Purpose, scope and regulatory context
This Policy addresses money laundering, terrorist financing, sanctions evasion and other misuse of Coinvay accounts, invoices, payment links, APIs and integrations. Coinvay operates from Estonia. This document is a contractual acceptable-use and escalation policy, not a representation that Coinvay holds an AML, MiCA or other financial-services licence, has received regulatory approval, or operates a certified screening programme.
Non-custodial software does not automatically remove legal obligations. The rules depend on the actual activities and relevant jurisdiction. Where a regulated service is involved, it must not be offered without any required authorisation and controls. Merchants remain responsible for obligations that apply to their own goods, services, customers and transfers.
No routine KYC does not mean anonymous or unrestricted
Current Coinvay signup does not routinely request identity documents. ‘No KYC required’ describes that current onboarding flow; it is not permission to use the service illegally, a promise of anonymity, or an exemption from legal requirements. Account emails, linked wallets, payment records and limited security metadata can identify or be linked to a user.
We may request relevant business, transaction, source-of-funds or identity information where proportionate to a credible concern or required by applicable law. Requests must have an appropriate purpose and lawful basis, with suitable handling safeguards. If a required review cannot be completed, access may be restricted or terminated. We do not currently claim automated identity verification, universal sanctions screening or comprehensive blockchain tracing.
Prohibited activities
You must not use Coinvay for money laundering, hiding criminal proceeds, financing terrorism, sanctions evasion, fraud, phishing, scams, stolen funds, ransomware, extortion, trafficking in people, forced labour, sexual exploitation, child sexual abuse material, illegal gambling, unlawful weapons sales or any other activity prohibited by applicable law.
Drug trafficking and the unlawful manufacture, distribution or sale of narcotics, controlled substances or drug paraphernalia are prohibited. So are sales of stolen or counterfeit goods, unlawful personal-data trading, fraudulent investment schemes and transactions designed to disguise the real merchant, customer, asset or purpose. Lawful regulated goods still require the seller’s relevant permits and compliance.
Do not split transactions to evade a legal restriction, falsify documents or source-of-funds explanations, impersonate another business, operate a hidden merchant account for a prohibited party, bypass access controls or route traffic through Coinvay to obscure criminal activity. Privacy tools or a large transaction alone do not prove illegality; we assess the available context.
Sanctions and merchant duties
Do not use Coinvay for transactions prohibited by sanctions or restrictions applicable to you or the service. Verify your legal ability to sell, accept a particular asset and serve the customer’s location. Maintain lawful records and respond accurately to relevant enquiries. Do not imply that Coinvay has approved the legality of your business merely because a payment link was created.
If you collect customer or source-of-funds information, do so lawfully and proportionately, protect it and provide the required notices. Do not send sensitive documents or unrequested customer data through public invoice notes or blockchain messages. Coinvay’s default onboarding does not replace a merchant’s own AML, sanctions, tax or consumer obligations.
Signals and review process
Concerns may arise from credible complaints, lawfully available blockchain information, inconsistent account details, suspected compromised credentials, fraudulent invoices, attempts to evade restrictions or a competent authority’s request. Operational payment verification confirms transaction details; it is not a guarantee that funds have a lawful origin.
Authorised personnel may review relevant account, invoice, wallet, transaction and security records, request an explanation or supporting information and document the decision. We aim to distinguish credible indicators from false positives. Reviews are proportionate to the concern; no statement here promises that every transaction is manually investigated or automatically screened. You can report suspected abuse to support@coinvay.com with the relevant invoice or transaction reference.
Restrictions, suspension and termination
Where reasonably necessary, we may temporarily restrict features, disable payment-link creation or API keys, suspend access, preserve relevant records or terminate a Coinvay account for suspected prohibited conduct, refusal of a lawful and necessary review, a material policy breach, a compromised account or a legal requirement. We may act promptly where delay would increase harm or violate the law.
Where lawful and appropriate, we explain the restriction and allow you to request review at support@coinvay.com. Provide the account reference and a concise explanation; do not create another account to bypass the restriction. Confidentiality or investigation requirements may limit what we can disclose. Suspicion is not a finding of guilt. Coinvay access restrictions do not allow us to seize, freeze or reverse funds already in your private wallet; blockchain networks and token issuers may have their own controls.
Reporting and sharing with authorities
If we identify credible suspicious activity, we may inform competent authorities where legally required or permitted and supported by an appropriate lawful basis. We may also respond to a valid court order, regulator request or other legally binding process. Relevant data may include account identifiers and contact information, receiving wallets, invoices, payment amounts and hashes, account access metadata, relevant communications and review records.
We verify the request or reporting basis, assess necessity and scope, and limit disclosure to relevant information with applicable safeguards. We do not give every authority unrestricted database access or promise to share all data on request. Notification to you may be delayed or withheld where law prohibits it or notification would compromise an investigation. A required suspicious-activity report and related restrictions on disclosure depend on the obligations actually applicable to the operator.
Record protection and privacy
Relevant review, decision and disclosure records may be retained as needed for the specific legal obligation, dispute or legitimate security purpose. The Privacy Policy explains account metadata, ordinary retention, international processing and data rights. A legal hold is limited to relevant records; it is not a basis to collect unnecessary information about all users. Access should be restricted to authorised people handling the matter.
Do not reveal security checks or information about another person’s account to unauthorised parties. Reports should be factual and made in good faith. Never send wallet keys, seed phrases or account passwords as evidence.
Reporting concerns and policy updates
Report abuse, an incorrect suspension or a security concern to support@coinvay.com. Data-rights and disclosure questions go to privacy@coinvay.com. Include an invoice or transaction reference and relevant facts, avoiding unnecessary personal data. We may ask follow-up questions through an appropriate channel.
New users must agree to this Policy during signup. Existing login is not treated as a new agreement. We will update the published version and provide appropriate notice when this Policy changes; any legally required fresh agreement will use a separate process. This Policy is informed by general risk-based principles and does not certify regulatory compliance.