How we keep your money safe
Funds held with licensed partner institutions, every business verified before it goes live, every payment screened, and security controls independently attested under SOC 2 Type I.
Updated October 2026
AICPA Trust Services Criteria for security.
Four layers of protection
Funds held with licensed partners
Customer money is held with licensed partner institutions in the markets where we operate, kept separate from ElementPay's own operating funds.
Business verification
We verify each company's registration, directors, beneficial owners and use case before it can send or receive money.
Transaction monitoring
Payments are screened against sanctions lists and monitored for unusual activity, in fiat and in stablecoins.
Encryption and access control
Data is encrypted in transit and at rest. Staff access is limited by role, protected by multi-factor authentication and logged.
SOC 2 Type I attested
An independent auditor has examined the design of ElementPay's security controls against the AICPA Trust Services Criteria for security. The report is available to customers and prospects under NDA.
Built on independently certified infrastructure
The banking and infrastructure partners that hold funds and process payments for ElementPay carry the certifications below.
AICPA SOC 2 Type 2
Security, availability and confidentiality controls tested over a period of operation.
AICPA SOC 1 Type 2
Controls over financial reporting tested over a period of operation.
ISO/IEC 27001:2022
An audited information security management system.
GDPR compliant
Personal data handled under the EU General Data Protection Regulation.
These certifications are held by ElementPay's partners. ElementPay's own attestation is SOC 2 Type I.
Compliance built into every payment
Our compliance programme follows a risk-based approach to anti-money-laundering and counter-terrorist financing, applied before onboarding and on every transaction after it.
Know your business
Company documents, directors and ultimate beneficial owners checked at onboarding, and reviewed when risk changes.
Sanctions and PEP screening
Customers, owners and counterparties screened against global sanctions and politically exposed persons lists.
Ongoing monitoring
Rules and reviews that flag unusual patterns, with escalation and reporting to authorities where required.
Stablecoin screening
Wallet addresses and on-chain flows screened before USDC and USDT are accepted or sent.
Trained people
Staff are trained on AML, fraud and data handling, with a dedicated compliance function.
Records you can audit
Every onboarding decision and payment is recorded and retained for review.
What happens to every payment
Regulators and banking partners
Add each licence or registration (regulator, licence type, number, jurisdiction) and each banking partner here before publishing.
Controls you set
Roles and permissions
Decide who can view, create and approve payments.
Approval thresholds
Require one or more approvers above amounts you choose.
Allow-lists
Limit which recipients your team, or your AI agents, can pay.
Audit trail
Every action is recorded with who did it and when.