Compliance and Security

How verification works, what is monitored, which obligations apply where, and what the platform will not tell you.

Verification

No space can hold or move money before it is verified. Verification is performed by Sumsub, a licensed identity provider, in a hosted flow — evidence goes to the provider, not through Buburuza’s own screens.

Space	What is checked
Company	The company itself, plus its associated persons — directors, controllers, and beneficial owners
Personal	The individual who owns the space

The document set asked for depends on the country: company registration for a company space, stated country of residence for a personal one. Both are served for the United States and Canada only.

Companies verify at a tier. A lighter tier can be enough to receive funds while outbound movement remains closed; a full tier opens the rest. The tier is set by the verification outcome, not chosen.

A verification decision arrives asynchronously from the reviewer. There is no automatic approval path, and no way to shortcut one from inside the product.

Monitoring

Money movement is screened continuously, without anything being required from you:

Control	What it does
Transaction monitoring	Screens payments and counterparties against sanctions and watch lists
Risk scoring	Maintains a risk tier for each verified customer, which the payment path prices against
Travel Rule	Shares originator and beneficiary information on transfers above the applicable threshold, where regulation requires it

Reporting obligations

Who reports, and to whom, depends on the corridor — and it is not always Buburuza.

Jurisdiction	Who reports	Buburuza’s part
Canada	Buburuza, once its FINTRAC registration is issued	Monitoring, risk scoring, and the reports themselves
United States	The licensed partner, as money transmitter of record, filing in its own name	Monitoring and risk scoring only

Buburuza’s FINTRAC Money Services Business registration has been applied for and has not been issued. Until it is, Buburuza files nothing in Canada. See Legal and regulatory.

Reporting decisions are made by qualified compliance staff. Automated systems detect patterns and assemble evidence; they do not determine suspicion and do not file. Buburuza does not disclose whether a report has been made about any particular customer or payment, and no agent can tell you.

Account security

Control	How it works
Passkeys	WebAuthn credentials, bound to the site and resistant to phishing and replay
TOTP	Enrolled as a fallback credential, or switched on as an extra step
Recovery codes	Single-use, issued once at signup
Sessions	Listed and revocable individually or all at once; access tokens are short-lived
Step-up	Sensitive actions re-confirm your identity even within a live session
Verification gate	Money movement stays closed until verification passes

What the platform will not expose

Some things are deliberately absent from every response, and their absence is a feature:

• Raw provider payloads and verification internals
• Provider identifiers and internal screening records
• Any indication of whether a regulatory report exists

Data is scoped to the space you are acting in, and every request is authorised against it.

Related

Legal and regulatory

Permissions, what is not offered, and personal data.

Onboarding and security

The same ground from the account holder’s side.