The regulator no longer asks if you have control. It asks what you did with it.
Oversight has shifted its focus from purely formal compliance to examining the behavior of the user base. Operations that fail to monitor, communicate with, and educate platform users are sending signals to the Central Bank and the SPA (Spanish Business Support Service) that they shouldn't be sending.
By Connect PSP , infrastructure for highly complex digital financial operations.
In previous sections we discussed the mechanism: what changed in MED 2.0, the practical effects on timelines, cash flow, and reputation, and how graph tracking works internally. What remains is the point that operators tend to underestimate. Auditing doesn't just assess whether the tool exists. It evaluates the behavior of the user base that the operation tolerates.
What has changed in the regulator's interpretation?
The focus of oversight has shifted. Previously, the question was whether the company had a compliance policy, anti-fraud tools, and a response to notifications. Today, the question is different: what did the operation do with that capability? A platform that receives recurring MEDs (Medical Data Releases) from the same users, month after month, and does not act, produces a history. This history is readable from the outside.
Companies that accept irregular transactions without questioning them, that fail to monitor end-user financial misconduct, that do not communicate with their user base and do not guide them, provide the Central Bank and the SPA with unintentional evidence: that they do not exercise real control over who operates on the platform.
Open MED (Medical Data Entry) without fraud is a problem for the user, and for the operation.
There is a distinction that a large part of the public is unaware of. Filing a MED (Medical Disclosure Report) when there has been no fraud or scam is not a matter of convenience. It is a false declaration within a regulatory mechanism, and it is recorded as such.
The user who does this rarely acts out of calculated bad faith. They act because no one has explained it to them. That's where the responsibility of the operation lies: when the platform doesn't communicate, educate, or correct, it's not just absorbing losses. It's creating a base that learns to use MED (Medical Data) as a shortcut. And it's this base that the regulator sees when looking at the operation's numbers.
Quality of operation isn't just about conversion. It's about how you care for and guide those who use the platform. Without scrutinizing its own user base, the operation is declaring to the regulator that it lacks true compliance.
It is no longer optional.
This is where the understanding needs to change. Having a tool for monitoring, tracking, and responding to MED (Medical Data Error) is not a competitive advantage or a sign of maturity. It's a demonstrable obligation. The operation needs to be able to show, with evidence, that it monitors, trains the team, tracks behavioral patterns, and communicates with the end user about best practices.
The absence of this has concrete consequences. CNPJ (Brazilian tax ID) flagging, restrictions with banking partners, reinforced compliance requirements, and worse settlement conditions. None of these things can be resolved afterward. They all need to be prevented beforehand, and prevention requires registration.
What can the operation do now?
Three fronts, all verifiable by an auditor. Monitor the database: identify users with recurring dispute resolutions, cross-reference behavioral patterns, and act before the pattern becomes entrenched. Communicate and guide: inform the user, at the right time, what is and what is not a legitimate dispute, and what it means to open an improper dispute resolution. Record everything: maintain an audit trail of each decision, each notification responded to, and each user flagged.
This is the function of Sentinela , Connect PSP's compliance and anti-fraud engine, and its Advanced Transaction Tracking Module . It provides risk scoring per transaction, identification of recurring fraud and shell company patterns, timely management of Infraction Notices, and a complete end-to-end audit trail. Not as a report issued afterward, but as evidence produced during the course of the operation.
The question the regulator asks is not whether the operation was a victim. It's whether it acted. With Sentinela, the answer no longer depends on manual reconstruction under pressure and is now recorded, with date, decision, and justification, in the way that the oversight body now expects to find it.
About Connect PSP
Connect PSP is the technological infrastructure for highly complex digital financial operations: multi-bank orchestration, continuous compliance, and full traceability for iGaming, marketplaces, infoproducts, and high-volume fintechs.
Contact us at connectpsp.com.
