Compliance Statement

NexliPay is an orchestration layer sitting between a merchant and the processor accounts that merchant owns. We route, retry and reconcile. We are not the merchant of record, we do not aggregate unrelated merchants under a single account, and we do not introduce third-party volume into anyone’s account.

That distinction is the whole basis of our compliance posture. Every account we touch was underwritten by its processor for the business that owns it, and it stays that way.

LEGAL ENTITY NAME is REGULATORY STATUS — e.g. registered as a Small Payment Institution / authorised as an API / not currently regulated because it does not hold client funds with REGULATOR under reference LICENCE OR REGISTRATION NUMBER.

State this accurately and narrowly. Describing yourself as “licensed” without naming the licence, the regulator and the reference number is itself a regulatory problem, and it is the first thing an acquirer’s compliance team will check.

• Customer due diligence on every merchant before activation: identity, business registration, beneficial ownership above UBO THRESHOLD, and source of funds where risk indicates.
• Enhanced due diligence for high-risk categories, high-risk jurisdictions and politically exposed persons.
• Sanctions and PEP screening at onboarding and on an ongoing basis against SANCTIONS LISTS.
• Transaction monitoring for structuring, velocity anomalies, mismatched descriptors and volume inconsistent with the underwritten business model.
• Suspicious activity reporting to FIU / NCA / FinCEN by our nominated officer, MLRO NAME.
• Records kept for 5 years from the end of the relationship.

We operate to Visa Core Rules and Mastercard Standards as they apply to third-party service providers. In particular we enforce the prohibitions on transaction laundering, factoring and merchant account sharing, and we monitor dispute ratios against scheme thresholds so that merchants are pulled back before they enter a monitoring programme.

Where required we are registered with the schemes as a third-party agent under TPA REGISTRATION DETAILS.

Accounts that fail review are not connected. Merchants already connected are re-screened REVIEW FREQUENCY and on any material change. We offboard where we find undisclosed ownership changes, category drift into prohibited goods, evidence of third-party processing, or dispute rates that breach scheme limits after remediation.

NexliPay does not store, process or transmit full card numbers or CVV data. Cardholder data remains within the PCI DSS environments of your connected processors, and we operate against tokenised references. Our current PCI scope and validation status is PCI DSS SAQ TYPE / AOC REFERENCE, assessed ASSESSMENT DATE.

• Compliance is owned by COMPLIANCE OFFICER NAME, reporting to REPORTING LINE.
• Policies are reviewed at least annually and after any material regulatory change.
• Staff complete AML and financial crime training at induction and TRAINING FREQUENCY thereafter.
• Independent audit of the compliance programme is carried out by AUDITOR on a AUDIT FREQUENCY basis.

If you believe an account on our platform is being used for transaction laundering or any other financial crime, report it to compliance@nexlipay.com. Reports can be made anonymously and we do not retaliate against anyone who makes one in good faith.