Security and compliance

Sanctions screening, KYB, a full audit trail and suspicious-transaction reporting, wired into every flow. AML and security controls for stablecoin payments in Africa.

Account and access

KYB verification

We verify your business before enabling live operations.

Scoped API keys, production and test

Each key carries fine-grained scopes, separate for production and test.

Multi-factor authentication

Dashboard access is protected with a second factor.

Role-based access

Control what each team member can see and do.

Compliance and AML

Source-of-funds screening

The origin address of every deposit is screened against sanctions lists before it is credited or swept.

Sanctions and asset-freeze lists

Addresses are screened against the major lists (OFAC, UN, EU), refreshed on a schedule.

Held by default

If screening cannot run, funds are held rather than released.

Full audit trail

Every screening decision and sensitive action is recorded as an audit event.

Suspicious-transaction reporting

Generate suspicious-transaction report worksheets to complete and file with national financial intelligence units (CENTIF in Benin, NFIU in Nigeria).

KYB and beneficial owner

We verify the business and identify ultimate beneficial owners at the start of the relationship.

Withdrawal controls

Withdrawal allow-list

Payouts only go to addresses you have pre-approved.

Cooling-off window

New destinations wait before they can receive funds.

Per-asset withdrawal limits

Cap how much can leave per transaction and per day, per asset.

Destination screening

Risky destinations are held for review before sending.

Integration integrity

HMAC-signed webhooks

Every event is signed so you can verify it came from CowriePay.

Signing-secret rotation

Rotate secrets with an overlap window, with no missed deliveries.

Idempotency on writes

Safe retries, with no duplicate payouts.

Testnet and mainnet isolation

Sandbox and production data never mix.