Every crypto donation page has a brand on it. Behind the brand there is a company, incorporated somewhere specific, bound by that place's law, and willing to end the arrangement on terms the charity agreed to without reading.
We went looking for ours. We think every charity taking crypto should do the same exercise, and we are publishing what we found because almost nobody does.
Declare the conflict first: TraceGood accepts donations through NOWPayments. Everything below is about the company we ourselves depend on, read from its own published documents on 22 October 2026. We are not lawyers, and nothing here is legal advice.
The brand is not the counterparty
Our checkout says NOWPayments. The terms of service governing it are titled FD Transfers LLC Terms of Service, and they name a company registered in St Vincent and the Grenadines, with a registered address in Kingstown.
That is the entity on the other side of the agreement. It is the entity a dispute would be against, the entity holding funds in transit, and the entity receiving donors' data. Our own privacy page said "NOWPayments" for months — a brand, not a counterparty — and we changed it the day we worked this out.
If you take crypto donations, open your processor's terms right now and find the legal name and the country. It is often not the country in the marketing.
The five documents, and where they hide
Our processor publishes five legal documents: terms of service, an AML/KYC policy, a privacy policy, a cookie policy and a service-quality document. None of them were at the URLs we guessed. /terms, /legal and /aml-kyc-policy all returned 404.
They are linked only from the site footer, as versioned PDFs. We found them by reading the homepage's links.
This is worth saying plainly because it is the normal state of affairs: the documents that decide what happens to a charity's money are usually a PDF behind a footer link, with a version number that changes without announcement. Ours was last updated the day before we read it.
Download them and keep dated copies. A term you agreed to is not a term you can still read if the PDF is replaced.
What a prohibited-jurisdictions clause actually says
Section 15 of our processor's terms is headed "Prohibited Jurisdictions". It says the services are not rendered to residents or citizens of the European Union, the United Kingdom, the United States, the United Arab Emirates, the Russian Federation, or anywhere cryptocurrency services are restricted by law.
Read quickly, that sounds like a ban on donors, and we initially read it that way ourselves. Read carefully, it is two different things at once:
- A disclaimer aimed at individuals. If people in those places use the service anyway, the clause says they do so at their own risk and that the company does not thereby become subject to their country's data-protection or consumer rules. That is a shield against being regulated, not an instruction to the charity.
- An eligibility condition aimed at the merchant. A later subsection talks about preventing use by merchants in those places, and says the merchant must comply even if the blocking can be bypassed. A separate clause has the merchant warrant that it is "eligible" to use the service at all.
Nothing in the terms obliged us to block donors by country. But the merchant-side condition is real, and for us it has a consequence we had not seen.
The part that caught us
Our plan is to register as a non-profit association in Estonia. Estonia is in the European Union.
The processor's fiat withdrawal — converting crypto to ordinary money in a bank account — is offered in euro only, and requires business verification with company registration documents. So the position is circular:
- With no registered entity, there are no registration documents, so there is no fiat route at all.
- With an Estonian entity, the documents exist, but the merchant is now an EU legal person, squarely inside the clause above.
Crypto payouts to a wallet we control are unaffected either way, which is how donations actually settle for us today. But a charity that assumes it can convert to bank money later should check that assumption before it builds a budget on it.
The clause that matters more than the country
Buried past the jurisdiction language is the one most charities should read first. Our processor's terms reserve the right to terminate the agreement and the account at any time, in its sole discretion, for any or no reason, with immediate effect, without prior notice, with no obligation to give reasons and no obligation to refund amounts already paid. Disputes are governed by St Vincent law and heard where the company is domiciled.
For a commercial merchant that is an inconvenience. For a charity it is a different kind of risk: money in transit when the account closes is money donors gave for a purpose, and a thirty-day amicable-resolution step followed by proceedings in the Caribbean is not a realistic remedy for a small organisation.
The mitigation is not legal, it is operational. Do not let donations accumulate inside a processor. Settle to a wallet you control, on a schedule, and know what your fallback processor would be before you need one.
Two things we expected to find and did not
We went in assuming the worst on two points, and the documents did not support it. Both corrections are worth publishing.
Charities are not a restricted category. We read the restricted-business list expecting non-profits or fundraising to appear, as they do with some card processors. They do not appear anywhere in the terms or the AML policy.
It is not the processor that needs a licence here. A charity receiving donations through a processor is a merchant and a recipient, not a crypto-asset service provider. The licensing obligations in that chain sit with the processor, not with us.
Being wrong in a cautious direction is still being wrong, and we would rather say so than leave the scarier version standing.
The checklist
For any charity accepting crypto through a processor:
- Find the legal name and country of incorporation in the terms, not the brand on the button.
- Download all the legal PDFs and keep dated copies.
- Read the termination clause before the fee schedule. Notice period, reasons, and what happens to balances.
- Find the governing law and the forum for disputes, and ask yourself honestly whether you would ever use it.
- Check whether your own country of registration is excluded, including the one you plan to register in.
- Check what the fiat off-ramp requires — currency, verification documents, and whether it exists for you at all.
- Name your fallback before you need it.
- Tell your donors who receives their data. If the terms name a company, your privacy page should name it too.
Where we stand
We are still using this processor. Nothing we found is a scandal; most of it is ordinary offshore payments drafting, and some of the clauses are more carefully written than we expected. We are publishing it because a charity asking for money owes people the unglamorous facts about where that money goes, and because the exercise took an afternoon and told us something we would otherwise have learned at the worst possible moment.
The concrete change this produced is on our privacy page, which now names the company that receives donor data, where it sits, and what its terms say about it.
We are a newly founded organisation whose registration as a non-profit association in Estonia is not yet complete, and donations to us are not tax-deductible anywhere. Our About page carries the full position.
If you think we have misread any of this, tell us — we would genuinely like to know.
How donations reach us · Why some countries cannot be reached at all