Internal — Confidential
Salud Vault Strategic Research Brief · March 2025
Internal Strategic Research · Product Architecture · Go-to-Market
A comprehensive internal reference covering product design, partner stack, competitive positioning, CVS distribution strategy, healthcare credential integration, DeFi consumer gateway, and go-to-market roadmap for the Salud Vault × Tangem product launch.
01 Executive Summary
Salud Capital controls gift card planogram positions in over 9,000 CVS Health pharmacy locations. We are launching a co-branded Salud Vault × Tangem two-card set — distributed as a retail SKU alongside Green Dot and Vanilla — that gives unbanked and underbanked consumers a self-custodial USDC wallet, Visa debit card, healthcare credential vault, and DeFi gateway in a single store visit. The distribution position is the moat. No competitor can replicate it without a separate retail negotiation we've already won.
Salud Vault is a three-pillar product: a financial inclusion wallet (USDC stablecoin, Visa spend, cross-border remittance), a healthcare credential vault (insurance ID, HSA/FSA, Rx benefits, MinuteClinic access — all stored on the same passport-grade hardware), and a DeFi consumer gateway (ERC-4337 account abstraction makes blockchain infrastructure invisible to non-technical users). Each pillar is independently valuable. Together, they create a product no incumbent has assembled.
The hardware is Tangem's NFC card — an EAL6+ certified Samsung secure element, the same chip grade used in US passports and government-issued smart IDs. Tangem has an active co-branding program, an open-source MIT SDK, and is rolling out Tangem Pay (Rain Financial + Visa) — the exact card spending layer Salud Vault requires. The product exists. We are co-branding and distributing it at scale.
02 Market Opportunity
The FDIC's 2023 survey identifies 5.6 million unbanked US households and 18.7 million underbanked. Hispanic and Latino households are disproportionately represented, and are the primary participants in cross-border remittance. The US–Mexico corridor reached $63.1 billion in 2023 (Banco de México) — the largest bilateral remittance corridor in the world. Western Union and MoneyGram charge 4–8% per transaction. Remitly has compressed this to 2–4% but offers no card product and no retail cash-in.
The prepaid card market (Green Dot, NetSpend, Vanilla) charges $5.95–$9.95/month in maintenance fees plus $3–5 reload fees. These are custodial products on legacy ACH rails with 1–3 day settlement. Salud Vault competes directly on every dimension: zero monthly fee, zero reload fee, 5-second settlement, and adds remittance capability that the incumbents don't offer.
CVS Health operates 9,000+ pharmacies, 1,000+ MinuteClinic walk-in clinics, and serves 37 million members through Aetna health insurance plans. The average CVS customer carries 4 separate cards for the same ecosystem: insurance ID, FSA/HSA, ExtraCare loyalty, and payment card. Salud Vault consolidates all four. Medical identity theft costs the healthcare system an estimated $30 billion annually — a credential stored only on a tamper-proof hardware chip, never in a server database, is structurally immune to the breach vectors that compromise existing credential systems.
ERC-4337 account abstraction, deployed on Ethereum mainnet in March 2023 and extended by EIP-7702 in the Pectra upgrade (May 2025), represents the first viable path to consumer DeFi adoption without technical barriers. Over 40 million ERC-4337 smart accounts have already been deployed. The missing piece has always been the physical UX primitive — a tap gesture familiar to every consumer. The Tangem NFC card is that primitive. The card tap IS the cryptographic signature. Non-technical users access yield, programmable payments, and cross-border settlement with zero blockchain knowledge.
"85% of Americans live within 10 miles of a CVS Pharmacy. For the unbanked, that proximity is the financial system access point that traditional banks never provided."
Salud Capital Internal Analysis, citing CVS Health Investor Day 202503 Product Architecture
Tangem NFC hardware with EAL6+ Samsung secure element. Carries the Tangem Pay Visa applet — enables spending USDC balance at any Visa terminal worldwide. Custom co-branded Salud Vault design (teal/navy colorway matching brand identity). No battery, no wires — powered entirely by the phone's NFC field during a tap.
Form factor: Standard credit card dimensions (ISO/IEC 7810 ID-1). Fits wallet, planogram blister pack, and contactless payment terminals.
Identical hardware specification to Card 1. Functions as self-custody recovery — no seed phrase required. Tap-to-link with Card 1 during the 3-minute setup flow. Cold storage only; no spending functionality. Consumer stores separately (at home, in a safe) as hardware recovery key.
Key insight: Tangem already sells a 2-card set as their standard product. We are co-branding what exists and packaging it as a gift card SKU. No custom hardware development required.
Step 1: Consumer selects Salud Vault two-card kit from CVS planogram (like any gift card). Step 2: Pays for kit + loads desired USDC amount in cash at the same register. Step 3: Opens Salud Vault app — taps Card 1 to phone to activate (3 minutes). Step 4: Completes tiered KYC (phone number for basic tier; ITIN/passport for higher limits). Step 5: Wallet live — balance available for Visa spend or cross-border remittance. No bank account, no desktop computer, no prior crypto knowledge required.
