Know Your Customer and Anti-Money-Laundering Policy

RapidCents is required to know who it processes payments for. This policy explains what is verified when a business applies for a merchant account, what is verified about the people who own and direct it, why the law and the card networks require it, what continues for as long as the account is open, and what RapidCents may do when verification fails or the information on file stops matching the business. It also explains something that is easy to misread: there are reports RapidCents is prohibited by law from telling a merchant it has made.

1. Why a payment provider has to verify you

RapidCents does not ask for your incorporation documents and your owners’ identification out of curiosity. It is a regulated reporting entity, and the card networks and its acquiring bank require it as well. An account cannot be opened without it.

Opening a merchant account is not only a commercial decision. RapidCents is registered with the Financial Transactions and Reports Analysis Centre of Canada (“FINTRAC”) as a money services business under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (the “PCMLTFA”), and with the Bank of Canada as a payment service provider under the Retail Payment Activities Act. Clause H.3 of the Services Agreement records both registrations. A reporting entity carries obligations of its own concerning client identification, beneficial ownership, record keeping, transaction monitoring, sanctions screening and reporting, and those obligations cannot be waived by agreement between RapidCents and a merchant.

Three sources of obligation apply, and they reach a merchant wherever it is located. The first is statutory: the PCMLTFA and its regulations govern what RapidCents must verify, record and report as a Canadian reporting entity. The second is the Network Rules — the operating regulations of Visa, Mastercard, American Express, Discover, Diners Club and Interac — which require an acquirer and its processor to identify and underwrite every merchant it signs, to keep that identification current, and to remove a merchant it cannot identify. The third is contractual: RapidCents submits Transactions through its Acquirer, Elavon, as clause A.2 of the Services Agreement records, and the Acquirer imposes its own identification and due diligence requirements on the merchants RapidCents onboards.

A merchant carries obligations of its own, and they are separate from these. Clause H.3(e) of the Services Agreement requires a merchant to comply with the PCMLTFA and its regulations to the extent they apply to it, and with the equivalent legislation of every other jurisdiction in which it operates, including the Bank Secrecy Act and the USA PATRIOT Act in the United States. Nothing RapidCents verifies discharges a merchant’s own compliance obligation, and nothing in this policy is a determination that a merchant meets it.

This is why verification is a condition of the account rather than a formality attached to it. Clause B.1.3 of the Services Agreement is the authorization a merchant gives: RapidCents may, directly or through third parties, make any inquiry it considers necessary to validate the merchant’s identity and assess its business risk, including ordering a credit report, verifying information against third-party databases and requesting additional documentation; and it may obtain business and personal credit reports about the merchant at any time, including about its principals, beneficial owners and guarantors. Clause 3 sets out how that authorization is worded and which part of it reaches which people.

2. What this policy covers, and how it fits the Services Agreement

This policy describes RapidCents’ know-your-customer and anti-money-laundering programme as it applies to merchants and applicants: who is verified, what is collected, what screening is carried out, what continues while the account is open, and what RapidCents may do about a failure. It applies from the moment an application is made, for as long as the account is open, and through the period afterwards during which records must be kept.

It is not a compliance programme and does not set one out. The PCMLTFA regulations require a reporting entity to have a programme and prescribe what it must contain: a designated compliance officer, written policies and procedures, a documented risk assessment, a training programme, and a periodic review of the programme’s effectiveness. Those are requirements the legislation places on a reporting entity rather than undertakings this page gives, and clause H.3 of the Services Agreement is where they reach RapidCents — it records the FINTRAC registration that makes RapidCents a reporting entity, and the merchant’s acknowledgement that RapidCents therefore carries obligations of its own concerning customer identification, beneficial ownership, record keeping, transaction monitoring, sanctions screening and reporting. A programme of that kind is examined by a regulator rather than published to merchants, and what is published here is the part that affects a merchant directly.

It does not apply to a cardholder. A cardholder is identified by their own issuing bank, not by RapidCents, and nothing in this policy requires a merchant to verify the identity of its own customers beyond what the Network Rules, the Acceptable Use Policy and applicable law already require of it.

