Compliance at Tuppence.

Who we are

Tuppence (tuppence.ai) is a payments platform for developers and AI agents, built on Stripe Connect. It is operated by Tuppence AI Ltd, a private limited company registered in England and Wales. The same company provides Tuppence to businesses in the United Kingdom and the United States.

Regulatory status

Tuppence is software. We do not process card payments, hold your money or issue cards ourselves, and Tuppence AI Ltd is not authorised by the Financial Conduct Authority as a bank, payment institution or electronic money institution. The regulated services are provided by Stripe:

You can check Stripe Payments UK Ltd’s details on the Financial Conduct Authority’s Financial Services Register.

Our agent tools (the API, MCP server, tool packs, agent identities and mandates) are software. They carry out actions within the keys, mandates and approvals a business sets. They do not provide financial or investment advice.

PCI DSS

Payers’ card data never touches our systems. Payers enter card numbers and security codes only into Stripe’s own fields, on our hosted pages or embedded in a business’s own checkout. We store only a token, the card brand and the last four digits. Tuppence cards’ details are shown to cardholders through Stripe’s own secure fields.

• This keeps Tuppence within the scope of SAQ A, the self-assessment questionnaire under the Payment Card Industry Data Security Standard for merchants and platforms that fully outsource card data handling.
• Stripe, which holds the card data, is certified as a PCI DSS Level 1 Service Provider, the most stringent level.
• AI agents connected to Tuppence must never collect a payer’s card number. Our Acceptable Use Policy makes this a rule.

Your balance and payouts

Money from your card payments is held in the balance of your Stripe connected account, not in a Tuppence bank account, until it is paid out to your bank. Stripe Payments UK Ltd safeguards those funds as the Electronic Money Regulations 2011 and the Payment Services Regulations 2017 require. Safeguarded funds are not covered by the Financial Services Compensation Scheme.

As risk controls, payouts start once a person at Tuppence has reviewed your account, and funds from your first week of payments settle on T+7. New accounts start with limits on payments and payouts and a rolling reserve, which ease as the account builds a clean trading history. We or Stripe may also hold payouts where the risk calls for it. Your limits and any hold are shown in your dashboard. See our Terms of Service.

Financial crime and KYC

We use Stripe’s checks and our own to keep Tuppence free of financial crime. The full approach is in our Anti-Money Laundering and Sanctions Statement.

• Know your business. Before a business can take live payments, we collect details of the business and the people who own and control it through our own forms, check them against Companies House, and capture identity documents and a selfie through Stripe Identity. We keep an encrypted copy of these records for at least five years after the relationship ends.
• Human review. A person at Tuppence reviews every business before its first payout, and can ask for more information, hold payouts or decline the business.
• Sanctions and politically exposed people. Stripe screens businesses and the people behind them against sanctions lists as part of its own checks. We run our own screening too: every business, and the people who own, control or represent it, is checked against sanctions lists and lists of politically exposed people when they onboard, whenever their details change, and every week, and a person at Tuppence reviews every possible match. We refuse any business that is, or is owned or controlled by, a sanctioned person or that operates in a comprehensively sanctioned territory.
• Monitoring. We watch for unusual activity, such as card testing, spikes in refunds or disputes, linked accounts and cashback farming, and can hold payouts, freeze cards or close accounts.
• Prohibited businesses. We don’t serve the businesses on the prohibited list in our Acceptable Use Policy, which follows our payment processor’s and the card networks’ restrictions.
• Accountability. Our director is responsible for our financial crime controls and is the person our team reports suspicions to.

We or Stripe may ask you for information or documents from time to time to keep the payment system safe.

Certifications

Stripe and Google Cloud hold their own certifications, which they publish. These cover their services, not Tuppence.

Data protection

We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We host Tuppence on Google Cloud in the europe-west2 region (London). Tuppence AI Ltd is the controller of the personal data we collect about the businesses that use Tuppence and their people.

Our Privacy Notice explains what we collect, why, how long we keep it, who our sub-processors are and your rights. For data protection questions, email contact@tuppence.ai. Our security page explains how we protect your data.

Complaints

Our complaints procedure explains how to raise a complaint and how long we aim to take to respond.

Complaints about Tuppence’s own services can’t be referred to the Financial Ombudsman Service, because Tuppence is not authorised by the Financial Conduct Authority. Complaints about payment services or cards provided by Stripe Payments UK Ltd can be, by eligible complainants, once Stripe has given its final response. The complaints procedure explains who is eligible.

Our policies

• Anti-Money Laundering and Sanctions Statement
• Anti-Bribery and Corruption Policy
• Modern Slavery Statement
• Whistleblowing Policy
• Acceptable Use Policy, including the prohibited and restricted businesses list

About this page

This page is a summary, for information only. It describes our set-up and controls as they are on the date below, and they may change. It is not a contract, and it does not give any promise, warranty or guarantee: in particular, our controls reduce the risk of fraud and financial crime but cannot remove it. Our relationship with your business is governed only by our Terms of Service and the documents they refer to.

---

Last updated 8 October 2026. For regulatory questions, email contact@tuppence.ai or contact us.