1. Compliance Overview
Nevoxe Pay operates at the intersection of cryptocurrency and enterprise payments, an area subject to rapidly evolving regulatory requirements across multiple jurisdictions. We approach compliance not as a checkbox exercise, but as a core business function that protects our merchants, their customers, and the integrity of the financial system.
Our compliance program addresses:
- Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF)
- Know Your Customer and Know Your Business (KYC/KYB)
- Sanctions screening and enforcement
- FATF Travel Rule implementation
- European Union Markets in Crypto-Assets (MiCA) framework
- General Data Protection Regulation (GDPR) and equivalent privacy laws
- Payment Services Directive (PSD2) and analogues
- Information security standards (ISO 27001 alignment)
2. Licensing & Registration
Nevoxe Pay is committed to obtaining and maintaining all required regulatory authorizations to operate as a Virtual Asset Service Provider (VASP) in the jurisdictions where our services are offered.
2.1 VASP Registration
We operate pursuant to applicable VASP registration and licensing requirements. Where VASP registration is mandatory in a jurisdiction in which we actively market services, we obtain registration prior to operating. Our current registration status is updated in the table below.
| Jurisdiction | Registration Type | Status |
|---|---|---|
| European Union | VASP Registration / MiCA Authorization (pending) | In Progress — targeting Q4 2026 |
| United Kingdom | FCA Cryptoasset Business Registration | In Progress |
| International Operations | Voluntary compliance with FATF VASP Guidance | Active |
2.2 Operating Within Licensing Boundaries
We actively monitor which services we may offer in each jurisdiction based on current licensing. Where a specific service requires a license we do not yet hold, that service will be geofenced until authorization is obtained.
3. MiCA Readiness
The European Union's Markets in Crypto-Assets Regulation (MiCA), which came into full effect in December 2024, establishes a comprehensive framework for crypto-asset service providers (CASPs) operating in the EU. Nevoxe Pay is actively preparing for MiCA authorization.
3.1 Applicable MiCA Services
Our services implicate the following MiCA CASP categories:
- Execution of orders for crypto-assets on behalf of clients
- Providing transfer services for crypto-assets on behalf of clients
- Custody and administration of crypto-assets on behalf of clients (treasury wallets)
3.2 MiCA Readiness Actions
- Legal entity review and EU establishment for MiCA passporting
- White paper preparation for relevant crypto-asset offerings
- Governance structure updates to meet MiCA organizational requirements
- Capital adequacy assessment
- Enhanced AML/CTF controls aligned with MiCA and AMLD6
- FATF Travel Rule implementation for all qualifying transfers
4. KYC / KYB Framework
Our identity verification framework applies tiered controls proportional to risk. Full details of our KYC/KYB procedures are described in our AML Policy. Key compliance features:
- Automated Identity Verification: Document authenticity checks, liveness detection, and biometric matching via certified third-party providers.
- Ultimate Beneficial Ownership (UBO): For corporate merchants, we identify and verify all beneficial owners holding 25% or more before enabling full transaction capabilities.
- Ongoing Monitoring: Periodic re-verification and continuous sanctions/PEP screening throughout the merchant lifecycle.
- Trigger-Based Reviews: Significant changes in transaction behavior, beneficial ownership, or adverse media trigger enhanced review.
5. Data Protection Compliance
Nevoxe Pay processes personal data in accordance with the General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and equivalent privacy frameworks. Our compliance measures include:
- Lawfulness, fairness, and transparency in all data processing
- Data minimization — collecting only what is necessary for specified purposes
- Defined retention schedules aligned with regulatory requirements
- Data subject rights framework (access, erasure, portability, objection)
- Data Protection Impact Assessments (DPIAs) for high-risk processing activities
- Standard Contractual Clauses (SCCs) for international data transfers
- Data processing agreements with all sub-processors
- Encryption of personal data at rest and in transit
Our full privacy practices are described in our Privacy Policy. Our Cookie Policy describes our use of cookies and tracking technologies.
