Compliance Reviews

Compliance Reviews

A Compliance Review is the unit of work for advancing an Organization's KYC standing on the Mural platform. Before an Organization can transact, it must complete at least one Compliance Review to establish a verified identity Tier.

Mural supports two types of Compliance Reviews. You choose which one to create based on how the underlying Organization was set up:

• Individual Compliance Reviews — used when the Organization represents a single person operating in their own capacity. Required attestations cover that individual's identity and residency.
• Business Compliance Reviews — used when the Organization represents a legal entity (LLC, corporation, etc.). Required attestations cover the business itself plus its associated persons: every beneficial owner holding 10% or more (up to ten) plus one control person.

The accepted review type is based on the type of the Organization. A business Organization will not be able to create an Individual Compliance Review and vice versa.

Lifecycle

1. Create the review. Choose the review type and the Tier you want for the Organization. The review starts as a draft and lists the attestations it requires. An Organization has one review per Tier and type.
2. Upload attestations. Attestations are saved immediately; re-uploading an attestation type replaces the previous instance, so you can apply corrections before submitting. Some uploads will expand requiredAttestations (see the Attestations section below), so re-read the review after each call. Uploads are accepted while the review is in draft or submissionValidationsFailed.
3. Resolve submission validation failures. Mural validates each attestation. A blocking failure must be fixed by uploading the attestation again. A warning can be acknowledged when you submit.
4. Submit the review. The Organization must have a signed Mural agreement on file. Once submitted, the review is in the Mural compliance team's queue, and the team approves or rejects it.
5. Track the outcome. Follow the review's status through the webhook or by reading the review. If the team needs more information, they raise a request for information, and the review returns to the queue once you answer it.

Attestations

An Attestation is a grouped set of related KYC data submitted as part of a Compliance Review - for example, an individual's personal information (name, date of birth, nationality) or a business's formation documents. Each Compliance Review specifies exactly which attestations are required for the requested Tier via the requiredAttestations field on the review.

requiredAttestations is not necessarily exhaustive at create time. Some attestations are conditionally required based on data you upload - for example:

• Business Organizations that report transmittingCustomerFunds: true on the businessOperations attestation will see businessFlowOfFundsDocument added to requiredAttestations after that upload.
• Individual Standard reviews where the applicant's residential address is in the EEA or the UK, or where individualFinancialInfo.transactionCurrencies includes EUR, will see individualProofOfAddress added to requiredAttestations.
• Individual Standard reviews where the applicant's residential address is in the EEA (not the UK) will see individualEeaInfo added after the individualResidentialAddress upload.
• Individual Standard reviews where the applicant's residential address is in Argentina will see individualSelfiePhoto added after the individualResidentialAddress upload.
• Individual Standard reviews where individualFinancialInfo.monthlyUsdVolume is anything other than the lowest band will see individualSourceOfFunds added.

Re-read the review with the get Compliance Review endpoint after each upload to see the current effective requiredAttestations.

Review statuses

Upgrading between tiers

Tiers are ordered within each review type, and higher tiers supersede lower ones once approved:

• Individuals: STANDARD supersedes LIGHT.
• Businesses: FULL supersedes US_STANDARD.

To upgrade, create a new Compliance Review at the higher tier and follow the same four-step flow.

Tiers

Individual Tiers

Light

Lightweight KYC requiring an individual's name, date of birth, phone number, and residential address (nationality is optional). Submitted as the individualPersonalInfoLight attestation.

Light enables a subset of Mural's LATAM rails with transaction limits configured per parent organization. Light tier is gated per parent organization: contact Mural to enable Light for your parent organization and to configure transaction thresholds before attempting to create a Light review. Otherwise, creating a Light review returns 403.

Standard

Full individual KYC: personal info, contact info, residential address, identity document, financial info, and tax info. Proof-of-address and source-of-funds are added conditionally based on residency and declared monthly volume (see the Attestations section above).

Standard unlocks all supported individual payment rails with no transaction threshold.

Business Tiers

US Standard (tier: US_STANDARD)

USD-only KYB with a reduced document set — no beneficial-owner ownership documents and no proof-of-address documents required at either the business or associated-person level. Enables USD payment rails for businesses that do not need international offramp support.

US Standard is gated per parent organization: contact Mural to enable it before creating a US_STANDARD review. Otherwise, creating one returns 403.

Full (tier: FULL)

Full KYB with the complete document set, including beneficial-owner ownership documents and proof-of-address (both at the business level and per associated person). Unlocks Mural's international offramp providers in addition to everything US_STANDARD enables.

A business approved on US_STANDARD can upgrade to FULL by creating a new Compliance Review at the FULL tier.