Regulatory Disclosures, Gap Analysis & Legal Review Scope
Internal engineering and compliance readiness tracker prepared for payments counsel and technical diligence. Separates verified software controls from operational compliance gaps and legal determinations required prior to any commercial launch.
Mandatory Pre-Launch Banking, Licensing & Partner Disclosure
InstaPay IPX is a software prototype operating strictly in developer sandbox and public testnet mode (MODE=prototype, TESTNET_ONLY=true). It is not a chartered bank, depository institution, or licensed money transmitter, and it does not currently accept, hold, or transmit live customer funds.
1. No Active Bank Sponsorship or Partner Endorsement
References in technical documentation or code to third-party providers (such as Column, Circle, or PayPal) identify developer sandbox APIs and SDK adapters evaluated during prototype engineering. They do not represent executed production banking partnerships, sponsorship agreements, or endorsement by any financial institution.
2. No Custodial Accounts or FDIC Insurance Claims
No live custodial, FBO, or depository accounts are currently active, and no FDIC pass-through insurance coverage applies to this prototype. FDIC deposit insurance applies only to eligible deposits held at an FDIC-insured bank under an executed program agreement and never covers digital assets.
3. Money Transmission Depends on Actual Activities
Whether a business is subject to federal FinCEN MSB registration or state money-transmission licensing (MTL) depends on its actual operational activities, flow of funds, and legal circumstances—not on how its website describes its software or key architecture. Qualified payments counsel must review and approve the final flow of funds before launch.
4. Sanctions Screening Is Currently a Static Test Fixture
Pre-flight compliance checks in lib/sanctionsList.ts currently evaluate hardcoded test addresses (OFAC-SDN-2026.Q4.1 fixture) to verify fail-closed error handling in automated tests. Live OFAC SDN feed ingestion and commercial KYC/AML screening are not yet connected.
How to Read This Controls Mapping
Every item below carries one of four status labels to distinguish database/code invariants tested in this repository from unbuilt compliance operations and open legal questions:
Software or database control implemented in the repository and verified by automated integration or unit tests. Does not imply regulatory certification.
Implemented in application code or draft documentation using test fixtures, but lacking live data feeds, hardware isolation, or formal operational adoption.
Required operational, staffing, policy, or third-party vendor integration that is not yet implemented.
Legal, licensing, or partner-contract determination that must be reviewed and approved by qualified payments counsel before launch.
Tokenized Bank Details (Zero Plaintext DDA Storage in App DB)
Protection of sensitive customer financial information at rest; raw account numbers must not be stored in plaintext.
Application database schema stores only tokenized counterparty references (cpty_...), ABA routing numbers, and last-4 digits rather than raw bank account numbers.
In-Process Shamir Secret Sharing Module (2-of-3 Split-Key Math)
Cryptographic key-splitting primitives to reduce single-key exposure.
lib/crypto/mpcVault.ts implements mathematical Shamir Secret Sharing over GF(2^8) (generator 3, polynomial 0x11b) with AES-256-GCM encrypted share storage and buffer zeroization. Hardware enclaves, client biometric passkey shares, and cold-storage vaults are not yet deployed.
Secure Disposal After Retention Window (§ 314.4(c)(6))
Procedures for secure disposal of customer information when the applicable retention period expires.
purgeEligibleExpiredRecords() scrubs records older than the configured 7-year retention window while blocking deletion of active records within the hold period.
Written Information Security Program (WISP)
Comprehensive written program detailing administrative, technical, and physical safeguards.
Drafted in docs/compliance/glba-safeguards-rule.md covering data classification, access tiers, and operational rules.
Designated Qualified Individual
Formally designated individual responsible for overseeing, implementing, and enforcing the security program.
Role defined in draft documentation; no formal officer appointment has been executed.
Incident Response Plan & FTC Breach Notification
Written plan for security incidents and notification procedures for qualifying data breaches.
Draft policy outlines containment, forensics, and notification workflows.
Service Provider Oversight & Commercial Agreements
Selecting service providers capable of maintaining appropriate safeguards and executing required contractual protections.
Technical integrations currently target developer sandbox/testnet endpoints only.
Pre-Flight Sanctions Check (Static Test Fixture Only)
Blocking transactions involving Specially Designated Nationals (SDNs) or blocked jurisdictions.
lib/sanctionsList.ts and lib/services/payoutCompliance.ts check destination addresses against a hardcoded test fixture list before payout execution and throw SanctionsBlockError on a match.
Screening Decision Audit Logging
Audit record of screening checks performed by the application.
Records destination checked, screening outcome, and static fixture version tag in the application audit log via logAudit().
Live OFAC SDN Feed Ingestion & Commercial Screening Provider
Real-time synchronization with official U.S. Treasury OFAC SDN lists and consolidated sanctions lists.
Not yet implemented. Application currently relies on a static test fixture list.
Name Matching Tolerance & Fuzzy Screening
Identification of phonetic, spelling, or alias variants in counterparty names.
Exact string matching only in current prototype.
Application Velocity Limits & Rapid-Fire Prevention
Monitoring transaction velocity to prevent rapid automated payout drains.
Application rule engine flags accounts exceeding 3 payouts in 5 minutes and blocks at 5 or more transactions.
Batch Structuring Heuristic Rules
Detection of transactions structured to evade reporting or recordkeeping thresholds.
Heuristic rules defined in application code for transfer clusters near $2,800–$2,999 or $9,000–$9,999.
