Compliance & trust

Regulation isn't a feature we added. It's the foundation.

The platform was designed on the assumption that a regulator, an auditor and a bank would all one day ask us to prove exactly what happened. Every control below exists so the answer is always yes.

Regulator-grade by design

The platform is engineered to meet the standards that regulators, auditors and banks expect. The audit-readiness design, hash-chained log, revenue ledger and evidence generator mean that if an examination or certification is ever required, the evidence already exists — nothing to reconstruct after the fact.

PDPA — the processor model

Under a partnership, the licensed operator is the data controller and Mesos Data is the data processor. We supply the consent, retention and access machinery; a Data Processing Agreement governs the relationship. Personal data never leaves its jurisdiction.

Responsible play

Deposit and loss limits, cool-off periods, self-exclusion, age assurance and reality checks are core services — configurable by the operator and enforced by the platform, not left to good intentions.

AML & monitoring

Sanctions screening, risk scoring, velocity checks and structured escalation — with every decision written to an immutable record that a compliance officer or examiner can replay in full.

Provable by design

An evidence trail that cannot be quietly rewritten.

The heart of the compliance posture is a hash-chained, append-only audit log. Each entry embeds the fingerprint of the one before it, so the entire history is bound together. Change or remove a single record and a verification routine detects it immediately.

That single property underwrites everything else: the settlement export a regulator receives, the transaction history a bank asks for, and the evidence pack an operator needs to demonstrate control.

Append-only — records are added, never edited or deleted in place.
Hash-chained — each entry commits to the previous, sealing the sequence.
Independently verifiable — a routine walks the chain and flags any break.
Full lifecycle — onboarding, deposits, bets, fills, payouts and settlements.
Export-ready — structured reports in the operator's reporting identity.
No RNG to certify — outcomes are exchange-determined, a real fairness edge.

Controls engineered into the platform

Data protection (PDPA) by design Tamper-evident audit Regulator-ready reporting KYC / CDD AML / sanctions Responsible play Data residency Exact-decimal accounting