Security and compliance
How we are regulated today, what our programme covers and which standards we work to.
Regulatory position
Royal Payment Solutions, LLC does not hold a banking, e-money, payment institution or money transmitter licence, and it does not hold, receive or transmit customer funds. RoyalPay will only go live with a licensed partner that issues the accounts and cards and holds the funds, under that partner’s supervision and a written agreement with it. If our role ever requires a licence or registration of our own, for example as a money services business with FinCEN, we will obtain it before doing that work.
AML, BSA and KYC programme
Adopted on 27 September 2026 and approved by the managing member. It is written to the US Bank Secrecy Act and the USA PATRIOT Act, and it will sit alongside the programme of the licensed partner.
Read the full KYC policy- Risk assessment
- At least once a year: customer types and locations, products, channels and transaction patterns. Higher risk gets enhanced due diligence.
- Customer identification
- Name, date of birth, address, an identification number and a government photo ID, verified by documents or reliable databases. No anonymous or fictitious accounts.
- Beneficial owners
- For companies, every owner of 25% or more and one controlling person are identified and verified.
- Sanctions screening
- Against the OFAC SDN list, the EU consolidated list, the UK Sanctions List and the UN Security Council list, held locally and refreshed every day, at onboarding and again for every customer after each update.
- Ongoing monitoring
- Unusual patterns, high-risk countries, structuring and sudden changes in volume, plus periodic review of customer information.
- Reporting
- Suspicious activity is reported to FinCEN when required, generally within 30 days of detection, and will be escalated to the partner under the programme agreement.
- Records
- Identification data, transaction records and reports are kept for at least five years.
- Training and testing
- AML training for relevant staff at least once a year, and periodic independent testing of the programme.
Our KYC promise
Strong customer checks keep fraud and financial crime away from our customers and their money. They are not a cost we try to minimise. They are part of the product.
-
Verified before money moves
No account receives or sends a cent until identity is verified and the partner has approved the customer.
-
Four official sanctions lists, every day
Every applicant is screened against the OFAC, EU, UK and UN lists, which we download and refresh daily, and every customer is screened again after each update.
-
A person decides every match
A potential match is never cleared by a machine. A compliance officer compares the details, decides and records the reason.
-
More risk, deeper checks
Politically exposed persons and higher-risk customers go through enhanced due diligence, including source of funds and wealth, before anyone approves them.
-
No anonymous accounts, ever
One customer, one verified identity, one file. We do not open accounts for third parties who stay in the background.
-
The stricter rule wins
Where the partner’s requirements are stricter than ours, the partner’s requirements apply. Where the law changes, the stricter version applies until our policy is updated.
-
Records you can audit
Every check, decision and reason is kept for at least five years after the relationship ends and can be produced for the partner or a supervisor on request.
-
Tested every year
An independent review tests the policy and how we apply it at least once a year. Findings and fixes are shared with the partner.
Standards we work to
Where a standard applies to the licensed partner rather than to us, we build the product so the partner can meet it.
| Area | Reference | How we apply it |
|---|---|---|
| AML and counter-terrorist financing | US Bank Secrecy Act, USA PATRIOT Act, FATF Recommendations | Our written programme, described above. In the EU and the UK we also follow the partner’s programme under the EU AML rules or the UK Money Laundering Regulations. |
| Sanctions | OFAC, EU, UK and UN sanctions regimes | Our own screening against the official lists at onboarding and after every daily update, plus the partner’s screening service once live. Every potential match is reviewed by a person. |
| Data protection | GDPR, UK GDPR, California CCPA/CPRA | Data minimisation, access, export and deletion on request, and no advertising or analytics cookies. |
| Payment services | EU PSD2 and e-money rules, UK PSRs and EMRs, US state money transmission laws | Regulated activity is carried out by the licensed partner. We will act as its technology provider under a written outsourcing agreement. |
| Card data | PCI DSS | We do not store full card numbers or security codes. Card data stays with the issuer and its processor. |
| Information security | ISO/IEC 27001 and OWASP ASVS as a reference, not certified | Encryption in transit, two-factor login, a strict content security policy, hashed API keys, rate limiting and audit logs. |
Governance
Policies are approved by the managing member, reviewed at least once a year and updated when the law or the product changes.
- AML, BSA and KYC compliance programme, version 1.0
- Privacy policy and terms of service
- Information security controls, described in the Trust Center
- Audit trail of every administrative action, kept for two years
- Independent legal review of all documents, scheduled before launch
Questions about security or compliance?
Our compliance team answers questions from customers, journalists, authorities and business contacts.