Compliance and security · trust passport
Everything a bank, an auditor or a careful client would ask us.
Public registry data, the operating model and the policies a bank, an auditor or a careful client would ask about. Licensing details are available on request. Partner names are not published.
- Legal entityPT Global Payment Gateway · NIB 2412240053279
- Not a bankno deposits, no interest, no lending
- KYC / KYBon every client, once
Trust passport
Legal entity record
The public registry record of the company behind Arkipo. Copies of every document are available for your due diligence.
December 13, 2024
SWIFT BMRIIDJAUSDEURCNYIDR
Telegram @arkipopay
We are
- A payment agent: we pay your invoice or collect your receivable on your written instruction, under an agent agreement
- A company that verifies every client and every beneficiary before money moves
- The sender of record on bank transfers, which is why they arrive
We are not
- A bank: we hold no deposits, pay no interest and lend nothing
- A trading platform or a wallet: we convert only to execute your payment, and hold USDT only until the transfer is sent
- An investment service: nothing here is advice, and crypto assets are volatile
Who are our partners?
Our own bank and licensed conversion partners. Partner names are not published; they are disclosed to banks, regulators and clients under agreement where the law requires it.
How does the AML and KYC programme work?
A summary of the policy. The full policy is available to partners under NDA and to regulators on request.
Verification tiers
Individuals: government ID, address, and for enhanced limits the source of funds. Companies: registry extract, directors, beneficial owners above 25%, nature of business, and the person acting for the company. Checked by our desk.
Sanctions-list checks
Clients, beneficiaries and senders are checked against OFAC, EU, UK HMT and UN lists at onboarding and before every payment. USDT is accepted only through our conversion partners, from addresses whose owner we can identify.
Review before sending
Unusual amounts, new beneficiaries and mismatches between the invoice and the payment are reviewed by the desk before anything is sent; client profiles are refreshed periodically.
Record keeping
Client files, invoices, check records, transaction hashes and bank confirmations are kept for at least five years after the relationship ends, with access limited to the people who need them and logged.
Reporting
Suspicious activity is reported to the competent authority of the operating jurisdiction. We do not tip off, and we cooperate with lawful requests.
Travel rule
Originator and beneficiary information is exchanged with counterpart VASPs where the rule applies, and USDT is accepted only from addresses whose owner we can identify.
What do we decline?
Declined at the quote stage where we can, and at compliance where we must. We do not route around restrictions through third countries or third parties.
- Sanctioned persons, entities, vessels and jurisdictions; see the country list
- Weapons, dual-use goods and anything requiring an export licence we cannot verify
- Gambling, adult content, drugs and precursors, counterfeit goods
- Unlicensed financial services, shell companies without substance, nested payment agents
- Payments on behalf of anonymous third parties, or invoices we cannot match to the client
- USDT from mixers, darknet markets, sanctioned platforms or addresses whose owner we cannot identify
How are client funds safeguarded?
- USDT legs settle through our licensed conversion partners, not through company wallets
- Fiat for client payments and collections moves through dedicated settlement accounts at Bank Mandiri, not operating accounts
- Daily reconciliation of bank accounts and open orders; discrepancies block payouts until resolved
- Client funds are never lent, staked or used for company expenses
- Client funds are held only until the transfer is sent; reserves for refunds are kept apart from operating funds
How is security handled?
Instructions
Orders are accepted only from the contacts named in your agreement; new payout details are confirmed through a second channel before the first payment.
Approvals
Payments above a limit need a second person on our desk; every instruction and change is logged with who and when.
Settlement addresses
Addresses for USDT legs are agreed in writing with the conversion partner and sent only in the order thread you already know.
Data
Client documents are kept in access-controlled storage, separate from the website, and shared only with the people who process your order and, where required, with the bank or regulator.
Incidents
A written incident response plan; clients affected by an incident are informed within 24 hours by email and Telegram.
Responsible disclosure
Security researchers can report issues to security@arkipopay.com. We acknowledge within two business days.
How do complaints work?
Write to complaints@arkipopay.com or use the “Raise a complaint” button in any order. We acknowledge within two business days and give a final answer within fifteen, with the reasons and the evidence we relied on.
If you disagree with the answer, you can escalate to the compliance officer, and, where the operating jurisdiction provides one, to the external dispute scheme named in the final answer.
Which legal documents are published?
Published versions carry a date; previous versions are available on request. The agent agreement and the tariff annex are provided during KYB.
For banks and partners
Request the due-diligence pack: policies, ownership, flow of funds.
Request the DDQ pack
Banks, auditors and partners can request the due-diligence pack: policies, ownership structure, flow of funds and corporate documents. Tell us who you are and what you need; we reply within one business day.