Earlier quoted context omitted.
"Financial services" are verbatim not allowed by Stripe's Acceptable Use Policy. What kind of businesses are permitted to use Stripe Treasury? Which functionality is specifically provided (or anticipated to be provided) by Goldman Sachs Bank? The answer is probably a credit card. Who performs KYC? Is it Stripe FTEs, Stripe contractors, or a vendor? Is it Evolve's vendor? The answer is probably a vendor. When submitti…
Stripe Treasury does not violate our terms, and allows SaaS platforms (and similar) to provide their business users with access to capabilities which are regulated with those capabilities fulfilled by entities with the appropriate licensing and backed by our financial partners. This is similar to how our Connect product lets our regulated entity do money transmission on behalf of a demand economy company without them…
Would AngelList's angel investing product, built on Treasury, violate Stripe's AUP? How about TransferWise? These are financial services companies, they are something I can imagine building on Stripe Treasury. But they are probably against your AUP, even if of course they are permissible from a legal point of view.
> KYC goes through Stripe's processes. This is both operationally complicated and something that we generally do not go into detail on.
One of the things I like about banks is, when you're dealing with large amounts of money, which is what I aspire to do, you are talking with an educated person on the other end of the line. It's very easy to talk with integrity because the bank's FTE is experienced, vested in a positive outcome for you, doesn't get tripped up with keywords, and critically, because they live here and are paid well, they have something at stake, you can achieve a remedy if you don't get what you need from them.
With a contractor, there's a script. It's hard to talk with integrity because you might say a forbidden word, or you might merely delay your legitimate business even further by having to wait even longer for a Zendesk follow-up, or you might be dealing with someone in a foreign country beyond the law who is just going to criminally misuse information in your docs, like your passport, because SOC 2 and ISO 27001 are just policies, they're not laws and they're especially not enforcement. This is pretty consistent with everyone’s experience with contractors versus W2 in customer service and other cost departments, it is not a controversial position, it is definitely correlated with the fact that it is capricious, with no remedies, when you are locked out of eg your Google account, compared to say getting your checking account closed at a bank for non-legal reasons - at least the bank gives you the money in the account, while Google generally does not give you your emails nor responds to your support tickets.
It's one thing when it's a $100 merchant payment. Who cares. It's another when it's a $1,000,000 transfer. I understand the desire to scale and compartmentalize, to use vendors. It is pretty clear that the bulk of compliance work is not done through W2 Stripe employees, although I don't see why that is possible with a bank and not with Stripe.
> Given that the implementing SaaS business will control the UX around initiating a payment, they could control how much or little bookkeeping to do at time of a payment or transfer.
I'm asking, how do the typical statement-of-purpose and other KYC processes adopted by other fintech firms fit into your API? For example, if my business or I transfer $1,000,000, most fintech firms ask a day or two later to fulfill more detailed statement of purpose asks, as part of a "large transfer compliance" department sort of thing, like providing an invoice and information about the recipient. I understand this is above-and-beyond any regulatory requirements but I could be wrong. So suppose my end user makes a $1,000,000 transfer that I fulfill using Stripe Treasury-backed API, do you then follow up days later with the Treasury implementer (me), via e-mail, to obtain PDFs from the end user, etc.? Or do you simply not perform this sort of above-and-beyond ask?
The broader question was really about, how do you anticipate doing this KYC in an API-driven way? Or is the answer you will not? I'm not asking the specifics of the policy, I understand you cannot disclose the policy, I'm asking from a UX point of view, how will that policy be acted out? Because building the whole API implementation and then winding up in an e-mailing PDF back-and-forth with a contract Stripe employee anyway sounds pretty crummy.
Are the unusual asks are part of determining whether or not the implementor / intermediary is obeying an AUP, not to fulfill legal obligations? AUPs are at once quite subjective and opinionated but also surprisingly uniform among Internet money companies, leading me to believe that this is not something anyone actually feels strongly about but really just cargo-cults. While I do not personally believe this, the most cynical belief is that this is data gathering and lead generation, that Treasury is really a Robinhood-style business, so the docs asked are retained to be later analyzed for secular, non-compliance reasons like identifying new customers (i.e., the recipients's business) and pricing.