Our commitments: what Baasto won't do, can't do, and must report.

Version 0.2 · Last updated November 1, 2026

Payments run on trust. This page is written for everyone who has to trust us: customers, merchants and vendors, banks and card partners, and governments and regulators. Each commitment links to the law or standard behind it.

1. What we will not do

These are limits set by law, by our licensing, or by our partners. We won't make exceptions to them.

• Pay out money. We aren't licensed for withdrawals, remittance or sending money to anyone, in Somalia, Djibouti or elsewhere. Moving money to another person or place is "money transmission" and requires licensing we don't hold.³ Your balance can only be spent at approved merchants.
• Serve anyone on a sanctions list, or anyone acting for them, including people listed by the US Treasury's Office of Foreign Assets Control (OFAC) or the UN Security Council.¹²¹³¹⁵
• Open an account without verification. We must confirm who you are before you can add money or use a card.⁵²⁰
• Guarantee that a merchant will accept a payment. Merchants, card networks and our card issuer each make their own decisions.
• Keep your information from authorities when the law requires it, or always tell you about reports we make (see section 3).⁶
• Reverse a completed merchant purchase ourselves. Refunds depend on the merchant. Approved refunds return to your Baasto balance.
• Process a transaction we suspect is structured to avoid reporting, such as splitting payments to stay under a limit. Structuring is a federal crime.²
• Let a business use a personal account. Personal accounts are for personal purchases only.
• Serve customers outside our approved markets or connect from places our partners don't support.
• Ignore a lawful freeze or seizure order.

2. What we cannot do

Baasto isn't built for any of the following. They aren't features we offer, and some of these limits go further than the law requires.

• No cash-out of any kind: no ATM access, no transfers between users, no payments to bank or mobile money accounts.
• No credit. Baasto is prepaid only. We don't lend, offer overdrafts or pay interest.
• No gift cards, wallet top-ups, prepaid balances, crypto, gambling or in-game currency, even at approved merchants. Stored value is a common route for laundering money, so we block it outright.⁴²⁰
• No physical goods. Digital purchases only.
• No shared or borrowed accounts. One verified person, one account.
• No anonymous or nicknamed accounts. The name on the account must match your verified ID.
• No selling your data, and no sharing it for advertising.¹⁶
• No asking for your passwords, codes or full card numbers by message or phone. Anyone who does isn't us. Report it.
• No storing full card numbers on our servers. Card details are shown to you directly from our card issuer's secure systems.¹⁹
• No hidden fees. Any fee is shown before you confirm.
• No fees on dormant or closed-account balances.
• No using customer money to run the company. Customer funds and Baasto's own money are kept apart (see section 7).

3. What we are legally obligated to report

As a payments business working with US-regulated partners, Baasto expects to have the following duties. Where they apply, we will:

• Report suspicious activity to the US Financial Crimes Enforcement Network (FinCEN) by filing a Suspicious Activity Report. For money services businesses this applies to transactions of $2,000 or more that we know or suspect involve illegal funds, avoiding reporting rules, no lawful purpose, or using Baasto to help crime. Reports are due within 30 days of detection.⁶
• Keep those reports confidential. The law forbids us from telling anyone involved that a report was filed.⁶²
• File Currency Transaction Reports for cash transactions over $10,000 in a day, if Baasto ever handles cash directly (today it doesn't; local partners collect funds).⁷
• Block and report sanctioned property. If money involving a sanctioned person reaches us, we must freeze it and report it to OFAC within 10 business days, plus an annual report of blocked property. We also report rejected transactions within 10 business days.¹⁴
• Answer FinCEN information requests (known as "314(a)" requests), which ask financial institutions to search their records for named suspects, by the deadline FinCEN sets (currently 14 days).⁹
• Respond to valid legal process, such as court orders, subpoenas or regulator requests in the US, Somalia or Djibouti. We review each request and disclose only what is required.¹⁶
• Report suspicious activity to Somali and Djiboutian authorities where their laws apply, such as Somalia's Financial Reporting Center under the Somali anti-money-laundering law.²¹
• Report unclaimed balances to the relevant authority where unclaimed-property law requires it.²³
• Notify the US Federal Trade Commission of a data breach affecting 500 or more people within 30 days, if the FTC's Safeguards Rule applies to us.¹⁷
• Share information with our card issuer and banking partners when they need it to meet their own legal duties, including under the voluntary information-sharing safe harbor for financial institutions.¹⁰

Because of these duties, we may freeze, limit or close an account without notice, and we may not always be able to explain why.

