This Acceptable Use Policy ("Policy") sets out the acceptable and prohibited use of the Duely platform. All Authorised Users representing a Subscriber (Firm) must comply with this Policy. By accessing Duely, you agree to follow these rules.

1. Fundamental Prohibited Conduct

You must NOT use Duely to:

facilitate, conceal, or aid money laundering, terrorist financing, fraud, or any other criminal or illicit activity;
store, upload, or transmit illegal, offensive, or grossly inappropriate content unrelated to legitimate compliance needs of the Firm;
knowingly input false, deceptive, or misleading information into verification workflows or screening tools;
request an identity check for an individual who has not been shown the collection notice and given express consent, or whose consent has been withdrawn;
use identity information, identity opinions, verification results or screening results to build a profile of an individual, to offer or market goods or services, to enrich any other database, or for market research;
attempt to obtain, derive or record the underlying result of any third-party or government verification check other than through the outputs the platform provides;
use identity verification or screening for any discriminatory, defamatory, abusive or otherwise harmful purpose, or in a way that infringes anyone's rights;
attempt to use identity verification or screening beyond, or to get around, the usage limits of the Firm's Subscription or the checks it has paid for, or in a way that places an unreasonable or disproportionate load on the platform or its providers;
request an identity check or screening for anyone other than a customer, prospective customer or associated party of the Firm for the Firm's AML/CTF customer due diligence, or an employee or contractor of the Firm for the personnel due diligence its AML/CTF program requires (for example, not for tenants, or people with no relationship to the Firm), or request a Document Verification Service check for anyone other than a customer or associated party; or
request identity checks from outside Australia or New Zealand, or contact Duely's verification providers or government agencies directly about a check, unless Duely has agreed in writing.

2. Integrity of Evidence and Data

Users must NOT:

deliberately falsify, tamper with, or manipulate verification records, identity documents, risk ratings, or screening results; or
attempt to alter or delete system-generated audit logs or Evidence Packs.

3. Account Sharing and Access

Security and attribution of actions matter in AML systems.

Individual credentials: Duely operates a "one account per individual user" policy. Login credentials must not be shared with personnel, contractors, or external parties.
Role limits: Users must not attempt to exploit vulnerabilities to exceed their authorised Role-Based Access Control (RBAC) permissions.

4. Tipping-Off and Circumvention

Section 123 of the AML/CTF Act 2006 (Cth) ("Tipping Off") makes it an offence to disclose that a Suspicious Matter Report (SMR) has been given or is required to be given, where the disclosure would or could reasonably be expected to prejudice an investigation, unless an exception in the Act applies. Users must NOT:

attempt to circumvent platform controls designed to restrict access to SMR data;
export, copy, or screenshot restricted SMR data to share with unauthorised parties, inside or outside the Firm; or
use the platform's communication features (if any) to disclose SMR-related information to the subject of the suspicion.

5. Security Violations

Users must NOT:

probe, scan, or test the vulnerability of the Duely system or network without express written permission (for example, sanctioned penetration testing);
attempt to introduce viruses, trojans, worms, logic bombs, or other malicious material to the platform; or
engage in denial-of-service (DoS) attacks against the platform.

Note: Security researchers acting responsibly are exempt from this restriction where they disclose findings to Duely at support@duely.com.au before any public disclosure, limit testing to their own account and data, and do not degrade the service for other users. This exemption does not extend to the systems of Duely's verification providers or to verification pages they host, which must not be probed, scanned or tested.

6. Consequences of Violation

A breach of section 1, 2, 4 or 5 of this Policy is a Serious Breach under the Master Subscription Agreement. For a Serious Breach, Duely may:

immediately suspend or terminate the relevant user account;
immediately suspend the Firm's subscription, and terminate it as clause 5.3(d) of the Master Subscription Agreement allows (immediately where the breach was deliberate or reckless, or has caused or is likely to cause a government agency or verification provider to restrict Duely's access, and otherwise if it is not remedied within five business days of notice); and
report any suspected criminal activity, deliberate falsification of compliance records, or terrorism financing facilitation to the relevant law enforcement or regulatory authorities (including AUSTRAC, AFP, or state police) as legally required or permitted.

Any other breach of this Policy is dealt with under the Master Subscription Agreement: Duely may suspend access if the breach is not cured within seven (7) days of written notice (clause 5) and may terminate under clause 5.3(c). Duely may also report suspected criminal activity for any breach, as above.

7. Governing Law

This Acceptable Use Policy is governed by the laws of Queensland, Australia.

8. Version History

2.2 (19 October 2026; for a Firm that accepted an earlier version, changes adverse to it take effect 30 days after Duely emails its administrator, and other changes on publication): sections 1, 4 and 5 updated; governed by Queensland law.
2.1 (19 August 2026): added the identity verification rules (consent, use of results, who may be checked, location of users).
2.0 (19 May 2026): revised policy.
1.0 (12 March 2026): first published version.

Acceptable Use Policy (AUP)