6. Security Compliance
We operate a multi-layered security architecture aligned with industry best practices and relevant standards. Our security controls include:
- Secrets Management: All production secrets are stored in a dedicated secrets management system with automated rotation, access auditing, and short-lived credentials. No secrets are stored in code repositories or configuration files.
- Encryption at Rest: All production databases and sensitive storage volumes are encrypted at rest using industry-standard full-volume encryption.
- Transport Security: TLS 1.2 or higher is enforced on all external endpoints. HTTP Strict Transport Security (HSTS) is enabled with a long max-age directive.
- Access Control: Role-based access control (RBAC) is applied throughout the platform. All privileged access requires multi-factor authentication (MFA). The principle of least privilege is enforced at all layers.
- API Security: All API access is authenticated. Server-to-server integrations use cryptographic request signing. Admin interfaces are additionally restricted by network-layer access controls.
- Intrusion Detection & Monitoring: Continuous monitoring of authentication events, network traffic, and file integrity across all production systems. Automated alerting on anomalous behavior.
- Backup & Recovery: Encrypted backups of all critical data are taken daily and stored securely. Restore procedures are tested regularly.
- Vulnerability Management: Regular automated scanning of production systems and dependencies. Critical findings are remediated within defined SLAs. Annual third-party penetration testing.
We maintain a responsible disclosure program. Security researchers who identify vulnerabilities are encouraged to contact security@nevoxepay.com.
7. Audits & Assessments
Nevoxe Pay conducts the following compliance assessments:
- Annual AML/CTF Program Review: Independent assessment of our AML controls, risk ratings, SAR procedures, and staff training.
- Annual Penetration Test: Third-party security penetration testing covering network, API, and application layers.
- Quarterly Vulnerability Scanning: Automated scanning of all production container images and dependencies.
- Ongoing Blockchain Analytics Review: Continuous automated transaction monitoring with quarterly human review of alert quality and model calibration.
- Ad Hoc Compliance Reviews: Triggered by regulatory changes, significant business changes, or incident findings.
Merchants requiring compliance attestations or audit reports for their own due diligence should contact compliance@nevoxepay.com. We may provide security questionnaire responses, compliance summaries, and regulator letters upon request.
8. Merchant Compliance Obligations
By integrating Nevoxe Pay, merchants accept shared responsibility for the integrity of the payments they process. Merchants are required to:
- Maintain their own KYC/AML programs for their end customers where required by applicable law
- Not process funds from sanctioned persons or prohibited jurisdictions
- Promptly respond to compliance information requests within stated timeframes
- Notify Nevoxe Pay of any regulatory inquiry, legal hold, or law enforcement contact related to transactions processed through our platform
- Maintain records of the business purpose of all payment flows for audit purposes
- Not use our infrastructure to circumvent AML/CTF controls or as a layering mechanism
Failure to meet these obligations may result in account suspension, enhanced monitoring, or termination. We may also be required to file regulatory reports regarding non-compliant merchant activity.
9. Regulatory Updates
The regulatory landscape for virtual asset service providers is evolving rapidly. Nevoxe Pay monitors regulatory developments in key jurisdictions and updates its policies, systems, and procedures accordingly. We subscribe to regulatory guidance from:
- Financial Action Task Force (FATF)
- European Banking Authority (EBA)
- European Securities and Markets Authority (ESMA)
- Financial Crimes Enforcement Network (FinCEN)
- UK Financial Conduct Authority (FCA)
- Relevant national FIUs and supervisory authorities
Material regulatory changes affecting our services will be communicated to merchants via email and the in-platform compliance notice center.
10. Compliance Contact
For compliance inquiries, regulatory correspondence, due diligence requests, or to report potential violations:
- Compliance Team: compliance@nevoxepay.com
- Legal Team: legal@nevoxepay.com
- Data Protection: privacy@nevoxepay.com
- Security & Fraud: security@nevoxepay.com
Law enforcement agencies seeking records or assistance should submit formal requests through our Law Enforcement Request process. Contact legal@nevoxepay.com for process documentation.