Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Incumbent rails have no public chain settlement and no public code. They are scored with the same rubric as every other row. Their low ratings show the verifiability gap between rails whose behaviour can be inspected and rails whose behaviour must be trusted; that gap is the point of the comparison, not a claim that the incumbent is unsafe.
Offered everywhere except the countries listed. Checked 2026-10-09. Not scored.
Solayer's Eligibility page lists 96 restricted countries and territories, applying to residents or citizens regardless of where they live. Darfur is listed separately and is covered by Sudan (SD); "Eritea" is read as Eritrea (ER). Every EU member except Slovenia is listed, so the codes are given individually rather than as EU. Residents of 17 US states are also not eligible: Arizona, Delaware, Georgia, Idaho, Louisiana, Maryland, Montana, Nevada, New Mexico, North Dakota, Ohio, Oregon, Rhode Island, South Dakota, Vermont, Washington, Wisconsin. Two card programmes: the international card terms require attesting that you are not a US citizen; US residents get the separate US card agreement.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Settlement token
What the balance is held in and debited from. Shown as context; it does not change any rating.
Token
Class
Issuer
Contract
USDCDefault
fiat-backed stablecoin
Circle
Conversion. The token is sold for fiat when a payment is authorised.
Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
The card spends USDC with no conversion at top-up. The Card Terms make the deposited digital asset collateral that is liquidated by smart contract to repay each purchase. Users can opt into sUSD, Solayer's yield-bearing stablecoin, for savings, but the docs describe spending from USDC. The chain is unsettled: the Card Terms name Solana as the Supported Blockchain, while the product pages say Solayer Pay runs on Solayer Chain, so no chain or mint address is given.
Checked 2026-10-12
Evidence (2)2 documented
Documented
The Overview says the card spends directly from USDC with no pre-conversion and runs on Solayer Chain.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 0 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Solayer and the issuer can suspend an individual account or card, or deny any transaction, without cause or notice. Anchor 0. No settlement contract was found to assess.
Evidence (1)1 documented
Documented
International Card Terms s9 let Solayer or the Issuer suspend, revoke or cancel the account or card, or deny any transaction, at any time in their sole discretion.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Geographic and sanctions filtering is disclosed in docs (also versioned in the public solayer_docs repo) and enforced in closed services. It cannot be bypassed (C2 = 0). 1.
Evidence (1)1 documented
Documented
The Eligibility page lists 17 restricted US states and 96 restricted countries and territories (residents or citizens), with sanctions, regulation and security as the reasons; the Card Terms require that the user is not OFAC-sanctioned.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The token (USDC) and chains are named in docs only, and the docs disagree on the chain: the Card Terms say Solana, the product pages say Solayer Chain. Freeze powers are not stated. 1.
Evidence (1)1 documented
Documented
Card Terms define Supported Blockchains as Solana plus networks the Issuer may add; the Overview says the card spends USDC and is "built on Solayer Chain". Neither names USDC's issuer freeze powers or Solayer Chain's operator assumptions.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Nothing needed to run the card is public. 0.
Evidence (1)1 verified
Verified
The only Solayer Pay material on GitHub is documentation in solayer_docs; none of the 15 solayer-labs repos (agave fork, solayer-rpc, solayer-cli, token-metadata and others) contains card, deposit or wallet code.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
KYC plus occupation and salary goes beyond settlement needs. It is disclosed in the guide, with no stated legal basis. 1.
Evidence (1)1 documented
Documented
The KYC guide (Sumsub) collects country, state, city, address, postal code, occupation, annual salary, email, an identity document (front and back) and a liveness check.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The issuer, Visa and Sumsub are named in docs and are not swappable. No Solayer privacy policy was found (solayer.org/privacy returns 404). Disclosed in docs only, so 1.
Evidence (1)1 documented
Documented
The Card Terms name the issuer and the KYC guide names Sumsub; the FAQ says personal information is handled per the card provider's privacy policy.
Who holds funds between payer and payee, and can the provider redirect them? S1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Solayer's own Security page describes provider-held hot and cold wallets. The Card Terms template's user-custody smart-contract claim names no contract and contradicts that page. Judgment call: taking the lower reading, provider-held and disclosed, so 1.
Evidence (1)1 documented
Documented
The Security page says card funds sit in Solayer-run hot wallets (operational balance) and multi-signature cold storage; the US Card Terms instead say collateral is held in the user's custody in smart contracts, with no address given.
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Derived: funds are provider-held (S1 = 1), there is no direct settlement path (C2 = 0), every service is closed and single-vendor (C3 = 0), and nothing can be self-hosted. Withdrawal is a request to Solayer. Funds depend on Solayer being live. 0.