Where this policy and the Services Agreement differ, the Services Agreement governs. This policy describes how RapidCents exercises rights the Agreement already confers — principally clause B.1.3 (verification and underwriting), clause F.7 (on-request disclosure), clause H.1 (changes you must tell us about), clause H.3 (sanctions, anti-money laundering and export control) and clause H.4 (records, audit and information requests) — and it neither adds to those rights nor limits them. How the personal information collected under this policy is handled is set out in the Privacy Policy; which businesses RapidCents will and will not process for is set out in the Acceptable Use Policy.

3. What is collected, and from whom

Two sets of information: one about the company, one about the people who own, direct or sign for it. Most of it is documentary — largely the same paperwork a bank asks for when it opens a business account.

RapidCents collects two categories of information at onboarding: information identifying the business as a legal entity, and information identifying the individuals who own, control, direct or sign for it. What is asked for varies with the entity type, the country of operation, the business model and the risk rating assigned to the account, so the tables below describe the standard set rather than a fixed and exhaustive checklist.

Identification is verified rather than merely collected, and that is a requirement rather than a preference. The PCMLTFA regulations do not allow a reporting entity to treat a name written on a form as an identification: they require an individual’s identity to be verified by one of the methods they prescribe — examining an authentic, valid and current government-issued photo identification document; referring to information in a credit file that has existed for the prescribed period; or the dual-process method, which relies on information from two reliable and independent sources. Which of those is available in a particular case is fixed by the regulations, and turns on the documents supplied and on where the individual is. The requirement reaches a beneficial owner as well as a director or a signing authority: the regulations require beneficial ownership information to be obtained and reasonable measures to be taken to confirm its accuracy, which is what clause 4 is about.

Clause B.1.3 of the Services Agreement is the authorization for the checks that involves, and it does two things rather than one. It permits RapidCents, directly or through third parties, to make any inquiry it considers necessary to validate the merchant’s identity and assess its business risk, which may include ordering a credit report, verifying information against third-party databases or requesting additional documentation. It then separately authorizes RapidCents to obtain business and personal credit reports about the merchant at any time, and it is that second authorization, not the first, that names principals, beneficial owners and guarantors. That is the merchant-facing consequence: what is asked for at onboarding is asked for because a document has to be examined or a record checked, not because a form has a field.

Collected about the business

Information	Why it is required
Legal name, operating or trade name, and the name a Customer sees on a statement	The identity of the entity being onboarded, and the billing descriptor obligation at clause G.5 of the Services Agreement.
Entity type, jurisdiction of formation, incorporation or registration number, and the constating documents	Confirmation that the entity exists and is what it says it is. The PCMLTFA regulations require an entity’s existence to be confirmed from a record of its formation.
Registered address, principal place of business, and the address the business actually operates from	A registered address on its own does not establish where a business trades.
Business number and tax registration numbers, including GST/HST or QST registration and a United States taxpayer identification number where applicable	Required under clause H.2 of the Services Agreement, and used to confirm the entity against the records of the applicable authority.
A description of what is sold, how it is sold, the countries sold into, the sales channels used, average and maximum Transaction size, and expected monthly volume	This description defines what the account is approved to process, as clause 7 of the Acceptable Use Policy provides, and it is the basis on which the account is underwritten, priced and monitored.
Websites, domains, mobile applications and storefronts the business sells through	The Network Rules require the selling surface to be identified and reviewed, not merely declared.
Licences, permits, registrations and authorizations the business needs in order to trade	Some categories cannot be approved without one. Clause 8 of the Acceptable Use Policy allows RapidCents to require evidence that a licence remains valid.
Financial information, which may include financial statements, bank statements and prior processing history	Underwriting and exposure, and assessing whether the volumes stated are consistent with the business described.
The Payout Account, held in the name of the business at a Canadian financial institution	Clause C.6.1 of the Services Agreement. Settling to an account held in a name other than the merchant’s is a recognised money-laundering typology and is not permitted.

Not every item is required of every applicant. A sole proprietorship has no constating document and no beneficial owners other than the proprietor; a business that sells only in person has no domain to review.

