Regulatory status
Live payments are enabled once your account is verified and approved. Until an account is activated, GRYPHEM PAY processes no payments, moves no funds and holds no funds for it. No licence, registration, authorisation, certification, audit outcome, insurance or partner agreement is claimed in these docs or anywhere in the product.
What this means in practice
Section titled “What this means in practice”- Live API keys, payment intents, checkout sessions, payouts and any other live-money behaviour stay switched off for an account until it is activated. They are also guarded by a server-side production switch that defaults to off.
- Fiat methods (PIX, cards, SEPA) are not available. Offering them requires contracts with licensed payment providers; none are in place.
- Live payments are custodial. For an activated account, they are processed through the platform’s own Bitcart account: customers pay the platform’s wallets, GRYPHEM PAY holds the funds on the merchant’s behalf as a balance until payout, and merchants withdraw them through payouts approved by a second member of their organization (by default) and always reviewed by a GRYPHEM operator.
- GRYPHEM PAY does not exchange currencies. Payouts are made in the asset that was received.
Custody is a regulated activity
Section titled “Custody is a regulated activity”Holding and transferring clients’ crypto-assets — what live payments involve — generally requires authorisation: for example as a crypto-asset service provider for custody and transfer services under the EU Markets in Crypto-Assets Regulation (MiCA), or as a virtual-asset service provider in Brazil. GRYPHEM PAY holds no such authorisation. Accounts are activated for live payments only in countries, and through legal entities, for which it has been obtained, or for which counsel has given a written opinion that none is required.
Whether and how each activity falls under rules such as MiCA, payment-services legislation or anti-money-laundering obligations depends on the exact features, roles, legal entity and jurisdiction. That determination belongs to qualified counsel.
Release gates
Section titled “Release gates”Accounts can be activated for live payments only after every release gate is approved by two different operators with recorded evidence:
- Threat model sign-off
- Independent security review and penetration test
- Smart-contract audit (if a contract is ever used)
- Licensing assessment by counsel
- Custody and transfer authorisation — authorisation to hold and transfer customers’ crypto-assets (for example MiCA custody and transfer services in the EU, or virtual-asset service provider authorisation in Brazil) for every country and legal entity where live payments are offered, or counsel’s written opinion that none is required
- Legal go/no-go per country
- Data protection review (GDPR / DPIA)
- KYB / AML process approval
- Chain and price-feed resilience
- Production observability and alerting
- Incident runbook and on-call
- Disaster recovery drill
- Finance controls
Business verification (KYB) in the dashboard is a manual review workflow that records your information; submitting it is not an approval, and an approved verification does not activate an account unless every release gate is approved.
Badges you will not see
Section titled “Badges you will not see”You will not see “regulated”, “licensed”, “MiCA authorised”, “PCI certified”, “SOC 2”, “bank-grade”, “insured” or “guaranteed irreversible” claims. If any page shows one, treat it as an error and tell us.