Evidence (1)1 documented
Documented
US Card Terms make withdrawal a request to Solayer with three business days' notice; the Security page puts balances in Solayer-run wallets.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 0
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
No published audit report was found.
Compiled from: Solayer's Audits page (docs.solayer.org/resources/security/audits) and the Solayer Pay Security page, the solayer-labs GitHub org (solayer-improvement-proposal audits/ folder, token-metadata), Rain's security page (audits under NDA, Sherlock named) and the Sherlock report repo. The listed OtterSec and Halborn reports (2024) cover the restaking, endoAVS, pool, sUSD and token-metadata programs, none of which is in the card's USDC spending path, so they are not logged. No audit of Solayer Pay, its hot and cold wallets or a card collateral program is published. Rain's Sherlock contest of its EVM collateral contracts is not logged: the docs put card funds in Solayer-run wallets on Solana or Solayer Chain, not in Rain's EVM contracts. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 7 evidenced, 0 attested, 1 absent, 0 not applicable, 37 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
card
payer
20 USD per year membership (virtual card); physical card free plus shipping 24.99 USD (US) or 59.99 USD (international)
Fee structure page and physical card page; the card is deactivated after 6 months of inactivity.
provider
payer
Top-up 1% per top-up (fee page); the FAQ says 0.5% and the top-up guide 0.10 USD
Three Solayer docs pages disagree; the dedicated fee page is listed first.
card
payer
0.15 USD per USD transaction
Fee structure page and FAQ.
fx
payer
Intl card: 0.10 USD + 1.5% per non-USD transaction, plus cross-border up to 3%; US card: 1%
International Card Terms disclosures (effective 11 April 2025) and fee page; the FAQ says 0.10 USD + 1.75%; US Card Terms disclosures.
cashout
payer
ATM withdrawals with the physical card; standard ATM and network fees may apply; no Solayer figure
Physical card page.
limit
none
ATM 250 USD per withdrawal (including surcharges), three attempts per rolling 24 hours
Physical card page; spending limits are otherwise set dynamically by Solayer and the issuer (card terms).
card
payer
Penalties (international card): late payment up to 40 USD, returned payment up to 29 USD, liquidation up to 35 USD
International Card Terms disclosures; fees may change on 30 days' notice.
Solayer's own pages disagree on the top-up fee (1%, 0.5%, 0.10 USD) and the international fee (1.5% or 1.75%); the US Card Terms list no annual fee while the docs charge 20 USD a year. Network fees for deposits are not stated.
Documented
Solayer Pay fee structure page (membership, top-up and transaction fees).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Provider-custodial
Agrees with S1 (score 1, judgment call), because the Security page puts card funds in Solayer-run hot wallets and multisig cold storage, against the US Card Terms' unbacked statement that collateral stays in the user's custody in smart contracts and the overview's "non-custodial" claim.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Licences and registrations
Unknown
No licence found for any party. No Solayer document names a licence, regulator or registration for Solayer Labs, Inc. Third National is not an FDIC-insured US bank by that name; the Puerto Rico OCIF register was not checked (earlier attempts from this environment failed the TLS handshake). Rain (Signify Holdings) is not named in Solayer's documents.
Documented
The card terms name Third National as issuer under licence from Visa, without regulator, licence type or number; governing law Puerto Rico.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
Evidenced
Where
Method
Partner
Fee
Limits
everywhere offered
card spend
Third National (issuer), Visa
0.15 USD per USD transaction; 0.10 USD + 1.5% non-USD (plus up to 3% cross-border)
Virtual and physical cards; spending limits set dynamically by Solayer and the issuer; 17 US states excluded.
everywhere offered
atm
Third National (issuer), Visa ATMs
Standard ATM and network fees may apply
Physical card only; 250 USD per withdrawal including surcharges; three attempts per 24 hours.
ALL means every country not on the blocklist in the provider file. No bank-transfer off-ramp is documented; balances leave the card only as spend, ATM cash or a collateral withdrawal requested from Solayer (US terms, 3 business days' notice).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Evidenced
2025-04-11: Card Terms (international and US) take effect; earliest dated primary source for the card programme. No launch announcement found.
solayer.org/resources/blog lists posts back to May 2025 (a July 2025 post on card updates via Telegram) but no launch post. The docs overview says the card is live for 40,000+ users.
Documented
International Card Terms header; the US Cardholder Agreement carries the same date.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Operating entity
Unknown
The contracting entity is named (Solayer Labs, Inc.), but no document states its jurisdiction of incorporation, registration number or a real address (the Terms give "123 Main Street, Anytown, USA"). Governing law (New York) is not taken as the jurisdiction. No company register checked.
