AlgoVoi
Compliance Summary
AlgoVoi is a non-custodial cryptoasset payment-message gateway. This page summarises its alignment with UK MLRs 2017, UK GDPR, SAMLA 2018, PoCA 2002, FSMA 2023 monitoring posture, and FCA PS19/22 self-assessment. Full audit documentation is available on request under NDA.
Last updated: 2026-05-03 (Postgres TLS + VPC migration shipped)
Key Alignments
ssl_min_protocol_version=TLSv1.3, self-signed CA, hostssl required for non-bridge sources). Inter-VM control traffic on Vultr private VPC (sub-1ms RTT). MFA on admin surfaces. Per-tenant kill switches. Hash-chained immutable audit logs.AVK1 Fernet scheme using a key separate from the general database key. Plaintext exists only in process memory during reviewer access./verify-chain), (3) off-VM Object Lock shipping in COMPLIANCE mode with 7-year retention.Regulatory Scope
AML / CTF Programme
Sanctions & PEP Screening (C1)
Wallet-level sanctions screening is live. Every payment is checked in real time against the UK OFSI, US OFAC SDN, and EU Consolidated sanctions lists, ingested directly from the public XML feeds and refreshed daily. UN designations cascade through EU implementing regulations and are screened transitively. Wallet addresses are normalised before lookup. Confirmed positive matches block mainnet activation, are escalated to the MLRO, and trigger consideration of an OFSI report and SAR filing. Generic error responses prevent tipping off (SAMLA 2018 s.20; POCA 2002 s.333A).
Name-level sanctions and PEP screening: in preparation. The policy framework is defined (FCA FG17/6 risk-based handling; PEP definition per UK MLR 2017 reg 35) and the PEP Screening Procedure (under NDA) describes the operational handling. The commercial data feed (e.g. ComplyAdvantage / Acuris) for name-based PEP and adverse-media screening is being evaluated; for UK Limited Companies, MLRO review at onboarding currently performs this check manually against public sources. See the Sanctions Screening Procedure (under NDA) public summary.
Transaction Monitoring (C2)
Payment activity is evaluated against seven rule families covering structuring, velocity anomalies, counterparty exposure, round-tripping, geographic concentration, anomalous chain choice, and adverse counterparty signals. Rule values (thresholds, weights) are operationally sensitive and held under NDA. Alert disposition is segregated from rule authorship. Monitoring runs post-commit and never blocks the payment path. See the Transaction Monitoring Procedure (under NDA) public summary.
AML Data Retention (C3)
Records linked to a screening hit, an escalation event, or AML-relevant activity are retained for five years from end of business relationship, and excluded from the general data-purge schedule. Retention satisfies UK MLRs Reg 40. See the Retention Procedure (under NDA).
KYB / KYC Document Workflow (C4)
Onboarding is split by legal entity type. Individual and sole-trader accounts complete a streamlined KYC flow. UK Limited Companies follow the full KYB checklist (Certificate of Incorporation, proof of business address, PSC / UBO register, director ID, source of funds) and are reviewed by the MLRO. The KYC-unlocks-mainnet gate is the principal preventive control: no merchant transacts on mainnet until CDD has been completed.
KYC at-rest encryption. All KYC/KYB documents are encrypted at the application
layer using a versioned MultiFernet scheme (AVK1 magic prefix) with a key
separate from the general database key. Plaintext exists only in process memory during
authorised reviewer access. The encryption layer is independent of disk-level encryption and
protects against database-snapshot exposure scenarios. Already in production for new uploads
with a backfill of historical documents complete.
MLRO & SAR Workflow (C5)
A designated Money Laundering Reporting Officer (MLRO) is assigned at the platform level. Escalation events and confirmed sanctions matches trigger immediate MLRO notification. Internal SAR records are maintained with full audit trail and a restricted flag — SAR existence is never exposed to tenants or payers, satisfying PoCA 2002 s.333A. Submission is via the UKFIU SAR Online portal.