Collected about directors, beneficial owners, signing authorities and guarantors

Information	Why it is required
Full legal name, date of birth, residential address and occupation	The identifying information the PCMLTFA regulations prescribe for an individual.
Government-issued identification, or one of the alternative verification methods described above	Verification, as distinct from collection. A name written on a form is not an identification.
The nature and percentage of the individual’s ownership or control, direct and indirect	See clause 4.
The position held: director, officer, signing authority, or the individual authorised to act on the account	Control is not always ownership, and the PCMLTFA regulations require directors and those holding senior management responsibility to be recorded whether or not they own anything.
Consent to a personal credit report, where one is obtained	Authorised at clause B.1.3 of the Services Agreement, which extends to principals, beneficial owners and guarantors.
Where a personal guarantee is given, the guarantor’s identifying information	Clause F.11 of the Services Agreement. A guarantee from an unidentified individual secures nothing.

RapidCents may also ask about the source of the funds moving through the account, and about the source of a merchant’s wealth where the risk rating assigned to the account calls for it. Clause H.3 of the Services Agreement obliges a merchant to provide source-of-funds information on request, within the time RapidCents specifies.

4. Beneficial ownership, and why there is a threshold

RapidCents has to know the real people behind the company, not only the company. Anyone who owns or controls twenty-five percent or more, directly or indirectly, has to be identified. If nobody reaches twenty-five percent, the directors and the most senior managing officers are recorded instead.

A company is a legal person, and a legal person can be created quickly, cheaply and repeatedly. Verifying only the entity would therefore verify nothing about who actually benefits from the account. The PCMLTFA regulations require a reporting entity to obtain information about the beneficial ownership of an entity it enters into a business relationship with, and to take reasonable measures to confirm the accuracy of that information.

The threshold is twenty-five percent (25%). RapidCents identifies every individual who directly or indirectly owns or controls twenty-five percent or more of the merchant — of its shares, of its ownership interests or of its voting rights — whether that interest is held through a single holding or through a chain of them. The same figure appears at clause H.1(a) of the Services Agreement, which requires a merchant to notify RapidCents of a change in the direct or indirect legal or beneficial ownership of twenty-five percent or more, whether by a single transaction or by a series of transactions.

A threshold exists because the alternative fails in both directions. Without one, a widely held company could not be onboarded at all; with one set very low, the exercise collects names without producing information about control. Twenty-five percent is the figure the PCMLTFA regulations fix for the beneficial ownership of a corporation or other entity, and RapidCents applies that figure rather than one of its own.

Ownership is traced through the chain rather than stopped at the first company. Where the merchant’s shares are held by another entity, RapidCents identifies the individuals behind that entity and continues up the ownership chain until it reaches individuals. A trust is treated the same way: the trustees, the known beneficiaries and the settlors are identified. This is why an applicant with a holding company structure is asked for more than an applicant with two individual shareholders — it is the number of layers, not the size of the business, that determines the work.

Where no individual reaches the threshold — as happens with a widely held company, a co-operative or a not-for-profit — RapidCents records the directors and the individuals holding senior management responsibility, as the regulations direct. Where beneficial ownership information cannot be obtained, or where RapidCents cannot confirm its accuracy by reasonable measures, the regulations require the business relationship to be treated as high risk and enhanced measures to be applied. That is a rating, not an accusation, and it is stated here because a merchant asked further questions after supplying a complicated ownership chart is entitled to know why.

5. Sanctions and politically exposed person screening

Names are checked against sanctions lists, and against lists of people holding senior public office and those close to them. A match is not an allegation — most are false and are cleared by confirming a date of birth. A genuine match is not something RapidCents has any discretion about.

The business, its directors, its officers, its beneficial owners, its affiliates and the individuals authorised on the account are screened against sanctions listings before the account is opened, and again while it is open, because a listing can be added at any time to a person who was not listed when the account was approved.