Documented
Solayer Terms of Use name Solayer Labs, Inc. as operator and choose New York law; the notice address is a placeholder.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
No incident report for the card found. Searched status.solayer.org (no card component, no incident listed), solayer.org/resources/blog and docs.solayer.org.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2025-04-11: International and US Card Terms take effect (issuer Third National). source
2026-03-12: Docs rebrand the Emerald Card to Solayer Pay and switch to a 20 USD per year membership model. source
Verified
Commit of 2026-03-12 "docs - update Solayer Pay to $20/year membership model", following f0bac808 (rebrand Emerald Card to Solayer Pay) the same day.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not verifiable
No listed contracts. Card funds sit in Solayer-run hot and cold wallets whose addresses are not published, and the card settles over Visa on the issuer's closed ledger.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No ISO 27001 statement found for Solayer Labs, Inc. in docs.solayer.org (Solayer Pay pages, security and audits pages, legal pages) or solayer.org/terms. Third National not checked.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown
No SOC 2 or ISAE report or statement found.
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Evidenced
Solayer lists five audits (OtterSec April and July 2024; Halborn August and October 2024) covering token-metadata, restaking, endoAVS and sUSD programs, and commits to two audits a year on existing contracts. None covers Solayer Pay, its hot/cold wallet backend or the card programme. source 1
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown
No penetration-test report or statement found. The audits page invites bug reports to report@solayer.org; no bounty terms found.
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown
No customer incident-notification commitment found in the card terms, website terms or docs.
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown
The Security page says cold storage "provides a fallback in extreme cases" and describes regular cold-wallet rotation and review; no recovery plan is published.
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Evidenced
Public status page at status.solayer.org (Better Stack) covering solayer.org, the app page, a deposit/withdraw monitor and RPC endpoints; no card or Solayer Pay component. No post-mortems found. source 1
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Unknown
Users connect a wallet to the Solayer app; no account-level MFA statement found for the card dashboard.
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
The Security page says cold wallets are protected by multi-signature access controls; no statement on privileged staff access.
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown implied from the component list
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown implied from the component list
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown implied from the component list
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Evidenced
Only the issuer's GLBA privacy notice speaks to data security ("security measures that comply with federal law", computer safeguards, secured files and buildings). No Solayer data classification, encryption-at-rest or TLS statement found. source 1
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Absent
The card terms refer to a "Solayer Privacy Policy" that is not published; the FAQ defers to the card provider's privacy policy. No retention or deletion statement exists for Solayer. Third National's GLBA notice (opening-account) covers sharing, not retention. source 1 · source 2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Unknown
No Solayer privacy policy, so no controller statement; the only notice is Third National's GLBA notice. KYC is collected by Sumsub (CROPS P2).
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown
The Security page lists real-time transaction monitoring and circuit breakers that freeze suspicious activity; no SIEM or endpoint-detection statement.
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Evidenced
The Security page describes a hybrid hot-wallet (card swipes, small operational balance) and offline multisig cold-storage design; no logical, infrastructure or integration architecture and no deposit or wallet addresses are published. source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Solayer Labs, Inc. under the website Terms (New York law); the card terms are between the user, Solayer and the issuer Third National (Puerto Rico law). Incorporation state and address are not given: the Terms' notice address is a placeholder (123 Main Street, Anytown, USA). Rain is not named in any Solayer document read, though the card terms follow Rain's template. source 1 · source 2 · source 3
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
Card revenue from a 20 USD annual membership, top-up fees and per-transaction fees (see fees); Solayer also runs a LAYER token and points programme. No financial statements found. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Solayer or the issuer may suspend, revoke or cancel the account or card at any time, with or without cause or notice (card terms s9); the website Terms allow suspension or termination with or without notice. Cards are deactivated after 6 months of inactivity. Under the US terms, withdrawing collateral needs 3 business days' notice to Solayer. No statement on what happens to balances or data on termination. source 1 · source 2
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Unknown
Circuit breakers that freeze suspicious activity and real-time monitoring are described; whether these are automated or AI-driven is not stated.
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
None found. Absence of public code is itself a finding.
Contracts
None listed.
Assessor notes
Eligibility: no verified contract and no public repository needed to run the card, so type is incumbent. Chain: the Card Terms define Supported Blockchains as Solana; product pages say the card is "built on Solayer Chain" (InfiniSVM). Neither names a deposit address or program, so I could not decide between them from evidence and recorded both. Searched 2026-10-07: docs.solayer.org llms.txt and every solayer-pay page (overview, card, portfolio, security, eligibility, fees, register, KYC, top-up, FAQ) and legal pages; github.com/solayer-labs (15 repos; card material only in solayer_docs); solayer.org/terms (website terms); solayer.org/privacy (404). The Card Terms are Rain's template (Third National, collateral, Supported Blockchains); Rain's Solana collateral program id is not published (SignifyHQ examples repo has IDLs only). Re-assess as type card if a deposit or collateral program is published.
