Compliance & AML

This statement describes how ScarabPay Business approaches financial crime prevention. It is a statement of posture and controls, not a certification, and nothing in it should be read as one.

Our position in the chain

We are not a bank and we hold no banking licence. Cards are issued through licensed issuing partners, who are themselves regulated and who carry programme-level obligations. We operate the platform that sits between our merchants and those partners.

That means compliance here is layered. Our merchants are responsible for their own customers. We are responsible for our merchants. Our issuing partners are responsible for the programme, and they impose requirements on us that we pass through.

Know Your Business

Before a merchant can move money we verify:

• the legal existence of the business and its registration details;
• its beneficial owners and controlling persons;
• the identity of the individuals authorised to operate the account;
• the nature of the business, and whether it is one we are permitted to serve.

Verification documents are stored on private storage and are not publicly reachable. We may re-verify at any time, and we may suspend activity while we do.

Cardholder identity

Where a card is issued to an individual, identity details required by the issuing partner are collected and stored encrypted at rest, and transmitted to that partner as part of the issue request. Merchants remain responsible for verifying their own customers to the standard their regulator and ours require.

Sanctions screening

We do not knowingly onboard, or continue to serve, any person or entity subject to applicable sanctions, and we do not serve businesses operating in sanctioned jurisdictions. Screening obligations also sit with our issuing partners, whose programme requirements we apply.

Where a match is identified we may freeze activity immediately and without notice, and we may be legally prohibited from telling the affected party why.

Monitoring and record-keeping

• Every movement of money is recorded as balanced double-entry legs in an insert-only ledger. Entries are never edited or deleted; corrections are posted as new entries. This means the transaction history is reconstructable rather than merely current.
• Actions that change money or status are written to an insert-only audit trail with the acting user, retained for 365 days.
• Automated watchdogs re-derive wallet balances against ledger entries hourly and alert on drift, and a separate sweep detects transactions stuck mid-saga every ten minutes.
• Prohibited activity is defined in the Acceptable Use Policy and is enforced by suspension or termination.

What is not in place

We would rather list these than let their absence be inferred from silence:

• We hold no SOC 2, PCI DSS, or ISO 27001 certification.
• No third-party penetration test has been commissioned.
• A named compliance officer and the associated contact address are published here once company registration completes.

Reporting a concern

To report suspected misuse of the platform, use the contact form with the topic set to support. Reports are reviewed by a person, and reports of suspected financial crime are escalated internally rather than answered with a template.