Christopher Hopley — Money Laundering Reporting Officer
Contact: [email protected]
Data Protection & Privacy
AlgoVoi processes personal data as a controller for its own personnel, vendor, and onboarding records, and as a processor for end-customer payment data passed via merchant integrations. Lawful bases, retention windows, and international-transfer instruments are documented in the Record of Processing Activities (RoPA) — public summary (under NDA).
Travel Rule & Agent-to-Agent (A2A) Position
UK Cryptoasset Travel Rule. The UK HMT Travel Rule applies to FCA-registered cryptoasset businesses making cryptoasset transfers above £1,000, requiring the sharing of originator and beneficiary information with the receiving institution. AlgoVoi is not an FCA-registered cryptoasset business and does not initiate or receive transfers on its own account; settlement is direct wallet-to-wallet on public blockchains between a customer and a merchant. AlgoVoi is consequently not a Travel Rule originator or beneficiary institution. Should architecture or regulatory scope change, AlgoVoi will adopt one of the established Travel Rule protocols (e.g. TRP, IVMS101) before activation.
Agent-to-Agent (A2A) payments. AlgoVoi supports the Google A2A v0.3 protocol and the AP2 specification, allowing AI agents to discover, request, and verify payments programmatically. The platform applies the same KYC-unlocks-mainnet gate, wallet-level sanctions screening, and transaction monitoring to A2A-initiated payments as to human-initiated ones (name-level + PEP screening data feed in preparation, applies equally once live). AI agents acting on behalf of a tenant inherit that tenant's risk tier and limits; no AI agent can transact on behalf of a tenant whose mainnet access is not active. The BWRA — public summary (under NDA) identifies AI-agent-initiated payment as a residual risk under continuing review.
URL / IP Screening
Four enforcement points, each running synchronously before the operation completes. Failed checks are routed to the MLRO with audited reason codes; hard-block responses include a human-review appeal path via [email protected] to satisfy UK GDPR Article 22 obligations.
169.254.169.254 or similar.Threat-intelligence feeds are refreshed hourly by an in-process reaper. Maintained sources: Tor Project public exit list, SpamHaus DROP / EDROP, abuse.ch URLhaus + ThreatFox, OpenPhish, PhishTank, MaxMind GeoLite2 Country. No vendor lock-in — every signal is on a public feed an acquirer or successor operator can continue to consume directly. No AlgoVoi data is ever transmitted to these feed providers; they are read-only.
Lawful basis for IP processing: UK GDPR Art. 6(1)(f) legitimate interests, with an LIA balancing test and Article 22 mitigation documented in the AML / CTF Policy (under NDA) §8a and a per-activity entry in the RoPA — public summary (under NDA) §3.7.
Security Infrastructure
- HSTS preload — max-age=63072000
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- Content-Security-Policy: default-src 'none'
- Permissions-Policy enforced
- Server header suppressed
- Evil CORS origin blocked
- POST /mcp no body → 400 (JSON-RPC -32700)
- GET /api/coinbase-session → 405
- Path traversal → 404
- SQL injection → 400
- Internal suite: 24/24 PASS
- HSTS preload — max-age=63072000
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- CSP: default-src 'none'
- Permissions-Policy enforced
- Server header — no version exposed
- All API endpoints → 401 without auth
- Wrong methods → 405
- Path traversal → 400
- Evil CORS origin blocked
- Injection attacks all rejected
- Validation errors genericised — no framework fingerprinting
- HSTS preload — max-age=63072000
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- Permissions-Policy enforced
- nginx version suppressed
- Duplicate HSTS header removed
- GET / genericised — no internal info
- Payment endpoints → 402 without valid sig
- Fake PAYMENT-SIGNATURE → 402
- Fake MPP Authorization → 402
- Path traversal → 400
- Evil CORS origin blocked
- All invalid methods → 405
- HSTS preload — max-age=31536000
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- CSP: default-src 'none'; connect-src 'self'; frame-ancestors 'none'
- Permissions-Policy: camera/mic/geo/payment disabled
- Referrer-Policy: strict-origin-when-cross-origin
- Cloudflare WAF + DDoS in front
- Multi-layer rate limiting
- Signup endpoint capped per IP
- AP2 mutations capped per IP
- Unauth API → 401; wrong methods → 405
- Fernet-encrypted session tokens
- HSTS preload — max-age=31536000
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY
- CSP: connect-src restricted to self + cloud.algovoi.co.uk
- frame-ancestors 'none' · form-action 'self' · object-src 'none'
- Permissions-Policy: camera/mic/geo/payment disabled
- Referrer-Policy: strict-origin-when-cross-origin
- Cloudflare WAF + DDoS in front
- Admin API rate-limited per session
- GitHub-OAuth only (no passwords stored)
- Secrets shown once, never re-displayed
- All mutations go through authenticated Cloud API (separate origin)
Policy Library
Internal security, AML, and privacy policies are public by design. Tier B documents (NDA-tier full text) carry a public summary in the same repository. Documents listed here live in the AlgoVoi-Platform-Adapters repository and update with every commit — the Git history is the audit trail.
Security policies (available under NDA)
AML / Privacy (Available under NDA)
AML / Privacy (Tier B — public summary, full document under NDA)
Tier C — statement only
- SAR Procedure — operational; not published in detail per UKFIU guidance. Capability statement: AlgoVoi has an internal SAR draft / submit / acknowledge workflow with restricted records and observes the tipping-off prohibition.
- MLRO Designation — Christopher Hopley; contact [email protected].
- IP Assignment — all platform IP is fully assigned to the operating company; assignment documentation held internally and disclosable under NDA in a sale process.
- Training Log — annual AML / security awareness training is performed; the log is held internally.
Document Binder Status
A live status table for the full compliance binder, including documents not yet authored or not authored to a publishable form. Tier A documents are public; Tier B documents are published as a public summary with the full document available on request under NDA; Tier C documents exist as one-line statements only. The binder maps to a 24-document sale-readiness pack.
Request the full DD pack under NDA — covers every Tier B document in full, sample-tested cases, the BWRA with residual risk scores, the executed legal opinion when delivered, and the SOC 2 evidence package as it builds.
Request the full DD pack →Subprocessors
Third parties that process AlgoVoi data or host production infrastructure. Reviewed at least annually. Full list with breach-notification clauses and data flow diagrams available under NDA.
SOC 2 & Enterprise Certifications
PCI-DSS is Not Applicable — AlgoVoi processes zero cardholder data. We do not store, process, or transmit primary account numbers (PANs), CVVs, or magnetic-stripe data. All settlement is on-chain via customer crypto wallets. This structurally eliminates the entire cardholder-data attack surface that PCI-DSS exists to protect.
SOC 2 Type II is in progress. The policy framework (above) is operational today. Type I (point-in-time attestation) is targeted for Q2 2027; Type II (sustained operation over 6 months) is targeted for Q4 2027 with a recognised startup-specialist auditor. Merchants with enterprise procurement requirements can request interim security questionnaires and pre-audit evidence packages via [email protected].
FCA MLR Schedule 6A registration. AlgoVoi has self-assessed against FCA Policy Statement PS19/22 ("Guidance on Cryptoassets"), which states that cryptoasset registration is required only where the firm's core business proposition is a regulated cryptoasset activity. AlgoVoi's core business proposition is the provision of payment-message infrastructure between self-custodial wallets on public blockchains — not cryptoasset exchange or custody. On this basis, the activity is considered out of scope of MLR Schedule 6A registration. A formal external legal opinion confirming this position is in preparation. AlgoVoi monitors the FSMA 2023 cryptoasset perimeter (expected to bite circa 2027) and the HMT cryptoasset Travel Rule for changes that could alter this position.
Cyber Essentials certification is planned for Q3 2026. ISO 27001 is on the roadmap after SOC 2 Type II and typically runs on an overlapping timeline with the same auditor.
Security Disclosure
Responsible disclosure is welcome and encouraged. Submit reports to [email protected] or consult our /.well-known/security.txt file for structured contact information. We aim to acknowledge within 1 business day and provide a triage outcome within 3 business days. Researchers acting in good faith will not be pursued through legal channels for activity consistent with our Incident Response Plan (under NDA).