Compliance
A public, evidence-based overview of how VSL Market handles privacy, identity verification, provider-routed payments, fraud prevention, transaction monitoring, lawful-request handling, infrastructure security, AI permissions, marketplace responsibility and country-by-country operations across Nigeria, Kenya, Ghana, South Africa, the EU/EEA, the United Kingdom and Canada.
How VSL defines its role
Compliance starts with a clear description of what the platform does and does not do.
VSL Market provides social-commerce, marketplace, messaging, quotation, invoicing, payment-request, delivery and commerce-management software. Buyers and sellers can discover each other, document terms, communicate, create commercial records and use supported payment rails.
For ordinary user-to-user commerce, VSL is not the seller, buyer, manufacturer, importer, exporter, bank, escrow service or custodian of funds unless a separate written agreement expressly says otherwise. Supported payment methods are routed through payment, banking, crypto or payout providers that apply their own onboarding, transaction monitoring, sanctions, KYC/KYB and risk rules.
Data & Privacy
What we collect, why we collect it, who receives it when a workflow requires sharing, user rights, retention, KYC data handling and our no-sale commitment.
Payments, KYC & AML
Fincra, Busha and NOWPayments controls, BVN/NIN and identity checks, source-of-funds reviews, webhook verification and reconciliation.
Fraud Prevention & Lawful Requests
Transaction monitoring, provider-confirmed payment states, reported-content review, private-content boundaries, dispute evidence and proportionate responses to valid legal requests.
Security & Infrastructure
Cloudflare edge protections, secure hosting practices, authentication, CSRF and webhook controls, secret handling, logging and incident response.
AI & Passport Protection
Scoped AI access, OAuth/PKCE, prepared actions, confirmations, ownership checks, delegation guardrails and Commerce Passport evidence boundaries.
Regional Readiness
Dedicated regional pages for Nigeria, Kenya, Ghana, South Africa, the EU/EEA, the United Kingdom and Canada, with privacy, marketplace, payment, AI and consumer controls explained in the correct local context.
Marketplace Responsibility
What sellers must do, what buyers must do, prohibited activity, product legality, consumer obligations, refunds, fulfilment and enforcement.
Vendor Due Diligence
A review path for payment partners, banks, enterprise customers, legal teams, security teams and other counterparties.
Layered compliance model
VSL does not rely on one control to carry the entire risk of a transaction.
| Layer | Purpose | Examples |
|---|---|---|
| Identity and seller trust | Know who is using the platform and who is receiving value. | Account verification, KYC/KYB, business information, payout ownership, BVN/NIN or identity-document checks where required, seller verification status. |
| Payment-provider compliance | Use regulated or specialist providers for payment and crypto functions and respect their rules. | Provider onboarding, transaction limits, sanctions/AML controls, source-of-funds requests, signed webhooks, payout reconciliation and provider-specific eligibility. |
| Marketplace controls | Reduce illegal, deceptive, unsafe and prohibited commerce. | Acceptable Use Policy, listing and payment-purpose review, dispute records, seller accountability, content removal, account restrictions and escalation. |
| Privacy and data governance | Collect only data connected to a real service, security or compliance purpose. | Purpose limitation, role-based access, restricted KYC material, retention controls, data subject rights, service-provider sharing and security logging. |
| Fraud prevention and investigations | Protect legitimate users, payment integrity and marketplace trust using proportionate evidence. | Transaction monitoring, reference/method/amount checks, provider-state validation, reported-content review, dispute evidence, private-case access controls and lawful-request handling. |
| Technical security | Protect accounts, integrations, APIs and infrastructure. | TLS, Cloudflare edge controls, signed webhook verification, CSRF protection, authenticated encryption for sensitive tokens, secret redaction, idempotency and audit events. |
| AI and agentic controls | Prevent an AI from becoming an uncontrolled source of financial or commercial authority. | Scoped permissions, ownership validation, prepared actions, human confirmation or bounded delegation, negotiation guardrails, pause/resume controls and audit logs. |
Dispute visibility, resolution scores and transaction evidence
VSL uses proportionate public accountability to encourage buyers and sellers to resolve order problems promptly.
Disputes begin as a direct resolution process between the buyer and seller. The parties can respond, upload proof, propose a refund, replacement or delivery remedy, and acknowledge the outcome without waiting for VSL to approve or cancel the case. If a qualifying dispute remains unresolved for more than 24 hours, its permitted public record and thread information may become visible on the seller's profile, Commerce Passport and AI-commerce trust view. Private contact details, payment credentials and protected evidence remain restricted.
The dispute score measures the seller's demonstrated effort to resolve order disputes; it is not a general character rating or a finding of wrongdoing. It considers qualifying public cases, resolution status and seller response within 24 hours. A score of 3.5 or higher indicates a strong resolution record, above 2.5 indicates visible resolution effort, and 2.5 or lower may indicate that the seller has not been responsive. Without qualifying dispute information, VSL displays no score, conclusion or trading advice. Scores update as cases are resolved, and resolved cash-payment proof is excluded from the public dispute list.
Cash payments, physical handovers and other direct arrangements remain supported at the mutual discretion of the customer and seller. The parties should preserve receipts, delivery notes, handover acknowledgements and agreed refund terms because VSL generally cannot provider-verify or reverse cash.
This model is sometimes described as shame-based because unresolved conduct can affect public reputation. VSL's intended control is evidence-based, correctable public accountability—not humiliation or harassment. It is designed to carry consistent order-resolution context across marketplace listings and social-commerce channels such as WhatsApp and Facebook, while allowing resolved outcomes to improve the seller's record.
Provider onboarding is part of the control environment
Third-party activation adds another layer of review, but it is not represented as a universal certification.
VSL's payment stack has been built around provider onboarding and technical activation requirements for services including Fincra, Busha and NOWPayments. Those providers may require corporate information, ownership information, KYC/KYB information, transaction-purpose information, security controls, webhook configuration, risk documentation or additional evidence before specific capabilities are enabled.
VSL treats provider approval as capability-specific. A provider may approve one currency, country, payout rail, crypto network, merchant type or transaction pattern while another remains unavailable or requires further review.
- Fincra: supports parts of VSL's fiat payment infrastructure and requires client-side customer due diligence and compliance with relevant AML/CFT obligations in its framework documentation.
- Busha: provides digital-asset and local settlement capabilities where enabled. Busha documents KYC/KYB, AML and CTF controls, and Nigeria's SEC lists Busha Digital Limited under its ARIP participants as a Digital Assets Exchange.
- NOWPayments: provides crypto-processing capabilities. VSL uses provider payment/status data as part of the crypto transaction record and does not treat a payment-created screen as confirmed settlement.
Location and infrastructure providers: VSL also uses Cloudflare technology for edge/media delivery and security, and Google Maps / Mapbox components in delivery-location workflows. Those providers process technical or location request data under their own terms, so they form part of VSL's privacy and vendor-governance map.
What this Compliance Center is for
It gives users, enterprise customers, vendors, payment partners, legal teams and security reviewers a clear view of VSL's public compliance controls and operating boundaries.
This center explains VSL's public control framework and forms part of VSL's compliance materials alongside the Privacy Policy, Terms of Service, Acceptable Use Policy, Security & Safe Trading page and any transaction-specific or provider-specific terms.
For a formal due-diligence exercise, public pages are only the starting point. VSL provides additional corporate, technical, data-flow, security or provider information where appropriate, subject to confidentiality, data-minimisation and security restrictions.
Regulatory and provider references
Primary regulator, government and provider materials used to frame this public compliance overview. External documents can change; VSL reviews the applicable source before relying on it for a launch or feature decision.