The listings screened are the ones clause H.3 of the Services Agreement identifies. In Canada: persons listed under the Special Economic Measures Act, the Justice for Victims of Corrupt Foreign Officials Act (Sergei Magnitsky Law), the United Nations Act and the regulations made under it, and the listings of terrorist entities under the Criminal Code. Elsewhere: the lists maintained by the Office of Foreign Assets Control of the United States Department of the Treasury, including the Specially Designated Nationals and Blocked Persons List, and the listings of the United Nations Security Council, the European Union and the United Kingdom. A person owned or controlled by a listed person is treated as listed.

This policy does not publish a list of countries RapidCents will not process for. Sanctions listings and the scope of country-level measures change without notice and by instrument, and a list reproduced here would be wrong from the day it changed. Whether RapidCents can support a business selling into a particular country is determined at application and, for an existing merchant, on request through the route in clause 13. What clause H.3(c) of the Services Agreement fixes is the rule rather than the list: the Services may not be used to submit, process, settle or receive funds for a Transaction for, on behalf of or for the benefit of a listed person, or in, from or involving a country or territory that is the subject of comprehensive sanctions.

Separately from sanctions, RapidCents makes the politically exposed person determinations the PCMLTFA and its regulations require of it, in the circumstances they prescribe. The categories the legislation defines are a politically exposed foreign person, a politically exposed domestic person and the head of an international organization, together with their prescribed family members and close associates. Being a politically exposed person is not a disqualification and carries no imputation of wrongdoing: it is a status attaching to holding or having held a senior public office, and it triggers the additional measures the regulations set, which may include establishing the source of the funds and the source of the wealth involved and obtaining senior management approval to open or keep open the account.

Screening produces false matches, and produces them constantly, because it matches on names. A common name will hit a listing belonging to somebody else. Most matches are cleared by confirming a date of birth or a country of residence, which is one of the reasons that information is collected. Where a match is not cleared, RapidCents will not open the account, and where the merchant is already onboarded RapidCents may act under clause 9. Where a listing genuinely applies, RapidCents has no discretion: it may not process, and it may not release funds, whatever the commercial consequence to the merchant or to RapidCents.

6. Ongoing monitoring, and why an established merchant is asked again

Verification is not a gate you pass once. RapidCents has a legal duty to keep your file current, so a merchant of eight years can be asked for fresh identification or an updated ownership chart. That request is not a signal that something is wrong.

Verification at onboarding establishes who a merchant was on the day it applied. The PCMLTFA regulations require a reporting entity to conduct ongoing monitoring of a business relationship: to keep client identification and beneficial ownership information up to date, to reassess risk, and to detect activity that is inconsistent with what is known about the client. That obligation runs for the life of the relationship.

The practical consequence is that an established merchant will periodically be asked for documents it has already supplied. A request of that kind is generated by the age of the file and the risk rating attached to it, not by suspicion. The regulations require information to be kept current at a frequency set by the risk assessed, and more frequently where that risk is assessed as high. A merchant asked to re-confirm its ownership after several uneventful years is being asked because the file has aged.

Other events prompt a review outside the ordinary cycle: a change reported under clause H.1 of the Services Agreement, or one RapidCents becomes aware of without being told; a change in what is sold or in how it is sold; a shift in volume, average ticket size or country mix that does not match the business described at approval; a new sanctions listing; information received from the Acquirer, an Association, a regulator or a Customer; and a chargeback, refund or complaint pattern of the kind clause 8 of the Acceptable Use Policy describes.

Clause F.7 of the Services Agreement obliges a merchant to provide requested information promptly, and clause H.4 requires records to be produced in a usable format within five (5) days of a request, or within any shorter period a Network Rule, a retrieval or representment deadline or a legal obligation imposes. Clause 8 of the Acceptable Use Policy states the same duty in its own terms. Failure to provide what has been requested, within the time specified, is itself a ground for suspension under clause B.5 of the Services Agreement, independently of whatever the request was about.

Monitoring is carried out for RapidCents’ own regulatory and risk purposes. It is not a review conducted for a merchant’s benefit, and the fact that RapidCents has not raised a question does not mean a merchant is meeting its own obligations.

