’s Opefin Passport. The person may photograph it themselves at that point, or you may upload the copy you verified.
4. If the person declines, or does not answer, Opefin deletes the contact details, tells you that the person did not confirm, and you may not send an Opefin request for that person until the person tells you otherwise. A decline changes nothing about the verification you have already carried out or the file you keep, and it is not a reason to treat the person any differently.

Before the person has agreed, Opefin holds only the name and contact details you gave, and holds them so that it can make contact. There is no Opefin Passport, nothing is available to any other business, and Opefin runs no checks for its own purposes. Opefin does not apply facial recognition to a document you upload unless and until the person adds their own photograph and agrees to that.

You confirm the person’s authority for you to give Opefin their contact details. You do not confirm the person’s agreement to Opefin, and Opefin does not act on a statement by you that the person has accepted Opefin’s documents. Your confirmation is what lets Opefin make contact. The person’s own answer is what lets Opefin hold anything.

An Opefin Passport built this way holds what was uploaded and what Opefin screens, and Opefin’s result for a later request states which checks were carried out. It holds no photograph taken by Opefin, so Opefin cannot compare a later selfie against it, and a later business carries out its own identity check accordingly. The person may add their photograph at any time, and the Opefin Passport then works in the same way as any other.

If a person has no email address and no mobile number. A small number of people cannot be contacted electronically at all. For them, print the Opefin pack from the Platform: the summary, the notice and the agreement form, already carrying your firm’s name and the reason for the request. Give it to the person, let them read it or read it to them, and have them sign the form and initial the boxes that apply.

You then sign the certification on the form. It records what you saw: that you gave the person the pack, that they read it or had it read to them, and that they signed it in your presence on the date stated. It asks you for nothing beyond that, and it is not a warranty. Upload the signed form with the identity document. Opefin holds that form as its record of what the person was shown, in place of the screen capture it would otherwise hold. Take a postal address at the same time, because it becomes the way Opefin reaches that person for anything it would otherwise email.

Where that person is later asked for information from their Opefin Passport, the business making the request prints the approval sheet Opefin generates for that request, the person signs it, and the business uploads it. Each sheet carries its own reference and expires, and a sheet cannot be used for a second request. Opefin releases nothing until it has the signed sheet. A person may instead ask Opefin to post approval sheets to them.

This route is for people who cannot use the electronic one. Opefin records which route each verification used and may ask you about your use of this one. If a person does not appear to understand what they are signing, do not use this route at all: verify them under your own programme and leave Opefin out of it.

Your confirmations are warranties. Each confirmation and certification you give under this section is a warranty by you that it is true when you give it, that you have taken reasonable care to satisfy yourself that it is true, and that it is not misleading. Opefin acts on them without independent checking, which is what makes the arrangement workable, and section 11 applies if one turns out to be wrong.

Opefin does not check your work. Opefin does not monitor, investigate, audit or verify what you confirm, state, select or upload, and has no obligation to do so. It is a technology and data supplier, not a supervisor of your practice, and it is not in a position to know whether what you tell it is correct. Where something you provide is wrong, incomplete or misleading, the consequences are yours, and Opefin is not responsible for a result, a record or a decision that follows from it. Opefin does run checks of its own as part of the Platform, such as reading and testing an identity document or confirming a person’s age, and it runs those as part of producing its own result. They are not a check of what you have told it, and they do not reduce your responsibility for your own confirmations.

Companies, trusts and partnerships. Where a request concerns a company, trust or partnership, record who is acting for it and on what basis: a director or other officer, a partner, a trustee, a person authorised in writing by one of them, or you, acting on their instructions. Where the person acting is named as a director or officer on the relevant public register, the register check Opefin returns confirming that is the evidence and nothing further is needed. That check is separate from an ownership or beneficial ownership extract, which Opefin does not supply and which you obtain yourself where your own customer due diligence calls for one. Where they are not, upload the evidence of their authority, such as a board resolution, a written authority signed by a director, an extract of the partnership agreement or trust deed, or a power of attorney. Where you act on instructions, you confirm that you hold a current engagement with the entity and the instructions of a person authorised to give them, and you name that person. You satisfy yourself that the authority is genuine, current and wide enough for what is being done. Opefin stores what you upload as part of your record and does not assess it, and storing it is not a view by Opefin that the authority is valid.

