Appearance
Money transmission
Needs legal review
This is our intended structure. No lawyer has reviewed it. Nothing here is legal advice, and none of it should carry real money until a lawyer has signed off.
The problem
In the US, a business that takes money from one person to pass it to another is usually a money transmitter. That needs a licence in most states, which is slow and expensive. A marketplace that takes a buyer's money and pays a seller looks like exactly that.
The structure below is how we stay out of the middle. It has three parts, and each one covers a different leg.
The structure
- SellerLists a card. It stays theirs until a buyer is ready
- MatchWe buy the card from the seller and sell it to the buyer, in one step
- MoneyWaits where we cannot move it on our own
- Card worksThe buyer's money settles. The seller is paid for the card we bought
Two sales, each with us as a party, instead of one payment passed through us.
1. Instant principal flip
At match time we buy the card from the seller and sell it to the buyer, in one transaction. That is two sales where we are a principal, the buyer or the seller, not a payment we pass along for someone else. A business that sells its own goods is not transmitting money; it is selling.
Just-in-time matching is what makes this affordable. We own the card for milliseconds, between the two sales, so we never carry stock and never put money into cards nobody buys. See The core thesis.
2. Non-custodial settlement
We never have unilateral control of the money. A buyer's payment waits in an escrow contract that we cannot move on our own. It has no owner and no admin. It pays the seller 24 hours after the purchase, or 72 hours after the purchase if the shopper disputes, and only the seller can give money back. Nothing goes back to the buyer on a timer.
That needs release conditions anyone can check without our server: the escrow contract on chain, and Lit checking it before it unlocks a card. Lit's side is rebuilt; today its unlock rule is our own signature, which is custodial. Finishing the original design is half of this part. See What the blockchain is for.
3. Stripe Connect for card payments
For card payments, Stripe is the licensed party. With Stripe Connect, Stripe takes the buyer's money and pays the seller under its own licences.
This is the leg we can lose. Connect needs Stripe to approve the business, and Stripe lists gift card resale as restricted. See Why Stripe has to say yes. The two parts above must stand without it.
On the crypto rail
Salvo Pay works differently. Its escrow is deployed on Tempo's test network (2026-10-10), and it is not reviewed. On the testnet a listing is taken as the operator's own card.
- The escrow pays the seller directly. The shopper's own account pays
SalvoEscrowV1, and the escrow pays the seller's own address 24 hours later. Our server holds no key that can move that money, and the contract has no owner or admin. - Salvo is not a party to the sale. We do not buy the card, so there is no principal flip on this rail. The flip above stays the plan for the card-hold rail.
- No fee in this version. Salvo takes nothing from the shopper or the seller. How Salvo earns on this rail is not decided.
Where we are today
| Part | Today |
|---|---|
| Instant principal flip | 🟡 Designed. The code has no sale-and-resale step; a listing is matched to a buyer directly |
| Non-custodial settlement | 🔵 The escrow contract is deployed on Tempo's test network, and it and its Lit rule passed a live smoke on 2026-10-10. Not reviewed. The live Lit vault's unlock rule is still our own signature |
| Stripe Connect | 🟡 Not built. Card payments land in our own Stripe account |
Today's card holds are the custodial version
Pay on scan captures the shopper's hold into our own Stripe account. That is custody: we hold the money. It would be acceptable only if every listed card were the operator's own, so a sale is just the operator selling its own card. The moment another person's card can be listed, card payments need Stripe Connect, or the escrow path, first.
That premise has a hole today. The public sell screen records a stranger's card as the operator's, and the guard cannot tell the difference. So another person's card can already be listed and sold into our own Stripe account. Until that is closed (an open decision), the condition above is not met.
The till's deposit adds no custody while it waits. It is a hold, never a capture and a refund: until the next shopper uses the rest of the card, nothing has moved. A deposit taken for a seller is a capture into our own account like any other, under the same premise. Built and tested offline, not deployed.
Questions for the lawyer
- Are we really a principal? Regulators tend to look at substance, not labels. A principal normally carries the risk of what it sells. If the seller is paid only when the card works and we never carry the card's risk, does the flip still make us the seller? Owning the card for milliseconds keeps us out of stock. It may not, on its own, decide this.
- Does buying and reselling make us a seller of prepaid access? FinCEN's prepaid access rule generally excludes closed-loop gift cards up to $2,000 per card per day. Does reselling them in volume change that?
- Does an escrow we wrote count as our control? FinCEN's 2019 guidance on crypto asks whether a business has total independent control over the money. Does a contract we deployed, whose release needs the buyer or a Lit check, pass that test? Do state regulators read it the same way?
- State by state. Each state has its own money transmission law. Which states, if any, would still treat this as transmission?
- Stripe's restriction. If Stripe declines Connect, does the escrow path alone cover card-free payments, with cards dropped?
- The keeper. Our job calls the escrow's payout for each sale when it is due. Anyone may make that call, and it pays only that sale's seller. Does making it, with our own key, count as control?
- A fee payer. If we pay the network fees for shoppers' transactions (we do not yet), does paying fees on someone else's payment count as transmitting it?
- A cover pool. A later phase may pay shoppers from our own money when a card at a store nobody can check turns out bad. Is that insurance, a refund, or something else?