> ## Documentation Index
> Fetch the complete documentation index at: https://docs.buburuza.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance and Security

> How verification works, what is monitored, which obligations apply where, and what the platform will not tell you.

## Verification

No space can hold or move money before it is verified. Verification is performed by **Sumsub**, a licensed identity provider, in a hosted flow — evidence goes to the provider, not through Buburuza's own screens.

| Space    | What is checked                                                                                 |
| -------- | ----------------------------------------------------------------------------------------------- |
| Company  | The company itself, plus its associated persons — directors, controllers, and beneficial owners |
| Personal | The individual who owns the space                                                               |

The document set asked for depends on the country: company registration for a company space, stated country of residence for a personal one. Both are served for the **United States** and **Canada** only.

Companies verify at a **tier**. A lighter tier can be enough to receive funds while outbound movement remains closed; a full tier opens the rest. The tier is set by the verification outcome, not chosen.

<Note>
  A verification decision arrives asynchronously from the reviewer. There is no automatic approval path, and no way to shortcut one from inside the product.
</Note>

## Monitoring

Money movement is screened continuously, without anything being required from you:

| Control                    | What it does                                                                                                            |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| **Transaction monitoring** | Screens payments and counterparties against sanctions and watch lists                                                   |
| **Risk scoring**           | Maintains a risk tier for each verified customer, which the payment path prices against                                 |
| **Travel Rule**            | Shares originator and beneficiary information on transfers above the applicable threshold, where regulation requires it |

## Reporting obligations

Who reports, and to whom, depends on the corridor — and it is not always Buburuza.

| Jurisdiction      | Who reports                                                                  | Buburuza's part                                      |
| ----------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------- |
| **Canada**        | Buburuza, once its FINTRAC registration is issued                            | Monitoring, risk scoring, and the reports themselves |
| **United States** | The licensed partner, as money transmitter of record, filing in its own name | Monitoring and risk scoring only                     |

<Warning>
  Buburuza's FINTRAC Money Services Business registration has been applied for and has not been issued. Until it is, Buburuza files nothing in Canada. See [Legal and regulatory](/legal).
</Warning>

Reporting decisions are made by qualified compliance staff. Automated systems detect patterns and assemble evidence; they do not determine suspicion and do not file. Buburuza does not disclose whether a report has been made about any particular customer or payment, and no agent can tell you.

## Account security

| Control           | How it works                                                                    |
| ----------------- | ------------------------------------------------------------------------------- |
| Passkeys          | WebAuthn credentials, bound to the site and resistant to phishing and replay    |
| TOTP              | Enrolled as a fallback credential, or switched on as an extra step              |
| Recovery codes    | Single-use, issued once at signup                                               |
| Sessions          | Listed and revocable individually or all at once; access tokens are short-lived |
| Step-up           | Sensitive actions re-confirm your identity even within a live session           |
| Verification gate | Money movement stays closed until verification passes                           |

## What the platform will not expose

Some things are deliberately absent from every response, and their absence is a feature:

* Raw provider payloads and verification internals
* Provider identifiers and internal screening records
* Any indication of whether a regulatory report exists

Data is scoped to the space you are acting in, and every request is authorised against it.

## Related

<CardGroup cols={2}>
  <Card title="Legal and regulatory" icon="scale-balanced" href="/legal">
    Permissions, what is not offered, and personal data.
  </Card>

  <Card title="Onboarding and security" icon="user-check" href="/onboarding-and-security">
    The same ground from the account holder's side.
  </Card>
</CardGroup>


## Related topics

- [Onboarding and Security](/onboarding-and-security.md)
- [Support](/support.md)
- [Legal and Regulatory](/legal.md)
- [Introduction](/introduction.md)
- [Buburuza Documentation](/index.md)