Compliance and security · trust passport
Everything a bank, an auditor or a careful client would ask us.
Public registry data, the operating model and the policies a bank, an auditor or a careful client would ask about. Licensing details are available on request. Partner names are not published.
- Legal entityPT Global Payment Gateway · NIB 2412240053279
- Not a bankno deposits, no interest, no lending
- KYC / KYBon every client, once
What we are, and what we are not
We are
- ✓A payment agent: we pay your invoice or collect your receivable on your written instruction, under an agent agreement
- ✓A company that verifies every client and every beneficiary before money moves
- ✓The sender of record on bank transfers, which is why they arrive
We are not
- ×A bank: we hold no deposits, pay no interest and lend nothing
- ×A trading platform or a wallet: we convert only to execute your payment, and hold USDT only until the transfer is sent
- ×An investment service: nothing here is advice, and crypto assets are volatile
Partners
We do not publish partner names. Partners are licensed in their jurisdictions and are disclosed to banks, regulators and clients under agreement where the law requires it.
AML and KYC programme
A summary of the policy. The full policy is available to partners under NDA and to regulators on request.
Verification tiers
Individuals: government ID, liveness check, address, and for enhanced limits the source of funds. Companies: registry extract, directors, beneficial owners above 25%, nature of business, and the person acting for the company.
Screening
Clients, beneficiaries and senders against OFAC, EU, UK HMT and UN lists, PEP and adverse-media sources, at onboarding and on every payment. Incoming crypto scored by a blockchain analytics provider; high-risk exposure is declined.
Monitoring
Rules on velocity, structuring, unusual beneficiaries and mismatches between invoice and payment. Alerts are reviewed by an analyst, and periodic reviews refresh client profiles.
Record keeping
Client files, invoices, screening results, transaction hashes and bank confirmations are kept for at least five years after the relationship ends, encrypted, with access logged.
Reporting
Suspicious activity is reported to the competent authority of the operating jurisdiction. We do not tip off, and we cooperate with lawful requests.
Travel rule
Originator and beneficiary information is exchanged with counterpart VASPs where the rule applies, and USDT is accepted only from addresses whose owner we can identify.
What we decline
Declined at the quote stage where we can, and at compliance where we must. We do not route around restrictions through third countries or third parties.
- ×Sanctioned persons, entities, vessels and jurisdictions; see the country list
- ×Weapons, dual-use goods and anything requiring an export licence we cannot verify
- ×Gambling, adult content, drugs and precursors, counterfeit goods
- ×Unlicensed financial services, shell companies without substance, nested payment agents
- ×Payments on behalf of anonymous third parties, or invoices we cannot match to the client
- ×Crypto from mixers, darknet markets, sanctioned trading platforms or addresses with high-risk exposure
Safeguarding and segregation
- ✓USDT received for payments goes to dedicated settlement wallets, separate from company treasury
- ✓Fiat for client payments and collections moves through dedicated settlement accounts, not operating accounts
- ✓Daily reconciliation of wallets, bank accounts and open orders; discrepancies block payouts until resolved
- ✓Client funds are never lent, staked or used for company expenses
- ✓Reserves for refunds held in cold storage under multi-signature control
Security
Account security
Two-factor login, device confirmation, session limits, and a 24-hour cooling period for new payout addresses.
Roles and approvals
Business accounts assign roles; payments above a limit need a second approver. Every action is logged with who, when and from where.
Keys and reserves
Settlement wallets under multi-signature control; reserves in cold storage; withdrawal whitelists on all treasury accounts.
Data
Documents encrypted at rest and in transit, hosted in the EU, with access restricted to compliance staff and logged.
Testing
Independent penetration test before launch and annually; findings tracked to closure. Planned before launch.
SOC 2
On the roadmap: a Type I report targeted for the first year of operation, Type II after.
Incidents
A written incident response plan; clients affected by an incident are informed within 24 hours; the status page records every incident.
Responsible disclosure
Security researchers can report issues to security@arkipopay.com. We acknowledge within two business days; the full disclosure policy is available on request.
Complaints
Write to complaints@arkipopay.com or use the “Raise a complaint” button in any order. We acknowledge within two business days and give a final answer within fifteen, with the reasons and the evidence we relied on.
If you disagree with the answer, you can escalate to the compliance officer, and, where the operating jurisdiction provides one, to the external dispute scheme named in the final answer.
Legal documents
Published versions carry a date; previous versions are available on request. The agent agreement and the tariff annex are provided during KYB.
For banks and partners
Request the due-diligence pack: policies, ownership, flow of funds.
Request the DDQ pack
Banks, auditors and partners can request the due-diligence pack: policies, ownership structure, flow of funds and corporate documents. Tell us who you are and what you need; we reply within one business day.