4. What we are legally obligated to keep

• Identity and transaction records for at least 5 years. US anti-money-laundering rules require this.⁸
• Prepaid access records: who bought access to funds and how it was used, for 5 years.⁴⁸
• Copies of every Suspicious Activity Report and its supporting documents for 5 years.⁶
• Sanctions records for 10 years, following OFAC's 2025 extension of its recordkeeping period.¹⁴
• Our compliance decisions: every approval, freeze, closure and the reason for it, so auditors and partners can review them.

5. Sanctions

• Screening at signup and on every list update against the OFAC Specially Designated Nationals list and the UN Security Council consolidated list, including the Al-Shabaab sanctions regime.¹²¹⁵
• Somalia-specific rules. We follow the US Somalia Sanctions Regulations and the Global Terrorism Sanctions Regulations.¹³
• Fuzzy name matching for Somali names written in different spellings, with a trained person reviewing every possible match.
• No business with comprehensively sanctioned places, such as Cuba, Iran, North Korea, Syria and the occupied regions of Ukraine.¹²
• Blocked means blocked. Sanctioned funds are frozen and reported, never returned or forfeited to Baasto.¹⁴

6. How we verify people

• ID document plus a live selfie check before any account is used, following the international standard for customer due diligence.²⁰
• Phone number tied to a mobile money account in the customer's own name.
• Extra checks for politically exposed persons (government officials and their families), approved by our Compliance Officer.²⁰
• Ongoing monitoring, not a one-time check: we watch for shared devices, linked accounts and spending that doesn't match a customer's profile.⁵
• Spending and balance limits that start low and rise only with a clean history.
• Re-verification when something changes or looks wrong.

7. How we protect your money

• Prepaid only. Cards are funded only after your money arrives, so no one spends money that isn't there.
• Customer money kept separate from Baasto's operating money, in a dedicated customer-funds account and in our records.
• Double-entry ledger. Every cent is recorded twice, from and to, so the books always balance.
• Daily reconciliation. We check that our records match what our banking and card partners hold, to the cent.
• One card per merchant, with a spending cap, so a leaked card number can't be used anywhere else.
• Instant freeze if your account or phone is compromised.
• Not a bank, not insured. Baasto balances are not bank deposits and are not covered by FDIC deposit insurance.²²

8. How we protect your data

• A written information security program modeled on the FTC Safeguards Rule: a responsible security lead, risk assessments, access controls, encryption, staff training, vendor oversight and an incident response plan.¹⁷
• Encryption of data in transit and at rest, plus multi-factor login for staff.¹⁷
• Privacy notice and no selling of data, consistent with US financial privacy law.¹⁶
• Respect for Somali data protection law, including rules on sending personal data abroad.²¹
• Card data handled to the payment card industry standard (PCI DSS). Full card numbers stay inside the card issuer's secure systems.¹⁹
• Least-privilege access. Staff see only what their job needs, and every access is logged.
• No verification documents on personal devices, and none sent over chat apps.

See our full Privacy Notice.

9. Your rights and how to complain

• Clear terms before you pay. Fees, limits and rules are shown in plain language before you fund your account.
• Dispute a charge within 60 days, and we'll investigate with the merchant and our card issuer.
• Get your balance back after closure. Within 90 days, a formal request credits it to a Baasto account in your name. After that, a formal claim stays open for at least 3 years, handled under applicable law. See Terms, section 11.
• Access, correct or delete your data, within the limits of record-keeping law.
• Complain and escalate: from support, to a supervisor, to our Compliance Officer. You can also contact the relevant regulator or data protection authority.
• Report wrongdoing safely through our Watchdog channel. Anonymous reports are welcome, and we don't tolerate retaliation. US law also protects people who report anti-money-laundering violations to the government.¹¹

10. Our commitments to vendors and partners

• Full visibility into end customers. Any card can be traced to a verified customer, and we provide the full verification record on request.
• A written anti-money-laundering program with a named Compliance Officer, internal controls, staff training and independent testing, as required of money services businesses.⁵
• Registration with FinCEN as a money services business where required, renewed every two years.³
• Following the card networks' and issuer's rules, including merchant category restrictions and dispute processes.
• Merchant-friendly use only: direct purchases under each merchant's own terms, with no reselling of accounts or credit.
• Audit cooperation. Partners can review our controls, reconciliations and decision logs.
• No surprises. We'll tell partners before adding a new country, product or type of merchant.
• Brand respect. Partner names and logos are used only as permitted.

