|
> Stripe Treasury does not violate our terms... Would AngelList's angel investing product, built on Treasury, violate Stripe's AUP? How about TransferWise? These are financial services companies, they are something I can imagine building on Stripe Treasury. But they are probably against your AUP, even if of course they are permissible from a legal point of view. > KYC goes through Stripe's processes. This is both operationally complicated and something that we generally do not go into detail on. One of the things I like about banks is, when you're dealing with large amounts of money, which is what I aspire to do, you are talking with an educated person on the other end of the line. It's very easy to talk with integrity because the bank's FTE is experienced, vested in a positive outcome for you, doesn't get tripped up with keywords, and critically, because they live here and are paid well, they have something at stake, you can achieve a remedy if you don't get what you need from them. With a contractor, there's a script. It's hard to talk with integrity because you might say a forbidden word, or you might merely delay your legitimate business even further by having to wait even longer for a Zendesk follow-up, or you might be dealing with someone in a foreign country beyond the law who is just going to criminally misuse information in your docs, like your passport, because SOC 2 and ISO 27001 are just policies, they're not laws and they're especially not enforcement. This is pretty consistent with everyone’s experience with contractors versus W2 in customer service and other cost departments, it is not a controversial position, it is definitely correlated with the fact that it is capricious, with no remedies, when you are locked out of eg your Google account, compared to say getting your checking account closed at a bank for non-legal reasons - at least the bank gives you the money in the account, while Google generally does not give you your emails nor responds to your support tickets. It's one thing when it's a $100 merchant payment. Who cares. It's another when it's a $1,000,000 transfer. I understand the desire to scale and compartmentalize, to use vendors. It is pretty clear that the bulk of compliance work is not done through W2 Stripe employees, although I don't see why that is possible with a bank and not with Stripe. > Given that the implementing SaaS business will control the UX around initiating a payment, they could control how much or little bookkeeping to do at time of a payment or transfer. I'm asking, how do the typical statement-of-purpose and other KYC processes adopted by other fintech firms fit into your API? For example, if my business or I transfer $1,000,000, most fintech firms ask a day or two later to fulfill more detailed statement of purpose asks, as part of a "large transfer compliance" department sort of thing, like providing an invoice and information about the recipient. I understand this is above-and-beyond any regulatory requirements but I could be wrong. So suppose my end user makes a $1,000,000 transfer that I fulfill using Stripe Treasury-backed API, do you then follow up days later with the Treasury implementer (me), via e-mail, to obtain PDFs from the end user, etc.? Or do you simply not perform this sort of above-and-beyond ask? The broader question was really about, how do you anticipate doing this KYC in an API-driven way? Or is the answer you will not? I'm not asking the specifics of the policy, I understand you cannot disclose the policy, I'm asking from a UX point of view, how will that policy be acted out? Because building the whole API implementation and then winding up in an e-mailing PDF back-and-forth with a contract Stripe employee anyway sounds pretty crummy. Are the unusual asks are part of determining whether or not the implementor / intermediary is obeying an AUP, not to fulfill legal obligations? AUPs are at once quite subjective and opinionated but also surprisingly uniform among Internet money companies, leading me to believe that this is not something anyone actually feels strongly about but really just cargo-cults. While I do not personally believe this, the most cynical belief is that this is data gathering and lead generation, that Treasury is really a Robinhood-style business, so the docs asked are retained to be later analyzed for secular, non-compliance reasons like identifying new customers (i.e., the recipients's business) and pricing. |
As for handling exceptions on individual transactions: this is something which Stripe does very frequently with respect to our Stripe Connect users. For example, we might need to inquire about a large payment made over a Stripe Connect platform, particularly if it appears out-of-character for their usage or for that platform. (We might have questions about a million dollar “pizza” order.) Depending on our specific business relationship with the platform, the flow might be the platform reaching out to the customer for documentation, it might be the platform reviewing information provided contemporaneously with the transaction, it might involve us reviewing metadata on the transaction, or it might involve us reaching out to the user.
Depending on the specifics of what a platform does, it might have internal compliance or fraud teams. Many of our large platforms do; we interface with them (and create interfaces for them) to maximize their effectiveness and minimize silliness.