Trust Center · compliance
Compliance posture
Honest scope for bank and fintech vendor assessment. No false certifications.
01
What ABCP covers
- Agent identity binding, policy, limits, confirm, rail verification mapping, receipts
- Role separation: admin / operator / auditor
- Retention of receipts for the contracted window (pilot default: 13 months unless SOW states otherwise)
02
What partners hold
Money transmission, deposit taking, card issuing, and related licenses remain with licensed rail partners. ABCP does not substitute for those licenses.
03
What we do not claim
- PCI DSS certification (unless a separate attestation is published)
- OSFI / OCC / FCA approval
- Chartered bank or BaaS license
04
Control catalog (questionnaire map)
| Control | Bank ask (sample) |
|---|---|
| Identity & delegation identity_delegation | Who is the agent acting for? · Can grants be revoked instantly? |
| Dual control / confirm for high-value dual_control | What requires a second factor? · Is confirm replayable? |
| Segregation of duties sod | Who can change limits? · Who can suspend agents? |
| Idempotency & replay protection idempotency | What happens on network retry? · Can a confirm be reused? |
| Kill switch / suspend-agent kill_switch | How fast can we stop an agent? · Does suspend cover in-flight confirms? |
| Immutable audit (receipts) immutable_audit | Can we export for examiners? · Are receipts tamper-evident? |
| Fail-closed decisioning fail_closed | What is the default on dependency failure? |
Contact operations@noetfield.com for NDA diligence packs. Origin https://banking.noetfield.com.