For example, I could setup a fake product on ebay to facilitate payments to me. eBay shouldn't need to do CTF checks on this possibility.

Because the user already has a card, it means it has been verified by the bank (AMLc, CTF, etc.), and the bank has the final say on each transaction. I based ThreadPay on the logic of "checkout as guest" when purchasing something online; in my case, you pay an individual rather than a merchant.

According to security considerations, there are three layers:

1. The bank is the base layer. At any time, the bank may limit, suspend, or enforce any regulation on the user card.

2. The provider - Most payment providers, such as Stripe, have their own risk analysis products.

3. ThreadPay - based on the observation we will enforce our layer of security also. (We don’t have one at the moment)