1. Our commitment
Tuppence AI Ltd, which operates Tuppence, is committed to preventing its platform from being used to launder money, finance terrorism, evade sanctions or commit fraud. We do not knowingly do business with anyone involved in these crimes, and we close accounts and report concerns when the law requires it.
2. How responsibility is shared
Tuppence is software. We do not hold our customers’ money or move it ourselves. The regulated payment services on Tuppence are provided by Stripe, Inc. and the banks it works with, which is subject to anti-money laundering and sanctions law in its own right and runs its own checks on every business that uses Tuppence.
We add our own controls on top of Stripe’s, because we choose which businesses to onboard, set their limits and see how they use Tuppence. Those controls are designed around the standards in the UK’s Money Laundering Regulations 2017, the US Bank Secrecy Act and the sanctions programs of the Office of Foreign Assets Control (OFAC).
3. A risk-based approach
We assess the money laundering, terrorist financing and sanctions risks of the businesses we serve, the countries they are in, the products they use and how they take payments. We serve only businesses registered in the United Kingdom and the United States. The checks we run, the limits we set and how closely we watch an account depend on that assessment, and we review it as our products and the threats change.
Some businesses carry too much risk for us to serve at all, and others only with our written approval. They are listed in sections 3 and 4 of our Acceptable Use Policy, which follows our payment processor’s and the card networks’ restrictions.
4. Knowing our customers
Anyone can explore Tuppence in test mode, which never moves real money. Before a business can take live payments:
- we collect its legal details and those of the people who own a quarter or more of it or otherwise control it, and its directors or representatives;
- its representatives verify their identity with a photo ID and a selfie through Stripe Identity;
- Stripe verifies the business and the people behind it as part of its own checks;
- we confirm what the business sells and that it is not on our prohibited list;
- a person at Tuppence reviews the account before its first payout, and can ask for more information or documents, or decline the business.
Until that review is done, a new business can take only a limited amount of live payments and receives no payouts. Payouts go only to a bank account in the business’s own name.
5. Sanctions
We do not knowingly deal with anyone who is the target of sanctions imposed by the United Kingdom (including those administered by the Office of Financial Sanctions Implementation), the United Nations, the European Union or the United States (including those administered by OFAC), or with anyone owned or controlled by them. We do not serve businesses located in, or organized under the laws of, a country or region subject to comprehensive sanctions.
Stripe screens businesses and the people behind them against sanctions lists when they onboard and on an ongoing basis. We run our own screening as well: we check every business, and the people who own, control or represent it, against sanctions lists and lists of politically exposed people when they give us their details, whenever those details change, and every week. A person at Tuppence reviews every possible match. If a business or one of its owners matches a sanctions list, its account may be restricted while the match is reviewed and, if it is confirmed, the account may be closed, funds frozen and the match reported to the relevant authority, as the law requires.
6. Ongoing monitoring
We keep watching accounts after they open. Our systems look for signs of money laundering and fraud, including card testing, payments that don’t fit the business’s stated activity, sudden changes in volume, high refund or dispute rates, payments from the business’s own cards, frequent changes of payout bank account, and accounts linked to ones we have already closed. Account limits grow only with a clean trading history. When something looks wrong, we can pause payments, hold payouts, keep a reserve, freeze cards or close the account, as our Terms of Service describe.
7. Suspicious activity
Anyone who works for us must report any knowledge or suspicion of money laundering, terrorist financing or a sanctions breach to our director straight away. Our director decides whether to report it to the authorities, and shares it with Stripe where appropriate. Telling the person concerned that a report has been made, or is being considered, can be a criminal offense, so we may not be able to tell a business why we have acted on its account.
8. Records
We keep the records we collect to verify a business, and the decisions we make about it, for at least five years after the business relationship ends, and our financial records for seven years. These records are encrypted and access to them is restricted and logged. Our Privacy Notice explains how we handle them.
9. Our people
We aim to train everyone who reviews businesses or handles accounts on this statement, the signs of money laundering, fraud and sanctions evasion, and how to report a concern, when they join and when our controls change. Our Whistleblowing Policy protects anyone who raises a concern in good faith.
10. Responsibility and review
Our director is responsible for our financial crime controls, receives internal reports of suspicion and aims to review this statement and the risk assessment behind it at least once a year. Questions about this statement can be sent to contact@tuppence.ai.
11. About this statement
This statement describes our approach for information only. It is not a contract and does not form part of our Terms of Service. It gives no promise, warranty or guarantee to anyone: our controls, and Stripe’s, reduce the risk that Tuppence is misused for financial crime, but no controls can remove it, and we are not responsible for crimes committed by others. Nothing in it limits the steps we may take under our Terms of Service. We may change our controls and this statement at any time.