Our compliance program.

01Purpose and scope

This policy describes the compliance program of [Company legal name], registered in [Jurisdiction] under number [Registration no.], with its registered office at [Registered address] ("Zonipay", "we", "us").

Zonipay is the merchant of record for suppliers of research-use-only materials. We are the seller of record on each order, so we carry the obligations that come with each sale. Card payments are processed by Stripe. This program is how we make sure that what is sold in our name is lawful, accurately presented and sold only for laboratory research.

It applies to our own staff and systems, to every merchant and storefront on our platform, and to buyers who purchase through our checkout. Merchant obligations are binding through the merchant agreement and the Acceptable Use Policy.

02Regulatory posture

Products sold through Zonipay are research-use-only (RUO) materials: reference materials, analytical standards, reagents and laboratory consumables intended for laboratory research and analysis. They are not drugs, foods, supplements, cosmetics or medical devices, and they are not sold for human or animal use.

Under U.S. Food and Drug Administration regulations, the intended use of a product is determined by the objective intent of the people responsible for labeling it. Under 21 CFR 201.128, that intent can be shown by labeling, advertising, oral or written statements, and the circumstances in which a product is offered or sold. A product labeled "research use only" can still be treated as intended for human use if the way it is marketed or sold says otherwise.

For that reason our program looks at the whole storefront and the whole sale, and not only the label: product names, descriptions, images, URLs and metadata, how the catalog is accessed, who the buyer is and what the buyer confirms. The rules in sections 4 to 8 follow from this.

Merchants remain responsible for complying with laws that apply to their own products and operations, including any licensing, labeling, import, export and shipping rules in the places they operate and ship to.

03Merchant due diligence

No business can sell through Zonipay until it passes review. Review covers:

3.1 Business verification (KYB)

• legal name, registration number, jurisdiction and registered address, checked against official registry records or documents;
• tax identification;
• nature of the business, products sold, expected volumes, sales channels and payment history;
• a payout bank account held in the name of the business.

3.2 Owners and controllers

We identify and verify every individual who owns or controls 25% or more of the business, directly or indirectly, and at least one individual with significant control over its management. Identity is verified with government-issued identification and supporting information.

3.3 Sanctions and watchlist screening

The business, its owners and its controllers are screened against sanctions lists, including those administered by the U.S. Office of Foreign Assets Control (OFAC), and against other watchlists we consider relevant. Screening is repeated on a regular basis and whenever ownership or control changes. A confirmed match means the application is declined or the account is closed.

3.4 Website review before approval

Before approval we run a full compliance scan of the storefront (section 5) and review it by hand. A store with open critical findings is not approved.

3.5 Decision

Most complete applications get an answer within a few business days. We may ask for more information, approve with conditions (for example a reserve or limits on product categories), or decline. We may decline without giving detailed reasons where the law or our obligations to payment partners prevent it.

3.6 Keeping information current

Merchants must tell us before any change of ownership, control, legal name, products, storefronts or domains. We refresh due diligence periodically and when risk indicators change.

04Product catalog rules

• Only products permitted by the Acceptable Use Policy may be listed. Prohibited categories are listed there.
• Research products must be supplied as lyophilized vials or comparable reference forms. Capsules, sprays, pre-mixed solutions and ready-to-inject formats are not accepted.
• Each research product must have a certificate of analysis for the batch sold, available to buyers.
• Product names must be factual and must not borrow the brand of an approved medicine.
• New products are subject to the same scan as the rest of the catalog. We may ask for supporting documents for any product and may block a product from the checkout while we review it.

05Storefront requirements

Every storefront must pass each check below before its first sale, and keep passing it. Our scanner tests each one.

The checks are described in more detail on our compliance page and in the storefront compliance checklist.

06Continuous monitoring

After approval, every storefront is scanned every 8 hours. We may also review a store by hand at any time, including in response to a complaint, a dispute pattern or information from a payment partner.

Each finding is emailed to the merchant with the exact page and the change needed, and is given a severity:

A warning that is not fixed on time, or that recurs, may be raised to critical. When a merchant fixes a finding, the next scan confirms it and closes it. A merchant who believes a finding is wrong can reply to the finding email and we will review it by hand.

07Buyer attestation and age

Before paying, every buyer must confirm, by selecting an unticked checkbox, that they are purchasing for laboratory research use only and not for human or animal use. Payment cannot proceed without it. Buyers must also confirm they are 21 or older.

The attestation is stored with the order, with its date and time and the wording the buyer accepted. It forms part of the order record and is used in dispute responses. Terms for buyers are in the Buyer Terms.

08Order screening

• Fraud screening. Orders are screened for fraud signals. 3-D Secure authentication is applied where the card issuer asks for it.
• Sanctions. We do not accept orders from sanctioned persons or for delivery to comprehensively sanctioned countries and regions.
• Restricted jurisdictions. We maintain a list of jurisdictions where we do not accept orders, based on sanctions, local law on the products concerned and our payment partners' requirements. Merchants must not ship to these jurisdictions.
• Use signals. Orders with signs of personal use or resale for human use, such as messages or notes that describe such use, are held or canceled and refunded.

We may hold, cancel or refund any order that fails screening, and we tell the merchant when we do.

09Records and evidence

We keep the records needed to show how each merchant was reviewed and each sale was made, including:

• due diligence files for each merchant, its owners and controllers;
• for each scan: the findings, screenshots and page snapshots, archived as evidence;
• findings sent to merchants, their responses and the dates of correction;
• order records, including the buyer attestation;
• refunds, disputes and complaints, with the steps taken.

Records are kept for as long as the law and our payment partners require, and for at least [retention period] after the end of the relationship. Personal data in these records is handled as described in our Privacy Policy.

10Incidents and payment pause

An incident is any event that puts a sale, a buyer or our obligations at risk: an unfixed critical finding, a prohibited product, signs of processing for a third party, a sanctions match, a sharp rise in disputes or fraud, or a request from a payment partner or authority.

When an incident occurs we may, in proportion to the risk:

1. contact the merchant and ask for an explanation or a fix by a set time;
2. block affected products from the checkout;
3. pause payments on the store until the issue is resolved;
4. hold payouts or adjust a reserve as the merchant agreement permits;
5. suspend or close the account.

We tell the merchant what triggered the action and what is needed to lift it, unless the law prevents us. Payments resume once the issue is fixed and confirmed by a new scan or review.

11Cooperation with payment partners and authorities

We cooperate with our payment processor, card networks and banks, and provide them with information they are entitled to under our agreements and their rules. We respond to lawful requests from regulators, law enforcement and courts, and we may report suspected unlawful activity where the law requires or allows it. Where permitted, we tell the merchant concerned.

12Reporting a concern

Anyone can report a concern about a store, a product, an order or our own conduct to compliance@zonipay.com. Reports may be anonymous. Include the store address, the page or order concerned and what you saw.

We review every report, act where it is warranted, and do not tolerate retaliation against anyone who reports in good faith. If you give us a way to reach you, we will confirm receipt.

13Review of this policy

We review this policy at least once a year, and sooner when the law, card network rules or our payment partners' requirements change, or when an incident shows a gap. Material changes that affect merchants are notified by email with reasonable notice, except where an immediate change is required.

Questions about this policy: compliance@zonipay.com, Monday to Friday, 9:00 to 18:00 ET.