7. Transaction monitoring and reporting obligations

Payments are monitored for the patterns the law tells RapidCents to look for, and some of what is found has to be reported. Reporting is a legal duty, not a judgement about you.

Transactions submitted through the Services are monitored for the indicators the PCMLTFA, its regulations and FINTRAC’s published guidance identify, and for the patterns the Network Rules and the Acquirer require an acquiring processor to detect. Monitoring is applied to individual Transactions and to the account as a whole, and it is informed by what the merchant told RapidCents about its business at approval — which is why clause H.1 makes an unreported change to that description a material breach.

Indicators are patterns, not verdicts. What is examined includes Transactions inconsistent with the stated business model, average ticket size or volume; a rapid change in activity with no business explanation; card testing; the characteristics of processing on behalf of an undisclosed third party, contrary to clauses B.4(g) and H.9 of the Services Agreement; refund and chargeback patterns not explained by the goods or services sold; structuring, meaning the splitting of a payment so that it falls below a threshold; and Transactions connected to a person or a place that screening has flagged.

Where the applicable test is met, RapidCents makes the reports the PCMLTFA and its regulations require of a reporting entity of its kind. These include a suspicious transaction report, where there are reasonable grounds to suspect that a Transaction or an attempted Transaction is related to the commission or attempted commission of a money laundering offence or a terrorist activity financing offence, and a terrorist property report, where property in RapidCents’ possession or control is owned or controlled by or on behalf of a listed person. Reporting is a statutory duty. RapidCents has no discretion to decline to report, and a merchant cannot ask it not to.

A report is not a finding that a merchant has done anything wrong. The statutory test for a suspicious transaction report is reasonable grounds to suspect, which is a lower standard than belief and far lower than proof, and it is set that way deliberately: a reporting entity is a source of information for a financial intelligence unit, not a tribunal. Clause 8 sets out what RapidCents may and may not say to a merchant about this.

Clause F.7 of the Services Agreement authorises RapidCents to share information about a merchant with the Acquirer, the Associations, regulatory authorities and other financial services providers where that is necessary for compliance or risk management purposes. Section 6 of the Privacy Policy describes the same sharing from the privacy side.

8. What RapidCents cannot tell you about a report

If RapidCents has made a report, it will not tell you that it has, and in some cases the law forbids it to. So if an explanation seems thin, or an account stays restricted with no detail given, do not read that silence as evasion or bad faith — it may be the only answer RapidCents is free to give.

This clause exists because its absence causes real harm. A merchant whose funds are held, whose account is restricted, or whose questions receive an answer with no detail in it will reasonably conclude that RapidCents is avoiding them. Sometimes it is not, and cannot say so.

In Canada, section 8 of the PCMLTFA prohibits a person or entity from disclosing that they have made a report under section 7 of that Act, or from disclosing the contents of such a report, with the intent to prejudice a criminal investigation, whether or not a criminal investigation has begun. In the United States, the confidentiality rule attaching to a suspicious activity report under the Bank Secrecy Act is absolute in its terms: a financial institution and its directors, officers, employees and agents are prohibited from disclosing the existence of such a report, and that prohibition applies even as against the person the report concerns.

RapidCents’ position is therefore the position a reporting entity has to take. It neither confirms nor denies that a report has been made about a merchant, a Transaction or an account, to the merchant or to anyone else. It does not do so on request, in response to a complaint, or in correspondence with a merchant’s lawyer or accountant. The reason it neither confirms nor denies, rather than answering case by case, is that answering only where nothing has been reported would itself disclose the cases where something has.

What follows from this is worth stating plainly. If a hold, a restriction or a closure is explained only in general terms, that is not necessarily discretion being exercised badly — it may be the most that can lawfully be said. Clause H.3 of the Services Agreement records the same thing in contractual form: RapidCents may be required to decline or delay a Transaction, to freeze or refuse to release funds, or to restrict, suspend or close an account, in each case without notice and in some cases without being permitted by law to tell the merchant that it has done so.