Authority to act for an entity is authority about the entity. It is never authority to give another individual’s agreement to Opefin. Each individual whose identity is verified gives their own agreement. Where you supply information about other individuals, such as directors, shareholders, partners, trustees or beneficiaries, you give those people Opefin’s Consumer Consent Disclosure Notice, in the wording Opefin provides for that purpose, and you confirm that you have done so. You hold the relationship and the contact details, so you are the practical route to them. Opefin may also contact them itself where it can.

4. What you must do with what you receive

A Verification Pack is personal information about a person. Depending on what that person approves, it can include their identity document image, their facial image, documents they provided for an Opefin service, including source of funds documents of any kind, the analysis produced from them, and bank information. Everything in it is covered by this section. You must:

• use it only for the purpose for which you requested it, your own records and your dealings with that person, and, where you have anti-money laundering obligations, your own customer due diligence;
• where it includes a facial image, not use that image for any other biometric processing, including identification against a set of people or categorisation, and not compare it with anything other than the identity document image in the same Verification Pack, an identity document or image you already hold lawfully for that same person, or the person themselves, whether you are with that person or reviewing the images on screen;
• not use it for profiling, marketing, model training, or any product of your own;
• keep it secure, limit access to people who need it for those purposes, and hold it under the same or better protections you apply to your own client files;
• not pass it to anyone else, except to a managed service provider or compliance provider acting for you as the paragraph below describes, to your auditor or supervisor where your obligations require it, or as the law otherwise requires;
• delete or de-identify it when you no longer need it, consistent with your own record keeping obligations; and
• tell Opefin promptly, at privacy@opefin.com, if it is involved in a data breach.

What Opefin owes you in return

Opefin keeps your non-public business information confidential, including the content of your requests, the identity of the people you ask about and the fact that a person is your client, and uses it only to provide the Platform to you and to meet its own legal obligations. Opefin does not use it for product development, benchmarking, marketing or model training, and does not disclose it to another business in the Opefin Network. Opefin recognises that material you upload may be confidential to your own client or subject to legal professional privilege belonging to that client, and will not treat any privilege as waived. Where Opefin is required by law to disclose anything of yours, it will tell you first and disclose no more than it must, unless it is not allowed to tell you. Opefin will tell you within 24 hours of becoming aware of any breach affecting information it holds for you or about your clients, with enough detail for you to decide what you must do under your own privacy law, and will help you do it.

Where you use a compliance provider, or any other person acting for you in connection with the Platform, you remain responsible for its compliance with these terms as a whole, as if its acts and omissions were your own. That does not apply to a managed service provider named in your Mandate, which Opefin binds directly under its own agreement with Opefin, and for whose acts and omissions you are not responsible under these terms. For anyone else, you must also have a written agreement with that person requiring it to handle the information only on your instructions, only for your dealings with the person it concerns, and never for its own purposes, and to bind any subcontractor to the same terms. Opefin gives that person access on that basis. Tell Opefin before a provider begins acting for you, and tell Opefin when it stops.

5. Identity record checks

Where Opefin checks a person’s identity details with the organisation that issued the document or that keeps the official record, the terms Opefin is under with the operators of those systems flow down to you. You:

• act on your own behalf, and not as anyone’s agent, when you ask for a verification;
• must comply with the privacy law that applies to you and, if none applies to you, must comply with the Australian Privacy Principles as if you were bound by them;
• must not use a person’s identity details for marketing, profiling or tracking;
• acknowledge, where and only where you ask for a check that uses the Australian identity system, that the disclaimers, exclusions, limitations of liability and indemnities in these terms are also for the benefit of, and enforceable by, the Commonwealth of Australia in respect of that check, subject to the same limits that apply to Opefin under section 11; and
• acknowledge that Opefin presents the consent information to the person and keeps the consent record for you, and that Opefin gives you its own verification result rather than the operator’s response.

