Policies

Your policies are the rules your institution sets for its transfers, and your node evaluates every transfer against them to give a verdict: approve, flag or reject. Notabene runs the evaluation, but the rules, and so the decision, are yours.

What each verdict does

Three calls decide a transfer by hand, and they are easy to confuse:

The verdict is private, so the other institutions on the transfer see only your status, as Transfers explains. Your audit trail records the verdict as transaction.compliance.evaluated with its decision, and keeps a flag even after a person resolves it.

How a verdict is reached

Every policy that applies to the transfer, such as one for a jurisdiction, a counterparty institution or an amount, gives a verdict. The strictest one wins, reject over flag over approve, and where none applies, a default decides:

1. The default for its group, such as counterparty institutions.
2. If that group has none, your general default, so that every transfer gets a verdict.

A new account’s general default is Flag, so every transfer waits for review until you change it in the dashboard, under Authorization Rules › Policies. You set a default for each group too: your customers, your own self-hosted wallet addresses, counterparty institutions, counterparty customers and counterparty wallets. Each group’s default is Flag, Reject or no policy.

Policies use the trust status you give a jurisdiction, an asset, a chain or an institution, and the results of the screening providers you connect, as Integrations explains.

Read your policies

curl https://sandbox.notabene.id/api/v1/policy-configs \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'const response = await fetch('https://sandbox.notabene.id/api/v1/policy-configs', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_ACCESS_TOKEN',
  },
});
const answer = response.status === 204 ? null : await response.json();import requests

response = requests.get(
    'https://sandbox.notabene.id/api/v1/policy-configs',
    headers={'Authorization': 'Bearer YOUR_ACCESS_TOKEN'},
)
answer = None if response.status_code == 204 else response.json()

[
  {
    "policy_name": "AmountThreshold",
    "kind": "Standard",
    "type": "Transaction",
    "is_enabled": true,
    "config": {
      "basis": "",
      "approve_below": 0,
      "flag_above": 10000,
      "reject_above": 100000
    }
  },
  {
    "policy_name": "GeneralDefault",
    "kind": "Standard",
    "type": "Transaction",
    "is_enabled": true,
    "config": {
      "verdict": "Flag"
    }
  }
]

curl https://sandbox.notabene.id/api/v1/policy-configs \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

const response = await fetch('https://sandbox.notabene.id/api/v1/policy-configs', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_ACCESS_TOKEN',
  },
});
const answer = response.status === 204 ? null : await response.json();

import requests

response = requests.get(
    'https://sandbox.notabene.id/api/v1/policy-configs',
    headers={'Authorization': 'Bearer YOUR_ACCESS_TOKEN'},
)
answer = None if response.status_code == 204 else response.json()

[
  {
    "policy_name": "AmountThreshold",
    "kind": "Standard",
    "type": "Transaction",
    "is_enabled": true,
    "config": {
      "basis": "",
      "approve_below": 0,
      "flag_above": 10000,
      "reject_above": 100000
    }
  },
  {
    "policy_name": "GeneralDefault",
    "kind": "Standard",
    "type": "Transaction",
    "is_enabled": true,
    "config": {
      "verdict": "Flag"
    }
  }
]

Each policy carries its policy_name, whether it is_enabled, and its settings in config. Here a transfer above 10,000 is flagged, one above 100,000 is rejected, and one that no policy has an opinion on is flagged too.

Requirements

Separately from your policies, your requirements decide what must happen before your side can be authorized. You choose them as a preset in the dashboard, under Authorization Rules › Requirements.

Every requirement has a time-out after which it is skipped, so no transfer waits forever on a counterparty that does not answer, and every skip is recorded. You can add beneficiary name matching to either preset, and your team then confirms the name on each deposit.

What Notabene does and what you decide

Only your policies can flag a transfer, and neither your team nor your backend can add a flag by hand. Every step is recorded in your audit trail, which Security and status explains.