Two limits on that. First, this clause covers reports and their contents. It does not extend to whatever RapidCents can lawfully explain, and RapidCents will give a merchant the reason for an action where it is free to do so; clause C.6.3 of the Services Agreement requires notice of the general reason for a payout suspension and, where possible, an estimated timeline for release of funds. Second, nothing here affects a merchant’s right to complain under clause A.6 of the Services Agreement, to exercise the rights described in section 8 of the Privacy Policy subject to the exceptions that privacy legislation itself provides, or to take a matter to a court or a regulator. Those routes remain open whether or not anything has been reported.

9. When verification fails, or a file goes stale

Verification failure is not one thing, and neither is the response. RapidCents may hold a payout, restrict what the account can do, suspend it, or close it. What it will not do is charge you for closing — there is no cancellation fee and no early termination fee, whatever the reason the account ends.

Verification can fail in several distinct ways, and they are not equivalent: an applicant does not supply what was asked for; what was supplied cannot be verified against an independent source; the information supplied is inconsistent with the business as it actually operates; a beneficial owner cannot be identified or confirmed; a screening match is not cleared; or a file that was complete has gone stale because a request under clause 6 was never answered.

The measures available to RapidCents are the ones the Services Agreement already confers, and this policy adds none:

• Decline the application. RapidCents is not obliged to open an account, and clause 1 of the Acceptable Use Policy states that nothing obliges RapidCents to process for a business merely because that business is not named as prohibited.
• Hold or delay a payout, or change the Payout Schedule, under clause C.6.3 of the Services Agreement, which names compliance requirements and pending investigations among the grounds. Funds held do not bear interest payable to the merchant.
• Require or increase a Reserve under clause C.7, or extend the period for which one is held.
• Restrict what the account can do under clause H.3 — for example by limiting a channel, a Transaction type, a country or a volume — pending resolution.
• Decline or delay an individual Transaction, or refuse to release funds, where clause H.3 requires it.
• Suspend the account, immediately and without prior notice, under clause B.5, which makes failure to cooperate in an investigation or to provide requested information an express ground.
• Terminate the Agreement under clause F.1.3, which includes providing false, incomplete, inaccurate or misleading information, failing to cooperate or to provide requested information, and being required to act by law, regulation, court order or the request of a regulatory authority.

Which of these is used depends on what has failed. An unanswered document request from a merchant with an otherwise consistent file is ordinarily met with a reminder and, if it stays unanswered, a restriction until it is answered. A screening match that is not cleared, or an ownership structure that cannot be resolved to individuals, has no graduated response available: RapidCents cannot lawfully continue to process.

Closing an account costs a merchant nothing. RapidCents charges no early termination fee and imposes no cancellation penalty of any kind, as clause A.4 and clause F.1.2 of the Services Agreement provide, and that is so whether the merchant closes the account or RapidCents does, and whatever the reason. What termination does not do is extinguish liability already incurred: clause A.5 preserves a merchant’s liability for Transactions processed before termination, including chargebacks and refunds that arise afterwards, and clause C.7 allows Reserve funds to continue to be held while trailing liabilities or an investigation remain open.

Clause F.8(a) of the Services Agreement is the waiver that attaches to action taken in good faith to comply with applicable law, regulations, court orders or requests from regulatory authorities. Where a lawful obligation requires RapidCents to act, acting on it is not a breach of the Agreement.

10. Changes you must tell us about

Tell RapidCents before things change if you can see the change coming — ten days ahead — and within five days if you cannot. A new owner, a new product, a new country, a new website, a new director: all of it. Silence is a breach of the agreement, not an oversight.

Underwriting, pricing, monitoring and every verification described above run off what a merchant told RapidCents. Clause H.1 of the Services Agreement makes reporting a change to those facts an obligation with a deadline rather than a courtesy: notice at least ten (10) days before the event where it is within the merchant’s control or reasonably foreseeable by it, and in every other case no later than five (5) days after the merchant first becomes aware of it.

