How Compliance Works

Compliance is the gate between having API access and being able to transact. Before you can issue a card to a customer or move money on their behalf, Rain has to verify them. Use this page as your roadmap. Each card links to the guide for that step.

​

Compliance and risk at Rain

Enterprise compliance was built into Rain from the start. Our four-layer compliance matrix covers:

• Partner vetting: every program is reviewed before it goes live.
• Customer vetting: identity checks on every customer. Know Your Customer (KYC) and Know Your Business (KYB) cover cardholders and the businesses behind them, and account-owner checks cover payments customers.
• Sanctions and PEP screening: every party checked against sanctions, PEP, and watchlist sources.
• Ongoing monitoring: continuous transaction monitoring for suspicious activity and fraud.

Rain goes further than traditional payment infrastructure by operating onchain. Every transaction is recorded on an immutable ledger, giving our compliance team real-time visibility, so Rain reacts in seconds when something needs attention. Rain is PCI- and SOC 2-certified, and a Visa and Mastercard Principal Member trusted by 100+ programs worldwide.

​

How verification works at Rain

Rain runs two separate verification pipelines. Clearing one does not clear the other. A customer approved to issue cards may still need to complete verification before they can move money. Each pipeline unlocks a different capability:

• Cards (KYC and KYB): verifies every person with a KYC application, whether that’s a consumer cardholder or a corporate UBO. A corporate program also runs a separate KYB application on the company itself. Approval unlocks card issuance.
• Payments: verifies the account owner behind money movement, through account-owner identification (CIP), transaction monitoring, and on-chain screening. Approval unlocks moving money, opening virtual accounts, and creating payment routes, independently of card approval.

Both pipelines run differently depending on your compliance model:

• Standard Compliance: Rain collects and verifies customer identity directly (documents, selfie and liveness, and screening).
• Hybrid Compliance: you verify customers in your own compliance program first. Rain still runs AML, sanctions, and PEP screening on every party.

Your compliance model is separate from your management model. Rain-Managed and Partner-Managed describe how collateral and funds are handled, not who verifies your customers. See Who verifies what for a side-by-side comparison of the two compliance models. The next three sections walk the Cards pipeline in order, from working out what Rain needs through to handling a rejection. Payments compliance follows and stands on its own. Work through a pipeline in order, or jump to the step you are on.

​

Understand compliance

Start here. Work out which pipeline applies to you, who is responsible for collecting and verifying identity, and what Rain needs before an application can be approved.

​

Collect and submit

Send Rain the identity data and documents for each customer. If you already verified them somewhere else, reuse that verification instead of collecting it again.

​

Track a decision

An application moves through a series of states before it reaches an outcome. Poll for the status or listen for a webhook, and gate your own features on it. Not every application is approved: some rejections are fixable and some are permanent, so read the label before you ask a customer to try again.

​

Payments compliance

Money movement is gated separately from cards. A customer cleared to spend on a card is not automatically cleared to move money.

​

More guides

Lookup pages for specific fields and codes:

• Industry codes (KYB)
• Occupation codes (KYC)
• Applications API reference