Where you ask for a check that uses the Australian identity system, you also:

• confirm that you are carrying on business in Australia or New Zealand, or both, and are subject to Australian law, New Zealand law, or both;
• must meet all requirements and comply with all guidelines in the Document Verification Service Access Policy; and
• must cooperate fully with, and support, any audit or verification process the Framework Administrator or its personnel wish to conduct, including giving prompt access to your records, systems, premises and facilities relevant to that system, and you authorise the Framework Administrator and its personnel to access any records or information you hold that is relevant to it.

6. Bank information

Where a person chooses to connect a bank account so that you can see where money came from, the connection runs under a separate agreement between that person and the open banking provider. You accept that provider’s consumer information policy, and you may use what you receive only for the purpose the person authorised. In Australia, information collected under the Consumer Data Right, and anything derived from it, may be shared only in the forms and with the recipients the Consumer Data Right rules allow.

7. Records you keep with Opefin

You may keep your own records in the Platform. Records you keep there are yours, held at your direction, and you tell Opefin how long you need them. Opefin deletes or returns them when you tell it to, or when your access ends, unless the law requires it to keep them. Opefin will tell you directly if anything is going to end your access, including the arrangement between Opefin and your managed service provider ending, or your Order Form ending. You may ask Opefin directly for a copy of your own records within 30 days of that notice or of your access ending, whichever is later, and Opefin will not delete them while a request is outstanding. Where a managed service provider administers your use, that right survives the end of the arrangement between Opefin and that provider regardless of cause, as that agreement provides. Where you contract with Opefin directly, it survives the end of your Order Form, however it ends.

Opefin’s systems are not your statutory record. You remain responsible for keeping your own customer due diligence records for the period the law requires: at least 5 years in New Zealand, 7 years in Australia and whatever that country’s law requires elsewhere, in each case measured from the end of your business relationship with the client or the completion of the occasional transaction, and not from the date of a Verification Pack.

8. Our results are information

• A Verification Pack, the verification result and any output of an Opefin service are automated outputs produced by the Platform from the information available to it. They are information and automated signals for you to consider.
• They are not a professional opinion, a recommendation, advice, a decision about the person, or confirmation that you have met a legal requirement.
• You apply your own risk assessment and your own programme to what you receive, form your own view, and record your own decision. You must not treat a Verification Pack as the sole basis for that decision.
• Automated checks can be wrong. Where a result is unclear, you or your compliance provider review it, which may include comparing the facial image and the identity document image. That comparison, and the decision that follows, are yours. Opefin’s people do not review those images as part of a check and do not make decisions about a person’s checks. Their access to stored images is restricted to named individuals, is limited to operating, supporting and securing the Platform, investigating a suspected security or fraud incident, responding to a request or complaint from the person, and complying with the law, and is logged.
• Information that comes from lists, news sources, registers, banks and other third parties is passed on as Opefin receives it. Opefin takes reasonable care and corrects its own record when it learns of an error.

9. Privacy law

• You must comply with the privacy law that applies to you, including the Privacy Act 2020 in New Zealand and the Privacy Act 1988 (Cth) and the Australian Privacy Principles in Australia.
• If no privacy law applies to you, or the law that applies does not provide protections comparable to those Acts, you agree to protect the information you receive in a way that, overall, provides comparable safeguards, and you agree to comply with the Australian Privacy Principles as if you were bound by them.
• You must handle any request from a person about the information you hold, under your own obligations and within the time your own privacy law allows. Pointing a person to Opefin does not discharge that obligation. Where a person asks you about information Opefin holds that you do not, or about how Opefin produced a result, you may also point them to privacy@opefin.com, and you tell Opefin within 5 working days so that it can respond in time.

10. Fees

Where a managed service provider administers your use. You pay your managed service provider under your agreement with it. Opefin charges your managed service provider under its own agreement with Opefin. Nothing in these terms creates a payment obligation between you and Opefin.

Where you contract with Opefin directly. Your Order Form sets out the fees you pay Opefin, what each one covers and when it is due. Opefin invoices you under the Order Form, and the Order Form applies if it and these terms differ on a fee.