The events clause H.1 lists, so far as this policy is concerned, are:

• A change of control, or a change in the direct or indirect legal or beneficial ownership of twenty-five percent (25%) or more, by a single transaction or a series of them — clause H.1(a).
• A sale, lease, assignment or transfer of all or a substantial part of the business or its assets, or an amalgamation, arrangement, merger, continuance or reorganization involving it — clause H.1(b).
• A change of legal name, registered address, principal place of business, directors, officers, or the individuals identified to RapidCents as beneficial owners or as having signing authority — clause H.1(i).
• A change in the type of business, product or service line, sales channel, fulfilment model, average ticket size or expected monthly Transaction volume, where it is material or falls outside what the account was approved for — clause H.1(e). Clause 7 of the Acceptable Use Policy requires that notice to be given before the change, not after it.
• A new, changed or additional URL, domain, mobile application, storefront, trade name, operating name or billing descriptor — clause H.1(f).
• The suspension, revocation, expiry, surrender or non-renewal of a licence, permit, registration or accreditation the business needs in order to trade — clause H.1(g).
• An investigation, enforcement action, order, undertaking, penalty or formal inquiry by a regulator, a law enforcement authority, a taxing authority, an Association, the Acquirer or another payment processor, and placement in an Association monitoring, remediation or terminated-merchant programme — clause H.1(h).
• Insolvency, bankruptcy, receivership, liquidation, a proposal or arrangement with creditors, and any materially adverse change in financial condition — clauses H.1(c) and H.1(d).

Failing to give a notice clause H.1 requires, and giving one that is false, incomplete or misleading, is a material breach of the Services Agreement. On becoming aware of any of these events, whether the merchant reported it or not, RapidCents may re-underwrite the account, change the Payout Schedule or hold funds under clause C.6.3, require or adjust a Reserve under clause C.7, suspend under clause B.5, and terminate under clause F.1.3.

A change of ownership or of the trading entity is the one merchants most often treat as an internal matter. It is not. A new beneficial owner is a person RapidCents has never verified and has never screened, and a new legal entity is a new customer with no verified file at all. In the second case the existing account cannot simply be relabelled, and a fresh application is required.

11. Platforms, marketplaces and sub-merchants

Clause B.4(g) of the Services Agreement prohibits a merchant from using the Services to process Transactions for a third party or from acting as a payment intermediary or aggregator, and clause H.9 states that prohibition in operative detail. The prohibition exists because processing for an unverified third party puts a party into the payment flow whom nobody has identified, which is precisely the outcome this policy is directed at.

Where RapidCents approves a platform or marketplace arrangement, sub-merchants are onboarded onto connected accounts and each one is verified in its own right. RapidCents collects the identification, ownership and screening information for each seller through that onboarding and surfaces the verification status to the platform, and the platform’s application controls the seller’s experience. That does not move the compliance obligation off the platform. Clause H.9 of the Services Agreement makes an approval conditional on the platform collecting, verifying and retaining identification and beneficial ownership information for each seller as RapidCents specifies, screening each seller against the sanctions listings referred to in clause H.3 before onboarding and on an ongoing basis, monitoring each seller and removing one when RapidCents directs it, accepting full liability for every Transaction, Chargeback, Refund, Fee, Fine and loss arising from a seller as if the platform had made the sale itself, and giving RapidCents, the Acquirer and the Associations the record-keeping, production and audit rights at clause H.4 in respect of each seller. Payouts to a seller are not enabled until that seller’s verification is complete.

A platform is therefore not a route by which businesses that could not be onboarded directly are onboarded indirectly. The Acceptable Use Policy applies to every sub-merchant, screening applies to every sub-merchant, and clause 9 of this policy applies to a sub-merchant that cannot be verified in the same way it applies to any other merchant.

12. How this information is handled, and how long it is kept

This is personal information and it is handled under the Privacy Policy. One thing to know: a request to delete your verification records cannot be granted while the law requires them to be kept. Correcting an inaccurate record is always available; deleting one the law requires us to hold is not.

The information collected under this policy is personal information, and it is handled under the Privacy Policy: section 4 lists what is collected, section 5 the purposes, section 6 who it is shared with, and section 9 where it is stored and transferred. It is held under the controls described in the Security Statement, data belonging to different merchants is logically separated, and access to merchant data by authorized RapidCents staff is granted by role and logged.

