Trust & Regulatory

Compliance from
day one.

We are building Bolrach the way a regulator would want it built. Real identity checks, sanctions screening on every party, and monitoring that never sleeps. While our own licenses are under review, we run in sandbox and test mode and move money through licensed partners. Compliance isn't a bolt-on here.

Identity verified before onboardingSanctions screening on every partyData kept in region
Canada
FINTRAC MSB
In progress
Nigeria
CBN Payment Solution
In progress
United States
FinCEN MSB + state MTLs
In progress
United Kingdom
FCA EMI authorisation
Planned
Bolrach runs in sandbox and test mode today.

Until our own licenses are granted, every bit of live money movement clears through licensed and regulated partner institutions. We do not hold customer funds on unlicensed rails. The statuses on this page reflect exactly where each application actually stands. No rounding up.

Licensing

We go through the front door in every market.

Every market we enter, we enter by registering with the regulator, filing our program, and passing review before real money moves. Here is honestly where each application stands.

In progress

Canada · FINTRAC

Money services business registration under the PCMLTFA is in progress with FINTRAC. Our program and reporting are being built to their standard.

  • Large cash and EFT reporting
  • Record retention controls
  • Named compliance officer
In progress

Nigeria · CBN PSS

Payment solution service provider licensing under the Central Bank of Nigeria framework is in progress. We settle through licensed partner banks in the meantime.

  • NDPA data protection alignment
  • NIN and BVN verification
  • NFIU reporting readiness
In progress

United States · FinCEN

Federal MSB registration with FinCEN and state money transmitter licenses are in progress across our launch markets, added on a rolling basis.

  • Bank Secrecy Act program
  • OFAC sanctions screening
  • State MTL applications underway
Planned

United Kingdom · FCA

Authorisation as an electronic money institution with the Financial Conduct Authority is planned. We are preparing safeguarding and governance ahead of filing.

  • Safeguarding of client funds
  • SYSC governance controls
  • Consumer Duty alignment
How we keep money clean

Three controls sit under every payment.

Onboarding, screening, and monitoring. Get those three right and most of the risk is caught before it ever becomes a problem.

KYC and KYB

We verify who we onboard and who stands behind them. Government ID and a liveness selfie for individuals, registration and director checks for businesses.

  • UBO tracing up the ownership chain
  • PEP screening on every party
  • Adverse media checks at onboarding

Sanctions screening

Every party is checked against OFAC, UN, EU, and HM Treasury lists before we authorize anything. The screen runs pre-authorization, not after the money has left.

  • Runs pre-authorization on every payment
  • Fails closed, so an unresolved match blocks it
  • Daily rescreen catches new listings

AML, monitoring and SAR

A written, board-approved AML program with a named compliance officer. Real-time monitoring flags the odd patterns, an analyst reviews each one, and we file when it is warranted.

  • Structuring and velocity detection
  • Human analyst review on every alert
  • SAR filed to FINTRAC, FinCEN, or NFIU
Know your customer and business

We verify who we onboard, and who stands behind them.

Onboarding is where risk gets caught or missed. So we go past the name on the form. We confirm the person, confirm the business, and trace ownership up the chain until we know who really controls the account.

KYC on every individual

Government ID capture, a liveness selfie, and address checks tied to national identity where it exists, like NIN and BVN in Nigeria.

KYB on every business

Registration documents, incorporation records, and director confirmation before a merchant can accept a single payment.

UBO tracing

We map beneficial owners down to a 10 percent stake and flag layered structures built to hide who is really in control.

PEP and adverse media

Every party is screened against politically exposed persons lists and negative news, then rescreened as those lists change.

Screening pipelineReal time
OFAC SDN list matching
UN and EU consolidated lists
HM Treasury UK sanctions
PEP and RCA screening
Adverse media checks
Daily rescreen on changes
AO
Adebayo Okafor
Business owner · Lagos
Cleared

SanctionsNo match
PEP statusNot exposed
Beneficial owners2 identified
Risk ratingL
Anti money laundering program

A written program a regulator can read cover to cover.

Ours follows the five-pillar model regulators expect. Documented, board approved, and reviewed by an independent party every year. Not a policy that sits in a drawer.

Named compliance officer

A designated MLRO owns the program, reports to the board, and can freeze accounts and file reports without a sign-off queue.

Risk-based controls

Customers and transactions get scored on geography, product, and behavior. Higher risk means deeper checks and tighter limits.

Ongoing training

Everyone who touches money or data completes AML training at onboarding and refreshes it each year. We keep the records.

Independent testing

An outside firm audits the program yearly and reports findings straight to the board, so weak spots surface early.

Always watching

Every transaction runs through the same rules engine.

Structuring, velocity spikes, mismatched geographies, and round-dollar patterns all raise alerts. A human analyst reviews what the rules surface, and files a suspicious activity report when it is warranted.

100%
Payments screened
< 90ms
Rule decision time
24 / 7
Analyst coverage
Alert · Velocity thresholdUnder review
14 inbound transfers · 6 hours · same beneficiary
Case #A7741SAR candidate
Transaction monitoring and reporting

From alert, to review, to a filed report.

Monitoring only matters if something happens after the alert. So we built a clear path from the moment a pattern trips a rule to the moment a report lands with the right financial intelligence unit.

01
Detect

Rules and behavioral models flag unusual activity as it happens, not in a nightly batch.

02
Review

An analyst opens a case, pulls the full history, and decides if the alert holds up.

03
Report

Confirmed cases become a SAR to FINTRAC, FinCEN, or the NFIU, filed within the deadline.

04
Retain

Every case and decision is logged and kept for the retention period each regulator sets.

Data residency

Customer data stays where the law says it should.

Financial and identity data is stored in the region it belongs to, encrypted in transit and at rest with AES-256. When a country requires local hosting, we host locally. When it requires local reporting, we report locally.

Canada
RegionCentral Canada
FrameworkPIPEDA
EncryptionAES-256 at rest
ReportingFINTRAC
Nigeria
RegionLagos, in-country
FrameworkNDPA
EncryptionAES-256 at rest
ReportingNFIU
United States
RegionUS East
FrameworkGLBA and state laws
EncryptionAES-256 at rest
ReportingFinCEN
Where we operate

Jurisdiction status at a glance.

Here is exactly what is in progress and what is next. If your market is not listed yet, reach out. We lay the compliance groundwork before we ever announce a launch.

JurisdictionRegulatorLicense typeIdentity sourceReportingStatus
CanadaFINTRACMSB registrationPassport, provincial IDFINTRAC STRIn progress
NigeriaCentral Bank of NigeriaPSSP licenceNIN, BVNNFIU STRIn progress
United StatesFinCEN and state regulatorsMSB + state MTLsSSN, state IDFinCEN SARIn progress
United KingdomFinancial Conduct AuthorityEMI authorisationPassport, driving licenceNCA SARPlanned
GermanyBaFinEMI passportingeID, passportFIU GermanyExploring
South AfricaSARB and FICTPPP registrationSA ID, passportFIC STRExploring

We do not publish registration numbers until a license is granted and confirmed. Live regulatory identifiers will appear on each market's public compliance page at that point, and not before.

Building on Bolrach? Let's talk compliance early.

Our team walks your legal and risk people through the licenses, controls, and reporting before you write a line of code.