KYB submission

Owner/Admin members with fresh MFA membership can GET /portal/merchants/{merchant}/kyb/submission for the current saved draft version, active document references, missing structural fields and any submitted snapshot. POST the same path with draft_version, the complete documents array of {id, version}, and an Idempotency-Key to submit. Browser calls use the session/CSRF BFF. Finance, Support, Developer and foreign merchants cannot access this evidence.

Submission JSON is bounded at 16,384 bytes before parsing at both BFF and API, including requests without Content-Length. Oversized bodies return 413.

The local checklist requires a saved draft, legal name, business type, address, director name/identifier and at least one READY document. Every active attachment must be ready and included. These are sandbox structural checks; they do not establish legal KYB eligibility. Business-specific required identifiers, beneficial ownership and documentary/screening rules require the production compliance policy.

Submission verifies the displayed profile/document versions under the merchant lock. Unseen profile edits, uploaded or removed documents, and changing readiness versions return 409. The exact normalized request under the same key replays the original result after rechecking current access. A changed request under the same key conflicts. Initially a merchant has one submission; additional review/revision workflows follow in the next increment.

The SUBMITTED snapshot freezes the profile, original document metadata and private encrypted objects. Later draft edits or removal cannot change it. Authorized members can preview submitted images at /portal/merchants/{merchant}/kyb/submission/{submission}/documents/{document}/content, even after removing them from the editable draft. Only documents belonging to that merchant’s submission can be read there. Draft removal remains immediate for the ordinary draft preview. The portal explains retained submitted evidence explicitly.

Submission payloads are authenticated-encrypted with merchant/submission binding, and audit contains only action, opaque IDs and version metadata. No public object URLs, source filenames or raw identifiers are logged. SUBMITTED does not approve a business, run sanctions/PEP screening or activate live mode. Staff queue/review, information requests, messages and resubmission follow. Use synthetic data only.