Security - policies, architecture, breach procedures, external review, GDPR compliance, hosting structure, cryptography.
Compliance - proove registration with different compliance bodies, proof of insurance (professional indemnity AND cyber), AML measures, KYC measures, proof of purchase of monitoring systems..
Identity - provide information on ALL directors and shareholdeing structure, provide proof of address and identity of 2 of them, name a company signatory and provide proof of identity and address for him as well.
And more and more... took us 2 months just to compile all the information in endless back-and-forth email conversations.