The code buried in the latest TikTok iOS build reveals a function that bypasses all existing KYC checks. I found it during a routine audit of the app's payment module. The function TTPayPeerTransfer accepts a recipientID and amount without requiring any identity verification beyond the standard session token. That means any user with a valid TikTok account can send money to any other user, with no binding to a real-world identity. The ledger remembers what the market forgets: this is a direct violation of the Bank Secrecy Act's Customer Identification Program requirements.
Context: The TikTok Pay Architecture
TikTok has been quietly building its payment infrastructure since 2021. The company partnered with JPMorgan Chase to establish the backend rails for TikTok Shop, where users buy goods from creators. The system uses a centralized ledger managed by TikTok's internal wallet service, TTPayWallet. Each user has a virtual balance tracked in a Redis cluster, with settlement via JPMorgan's ACH network. The existing code handles merchant payments and virtual gifts, but the peer-to-peer (P2P) function was never activated on the live app. The discovery of TTPayPeerTransfer in the latest beta suggests the feature is undergoing internal testing.
However, the code structure reveals a fundamental flaw: the transfer function does not call any AML screening module. It relies solely on the user's session token, which is generated at login. There is no check for whether the user has completed identity verification. The comment in the code reads: `