Compliance Architecture
NUSDpay has a built-in professional compliance engine that provides automated transaction monitoring and risk assessment capabilities.
KYA — Know Your Address
Know Your Address (KYA) technology performs risk assessments on the blockchain addresses involved in transactions:- Address Profile: Identifies the type of entity to which the address belongs (exchange, mixer, darknet, sanctions list, etc.)
- Risk Score: Generates a risk score based on the address’s historical behavior
- Real-Time Screening: Automatically screens the target address of every Payin/Payout transaction
KYT — Know Your Transaction
Know Your Transaction (KYT) technology performs real-time monitoring of every transaction:- Transaction Screening: Automatically analyzes dimensions such as transaction amount, frequency, and counterparties
- Risk Rating: Three-level classification: High Risk / Medium Risk / Low Risk
- Post-Processing Policies: Triggers automatic approval, manual review, or interception based on the risk level
Screening Flow
Payin Screening
For every deposit by an end user, the system automatically performs:On-chain transaction detection
After NUSDpay detects a deposit transaction, it extracts the sender’s address and transaction information.
KYA address screening
Performs risk profiling on the sender’s address to check whether it is associated with sanctions lists, mixers, or other high-risk entities.
KYT transaction screening
Analyzes dimensions such as transaction amount, frequency, and route to generate a risk rating.
Payout Screening
For every payment initiated by a merchant, the system automatically performs:- KYA screening of the recipient address (address whitelist + risk profile)
- KYT analysis of transaction amount and frequency
- When risk control rules are triggered, the transaction enters review status (Webhook notification Sub-Status:
PendingAML/KYCReview)
Screening Results
| Status | Description |
|---|---|
| Passed | Screening passed; transaction processed normally |
| Pending Screening | Awaiting screening completion |
| Screened | Screening completed; awaiting post-processing |
| Manual Review | Requires manual review |
| Rejected | Screening failed; transaction rejected |
Post-Screening Policies
NUSDpay supports configuring Post-Screening Policies that automatically perform corresponding actions based on the risk rating:| Risk Level | Default Policy | Configurable Actions |
|---|---|---|
| Low Risk | Auto Approve | Approve / Alert / Reject |
| Medium Risk | Manual Review | Approve with Alert / Manual Review / Reject |
| High Risk | Auto Block | Reject / Freeze |
Post-Screening policies can be customized in the risk control module of the admin console.
API Security
Request Signature
All API requests use the Ed25519 signature + nonce anti-replay mechanism:- Each request carries a unique nonce (timestamp)
- The request body is signed with the Ed25519 private key
- The server verifies the signature + checks nonce validity to prevent replay attacks
Webhook Security
The Webhook notifications pushed by NUSDpay are also protected by signatures:- Each Webhook carries a signature header, so merchants can verify the message source
- We recommend responding within 2 seconds; the system automatically retries on timeout
- Use
request_idfor idempotent handling to prevent duplicate consumption
Security Best Practices
Key management
Key management
- The private key should only be used on the server side; do not hardcode it in front-end code
- Rotate API keys regularly
- Store keys using environment variables or a secrets management service
Network security
Network security
- All API communication must use HTTPS
- We recommend configuring an IP allowlist to restrict API call sources
- We recommend configuring HTTPS + signature verification on Webhook endpoints
Access control
Access control
- Follow the principle of least privilege; assign console permissions by role
- Sensitive operations (settlement, transfer) require secondary verification with a code
- Audit operation logs regularly
Next Steps
Transaction Status Reference
Learn the meaning of each status and sub-status, including AML review-related statuses.
Webhook Configuration
Configure Webhooks to receive transaction and compliance review notifications.