Retention is where anti-money-laundering law and privacy law meet, and one of them wins. Identity verification and onboarding records are retained for the period required of a reporting entity under Canadian anti-money-laundering legislation, which runs from the end of the business relationship rather than from the date a document was collected. That period is fixed by the PCMLTFA and its regulations, not by RapidCents, and this policy does not state a number for it because the number is not RapidCents’ to set — nor is it one Support can supply, for the same reason. The categories retained, and the basis on which each is kept, are set out in section 7 of the Privacy Policy. Which of those categories a particular record falls in is a question about personal information RapidCents holds about you, so it goes to the Privacy Officer rather than to Support, and section 8 of the Privacy Policy fixes what happens to it: receipt is confirmed, an answer follows within thirty (30) days or an explanation of why more time is needed and when to expect one, and there is no charge for a reasonable request.

A consequence follows that merchants sometimes find surprising: a request to delete identity verification records cannot be granted while the statutory retention period is still running. Section 2 of the Privacy Policy says so expressly, and section 8 explains the rights that do apply — access, correction of information that is inaccurate or incomplete, and the balance of the rights conferred by PIPEDA, by Quebec’s Law 25, by Alberta’s and British Columbia’s Personal Information Protection Acts, and by the comprehensive privacy legislation of United States jurisdictions, each within its own scope. Correcting an inaccurate record is always available; deleting a record the law requires to be kept is not.

A merchant who wants to know what personal information is held about it should write to the Privacy Officer at the address in section 12 of the Privacy Policy. A question about verification status, about a document request, or about what is still needed to complete a file should go to the route in clause 13 instead, which reaches the team that can act on it.

13. Questions, decisions and complaints

Questions about what has been requested, what is still outstanding, or what a particular document is for should go to RapidCents Support: through the portal at help.rapidcents.com, by email to [email protected], or by telephone at +1-844-957-2743 in Canada or +1-202-902-6226 in the United States. Written correspondence may be sent to RapidCents Inc., 515 Consumers Road, Unit 210, North York, Ontario, M2J 4Z2, Canada, or in the United States to 43300 Southern Walk Plaza, #166, Ashburn, Virginia 20148.

A decision to decline an application, to restrict an account or to close one is RapidCents’ to make. RapidCents will give the reason where it is free to do so, and will say when it is not; clause 8 sets out the circumstance in which it is not. This policy sets no verification turnaround time and none should be inferred from it: how long verification takes depends on the entity type, the number of layers in an ownership structure, the quality of the documents supplied, and whether a screening match has to be cleared.

A complaint about how a verification or a compliance decision was handled follows the procedure at clause A.6 of the Services Agreement: Support first; escalation to the RapidCents Executive Office at [email protected] if the complaint is not resolved or formally closed within fourteen (14) business days; and the final escalation route in that clause if a further five (5) business days pass without a substantive answer. RapidCents adheres to the Code of Conduct for the Credit and Debit Card Industry in Canada, as clause A.9 of the Services Agreement records.

Where a verification outcome involves automated processing, the rights described in section 8 of the Privacy Policy apply, including the right of a Quebec resident to be informed of a decision made exclusively by automated processing and to submit observations on it. Clause H.8 of the Services Agreement separately governs the risk and fraud tools RapidCents makes available to merchants, which are advisory and leave the accept-or-decline decision on a Transaction with the merchant.

14. Changes to this policy

RapidCents may revise this policy. The effective date and the revision date at the head of this page are separate: the revision date changes with every edit, and the effective date changes when the substance changes. This policy is reviewed at least once every twelve months, and sooner where the PCMLTFA or its regulations are amended, where FINTRAC issues guidance that changes what is required, where a Network Rule or an Acquirer requirement changes, or where RapidCents changes how it operates the programme described here.

Where a change materially affects how personal information is handled, notice is given as section 14 of the Privacy Policy provides. A change to this policy does not amend the Services Agreement: clause F.2 of the Agreement governs how the Agreement itself is amended, and clause A.3 sets out a merchant’s right to cancel without penalty in the circumstances that clause names.