A license defines what a company may do; a compliance framework determines whether it does so responsibly. The distinction matters in digital assets, where products move quickly, users span jurisdictions and technology outpaces the rulebooks.
The principle: systems over certificates
NPX states that the compliance capability of a mature platform cannot be measured by a single license. Licenses are essential, but long-term compliant operations require broader systems: customer identification, AML/CTF, sanctions screening, monitoring, risk assessment and internal governance.
The company describes these as frameworks under development, not completed certifications. A control that is designed and operated is different from one independently audited; this wiki does not claim the latter.
Customer identification and verification
KYC begins with knowing who the customer is. NPX lists mechanisms for customer identification and verification among its core controls. In practice, a program of this kind typically collects identity information, checks it against documents or data sources, screens the person or entity against relevant lists, and assigns a risk profile that determines the level of ongoing review.
For users, the visible result is onboarding: identity documents, proof of address, source-of-funds questions and periodic refreshes. These steps create the record that monitoring and sanctions checks depend on; weak identification undermines every control downstream.
AML and counter-terrorist financing
Anti-money laundering (AML) and counter-terrorist financing (CTF) obligations require a platform to detect, assess and report activity that may involve criminal proceeds or prohibited financing. NPX names AML and CTF screening as part of its framework, alongside the identification of anomalous transactions and suspicious activities.
A credible program normally includes written policies, a compliance function, risk-based due diligence, monitoring, escalation, recordkeeping and reporting where required. NPX’s public description is high-level; this wiki does not invent thresholds or statistics.
Sanctions screening
Sanctions regimes prohibit dealings with named individuals, entities, sectors or jurisdictions. Screening is the control that checks customers, counterparties and sometimes wallet addresses against applicable lists. NPX states that sanctions list screening forms part of its compliance framework.
Screening is useful only if current, calibrated and documented. Lists change, names produce false positives and ownership can obscure a prohibited party. A serious program combines automated checks with human review and recorded decisions, including geographic restrictions.
Transaction monitoring and anomalous activity
Monitoring looks for patterns rather than isolated events: unusual volumes, rapid movement between accounts, structuring, activity inconsistent with a customer’s profile, or flows connected to higher-risk addresses. NPX lists the identification of anomalous transactions and suspicious activities among its controls.
The output is not simply an alert but a decision: close it with a documented rationale, request more information, restrict the account or escalate for a suspicious-activity report where required. Quality depends on trained staff, clear criteria and an audit trail, which is why monitoring and governance are linked.
Digital asset listing review
For an exchange, what it lists can matter as much as whom it serves. NPX says it conducts risk assessment for the listing of digital assets before they are made available. A listing review typically considers the asset’s legal character, its issuer and ownership, its liquidity and market conduct, the technology and smart-contract risk, and whether offering it in a given jurisdiction raises regulatory issues.
This is a pre-listing risk assessment, not an endorsement of value: a listing decision is a compliance judgment, not investment advice or a promise of performance.
Internal controls, access and approval
Compliance fails when authority is unclear. NPX lists internal access management and approval processes as part of its framework. These controls determine who can see customer data, who can move funds, who can change risk parameters and which actions require a second approver.
The governance entry describes tiered access, multi-party approval and escalation paths. The compliance point is simpler: a control one person can silently override is not a control. Segregation of duties, logging and review turn policy into a safeguard.
User disclosure and transparency
NPX says its framework includes user risk disclosures and information transparency. It also states that it will provide accurate disclosures about corporate information, technical capabilities and operational measures that are already in place, deployed and subject to verification — and that it will not present capabilities still under development or lacking supporting documentation as established facts.
Clear disclosures about fees, trading rules, custody, withdrawals, exceptional events and complaint routes give users a basis for decisions and give the company a standard to be measured against.
The framework at a glance
| Control area | Primary purpose | User-visible signal |
|---|---|---|
| Customer identification | Establish who the customer is and assign risk | Onboarding checks, document requests, periodic refresh |
| AML / CTF | Detect and report suspected illicit finance | Transaction questions, account review, reporting where required |
| Sanctions screening | Prevent dealings with prohibited parties | Restricted access or enhanced review for matches |
| Transaction monitoring | Identify unusual or suspicious patterns | Requests for source of funds; temporary limits |
| Listing review | Assess asset, issuer and jurisdictional risk | A published or stated listing process; risk disclosures |
| Access and approval | Constrain and evidence sensitive actions | Secondary confirmation, tiered permissions |
What the framework does not claim
NPX does not claim that its framework substitutes for a license, that every control is deployed, or that controls eliminate risk. It describes systems being refined as the company expands. Read the framework as a statement of design intent and operating discipline, subject to disclosure and local law.
Not investment advice. This entry is informational, does not assess any control or confirm any license, and is not investment, legal or tax advice. Digital assets carry significant risk, including total loss.