Compliance programme
Policy SET-CMP-001 · Programme charter · Version 0.1 (draft) · 2026-11-08
Draft These documents are a draft for review by counsel and adoption by SET's board (or sole manager). They are written to US Bank Secrecy Act and OFAC standards and to FATF and Swiss, EU and UK expectations, as a programme SET applies to every customer. They are not legal advice, and nothing here makes SET a bank, a money transmitter, a crypto-asset service provider or a financial intermediary. Each statement about a regulator or a provider cites its source and the date it was checked.
1. Why SET has its own programme
Simple Easy Transactions (SET) is software. Bridge holds the licences and provides the accounts, conversion, custody and payouts; SET onboards customers, instructs movements, and keeps the ledger. SET still carries its own obligations:
- By contract. SET's provider agreement requires SET to maintain an anti-money-laundering and counter-terrorist-financing programme, give the provider complete and accurate customer information, monitor its users, report suspicious activity to the provider, and provide a copy of the programme on request. SET is liable for losses caused by its own negligent monitoring.
- By law. OFAC sanctions bind every US person, whether or not regulated as a financial institution. Laws against money laundering (18 U.S.C. §§1956–1957) and against aiding terrorist financing apply to everyone.
- To its enterprise customers. A regulated platform (for example a Swiss financial intermediary affiliated to a self-regulatory organisation) must assess every service provider in its payment chain. SET's programme must stand on its own under that review.
2. Standing apart from customers' programmes
SET's programme does not rely on a platform's or merchant's programme to meet SET's obligations, and SET never represents that its programme meets a customer's own obligations. Concretely:
- SET verifies the platform itself (KYB), and each of the platform's merchants becomes SET's customer through its own verification. A platform's prior KYB of a merchant is information SET may consider, never a substitute.
- SET screens, monitors, investigates and reports under its own procedures and decision rights, whatever the platform decides.
- SET's suspicious activity decisions are SET's alone and are not shared with the platform where sharing would breach confidentiality (no tipping off).
- The platform keeps its own programme and its own regulatory reporting; SET's contract requires it to.
3. Document register
| ID | Document | Covers |
|---|---|---|
| SET-CMP-001 | This charter | Scope, governance, document control, implementation status |
| SET-CMP-010 | KYB policy | Businesses: platforms, merchants, Direct Deposit partners |
| SET-CMP-011 | KYC policy | Individuals: wallet users, payees, owners and control persons |
| SET-CMP-012 | Bridge KYB and KYC requirements | The provider's published requirements, quoted |
| SET-CMP-013 | Third parties | The provider's definitions of third parties, and SET's |
| SET-CMP-020 | AML/CTF programme | The five pillars: controls, officer, training, independent testing, customer due diligence; plus suspicious activity, Travel Rule and records |
| SET-CMP-030 | Sanctions and OFAC policy | Lists, screening, matches, blocking and rejecting, reporting |
| SET-CMP-040 | Prohibited and restricted activities | What SET never serves, and what needs enhanced due diligence |
| SET-CMP-050 | Monitoring and reporting standard | Alert scenarios, case handling, deadlines, the must-report calendar |
| SET-CMP-060 | Platform and merchant oversight | Due diligence on platforms, contract terms, downstream controls |
| SET-CMP-070 | Switzerland annex | Swiss AMLA, ordinances, SROs, MROS, SECO |
| SET-CMP-071 | Low-risk jurisdictions annex | EU, UK, Liechtenstein, Singapore, Canada, Australia, New Zealand |
4. Governance
| Role | Responsibility |
|---|---|
| Board (or sole manager) | Adopts the programme and each change; receives the Compliance Officer's report at least quarterly; sets risk appetite; provides resources |
| Compliance Officer (BSA/AML and sanctions) | Designated in writing by the board. Day-to-day compliance; owns the risk assessment, alert and case decisions, reports to the provider and authorities, training, and this register. Has direct access to the board and authority to suspend any customer or key |
| Operators | Run onboarding and monitoring under these procedures; escalate; never decide a suspicious activity report alone |
| Engineering | Builds and maintains the automated controls (Travel Rule enforcement, sanctions screening, alert rules, logs); changes to a control are reviewed by the Compliance Officer |
| Independent reviewer | Tests the programme each year (SET-CMP-020 §13) |
Until the board designates a Compliance Officer, the founder holds the role and no other duty overrides it. A material decision (onboarding a high-risk customer, clearing a potential sanctions match, filing or not filing a report, exiting a customer) is recorded with its evidence, reason and decision-maker.
5. Risk appetite
SET serves lawful businesses moving their own money and individuals receiving their own payments. SET has no appetite for: sanctioned persons or jurisdictions; the activities in SET-CMP-040's prohibited list; anonymous or nominee customers; shell banks; nested or payable-through use of SET by undisclosed third parties; and any customer that will not answer a request for information. SET has a limited appetite, subject to enhanced due diligence and written approval, for the restricted activities in SET-CMP-040 and for high-risk jurisdictions.
6. Implementation status (2026-11-08)
Honest status of each control, for customers' due diligence. "Automated" means enforced in code in production.
| Control | Status |
|---|---|
| Hosted KYB/KYC by the provider before any account opens | Automated |
| Travel Rule data on every movement; refusal when required data is missing | Automated (wallet-kit worker/lib/travel-rule.ts) |
| Unknown-sender detection and alert on Cash-Out Address payments | Automated |
| Payer naming for no-key merchants (saved payers, payer links) | Automated |
| Wallet ownership attestation from a signed identity token | Automated |
| New York refusal; Texas custody refusal | Automated for wallet and custody flows; KYB questionnaire for businesses |
| Platform-funds switch (platform never in the flow of funds by default) | Automated |
| Operator action log for every onboarding step | Automated |
| SET's own sanctions screening of customers, owners and counterparties against OFAC, UN, EU, UK and Swiss lists | To implement: vendor selection and daily re-screening (owner: Compliance Officer; target before the first live platform key) |
| Rule-based transaction monitoring (SET-CMP-050 scenarios) | Partly: events and ledger exist; scenario rules to implement |
| Blockchain analytics (wallet risk scoring) | To implement (vendor) |
| Case management and SAR decision log | To implement: until then, a restricted register kept by the Compliance Officer |
| Training programme and records | To implement at adoption |
| Independent review | To schedule within 12 months of adoption |
| Written designation of the Compliance Officer | Board action |
7. Document control
Each document carries an ID, version and date. The Compliance Officer reviews every document at least annually and on any material change in law, provider requirements, products or risk. Changes are approved by the board and recorded in the change log below. Superseded versions are kept for ten years.
| Version | Date | Change | Approved |
|---|---|---|---|
| 0.1 | 2026-11-08 | First draft for counsel review | Pending |
8. Open questions for counsel
- Whether any SET product, as built, requires SET's own registration as a money services business with FinCEN or a state licence (the programme is written to MSB standards in either case).
- Whether SET should file voluntary suspicious activity reports with FinCEN in addition to reporting to the provider.
- Data-sharing terms with platforms regulated outside the US (Swiss FADP, GDPR, UK GDPR) for KYC records and alerts.
- The written form of the provider's confirmations reported by the founder (SET-CMP-013 §4).