Originator information verification not validly performed before transfer

Mittenda's documents treat originator details as verified because the customer was verified at onboarding, and nothing shows a check of those details before each transfer leaves.

What should happen

Risk that the originator's PSP or originator's CASP dispatches a transfer without having validly established the accuracy of the Article 4(1) / 14(1) (and, where applicable, Article 4(3) / 14(3)) originator information before transfer, on the basis of documents, data or information obtained from a reliable and independent source. This may arise by omission, partial scope, non-reliable / non-independent source, stale evidence, late timing, wrong-record matching, failed-treated-as-passed gating inversion, missing audit trail, wrong-actor allocation (direct debit).

What we found

The duty. Before a transfer leaves, Mittenda must check the originator details it sends against a reliable and independent source. Failing looks like a transfer released with no such check on record.

What was searched. The wording of Articles 4(4) and 14(6), checks against a reliable and independent source, release gating, verification records and how the originator fields are filled. Documents held against it: MTD-STD-04, MTD-POL-01, MTD-STD-01, MTD-PRC-01, MTD-PRC-02, MTD-TEC-01.

What the documents show.

MTD-STD-04 Transfers Standard §3.5 — treats the details as verified once onboarding checks are done. A deeming clause does not show a check before the transfer.
MTD-POL-01 AML/CTF Policy §6.2 — verifies the customer's identity at onboarding. That is the customer check, not a check of what each transfer carries.
MTD-STD-01 CDD Standard §4.1 and §4.3 — sets the accepted sources and requires verification before the first transaction. Neither applies to later transfers.
MTD-PRC-01 Payments Procedure §11.4 — fills the originator fields from the Garnet account record. No step checks those fields before release.
MTD-TEC-01 Design Note §3.1 to §3.2 — the record holds a verified legal name beside a customer-set display name. Osprey receives changes overnight. The text does not say which name is sent.
MTD-PRC-02 Crypto Procedure §7.5 — releases transfers under dual control. The release steps name no check of originator details.
MTD-POL-01 §6.4 — keeps verification records under another policy. No record links a transfer to the evidence relied on.

Omitted sections are not charged: MTD-PRC-01 §11.1 to §11.2 and §12, MTD-PRC-02 §1 to §6, MTD-STD-04 §5 and Appendix A, MTD-TEC-01 §4 to §5.

Finding. The documents state the arrangement on paper through the onboarding route. Nothing shows a check of originator details before each transfer.

What it means

The accuracy of the originator information accompanying the transfer is not established against a reliable and independent source before dispatch. This defeats the assurance the Article 4(4) duty exists to provide, and reduces the integrity of downstream AML/CFT monitoring, sanctions screening and investigation by the beneficiary's PSP, intermediaries and competent authorities.
Supervisors and internal audit cannot evidence that pre-transfer verification was performed on a reliable-and-independent basis. This is so even where the verification may in fact have been performed.

Documented, not evidenced

Where the evidence falls short

A different control does run 1
Points at another document 2
Right act, wrong moment 2
Describes the act, leaves out a step 3
Misses for another reason 1

Examined

4 October 2026, against the 12 registered documents

Accepted by Demo User, 4 October 2026

Accepted on a debug-capture host, where the run or its caller may accept findings itself, so this is not necessarily a reviewer's decision.

Revise this finding

Opens Evidence findings, where decisions are made.

The risk

The evidence

Document	Why it falls short	Words
These passages show a control that does run. It is not the one this risk needs.
The document treats this as handled by pointing at another document, so it shows nothing itself.
The right act, at the wrong point in the lifecycle.
The document sets out what happens and leaves out a step the duty requires. Nothing excludes it; the document simply never mentions it.
Does not fit the patterns above. Each one says why.