Onboarding and Screening Systems

Purpose and scope

This document provides a technical description of the systems that carry out the verification record, the identity verification and the screening of XIP users. It serves as reference material for technical due diligence by partners, auditors and authorities.

At the implementation level, it complements the rules established in:

• KYC and EDD Policies and Procedures — what is required and why;
• AML/CFT Policy and Internal Procedures — the prevention controls and the division of responsibilities;
• Evidence of KYC Records — the verifiable proof of what is recorded and of the transaction block.

Architecture overview

Communication between all layers is encrypted in transit by TLS. Layer 2 is the only point through which verification data passes, and it delegates no control decision to the client.

Layer 1 — Mobile application

The application's verification module is organized as a navigation state machine, with a view model that holds the form and the status of the verification record, and dedicated screens for each step.

Screens of the flow

Controls performed in the application

• Structural validation of the CPF by the modulo 11 algorithm, with rejection of repeated sequences — an invalid CPF is never transmitted;
• Telephone validation for area code and national format, and e-mail validation for format;
• Blocking of advance on an incomplete step: each step requires its validations to pass;
• Consistency of the document set: changing the document type discards incompatible document images, preserving the facial image;
• Image compression on the device to JPEG, with a size budget distributed across the images and a minimum floor per image to preserve legibility;
• Masking in diagnostic logs: sensitive identifiers appear truncated in the application's technical logs — the CPF, for example, is logged only by its last digits;
• Automatic filling of the e-mail from the already confirmed account, reducing discrepancies in the verification record.

Layer 2 — API

The API exposes four verification operations, all authenticated and subject to the platform's security controls:

Relevant behaviors of the service layer

Layer 3 — Contracted provider

Identity verification proper and the screening are performed by the contracted provider, an authorized institution subject to the competent regulation and supervision. The integration takes place through an API authenticated by XIP's own credentials, transmitted in headers and kept in protected configuration, outside the source code.

The contracted provider is responsible, as established by contract, for:

• the analysis of the identification document images, as to authenticity, legibility and integrity;
• the liveness check and the comparison between the facial image and the photograph on the document;
• the validation of the CPF and the checking of the identification data against official databases;
• the screening against restrictive and sanctions lists — United Nations sanctions, applicable international sanctions and national restriction lists;
• the classification as a politically exposed person (PEP), including representatives, family members and close associates;
• the verification decision, with the reason recorded in the event of rejection;
• the custody of the identification documents for the legally required periods;
• the monitoring of settled operations and the analysis of alerts;
• the reporting of suspicious operations to the competent authorities.

XIP receives from the provider the result of these checks, not their inputs: neither the analyzed images nor the detail of the queries against the lists come back for storage at XIP.

Layer 4 — Administrative panel

The administrative panel is used by authorized XIP personnel for customer support and compliance. Its control characteristics:

• its own authentication, distinct from that of end users, with password reset through a dedicated flow;
• granular roles and permissions: access is assigned by function, applying the principle of least privilege, and is checked on the server on every request;
• lookup of users and of operations for customer support purposes, without the ability to alter the result of an identity verification;
• absence of access to identification documents: as the images are not stored by XIP, there is no screen, export or query that displays them to internal operators.

End-to-end flow

Screening: what is checked and where

Security controls of the pipeline

Screens of the onboarding process

The screenshots below document the screens actually presented to the user during the verification flow. The data shown is from a demonstration environment.

Video demonstration

The recordings below demonstrate the actual end-to-end process, in a demonstration environment, allowing the behavior of the system to be verified without requiring access to the platform.

Additional recordings and guided demonstrations in a controlled environment may be requested at compliance@xip.cash.

Environments and availability

Version history