Compliance
What we check, when, and why
Converting a digital asset into legal tender is a supervised operation. Rather than announcing “compliant” without showing anything, this page describes the controls we apply, the order they run in, and what they change for you.
- 5
- verification tiers
- 28
- open countries
- 9
- countries refused service
The verification tiers
The tier depends on the cumulative amount converted over a rolling 30-day window. It depends neither on how long you have been a customer, nor on the rail, nor on the country.
| Tier | Cumulative ceiling | What is required | Decision |
|---|---|---|---|
| 0 — Quote only | No deposit possible |
| Immediate |
| 1 — Light verification | €1,000 |
| About 2 minutes |
| 2 — Standard verification | €15,000 |
| About 12 minutes |
| 3 — Enhanced verification | €100,000 |
| 1 business day |
| 4 — Deep review | Case by case |
| Human review, no automation |
Ceilings are expressed in euros and converted at the daily rate for other currencies. Splitting a sum across several orders does not change the tier reached: the cumulative total is computed over the period, not per transaction.
What we ask for, and the exact reason
Every document requested serves a precise purpose. None is collected “just in case”: that would be a risk for you and a liability for us.
- Name, date of birth, nationality
- To compare your identity against sanctions and politically exposed person lists. Without a date of birth a homonym cannot be cleared and the block would last longer.
- Official identity document
- To establish that the person exists and that the declared information matches an authentic document. Automated reading checks the security features and the machine-readable zone.
- Liveness check
- To verify that the person in front of the lens is the one on the document, not someone holding up a photo. That is what stops a stolen document being used.
- Proof of address
- To establish the country of residence, which drives service availability, the rails on offer and the applicable regime. IP-based location is not enough and is often wrong.
- Source of funds
- To check consistency between the amounts converted and what you declared. Requested above the third tier, or earlier if chain analytics flags exposure.
- Payout beneficiary name
- It must match your verified identity. This is not a preference: paying a third party would mean executing a transfer for someone who was never verified.
The order of controls
Controls do not all run at the same moment. This order explains why an order can be accepted and then suspended later.
- 01
At account creation
Verification of the email address and phone number, screening of the declared name against sanctions and politically exposed person lists, check of the connection country.
- 02
At order creation
Check of the tier reached against the rolling cumulative total, rail ceiling check, validation of beneficiary detail formats, another country check.
- 03
On receipt of the deposit
Exposure analysis of the source address and the incoming transaction. This is where an otherwise ordinary order can flip into review: the risk comes from the funds, not from you.
- 04
Before the payout goes out
Fresh sanctions screening, verification that the verified name matches the destination account holder, Travel Rule checks where applicable.
- 05
Continuously, after the operation
Monitoring of structuring, acceleration and concentration patterns. Because sanctions lists are updated regularly, re-screening can happen after the fact.
Travel Rule
The obligation to make originator and beneficiary information travel with every transfer of digital assets.
The European regulation on information accompanying transfers of funds and certain crypto-assets requires originator and beneficiary data to move with the transfer between providers. Unlike bank wires, there is no threshold below which the obligation disappears.
Concretely: if your deposit comes from a platform, that platform must transmit your name with the transfer. If the information does not arrive, we have to obtain it before continuing — which can delay an order without any fault on your side.
If the deposit comes from a wallet you hold yourself, above a certain amount we must verify that the wallet is yours. Verification is by cryptographic signature of a message, not by a declaration of honour: it is faster and it tells us nothing beyond what is necessary.
The information transmitted is limited to what the text requires. It serves no commercial purpose and is shared with no third party other than the provider involved in the transfer.
Refusal of service by country
A geographic refusal is not a commercial preference: it is the application of a sanctions regime or of a risk finding.
The check runs before any page is rendered. A connection from a refused country gets an HTTP 451 response — unavailable for legal reasons — with the exact reason, rather than a not-found page. The check runs again server-side at order creation and before payout: the IP address alone is never authoritative.
| Country code | Exact reason |
|---|---|
| IR | International sanctions. |
| KP | International sanctions. |
| SY | International sanctions. |
| CU | International sanctions. |
| RU | Restrictive measures on digital asset services. |
| BY | Restrictive measures on digital asset services. |
| AF | Unacceptable money laundering risk. |
| MM | Unacceptable money laundering risk. |
| CN | Digital asset exchange services are prohibited there. |
What compliance forbids us from doing
An honest compliance page also says what will be refused to you, and what we are not allowed to explain.
- Paying a third party
- The beneficiary must be the verified customer. No exception, including for a family member or a joint account you do not hold.
- Explaining certain blocks
- Where a block stems from a suspicious activity report, the law forbids us from telling you. We then say a check is under way, and no more. That is not bad faith.
- Returning frozen funds
- A confirmed sanctions list match freezes the operation. We cannot return the funds without authorisation from the competent authority.
- Serving a sanctioned country
- No derogation is possible, whatever the amount, the length of the relationship or the quality of the file.
- Handling enhanced-anonymity assets in the Union
- The European framework requires providers to withdraw them from 1 July 2027. We do not offer them for conversion in the Union and we say so, rather than quietly dropping them.
The documents that govern
This page describes the practice. The documents below are the reference texts, versioned and dated.
- Anti-money-laundering policyRisk-based approach, screening, chain analytics, suspicious activity reporting, record keeping.
- Identity verification policyThe tiers, the accepted documents, refusal grounds and re-examination routes.
- Geographic restrictionsOpen, opening and refused countries, with the exact reason for each refusal.
- Regulatory statusRegistration status of the entity. No authorisation is claimed while none is held.
Frequently asked compliance questions
Why do I have to provide an identity document to sell my own crypto?
Because the operation does not stop at the sale: it ends with a transfer into the banking system. That move into legal tender is what triggers due-diligence obligations. Below the first tier verification stays light; above it, it becomes full.
Can the money be paid into my partner’s account?
No. The payout beneficiary must match the verified identity. Paying a third party would mean executing a transfer for someone who was never verified, which is precisely what the rules aim to prevent.
My order is blocked and nobody tells me why. Is that normal?
It is not normal, but it is sometimes unavoidable. Where a block stems from a due-diligence obligation, the law forbids us from detailing the reason. In every other case the reason is given to you and you can ask for a human review.
What happens if my name resembles a sanctioned person’s?
The order is suspended and an analyst compares distinguishing elements: date of birth, nationality, place. A cleared match releases the operation and is recorded, so the same false positive does not recur on every order.
Are you authorised or registered with an authority?
No, and we claim so nowhere. No regulator logo, no licence number, no “regulated” claim appears on this site. The day a registration is obtained, it will appear in the legal notice with the authority, the number and the public register verification link.
Do you keep my identity document forever?
No. Retention is five years from the end of the business relationship, imposed by anti-money-laundering rules, then deletion is automatic. We can neither shorten it at your request nor extend it on our own initiative.