PAID

Last reviewed: 2026-10-30

Anti-money-laundering summary

This is a short public summary of the financial-crime controls PAI'D runs today. It lists what the software does, and it says plainly what is not built yet.

Where PAI'D sits in a payment

PAI'D holds no money-transmitter licence, and it is built not to need to touch customer money. A merchant connects a Stripe account through PAI'D, and card payments are charged on that merchant's own Stripe account. Stripe accepts the payment, holds the funds and pays them out to the merchant's bank under its own licences. PAI'D's fee is taken by Stripe within the same charge. PAI'D does not hold balances for anyone, does not pool funds, and does not pay anyone out of its own account.

Card payments through Stripe are the only payment method PAI'D offers today.

Because Stripe is the licensed party that moves the money, Stripe also runs its own checks on cardholders and on the merchant's account. The controls below are PAI'D's own, and sit alongside Stripe's.

Knowing our merchants

Before a merchant can take live payments:

  1. Second factor on the account. Every merchant account must set up a second factor before reaching the dashboard.
  2. Business and owners. The merchant tells us its legal entity and declares its beneficial owners. Those details, the representative's identity and the business identifier are sent to Stripe, and Stripe verifies them. A merchant cannot take live payments until Stripe has enabled charges on its account.
  3. Sanctions screening. We screen the business and its beneficial owners against the US Treasury's OFAC sanctions lists (see below).
  4. Payout bank. Where a merchant links its payout bank account through Plaid, Plaid confirms the account and its holder.

Sanctions screening

  • The list must be loaded. In production the service refuses to start unless the OFAC sanctions feed is configured. The list is refreshed on a schedule.
  • At onboarding. A merchant and its beneficial owners are screened before they are admitted.
  • On every charge. Each card payment screens the merchant again before the charge goes through. If the screening service cannot give an answer, the charge is refused. A strong match blocks the charge, and a weaker match is sent for human review.
  • Buyers on PAI'D's own checkout. When a buyer pays through PAI'D's own checkout page, the payment is refused if the billing country is under a US embargo. A buyer name is required, and it is screened before the charge in the same way.
  • Every day after onboarding. Accounts that are already live are screened again on a schedule, and production refuses to start with this switched off. A strong match puts the account on hold. The hold is never lifted automatically: a person must review it. A weaker match opens a case for review.
  • Other government lists (UN, UK, EU) can be added to the same engine, but OFAC is the only list production requires today.

Watching transactions

Every completed payment is checked against monitoring rules that each merchant starts with:

  • a single payment of $10,000 or more goes to review;
  • five or more payments in an hour go to review;
  • more than fifty payments in an hour raise an alert.

Completed payments also feed a rolling total per payer, which is used to find possible structuring: several smaller payments that add up past a reporting threshold. Matches go to a review queue.

These rules detect; they do not block. A payment that triggers a rule has already gone through, and the rule creates a record for a person to review. A failure in monitoring never stops a payment.

Records

Screening results and alerts are kept, and security and payment events are written to an append-only, hash-chained audit log that the database refuses to edit or delete. Retention periods for screening and onboarding records are not set in code yet (see our Data Governance summary).

Not in place yet

  • Not every buyer is screened by PAI'D. Buyers are screened only on PAI'D's own checkout page. When a merchant sends buyers to a Stripe-hosted payment page, the buyer is checked by Stripe, not by PAI'D.
  • Enhanced due diligence is not enforced by the software. There is no coded list of high-risk industries or countries that forces extra checks before a merchant goes live.
  • No automated filing. Suspicious-activity reports are not filed by the software. Review and any filing are done by a person.
  • No independent review. One person runs PAI'D today, so the same person handles alerts and runs the service. No outside auditor has reviewed this program.

Questions about this summary, or to report a concern: security@trustfabric.ai