> ## Documentation Index
> Fetch the complete documentation index at: https://laas.mippo.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance obligations for LaaS partners

> BCB SPSAV rules, Travel Rule requirements, KYT monitoring, and record retention obligations that partners must follow when integrating Mippo LaaS.

<Note>
  Mippo is the regulated entity on all transactions. Your obligation as a LaaS partner is to integrate correctly — Mippo owns the compliance burden.
</Note>

## BCB SPSAV License

Mippo holds the **SPSAV (Serviço de Pagamento em Ativos Virtuais)** license under BCB Resolutions 519-521.

Key implications for partners:

* You **do not** need a SPSAV license to use LaaS
* Mippo remains the regulated entity — your company name does not appear on regulatory filings
* You cannot delegate or sub-license Mippo's SPSAV authorization to third parties

## Travel Rule (100% coverage)

BCB Resolution 520 mandates that originator and beneficiary data travels with every virtual asset transfer, regardless of amount. There is **no de minimis threshold** under the Brazilian rule.

Mippo enriches every transaction automatically:

* Originator: derived from the KYC submission (CPF, name, wallet)
* Beneficiary: the destination wallet address + asset
* No action required from partners

## Independent sanctions screening

Even in **Model 2** (partner runs KYC), Mippo independently screens every submission against:

| List                 | Body                                  |
| -------------------- | ------------------------------------- |
| COAF list            | Brazilian Financial Intelligence Unit |
| OFAC SDN             | US Treasury                           |
| UN Consolidated List | United Nations Security Council       |

A `partnerKycToken` does not bypass Mippo's screening. If Mippo detects a sanctions hit that your vendor missed, the KYC call returns `KYC_REJECTED` with `reason: "SANCTIONS_HIT"`.

## 5-year record retention

BCB requires that all KYC data and transaction records be retained for **5 years** from the date of the transaction. Mippo owns this obligation — you do not need to store KYC data beyond what your own product requires.

## COAF SAR reporting

When Mippo's KYT (Know Your Transaction) engine detects suspicious patterns, Mippo files a **Suspicious Activity Report (SAR)** with COAF within 24 hours. You are notified via a `compliance.sar_filed` webhook (contact support to enable this event).

Partners are **not required** to file their own SARs for transactions processed through LaaS.

## PEP handling

Politically Exposed Persons (PEPs) and their close associates trigger a `HIGH` risk tier in KYC. LaaS mandates liveness verification for every transaction from a `HIGH` or `PEP` client — TOTP MFA alone is insufficient per BCB guidance.

Do not attempt to override the `riskTier` returned by Mippo's KYC response.

## AML policy requirement

All approved LaaS partners must maintain and share an **AML Policy** document with Mippo before go-live. This is reviewed during the partner approval process.