> ## Documentation Index
> Fetch the complete documentation index at: https://laas.mippo.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance controls in Supercosmos for Platforms

> How Supercosmos for Platforms handles KYC and KYB, sanctions screening, Travel Rule data, and record retention.

> [!NOTE]
>
> Supercosmos runs the compliance controls below on your users and their transactions. Each platform is responsible for assessing its own regulatory obligations.

## KYC and KYB via Sumsub

Supercosmos verifies identities through Sumsub (KYC for individuals, KYB for companies). The parts your platform runs depend on the onboarding model you choose.

## Travel Rule (100% coverage)

Originator and beneficiary data travels with every virtual asset transfer, regardless of amount. There is **no threshold** below which it is skipped.

Supercosmos enriches every transaction automatically:

* Originator: derived from the KYC submission (CPF, name, wallet)
* Beneficiary: the destination wallet address + asset
* No action required from your platform

## Independent sanctions screening

Even in **Model 2** (your platform runs KYC), Supercosmos independently screens every submission against:

| List | Body |
| - | - |
| COAF list | Brazilian Financial Intelligence Unit |
| OFAC SDN | US Treasury |
| UN Consolidated List | United Nations Security Council |

A `partnerKycToken` does not bypass Supercosmos's screening. If Supercosmos detects a sanctions hit that your vendor missed, the KYC call returns `KYC_REJECTED` with `reason: "SANCTIONS_HIT"`.

## Record retention

Supercosmos keeps KYC data and transaction records under its retention policy.

## PEP handling

Politically Exposed Persons (PEPs) and their close associates trigger a `HIGH` risk tier in KYC. Supercosmos for Platforms requires liveness verification for every transaction from a `HIGH` or `PEP` client — TOTP MFA alone is not accepted for these risk tiers.

Do not attempt to override the `riskTier` returned by Supercosmos's KYC response.

## AML policy requirement

All approved platforms must maintain and share an **AML Policy** document with Supercosmos before go-live. This is reviewed during the access review.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.