Mexiwin Requires Full KYC on Any Withdrawal and Its Privacy Policy Never Says How the Documents Are Kept

Mexiwin's KYC and Privacy Policy describes a risk-based approach with three levels of checks: simplified due diligence for extremely low-risk transactions, customer due diligence as the standard, and enhanced due diligence for high-risk customers, large transactions or special cases. On top of those levels, the page sets three triggers for the full KYC process and lists exactly what each document must show.

• Any withdrawal triggers full KYC. "Separately and in addition to the above, when a user makes an aggregate lifetime total of deposits exceeding EUR 5,000 or requests a withdrawal of any amount on Website, or attempts to or completes a transaction that is deemed suspicious, then it is compulsory for them to complete the full KYC process." The first withdrawal, however small, is the point at which the documents are needed.
• Three uploads, each with its own checks. A government-issued photo ID that is signed, valid for a minimum of 3 months and belongs to someone over 18, a bank statement or utility bill issued less than 3 months ago with the name identical to the ID, and a selfie holding the same ID. An ID close to expiry or a bill older than 3 months fails the check, whatever else is in order.
• A restriction right that does not need a check to be running. "We reserve the right to restrict the service, payment, or withdrawal until identity is sufficiently determined, or for any other reason in our sole discretion based on the legal framework." The Company also reserves the right to ask for any KYC documentation it deems necessary, at any time. The policy sets no time limit on a check, and the second half of the sentence allows a restriction after identity is settled.
• Where the ID was issued counts, not only where the player lives. Both the ID's issuing country and the country of residence must not be Austria, France, Germany, the Netherlands, Spain, the Union of Comoros, the United Kingdom, the USA, an FATF-blacklisted country or any other jurisdiction prohibited by the Anjouan Offshore Financial Authority. A player living in an allowed country on a French, German or British passport fails the identity step on the document alone.
• A failed check comes with a reason. "If the KYC process is unsuccessful, the reason is documented and a support ticket is created in the system." The ticket number and an explanation are sent to the user, and the account is approved once all proper documents are received. A refusal arrives in writing with a ticket number the player can cite.
• No privacy terms in the privacy policy. The page contains no clause on how personal data is stored, for how long, who it is shared with, or how a player can see, correct or delete it. The selfie and bank statement it requires are collected under a policy that does not say what happens to them next.

As a KYC procedure the page is short and specific: three triggers, three documents, a written reason on failure. As a privacy policy it is empty, and the documents it asks for are a photo ID, a selfie with that ID and a bank statement.