Identity verification terms

1. Why we verify you

ⓘ The law requires us to know who our customers are, and it keeps your money and account safe.

Xpat is operated by Remit2Any Inc. We and our regulated partners must follow US anti-money laundering law, including the Bank Secrecy Act (BSA) and its Customer Identification Program (CIP) rules. Those rules require us to collect and verify identifying information before you open an account or send money.

We also verify you so that we can:

• screen customers and transfers against sanctions lists, including those kept by the US Treasury’s Office of Foreign Assets Control (OFAC);
• prevent fraud, identity theft and account takeover — including someone opening an account in your name;
• set the transfer limits that apply to you; and
• meet the requirements of our banking and money transmission partners and of Indian law for India-side features.

2. What we collect

ⓘ Your basic personal details, your tax ID, and a photo ID with a live selfie — plus PAN and Aadhaar for India features.

For US features

• your full legal name, date of birth and residential address;
• your Social Security number (SSN) or Individual Taxpayer Identification Number (ITIN);
• a photo of a government-issued ID, such as a passport, driver’s license or state ID; and
• a selfie or short video so the provider can check that you are a live person and that you match your ID (a “liveness” check).

For India-side features

If you use features that involve Indian accounts or Indian regulations, we may also ask for your PAN (Permanent Account Number) and your Aadhaar details. Where possible these are fetched, with your permission, through DigiLocker, the Government of India’s official document service, rather than uploaded by hand.

We may also collect information about the device and network you use during verification, to help detect fraud.

3. Who does the checking

ⓘ Trusted identity providers check your details for us; our account providers may run their own checks.

We use specialist identity verification providers. They act on our behalf and under contract with us:

• Persona — verifies US customers, including SSN or ITIN, ID documents and selfie or liveness checks.
• HyperVerge — verifies identity for India-side features, including PAN, Aadhaar and DigiLocker.

Our regulated account providers may also verify you, because they must know their own customers too. Bivo Inc. provides the Cash Plus Account, and Cybrid provides the USD Wallet that is being retired. See Licenses & partners for details.

4. Your consent

ⓘ By verifying, you let us and our providers collect your details, share them with each other and check them against official records.

By starting verification, you authorize Xpat and the providers named above to:

• collect the information and images described on this page;
• share them with each other as needed to verify you, open and service your accounts, and meet legal obligations;
• check your information against government databases and other third-party databases used for identity, fraud and sanctions checks; and
• repeat these checks later where the law or our risk controls require it.

If you don’t give consent, we can’t verify you, and you won’t be able to use features that require verification.

5. Biometric data notice

ⓘ Your selfie and ID photo are used only to confirm your identity, by the provider doing the check.

The selfie, video and ID photo you provide may be used to create a facial geometry template — a form of biometric data — so the provider can compare your face with your ID and confirm that you are present.

This biometric data is processed by the verification provider (Persona or HyperVerge) only to verify your identity and prevent fraud.

Biometric and identity-verification information is retained only for as long as reasonably necessary for identity verification, fraud prevention, regulatory compliance and other legally permitted purposes, subject to applicable law and the retention policies of our identity-verification providers. Xpat does not create or independently store biometric or face-geometry templates; the selfie, liveness and face-matching checks are performed by Persona and HyperVerge, and you are shown the applicable biometric disclosure and asked for your consent before the selfie step. We may receive verification results, identity information, images, status information and risk signals as reasonably needed for identity verification, fraud prevention and compliance. Some US states give you specific rights over biometric data; see our Privacy Policy.

6. Your SSN and your limits

ⓘ Your SSN is always masked, and giving your full SSN raises how much you can send each day.

Your SSN is always shown fully masked in the app and in our communications.

How much you can send to India depends on what you’ve verified:

Other limits, such as those on a single transfer or on adding money from a linked bank, may also apply. The app shows the limits that apply to you.

7. Enhanced checks for high-value transfers

ⓘ For large transfers we may ask for documents showing where the money came from.

For high-value transfers, or where our risk checks call for it, we may carry out enhanced due diligence. This means asking for more information or documents — for example, proof of where your funds came from, the purpose of the transfer, or recent bank statements. These documents are collected securely through Persona.

We may hold, delay or decline a transfer until enhanced checks are complete.

8. What happens after you verify

ⓘ You’ll be approved, asked for more information, or declined — and we may not be allowed to tell you why.

• Approved — you can use the features that need verification, within your limits.
• More information needed — we or the provider couldn’t confirm everything. The app will tell you what to provide, such as a clearer photo or another document.
• Declined — we can’t open or keep the account or feature for you.

For legal and compliance reasons, we may not be able to tell you why a verification was declined or delayed. This is a requirement of the law, not a judgment about you.

9. Re-verification

ⓘ We may ask you to verify again later.

We may ask you to verify again — for example, if your ID expires, your details change, you ask for higher limits, we see unusual activity, or the law or a partner requires it. Until you complete re-verification, some features or limits may be paused.

10. Keeping your information accurate

ⓘ Give us true, current details and tell us when they change; support handles mobile and email changes.

You agree that the information you give us is true, complete and your own, and that you will keep it up to date. Using someone else’s identity or documents is fraud, and we will close the account and may report it.

For your security, you can’t change your mobile number or email address yourself. Contact support through in-app chat and they will verify you before making the change.

11. How long we keep it

ⓘ The law requires us to keep identity records for five years after your account closes.

The Bank Secrecy Act requires us to keep identity verification records for five years after your account is closed. Our partners and providers may have their own legal retention periods. After that, information is deleted or anonymized in line with our Privacy Policy.

Identity documents are shown in the app as verified; they are not available for download.

12. Your rights and questions

ⓘ You have privacy rights over this information, and you can ask us about it any time.

Depending on where you live, you may have rights to access, correct or delete your personal information, subject to the legal retention duties above. Our Privacy Policy explains these rights, including for California and Indian residents, and how to use them.

Questions? Chat with us in the app, email support@xpat.money, or call +1 866-421-4888.