Mandatory controls
- Cross-border transfer logs retained for at least 6 months
- TLS 1.3 enforced for all API channels
- KYC tiering for personal and enterprise accounts
- Sensitive-region registration blocking
- AML alerts for high-risk recharge and usage patterns
- 24x7 moderation response workflow with manual escalation