1. Introduction
This page sets out the regulatory status of Maven Pay Inc., the public security posture we maintain, the way we handle the funds and the digital assets you hold with us, and the categorical scope of the sub-processors that handle data on our behalf. It is the single canonical reference for these disclosures and the index to the more detailed pages they connect to.
2. Regulatory Status
Maven Pay Inc. is regulated as a Payment Service Provider in Canada. Maven Pay Inc.'s payment operations sit under the supervisory framework administered by the Bank of Canada under the Retail Payment Activities Act.
Maven Pay Inc. is also registered with the Financial Transactions and Reports Analysis Centre of Canada as a Money Services Business. Our registration number is C1000000640. Our Compliance Officer is contactable at compliance@mavenpay.com.
The other entities in the MavenPay group are non-regulated tech, concierge, and operating entities. The list of public group entities is set out in our Privacy Policy.
3. Crypto Assets And Stablecoins
MavenPay offers crypto-asset features, including stablecoin payments, broader crypto-trading, crypto-treasury, sub-accounts, and yield products. These features are operated through regulated crypto infrastructure providers. The identity of the provider for each feature, and the terms of service and privacy policy of that provider where we are required to surface them to you, are disclosed at the point where you activate the feature and in the account-opening documentation for that feature.
MavenPay is not authorised as a crypto-asset service provider under the European Union Regulation 2023/1114 on markets in crypto-assets. The regulated party for the in-scope crypto services in that jurisdiction is the relevant infrastructure provider, not MavenPay.
Crypto is not legal tender. Crypto values are volatile and you can lose money. Stablecoin balances are not deposit-insured. They are not insured by the Canada Deposit Insurance Corporation, by the United States Federal Deposit Insurance Corporation, or by any other deposit-insurance scheme. The reserves backing a stablecoin are governed by the attestation regime of its issuer, typically a regular attestation by an independent auditor published on the issuer's website.
Yield features carry principal risk. Where a yield product advertises a variable rate, that rate can move and balances allocated to a yield product can lose value. Yield balances are not deposit-insured, are not bank deposits, and are not protected by any deposit-insurance scheme.
On-ramp and off-ramp between crypto and fiat may take longer than fiat-only payments because of identity verification, sanctions screening, and chain-confirmation requirements.
4. Safeguarding Of Customer Funds
Customer fiat balances are held in segregated accounts at regulated institutions under the rules that apply to a Canadian Payment Service Provider and a Canadian Money Services Business. Customer balances are not lent, are not rehypothecated, and are not invested.
Crypto-asset balances are held at the regulated crypto infrastructure partners we work with. The terms under which those partners hold customer crypto are governed by the relevant partner agreement.
5. Security Posture
Maven Pay Inc. maintains a continuously-verified security and privacy programme. The current state of the programme is published on the Maven Pay Trust Center, which is available to customers and partners at https://app.vanta.com/mavenpay.com/trust/lyjdri3s8ydg4qnc4uuq1.
The Trust Center surfaces the live status of our controls across five families. Infrastructure security, including cryptographic-controls policy, key management, electronic messaging, the protection of application-service transactions, and clock synchronisation. Organizational security, including ownership of assets, restrictions on software installation, acceptable use of assets, physical security perimeter, and the protection of offices, rooms, and facilities. Product security, including access control to program source code. Internal security procedures, including information-systems audit controls, identification of applicable legislation and contractual requirements, periodic review of information-security policies, contact with authorities, mobile-device policy, access-control policy, and the scope and operation of our information-security management system. Data and privacy, including classification of information, labelling of information, handling of assets, management of removable media, physical media transfer, and information-transfer policies.
The Trust Center is the live source of truth. The page you are reading summarises the programme; the Trust Center evidences it.
6. Sub-Processors
A categorical list of every sub-processor that processes customer data on our behalf is set out in our Sub-Processors page. The categorical list is public.
The named list of sub-processors is shared on request to customers under a data-processing addendum. Write to compliance@mavenpay.com for the current named list.
7. Contact
For any question about the disclosures on this page, write to compliance@mavenpay.com.
8. Changes To This Page
We may update this page from time to time. When we make a material change, we will tell you in the MavenPay product or by email at least thirty days before the change takes effect. The current version of this page and its effective date are shown at the top of this page.
