Compliance at Vuch

Compliance at Vuch is an engineering discipline before it is a document set. This page describes how risk management is built into the platform, how we handle data, and what we commit to on responsible gambling. It also states plainly what we do not claim: Vuch does not publish licence numbers or certification claims. In B2B iGaming, an unverifiable badge is worse than no badge — so instead of badges we offer a certification roadmap and a due-diligence pack on request, and we expect to be checked.

What we claim — and what we do not

• We do not claim licences or certifications. No regulator registration numbers, no laboratory certificates, no security-standard claims appear on this site. Where a target market requires platform certification or a supplier permit, that work is scoped explicitly as part of the deployment plan for that market.
• We do claim engineering. The risk and compliance capabilities described below are part of the platform's infrastructure, and they can be demonstrated in a technical session against a live environment.
• The division of responsibility is explicit. Our clients hold their own operator licences and own their regulatory relationships. We do not sub-license, and we decline engagements structured to blur that line.

Risk and compliance engineering

Risk intelligence is built into the platform's infrastructure and runs in real time — not bolted on as an external reporting layer. The risk engine covers:

• Transaction velocity monitoring — automatic detection of anomalous transaction activity
• AML signals — real-time flags on deposit and withdrawal patterns associated with laundering behaviour
• Market integrity — anti-manipulation controls for prediction markets, including detection of dominant-participant behaviour and wash trading
• Risk scoring and escalation — every event stream feeds a risk score; alerts are assigned a level, queued for administrator review, escalated where needed, and closed with either an automated block or a documented resolution

All detection thresholds are configuration parameters, tuned per jurisdiction and per operator risk appetite. We do not publish exact threshold values: publishing detection parameters makes them easier to circumvent, so specifics are shared with client compliance teams under NDA.

Reporting and auditability

The administrative back office is built so that compliance evidence is a by-product of operating, not a separate project:

• Finance operations (withdrawal approvals, rejections) carry a full audit trail
• Every user has a complete, reviewable transaction history
• Risk incidents record their alert level, escalation path and resolution
• Reporting outputs can be mapped to a regulator's prescribed format as part of deployment scoping

Data protection

Vuch processes player data on behalf of its operator clients, and the division of responsibility is contractual and explicit: clients are controllers, Vuch is a processor, and data processing agreements define scope, subprocessors and audit rights in GDPR terms. Data handling for a given market — retention periods, residency constraints, regulator access — is defined during deployment against that market's requirements rather than assumed from a global default. Data subject requests route through the operator as controller, with platform tooling supporting the underlying export or erasure. The current subprocessor list and security documentation are included in the due-diligence pack.

Responsible gambling commitments

As a supplier we do not face players, but our technology does — so player protection is engineered into the platform rather than delegated entirely to each client's process:

• Protection tooling ships with the platform: limit controls, intervention workflows and account restriction mechanics are platform capabilities that operators configure, not features to be built per client
• Self-exclusion integration is a platform capability: national registries such as GAMSTOP, Spelpaus, OASIS and CRUKS have materially different technical regimes, and integration with the registries a licence requires is implemented and validated as part of each market deployment
• We build for the conservative reading: where a market's player-protection rules are ambiguous, the platform defaults to the stricter interpretation, and operators may tighten further

Product-level detail lives on the Vuch Shield page.

Payments and jurisdictional honesty

Two facts we state to every prospect because they shape market fit:

• Payment rails today are USDT — deposits and withdrawals with manual moderation and a full status trail. A fiat payment layer is on the product roadmap; for fiat-first regulated markets, that layer and its market-specific integrations are a central part of the deployment conversation, not a footnote.
• Prediction markets are regulated differently everywhere. Depending on the jurisdiction they may be treated as gambling, as a financial instrument, or prohibited outright. We do not use one legal formulation across geographies; every target market needs its own legal assessment, and we support that work with technical documentation rather than legal conclusions.

Corporate conduct

Vuch maintains sanctions screening of counterparties, third-party risk management over its own vendors, and an internal escalation channel for compliance concerns. We serve legal entities and industry professionals only; nothing on this site is directed at players, and this website is intended for audiences of legal gambling age in their jurisdiction.

For due-diligence requests, regulator inquiries or the certification roadmap, contact us through the site's contact channel. For how compliance obligations translate into product behaviour per market, start with the markets hub or the licensing guides.