11. Our responsibility to you

• Opefin will provide the Platform with reasonable care and skill, and will comply with the law that applies to it in doing so. Beyond that, and to the extent the law allows, the Platform is provided as it is.
• To the extent the law allows, Opefin is not responsible for your decisions, for how you meet your own obligations, for an act or omission of a third party data source, or for a loss arising from information you or a person gave that was incorrect.
• To the extent the law allows, Opefin’s total liability to you under or in connection with these terms, whether in contract, tort, statute or otherwise, is limited to the greater of NZ$10,000 and the following amount for the 12 months before the claim arose: where a managed service provider administers your use, the amount you paid that provider for Opefin services; and where you contract with Opefin directly, the amount you paid Opefin. In either case the limit is no more than NZ$75,000 in total. That is a figure you can calculate from your own records.
• Neither party is liable to the other for indirect or consequential loss, including loss of profit, revenue, anticipated savings, business or data.
• These limits do not apply to fraud, wilful misconduct, death or personal injury caused by negligence, or any liability that cannot lawfully be limited. Nothing in these terms limits a right under consumer or privacy law that cannot be excluded.
• You indemnify Opefin against loss arising from your negligent or wilful breach of section 3, 4, 5, 6 or 9, from a confirmation or certification you gave under section 3 that was untrue or misleading when you gave it, from your use of the Platform other than as these terms allow, or from your misrepresenting Opefin’s role. This indemnity covers loss Opefin suffers directly and loss arising from a claim, complaint, investigation or regulatory action brought against Opefin, including the reasonable cost of responding to one. It does not cover loss to the extent Opefin caused or contributed to it, or that Opefin could reasonably have avoided. Opefin must tell you promptly of anything it may claim for, must let you take over the conduct and settlement of any third party claim, must not settle one without your agreement, and must take reasonable steps to keep the loss down.

12. Suspension and ending

Opefin may suspend your access immediately if there is a security incident, if it reasonably suspects fraud, or if a regulator requires it. In any other case, including where Opefin reasonably believes the Platform is being used in a way that breaches these terms or the law, Opefin will tell you first and give you 10 working days to put it right before suspending. Where it is practical to do so, Opefin will suspend only the user or the function concerned rather than your whole business. Opefin will tell you the reason as soon as it can, so far as the law allows, will restore access once the issue is resolved, and will keep your own records available to you to read and export throughout any suspension.

These terms end when your Mandate is revoked or the arrangement between Opefin and your managed service provider ends, or, where you deal with Opefin directly, when your Order Form ends or your account is closed. Sections 4, 5, 7, 8, 9, 11 and 15, the ownership and restriction provisions in section 13, the notices and severability provisions in section 14, and anything else that by its nature should continue, survive, including what Opefin owes you in return under section 4. Your right to use the Platform under section 13 does not survive. Opefin’s right to change these terms does not survive, and your indemnity under section 11 ends three years after these terms end.

13. Licence and intellectual property

For as long as these terms apply to you, Opefin grants your business a non-exclusive, non-transferable, revocable right to use the Platform, and to use a Verification Pack you receive, for the purpose for which you requested the information, your own records, your dealings with the person it concerns and, where you have anti-money laundering obligations, your own customer due diligence. Your authorised users may use the Platform on your behalf on the same basis, and you are responsible for what they do. The right ends when these terms end.

You may not sublicense, sell, rent or otherwise make the Platform available to anyone else, other than to a managed service provider or compliance provider acting for you as section 4 describes. You may not copy, modify or create anything derived from the Platform, reverse engineer, decompile or disassemble it or attempt to derive its source code, use it to build a competing product or service, or remove or obscure any notice of ownership on it. You may not use automated means to extract data from the Platform beyond the functions Opefin makes available to you.

Opefin, or its licensor, owns the Platform and everything in it, including the software, the data models, the way a Verification Pack is structured and presented, the Opefin name and marks, and every improvement to any of them. Nothing in these terms transfers any of that to you, and no right is granted by implication. Opefin reserves everything this section does not expressly grant.

What is yours is not affected. The information in a Verification Pack you receive is the person’s information, which you hold and use as these terms allow. The records you keep with Opefin under section 7 are yours. Nothing in this section gives Opefin any right in your business information, your client files or anything you upload, which section 4 governs.

