FANN is committed to the highest standards of legal and regulatory compliance. Our programme spans AML/KYC controls, data protection law, financial services regulation, and art market due diligence — protecting every buyer, seller, and stakeholder on the platform.
Last Updated: April 2025
Anti-Money Laundering & Know Your Customer
FANN operates a tiered KYC programme designed to meet global AML standards. Tier 1 (basic identity verification) applies to users transacting below USD 2,500 and requires government-issued ID and proof of address. Tier 2 (enhanced due diligence) applies to cumulative or single transactions between USD 2,500 and USD 50,000, requiring source-of-funds documentation and a short compliance interview. Tier 3 (institutional onboarding) governs transactions above USD 50,000 and involves full corporate due diligence, UBO identification, and ongoing monitoring. Identity verification at all tiers is conducted through our licensed third-party identity verification partner. Where required by applicable law, Suspicious Activity Reports (SARs) are filed promptly with the relevant Financial Intelligence Units.
General Data Protection Regulation (EU)
FANN processes the personal data of EU and EEA residents in strict compliance with the General Data Protection Regulation. We maintain a documented lawful basis for every data processing activity, have appointed a dedicated Data Protection Officer (DPO), and honour all data subject rights requests—including access, rectification, erasure, portability, and restriction—within 30 calendar days of receipt. Our Data Processing Agreement (DPA) is available upon request for business partners and enterprise clients. FANN adheres to the EU-U.S. Data Privacy Framework and equivalent Privacy Shield successor arrangements for international data transfers. Our data protection practices are subject to annual third-party audits to ensure continued compliance.
California Consumer Privacy Act
California residents are afforded enhanced privacy rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). These rights include: the right to know what personal information FANN collects, uses, and shares; the right to request deletion of personal information; the right to opt out of the sale or sharing of personal information; and the right to non-discrimination for exercising any CCPA rights. FANN does not sell personal data to third parties. All staff with access to personal data undergo annual privacy awareness training. To exercise your CCPA rights, submit a verifiable consumer request to privacy@fann.art or through our Privacy Centre.
Dubai & UAE Financial Regulation
FANN operates in compliance with applicable financial services regulations in the United Arab Emirates, including the frameworks administered by the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM). We conduct enhanced due diligence on all high-value transactions processed through our UAE-based entities and maintain compliance with the Financial Action Task Force (FATF) Recommendations as they apply to art market participants, including requirements for beneficial ownership transparency and risk-based customer monitoring.
Provenance & Due Diligence
FANN screens every artwork listed on the platform against the Art Loss Register, Interpol's Works of Art database, and the FBI Art Crime Team database prior to publication. Sellers are required to provide full provenance documentation for any artwork with a listing value above USD 10,000, including chain of title, export licences where applicable, and authentication records. FANN reserves the right to delist any artwork pending the outcome of a provenance review at any time, without liability to the seller. All provenance due diligence practices are subject to annual audit by an independent art law specialist.
OFAC / UN / EU Consolidated Lists
All users, counterparties, and transactions on the FANN platform are screened in real time against the U.S. Office of Foreign Assets Control (OFAC) Specially Designated Nationals List, the United Nations Security Council Consolidated Sanctions List, and the EU Consolidated List of Persons, Groups, and Entities Subject to EU Financial Sanctions. Screening is automated and powered by our licensed compliance technology partner. Any match triggers an immediate account hold and manual review by our compliance team. FANN will not process transactions involving sanctioned parties under any circumstances.
15+ Jurisdictions
Regulatory Coverage
ISO 27001
Certification In Progress
Licensed KYC Partner
Identity Verification
If you suspect fraudulent activity, money laundering, sanctions evasion, or the listing of a stolen or illicitly obtained artwork on FANN, please report it immediately. FANN takes all reports seriously and investigates them with strict confidentiality. Whistleblower protections apply to good-faith reports made through official channels. Our compliance team will acknowledge your report within two business days and provide a case reference number for follow-up.
FANN retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The table below summarises our primary retention periods.
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Transaction Records | 7 years | Legal requirement (AML/tax law) |
| Identity Documents (KYC) | 5 years after last transaction | AML regulation |
| Community Posts & Comments | Duration of account | Legitimate interest |
| Marketing Preferences | Until consent withdrawn | Consent |
| Server & Access Logs | 12 months | Security & fraud prevention |
| Support Correspondence | 3 years after resolution | Legitimate interest |
ISO 27001 Information Security Management
FANN is currently in the gap analysis and remediation phase of ISO 27001 certification. We expect to complete our Stage 1 audit in Q3 2025 and receive full certification by Q1 2026.
SOC 2 Type II
A SOC 2 Type II audit covering Security, Availability, and Confidentiality trust service criteria is planned for the second half of 2025, conducted by an accredited independent auditor.
Quarterly Internal Reviews
Our compliance team conducts quarterly internal reviews covering AML/KYC effectiveness, data protection controls, sanctions screening accuracy, and provenance due diligence procedures. Findings are reported to the Board Compliance Committee.