Controls & Compliance
A limit that is only reported is not a limit
Plenty of systems will tell you afterwards that a threshold was exceeded. That is a report of a breach, and by then the only question left is what to do about it.
See it live
Five dimensions, enforced at request time
Per-client, per-method and per-period thresholds sit in one schedule, with the approval tier attached to each band — not a report that arrives afterwards.
Five dimensions
Limits are rarely one number
The largest single movement allowed
Daily, weekly or monthly cumulative caps
A card limit and a bank limit are different questions
Retail and professional segments on different terms
A new destination can be capped until it is established
Tiers of authority
Where a movement needs a person, and how many
- 1Below threshold
Proceeds without human involvement. Most movements are here, and routing them through a queue slows down the ones that genuinely need attention.
- 2Single approval
One named approver, who cannot be the person who initiated it. The separation is enforced rather than expected, because expecting it is how it stops happening under pressure.
- 3Four eyes
Above an amount you set, two independent approvers. Neither can be the initiator, and the platform will not accept the same credentials twice.
- 4Video confirmation
Above a threshold you set, the approver confirms on a recorded video call before the movement is released. It is deliberately slow, and it is the control that survives an approver whose credentials have been taken.
- 5Exception
A standing override for a known case, granted deliberately, attributed to whoever granted it, and carrying an expiry date so it cannot quietly become permanent.
Operator controls
Approval thresholds assume the approver is who they say they are
Every limit above rests on operator identity. These are the controls underneath that assumption.
Device binding
An operator account is tied to devices you have registered. A correct password from an unregistered machine does not get in, which removes the value of a stolen credential on its own.
Network restriction
Administrative access is reachable only from address ranges you nominate. The console is not a public login page that happens to have a strong password in front of it.
Destination denylist
Alongside the approved-destination list, addresses and accounts you never want paid can be blocked outright — sanctioned entities, known theft addresses, or a counterparty you have ended.
New-destination cooling period
A newly added destination cannot receive a payment immediately. The delay is what gives your team time to notice an addition nobody authorised.
FAQ
Limits and approvals: common questions
6 short answers to what teams ask before a demo.
At the moment the request is made, before anything is committed. A limit evaluated afterwards produces a report of a breach rather than preventing one, and a report is not a control.
Yes, across all five dimensions — per transaction, per period, per method, per group and per destination. Applying one set of numbers to a retail client and a professional one satisfies neither.
No, and the platform enforces it rather than relying on procedure. Segregation of duties is exactly the control that quietly lapses under time pressure, which is why it should not depend on anyone remembering.
They are granted deliberately, attributed to whoever granted them, and carry an expiry. An override without an end date becomes permanent within a few months and nobody remembers why it exists.
That the amount exceeds their limit, along with what the limit is. Telling a client only that something failed guarantees a support contact, and the information is not sensitive.
The queue your team works in sits in BrokerOS, alongside the client record and their history. PayVault is what enforces the thresholds and executes the movement once a decision has been made.
Still have a question?
A specialist will answer it directly, with your set-up in mind.
Ask a specialistHow many standing exceptions do you have?
And do any of them have an expiry date? It is usually the fastest way to find out whether limits are being enforced or merely configured.