14. Changes, notices and general

The current version of these terms is published at opefin.com/legal, and that version applies to you from time to time. Any copy given to you with a Mandate, an Order Form or an Online Order is a convenience copy of the version current at that date, and Opefin will give you a copy of the version you accepted on request.

Opefin may change these terms. A change that does not materially disadvantage you, such as a correction, a clarification, updated contact details or a schedule for a further country, takes effect when Opefin publishes it at opefin.com/legal. Any other change takes effect on at least 30 days’ written notice, sent to you directly and, where a managed service provider administers your use, also through that provider. A change required by law, by a regulator, or by the operator of a data source as a condition of Opefin’s continued access to it, takes effect immediately and only to the extent that requirement needs, and Opefin tells you as soon as it reasonably can.

Opefin may not change section 4, or the Opefin Source Schedule, without your written agreement, unless the change is one the paragraph above describes as required by law, by a regulator or by the operator of a data source. Opefin may not change section 11, or this section, without your written agreement in any circumstances. If any change materially disadvantages you, you may end these terms within 60 days of the notice, by revoking your Mandate, by ending your Order Form or by closing your account, whichever applies to you, whether or not the change has already taken effect.

Notices go to the contact details in your Mandate, Order Form or Online Order, and to privacy@opefin.com for privacy matters. If a provision is unenforceable, the rest continues. These terms do not create a partnership, joint venture, agency or fiduciary relationship.

15. Governing law

These terms are governed by the laws of New Zealand, and the parties submit to the non-exclusive jurisdiction of the courts of New Zealand. If your business is in Australia, the mandatory protections of Australian law that apply to you are not affected, and Opefin applies the Australian Privacy Principles to the information it holds about Australian consumers whatever its size.

16. Independent advice

You confirm that you have taken, or have had the opportunity to take, your own independent legal advice on these terms and on your own obligations, and that you do not act on any statement by Opefin, or by any managed service provider acting for you, as legal advice.

Schedule: Opefin Source

This schedule applies where your Mandate or Order Form records that you use Opefin Source. Opefin Source is the Opefin service for businesses with anti-money laundering obligations. It packages information from a person’s Opefin Passport and adds the checks you ask for. Each Opefin service has its own schedule in this form, and these terms are unchanged when one is added. A service’s schedule carries that service’s own conditions and exclusions, and these terms do not promise any service’s results.

S1. What Opefin Source adds

S2. How you use it

• You set your own risk settings, and you choose whether ongoing checks are switched on and for whom. Both are your responsibility, and Opefin does not advise on either or prompt you about them.
• Every output of Opefin Source is information and an automated signal for you to consider, on the terms in section 8 of these terms. Any suggested next step is a suggestion, and you decide.
• You review anything unclear, or have your compliance provider review it, and you record your own decision.
• Where the Platform prepares a draft report for you in connection with your own reporting obligations, it does so solely on your instructions. Opefin holds it in confidence for you, does not use it for its own purposes, and does not disclose it to the person or to anyone else except you or as the law requires. You alone decide whether to make a report, and you make it.

S3. Information about other people

Documents about companies and trusts, and source of funds documents, can name other people, such as directors, beneficiaries or the other party to a sale. You must have the authority to provide them, and you must use what you receive about those people only for your own customer due diligence and records. You give a person named in a document Opefin’s Consumer Consent Disclosure Notice, in the wording Opefin provides, and Opefin may also contact them itself where it can.

S4. Records and retention

Opefin holds list check results, source of funds documents and its analysis with the person’s Opefin Passport, for the periods its consumer-facing privacy documents set out, because each of those is Opefin’s own output about the person. The initial risk score and any review notes are different: they are prepared to your risk settings for your own assessment, so Opefin holds them only as your record, at your direction under section 7 of these terms. Opefin does not show that material to the person, does not include it in anything the person receives, and does not vary what the person sees according to it. Where a person asks Opefin for it, Opefin passes the request to you and tells the person it has done so, and you decide what you may release under your own obligations. Do not ask Opefin to pass any of it to a person for you. They are not part of the person’s Opefin Passport, are never made available to another business through the Opefin Network, and are not used by Opefin for its own purposes. Your own record keeping obligations are unchanged.