FCA Compliance

Regulatory Framework

BlocMarket operates under UK Financial Conduct Authority (FCA) requirements for payment services and anti-money laundering (AML).

Applicable Regulations

Regulation	Scope
Payment Services Regulations 2017 (PSD2)	Payment processing, Open Banking
Proceeds of Crime Act 2002	AML, suspicious activity reporting
Money Laundering Regulations 2017	Customer due diligence
Consumer Duty (FCA)	Customer outcomes, fair treatment

BlocMarket is not itself an authorised Payment Institution. All regulated payment activities are performed by FCA-authorised providers:

• TrueLayer Ltd — FCA-authorised Payment Institution for Open Banking payments
• Stripe Ltd — FCA-authorised Payment Institution, PCI DSS Level 1, for card payments and escrow deposits

PSD2 Controls Matrix

Requirement	Description	Evidence
2.1	Licensed PI	TrueLayer Ltd is FCA-authorised PI
3.1	Consumer notification	TrueLayer sends payment status webhooks
4.1	Risk management	Payment amount validation, fee calculation
6.1	Transaction recording	payments table with full audit trail
8.1	Access control	JWT auth, admin-only endpoints
10.1	Record retention	PostgreSQL with RLS, audit logging
11.1	Information security	Encrypted in transit, RLS, HMAC

Payment Security

Stripe Integration

BlocMarket uses Stripe for payment processing:

• PCI DSS Level 1 compliant (Stripe handles card data)
• Tokenization — Card data never touches BlocMarket servers
• 3D Secure — Authentication for card payments
• Webhook verification — HMAC-SHA256 signature validation

Payment Flow

1. Client requests payment intent (POST /api/v1/payments/intent)
2. BlocMarket creates Stripe payment intent, returns client_secret
3. Client confirms payment — card data goes directly to Stripe, never touching BlocMarket
4. Stripe processes payment and sends signed webhook to /api/v1/payments/webhook
5. BlocMarket verifies HMAC-SHA256 signature
6. BlocMarket updates payment record (status = completed)
7. Payment event is recorded in the audit trail

Open Banking payments follow the equivalent TrueLayer flow via POST /api/v1/payments/truelayer/create-intent and POST /api/v1/payments/truelayer/create-payment.

Record Retention

Payment and transaction records are retained for 6 years per the Limitation Act 1980 and HMRC requirements. Stripe reference IDs (stripe_payment_intent_id, stripe_payment_method_id) are classified Restricted and encrypted at rest; only tokens are stored, never card data.

Escrow Model

BlocMarket does NOT hold client funds. Per UK property law:

• Solicitors hold all money in client accounts
• BlocMarket tracks milestones and payment status only
• Escrow deposits are processed via Stripe
• Refunds are handled through the same payment method

Open Banking

TrueLayer Integration

Open Banking payments via TrueLayer:

Feature	Implementation
Account verification	TrueName API
Payment initiation	TrueLayer Payments API
Bank authentication	Redirect flow
Payment status	Webhook + polling

Security

• TLS 1.3 for all API communication
• OAuth 2.0 for bank authentication
• FCA-regulated provider (TrueLayer)
• No card data stored by BlocMarket

Anti-Money Laundering (AML)

Customer Due Diligence

Check	Trigger	Implementation
Email verification	Registration	Automated
Identity verification	High-value transactions	DocuSign Identity
Source of funds	Transactions > threshold	Manual review
PEP screening	All users	Third-party service

Transaction Monitoring

Automated monitoring for suspicious patterns:

Pattern	Threshold	Action
High-value single transaction	> £10,000	Flag for review
Multiple rapid transactions	> 5 in 1 hour	Flag for review
Unusual geographic pattern	Cross-border	Enhanced due diligence
Structured transactions	Below threshold splitting	Suspicious Activity Report

Suspicious Activity Reports (SARs)

If a suspicious transaction is detected:

1. Transaction is flagged internally
2. Compliance officer reviews within 24 hours
3. If confirmed, SAR filed with NCA
4. Tipping-off prohibition enforced
5. Audit trail maintained

Automated Alerting

Prometheus business alerts in deploy/monitoring/business_alerts.yml provide operational transaction monitoring:

Alert	Trigger
BidVolumeAnomaly	5m bid rate exceeds 10x the same window one hour earlier
TransactionValueSpike	Cumulative transaction value exceeds 100,000
RegistrationSpike	> 20 registrations in 5 minutes (bot detection)

Transaction Milestones

Milestone Tracking

BlocMarket tracks transaction milestones without handling funds:

Milestone	Description
Offer Accepted	Bloc assembly agreement reached
Legal Review	Solicitor initiates due diligence
Surveys Complete	Property surveys finalized
Contracts Exchanged	Option Agreements signed (DocuSign)
Completion	Transaction finalized

Audit Trail

All transaction events are logged with:

• Timestamp (UTC)
• Actor (user ID or system)
• Action performed
• Previous and new state
• IP address and user agent

Data Protection

PCI DSS Compliance

BlocMarket achieves PCI DSS compliance by:

1. Never storing card data — Stripe tokenization
2. TLS encryption — All data in transit
3. Access controls — RBAC + RLS
4. Audit logging — All payment events
5. Vulnerability scanning — Trivy + cargo-deny

Sensitive Data Handling

Data Type	Storage	Access
Card numbers	Never stored (Stripe tokens)	N/A
Bank details	TrueLayer tokens	System only
Identity documents	Encrypted (pgcrypto)	Compliance officer
Transaction records	PostgreSQL	Authorized users

Compliance Reporting

Report	Frequency	Audience
Transaction summary	Daily	Operations
AML activity report	Weekly	Compliance officer
SAR report	As needed	NCA
FCA regulatory return	Annual	FCA
PCI DSS assessment	Annual	QSA

Controls Matrix

Control	Requirement	Implementation
Network security	PCI DSS Req 1	TLS 1.3, network segmentation
Cardholder data protection	PCI DSS Req 3	Stripe tokenization
Vulnerability management	PCI DSS Req 6	cargo-deny, Trivy scanning
Access control	PCI DSS Req 7	RBAC, RLS
Monitoring	PCI DSS Req 10	Prometheus, Grafana, audit logs
Security testing	PCI DSS Req 11	Annual pen testing
Policy	PCI DSS Req 12	Documented policies