11. Our commitments to governments and regulators

• Compliance first, aligned with the Financial Action Task Force's international standards, including the rules for money and value transfer services and wire transfers.²⁰
• Timely reporting and record-keeping under US law (sections 3 and 4), and under Somali and Djiboutian law where it applies.¹²¹
• Prompt answers to lawful requests, with a single point of contact for law enforcement.
• Licensed operation only. We don't operate a service anywhere until we hold the required licenses or work under a licensed partner there.
• Supporting legitimate access to the digital economy for Somali and Djiboutian people, through a regulated, transparent channel instead of informal workarounds.

12. What's live today, and what's planned

We'd rather be honest than impressive. As of this page's date:

13. General disclaimers

• Not a bank. Baasto is not a bank. Balances are not deposits and are not covered by deposit insurance.²²
• Pre-launch. Baasto does not currently hold customer funds or issue cards. Services will be provided through licensed partners once launched.
• No financial, legal or tax advice.
• Merchants. Merchant names and logos belong to their owners. Baasto is not affiliated with or endorsed by any merchant.
• Changes. Our merchant list, limits, fees and these commitments may change. We'll give notice of material changes as our Terms require.

Questions? Email hello@baasto.com.

Sources

1. Bank Secrecy Act, 31 U.S.C. § 5311 and following. law.cornell.edu
2. 31 U.S.C. § 5318(g) (suspicious activity reporting and confidentiality); 31 U.S.C. § 5324 (structuring). § 5318 · § 5324
3. Money services business definitions, 31 CFR 1010.100(ff), and registration, 31 CFR 1022.380 (FinCEN Form 107, renewed every 2 years). § 1010.100 · § 1022.380
4. Prepaid access, 31 CFR 1010.100(ww), and prepaid access recordkeeping, 31 CFR 1022.420. § 1022.420
5. Anti-money-laundering programs for money services businesses, 31 CFR 1022.210 (compliance officer, controls, training, independent review). § 1022.210
6. Suspicious activity reports by money services businesses, 31 CFR 1022.320 ($2,000 threshold, 30-day filing, 5-year retention, confidentiality). § 1022.320
7. Currency transaction reports, 31 CFR 1022.310 and 1010.311. § 1022.310
8. Record retention, 31 CFR 1010.430 (5 years). § 1010.430
9. FinCEN information requests ("314(a)"), 31 CFR 1010.520. § 1010.520
10. Voluntary information sharing between financial institutions ("314(b)"), 31 CFR 1010.540. § 1010.540
11. Anti-money-laundering whistleblower protections, 31 U.S.C. § 5323. § 5323
12. US Treasury, Office of Foreign Assets Control: sanctions programs and the Specially Designated Nationals list. ofac.treasury.gov
13. Somalia Sanctions Regulations, 31 CFR Part 551; Global Terrorism Sanctions Regulations, 31 CFR Part 594. Part 551 · Part 594
14. OFAC Reporting, Procedures and Penalties Regulations, 31 CFR Part 501, including 501.603 (blocked property reports), 501.604 (rejected transactions) and 501.601 (recordkeeping, extended to 10 years in 2025). Part 501
15. UN Security Council Resolution 2713 (2023), Al-Shabaab sanctions regime, and the UN consolidated sanctions list. un.org
16. Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 and following, and its privacy rule (Regulation P), 12 CFR Part 1016. § 6801 · Part 1016
17. FTC Standards for Safeguarding Customer Information (Safeguards Rule), 16 CFR Part 314, including breach notice to the FTC. Part 314
19. PCI Security Standards Council, PCI Data Security Standard (PCI DSS). pcisecuritystandards.org
20. Financial Action Task Force, International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation (the FATF Recommendations), including Recommendations 6 (targeted sanctions), 10 (customer due diligence), 12 (politically exposed persons), 14 (money or value transfer services), 16 (wire transfers) and 20 (suspicious transaction reporting). fatf-gafi.org
21. Federal Republic of Somalia: Anti-Money Laundering and Countering the Financing of Terrorism Act (2016), which established the Financial Reporting Center; and the Data Protection Act (2023). Djibouti: the anti-money-laundering law and Central Bank of Djibouti requirements, to be confirmed with local counsel.
22. FDIC: what deposit insurance covers, and what it doesn't. fdic.gov
23. Uniform Law Commission, Revised Uniform Unclaimed Property Act (2016), adopted in various forms by US states. uniformlaws.org