Compliance Case & Discrepancy Quarantine Tables
Quarantining flagged or discrepant transactions for human investigation rather than auto-releasing funds.
Database table compliance_cases and payout status = discrepancy quarantine holds (ReconciliationEngine) isolate flagged transactions until attributed operator review.
Suspicious Activity Report (SAR) Escalation & Filing Procedure
Escalating suspicious activity to a sponsoring financial institution or FinCEN BSA E-Filing where applicable.
Operational procedure and staffing not yet established.
Customer Identification Program (CIP / KYC / KYB)
Verifying the identity of merchants and payout recipients in accordance with applicable law and partner requirements.
Prototype forms collect basic profile fields only; no live identity verification provider is integrated.
7-Year Database Retention Guardrail
Preservation of financial ledger and transaction records for applicable statutory retention periods.
DataRetentionService enforces a 7-year retention lock in code that blocks programmatic deletion of ledger records, payouts, and audit trails.
ABA Routing Checksum & Account Format Validation
Pre-flight syntax validation of ABA routing numbers and counterparty parameters.
ABA Mod-10 checksum validation, account digit bounds checking (4–17 digits), and self-transfer blocks.
Idempotent Origination & Terminal Ledger Mutual Exclusion
Prevention of duplicate origination, double settlement, or conflicting settlement-and-refund postings.
Merchant-scoped idempotency keys (merchant_id, key), pre-broadcast EXECUTING state persistence, and database-enforced unique ledger journal constraints (uq_ledger_journals_idempotency, uq_ledger_journals_terminal_ref).
Nacha Participant Role & Originating Depository Financial Institution (ODFI) Agreement
Formal legal classification as Originator, Third-Party Sender (TPS), or Third-Party Service Provider (TPSP) under an executed ODFI agreement.
Determines ACH warranty obligations, Nacha registration mandates, and audit requirements.
Written ACH Fraud Monitoring Policy & Account Validation
Nacha risk-based fraud monitoring and WEB/account validation requirements.
Basic velocity and checksum checks exist in code; formal written policy and live micro-deposit/instant account verification are not yet deployed.
Standard Entry Class (SEC) Code Authorization
Proper utilization of CCD, PPD, or WEB SEC codes and authorization language.
Sandbox test payloads use placeholder CCD/PAYMENT tags.
Flow of Funds, Custody & Money Transmission Analysis
Legal determination of whether the platform’s actual activities, account structures, and key governance trigger state money transmitter licensing (MTL) or federal MSB obligations.
Whether a business is subject to money-transmission laws depends on its actual operational activities, flow of funds, and legal circumstances—not website descriptions.
FinCEN MSB Registration & State Money Transmitter Licensing
Evaluation of federal MSB registration and 50-state money transmission licensing requirements or statutory exemptions.
No self-executing exemption (such as software provider, payment processor, or agent of the payee) is claimed or relied upon without formal legal opinion and matching contractual structure.
Account Structure & FDIC Deposit Insurance Eligibility
Substantiation of any custodial/FBO account structure and strict compliance with 12 CFR Part 328 regarding FDIC misrepresentations.
InstaPay IPX is not a bank and is not FDIC-insured. No live custodial or FBO bank accounts are currently open, and no pass-through FDIC insurance coverage is claimed.
Electronic Fund Transfer Act (EFTA) / Regulation E Applicability
Determining disclosure, receipt, and error-resolution obligations for transfers to consumer accounts.
Evaluating whether disbursements to independent contractor personal accounts implicate Regulation E requirements.
Third-Party Provider Commercial Agreements & Naming Rights
Executing commercial terms and obtaining written permission before naming any bank, payment network, or financial institution as a partner.
Current integrations use developer sandbox/testnet APIs only. Third-party provider names in technical documentation identify API schemas and adapters, not commercial partnerships.
Mandatory Pre-Launch Review by Payments Counsel
Before any production launch, bank onboarding, or public marketing claim, qualified payments and financial regulatory counsel must review the actual operational flow of funds and issue written determinations on the following matters:
1. End-to-End Flow of Funds & Money Transmission Applicability
Analyzing the exact contractual and technical flow of funds across every enabled rail to determine whether federal FinCEN MSB registration or state Money Transmitter Licenses (MTLs) are required.
2. Statutory Exemptions & Contractual Prerequisites
Determining whether any statutory exemption (such as software provider, payment processor, or agent of the payee) is legally available and ensuring partner agreements satisfy every condition.
3. Bank Sponsorship, Account Titling & 12 CFR Part 328 (FDIC Rules)
Reviewing any bank sponsorship agreement, custodial/FBO account structure, and public disclosures to ensure strict compliance with FDIC truth-in-advertising rules and partner naming permissions.
4. Nacha Participant Role (Originator vs. TPS vs. TPSP)
Confirming Nacha classification with the sponsoring ODFI, including registration, warranty, audit, and WEB/PPD/CCD authorization requirements.
5. Consumer Regulation E & Error Resolution Scope
Determining whether disbursements to independent contractor personal accounts trigger Electronic Fund Transfer Act (EFTA) / Regulation E disclosures and error resolution rules.
6. Live Sanctions, KYC/KYB & SAR Escalation Program
Approving a production BSA/AML and OFAC compliance program backed by live sanctions feeds, commercial KYC/KYB verification, and documented SAR escalation workflows.
Diligence & Legal Review Inquiries
Payments counsel, prospective bank partners, and technical auditors may inspect the repository test suites and control artifacts or contact: