AML, KYC and Sanctions Policy

PayIt2, LLC · Grand Rapids, Michigan, United States · Registered address: 510 W Savidge St Ste B303, Spring Lake, MI 49456
Owner: Thomas Zinn, CEO

0. Purpose, scope and how to read this document

This document sets out PayIt2's policies for anti-money-laundering (AML), customer identification and due diligence (KYC/CDD), and sanctions compliance. It is one document in three independently-citable parts because the three subjects share a single governing fact, our payment architecture, and separating them would force a reader to reconstruct that fact three times.

Scope. All PayIt2 products and surfaces: the PayIt2 platform (collect.payit2.com), the public marketing site (payit2.com), and the administrative tooling used by PayIt2 staff. It covers organizers (the people and organizations who create campaigns and receive funds) and payers (donors, attendees and members who pay into a campaign).

The most important sentence in this document, stated at the top rather than buried: PayIt2 is a Stripe Connect platform using Standard connected accounts with Direct Charges. The organizer is the merchant of record. PayIt2 does not hold, transmit, or take custody of organizer or payer funds at any point. Our obligations, and the controls described here, follow from that architecture, and Part 1.2 states it precisely.

What this document deliberately does NOT do. It does not claim controls PayIt2 does not operate. Section 5 is an explicit, itemized list of what we do not do, because a policy that is silent about its boundaries is not verifiable. Every control described below is implemented in code or in a written procedure and can be evidenced on request.

Part 1: Anti-Money Laundering (AML)

1.1 Policy statement

PayIt2 prohibits the use of its platform to launder the proceeds of crime, to finance terrorism, or to evade sanctions or tax obligations. PayIt2 will not knowingly establish or maintain a relationship with any organizer who uses, or attempts to use, the platform for those purposes, and will terminate such relationships on discovery.

1.2 Regulatory posture, stated precisely

PayIt2 operates as a technology platform, not as a money services business, and the following facts determine that classification:

Because funds never flow through a PayIt2-controlled account, PayIt2 is not a money transmitter and does not act as a payment processor of record. The regulated payments functions, customer due diligence, sanctions screening, transaction monitoring for financial crime, and any regulatory reporting arising from them, are performed by Stripe as the regulated party.

This is a statement about where obligations sit, not an abdication. The controls in sections 1.3-1.5 and Parts 2-3 are the ones PayIt2 operates on top of Stripe's, and they exist because a platform that merely points at its processor is not running a compliance program.

1.3 Risk assessment

PayIt2's inherent financial-crime risk is assessed as moderate, driven by these characteristics and mitigated as stated:

Assessed LOW or not applicable: PayIt2 holds no customer funds, offers no stored value, no cash handling, no cross-border settlement of its own, no correspondent relationships, and no crypto. Organizers are presently United States only (§2.4).

1.4 Controls PayIt2 operates

(a) Money movement is gated on verified onboarding. A campaign cannot accept payment until its organizer's connected account reports charges_enabled. This is enforced server-side in the publish path (assertPublishGate), not in the browser client, so it cannot be bypassed by a client. The practical effect: an organizer who has not completed Stripe's CDD cannot collect money, and there is no state in which funds are accepted from an unverified organizer.

(b) A versioned acceptable-use rule set, maintained against Stripe's own policies. PayIt2 maintains a machine-readable rule set (31 rules at version 1: 18 prohibited, 9 restricted, 4 review) covering illegal activity, violence, money transmission, pyramid schemes, deceptive claims, sanctioned jurisdictions and persons, bail bonds, unauthorized government services, cryptocurrency, weapons, controlled substances, identity misrepresentation, and jurisdiction-specific restrictions. It is seeded from and reconciled against Stripe's published restricted-business and prohibited-use policies by a weekly automated job that hash-compares those pages and surfaces any change for incorporation. The rule set is version-controlled; every change is attributable to a commit and a date.

(c) Screening at publish, and again on a recurring basis. Campaign content is screened at the moment of publication against curated high-precision terms mapped to the rule set. A match places the campaign in a pending_review hold: it is not publicly visible and cannot collect, and an administrator must clear it. The hold is deliberately not a hard block: a false positive must never silently destroy a lawful campaign, and the organizer is told plainly that the campaign is under review. Separately, a recurring scan evaluates live campaigns against the full rule set, so a campaign edited after approval is re-examined rather than trusted indefinitely.

(d) Immutable activity record. Every state change on a campaign, participant, payment and account is appended to an event store with actor, timestamp and before/after context. This is the audit trail available to reconstruct any campaign's history for an internal investigation or a lawful request.

(e) Record retention. Financial records are retained. Where a data-subject erasure request is honored, personally identifying data is anonymized but the de-identified payment amount and date are retained under the legal-obligation exception to erasure (GDPR Art. 17(3)(b)), so the financial record survives. A campaign with completed payments cannot be hard-deleted; it is archived.

1.5 Escalation and reporting

PayIt2 does not file Suspicious Activity Reports: it is not the regulated party and does not hold the transaction relationship. Where PayIt2 identifies activity it believes may be suspicious, the procedure is:

1. Preserve: no destructive action on the account or its records.
2. Contain: place the campaign in pending_review (removing it from public view and stopping collection) where continued collection would compound harm.
3. Escalate to Stripe without tipping off the organizer as to the reason.
4. Record the decision, its basis and its timing.
5. Respond to any lawful request per the public-authority procedure (§3.4).

Accountable owner: the CEO. PayIt2 is a small team; there is no separate compliance department, and this document does not invent one.

Part 2: Know Your Customer / Customer Due Diligence (KYC/CDD)

2.1 Who is the customer

The organizer is the customer for CDD purposes: they are the merchant of record, they receive the funds, and they hold the Stripe account. Payers are card-present-equivalent consumers transacting with the organizer; PayIt2 performs no CDD on payers, and Stripe's fraud controls apply to their instruments.

2.2 Identification and verification: performed by Stripe

Because connected accounts are configured requirement_collection = stripe, Stripe collects and verifies all identity and business information directly and PayIt2 never sees it. Stripe's Standard-account CDD includes legal name, date of birth, government identification number, address, and, for business accounts , entity name, tax identification and beneficial-ownership/representative information, with documentary verification where Stripe requires it.

An account cannot accept payments until Stripe is satisfied. PayIt2's charges_enabled gate (§1.4a) is the enforcement point: Stripe's verdict, not PayIt2's, determines whether money can move.

2.3 What PayIt2 holds, and what it deliberately does not

Verified against the live Stripe API across connected accounts, September 2026:

PayIt2 therefore cannot leak, and is not a custodian of, the sensitive identity set. This is a deliberate architectural choice, not an omission: the platform is designed so that the most sensitive KYC data never touches it.

2.4 Geographic restriction

Organizer accounts are created as United States accounts only. A non-US Stripe account attempting to connect via the OAuth path is refused and disconnected; the embedded onboarding path creates US accounts by construction. International organizer support is a planned, staged expansion and will not be enabled without the corresponding per-country review.

2.5 Ongoing due diligence

• Stripe continues to collect requirements over an account's life and can disable charges or payouts at any time; PayIt2 honors that state on every publish and payment attempt rather than caching an approval.
• Account status changes arrive by webhook and are reflected in the organizer's own dashboard.
• The recurring campaign scan (§1.4c) is the content-side equivalent: approval is not permanent.

Part 3: Sanctions

3.1 Policy statement

PayIt2 prohibits any transaction or relationship involving a person, entity or jurisdiction subject to sanctions administered by OFAC, the UN, the EU, the UK, or any other applicable authority. PayIt2 will not facilitate any campaign that would evade such sanctions.

3.2 Where sanctions screening actually happens: stated without ambiguity

Sanctions and watchlist screening of organizers is performed by Stripe as part of onboarding and ongoing monitoring of the connected account, under the requirement_collection = stripe configuration. PayIt2 does not operate its own OFAC/SDN, UN, EU or UK list-screening capability, and nothing in this document should be read as claiming otherwise. See §5.

This is a deliberate reliance decision, not a gap by accident: Stripe holds the identity data that makes list screening meaningful (§2.3), and duplicate screening against a name PayIt2 holds, without date of birth or identification number, would produce false confidence rather than additional assurance.

3.3 What PayIt2 does operate on the sanctions surface

1. Two prohibited rules in the acceptable-use rule set, applied to campaign content at publish and on the recurring scan: - Sanctioned jurisdictions: campaigns organized by, benefiting, or directing funds to persons or entities in Cuba, Iran, North Korea, Syria, or the Crimea, Donetsk and Luhansk regions. - Sanctioned persons: campaigns where the organizer, beneficiary or a named associated party appears on OFAC, BIS Denied Persons/Entity, UN, EU or UK lists.

These are content and purpose controls: they act on what a campaign says it is for and who it names. They are complementary to, and not a substitute for, Stripe's identity-based screening.

2. The US-only organizer restriction (§2.4), which removes entire jurisdictional risk classes by construction.
3. The charges_enabled gate (§1.4a): if Stripe's screening disables an account, PayIt2 stops accepting money for it.

3.4 Escalation and lawful requests

A suspected sanctions match identified by PayIt2 is escalated to Stripe and the campaign is placed in pending_review; PayIt2 does not make an independent designation determination.

Requests for personal data from public authorities are handled under PayIt2's adopted government-data-request policy: each request is reviewed for legality before any response, unlawful requests are challenged, only the minimum necessary data is disclosed, and the request is documented end to end in a maintained request log. That log currently records zero requests.

4. Governance

5. Explicit limitations: what PayIt2 does NOT do

Stated plainly so that this policy can be relied upon, and so that no control is inferred that does not exist:

1. PayIt2 does not hold, transmit, pool or take custody of organizer or payer funds.
2. PayIt2 does not operate its own OFAC/UN/EU/UK sanctions list screening.
3. PayIt2 does not collect or store government identification numbers, dates of birth, identity documents, or bank credentials.
4. PayIt2 does not perform politically-exposed-person screening.
5. PayIt2 does not file Suspicious Activity Reports; it is not the regulated party. It escalates to Stripe.
6. PayIt2 does not operate a transaction-monitoring system of its own for financial-crime typologies; transaction monitoring sits with Stripe, which holds the transaction data.
7. PayIt2 does not employ a dedicated compliance officer or maintain a formal staff AML training program. Accountability sits with the CEO.
8. PayIt2's publish-time screen is tuned for precision over recall: it is designed not to block lawful campaigns, and it is therefore not a comprehensive detection control. The recurring scan and Stripe's own controls are the compensating layers.

Items 2-7 follow from the architecture in §1.2. If PayIt2's payment architecture changes such that PayIt2 becomes a party to the flow of funds, this policy must be re-issued and these limitations re-examined before that change ships.