Skip to main content
Mippo is the regulated entity on all transactions. Your obligation as a LaaS partner is to integrate correctly — Mippo owns the compliance burden.

​
BCB SPSAV License

Mippo holds the SPSAV (Serviço de Pagamento em Ativos Virtuais) license under BCB Resolutions 519-521. Key implications for partners:
  • You do not need a SPSAV license to use LaaS
  • Mippo remains the regulated entity — your company name does not appear on regulatory filings
  • You cannot delegate or sub-license Mippo’s SPSAV authorization to third parties

​
Travel Rule (100% coverage)

BCB Resolution 520 mandates that originator and beneficiary data travels with every virtual asset transfer, regardless of amount. There is no de minimis threshold under the Brazilian rule. Mippo enriches every transaction automatically:
  • Originator: derived from the KYC submission (CPF, name, wallet)
  • Beneficiary: the destination wallet address + asset
  • No action required from partners

​
Independent sanctions screening

Even in Model 2 (partner runs KYC), Mippo independently screens every submission against: A partnerKycToken does not bypass Mippo’s screening. If Mippo detects a sanctions hit that your vendor missed, the KYC call returns KYC_REJECTED with reason: "SANCTIONS_HIT".

​
5-year record retention

BCB requires that all KYC data and transaction records be retained for 5 years from the date of the transaction. Mippo owns this obligation — you do not need to store KYC data beyond what your own product requires.

​
COAF SAR reporting

When Mippo’s KYT (Know Your Transaction) engine detects suspicious patterns, Mippo files a Suspicious Activity Report (SAR) with COAF within 24 hours. You are notified via a compliance.sar_filed webhook (contact support to enable this event). Partners are not required to file their own SARs for transactions processed through LaaS.

​
PEP handling

Politically Exposed Persons (PEPs) and their close associates trigger a HIGH risk tier in KYC. LaaS mandates liveness verification for every transaction from a HIGH or PEP client — TOTP MFA alone is insufficient per BCB guidance. Do not attempt to override the riskTier returned by Mippo’s KYC response.

​
AML policy requirement

All approved LaaS partners must maintain and share an AML Policy document with Mippo before go-live. This is reviewed during the partner approval process.