04 Three-Pillar Architecture Table
The table below maps every product dimension — user experience, technology, partners, security, and business model — across all three pillars of the Salud Vault product.
| Dimension | 01 — Financial Wallet & Remittance | 02 — Healthcare Credential Vault | 03 — DeFi Consumer Gateway |
|---|---|---|---|
| User Experience Layer | |||
| Entry point | CVS planogram kit purchase + same-register cash load | Tap at MinuteClinic check-in or pharmacy counter | Included in financial wallet setup — no separate activation |
| Activation | ~3 minutes · NFC tap | Instant credential tap | Runs on same smart account |
| Prior requirements | None — cash only, no bank, no credit check | Existing CVS / Aetna plan — linked during setup | None — Paymaster covers all gas. No ETH needed. |
| Technical knowledge | Zero — identical to tap-to-pay | Zero — tap card, done | Zero — blockchain is invisible infrastructure |
| Core Features | |||
| Balance type | USDC — on-chain, self-custodial, Visa-spendable | HSA/FSA — smart contract enforces eligibility rules | aUSDC yield position (Aave v3) — earns while idle |
| Primary action | Load → spend Visa → send remittance | Present credential → pay copay → earn rewards | Tap to sign → batch ops → automated schedules |
| Cross-border | MX, BR, PH, GT, SV — SPEI/PIX off-ramp, 5s, <1% | Aetna international network — global provider access | Any EVM chain — seamless, no chain selection needed |
| Automated finance | Recurring remittance via smart contract schedule | Recurring Rx auto-pay and benefit renewal | Rent, utilities, bills — full programmable automation |
| Technology Stack | |||
| Hardware (shared) | Tangem EAL6+ · Samsung secure element · NFC ISO 14443-A · Common Criteria EAL6+ (US passport grade) · No battery · 25-year lifespan · Water/dust resistant | ||
| On-chain standard | USDC ERC-20 on Polygon PoS | ERC-4337 smart account — HSA/FSA logic encoded | ERC-4337 + EIP-7702 (Pectra, May 2025) |
| Gas model | Paymaster sponsored — $0 ETH to user | Paymaster sponsored — healthcare ops subsidized | Alchemy AccountKit Paymaster — Salud absorbs gas |
| Settlement | 2–5 seconds · <$0.01/tx on Polygon | Instant credential present · 2–5s payment | 2–5s · batch in single UserOperation |
| Partner Integrations | |||
| Hardware / SDK | Tangem co-brand program ([email protected]) · MIT open-source SDK · iOS + Android · white-label app support | ||
| Card / spend rails | Rain Financial + Visa (Tangem Pay) | Rain + Visa for HSA/FSA point-of-sale | Rain + Visa for DeFi-to-fiat bridge |
| Cash-in | PayNearMe · CVS POS barcode reload | N/A | N/A (funded from existing wallet balance) |
| Stablecoin | Circle USDC · Programmable Wallets API | Circle USDC for HSA/FSA settlement | Circle USDC · Aave aUSDC yield token |
| FX / remittance | Circle (USD) · Bitso (MXN) · dLocal (BRL/PHP/LA) | N/A | Any DEX via ERC-4337 UserOperation |
| KYC / compliance | Persona · Tiered: phone number (Tier 1, $500 limit) → ITIN/passport (Tier 2, $2,500) → full KYC (Tier 3, $10k+) · Siloed from self-custody wallet per Tangem Pay model | ||
| Security & Compliance Architecture | |||
| Credential storage | Private keys on-chip only. EAL6+ prevents extraction. | Health ID on-chip · off-server · never in any database | Smart account keys on-chip · Paymaster is compliance layer |
| Privacy model | Self-custody wallet stays private. KYC applies only to Rain/Visa spending layer. | HIPAA-aligned by design. No PHI transmitted to Salud servers. | On-chain activity is pseudonymous. Compliance siloed to card layer. |
| Regulatory path | MSB/FinCEN · State MTLs via bank charter · CFPB Reg E prepaid | HIPAA Privacy Rule · HHS OCR · No PHI on servers | ERC-4337 is account infrastructure — not a money transmitter |
| Breach vector | None — card must be physically present for NFC signing | None — credentials never stored in breachable database | None — hardware-signed UserOps, no server-side key custody |
| Business Model | |||
| Revenue streams | Card interchange (~1.5–2%) · Remittance margin · Plan fee ($0–$55/mo) · Cash-in spread | Payment interchange · HSA/FSA management fee · ExtraCare loyalty revenue share | Aave yield spread · Automation subscription tier · DeFi protocol referrals |
| Unit economics | Tangem kit COGS ~$15–25 · PayNearMe fee ~$1/load · Rain BIN fee · Circle API | Incremental to Pillar 1 — credential provisioning only | Alchemy Paymaster gas (~$0.01/tx) · Aave integration free |
| Launch timeline | Q3 2025 · 500 CVS pilot | Q4 2025 · 2,500 locations | Q1 2026 · 9,000 national |
| Competitive Moat | |||
| Primary moat | Salud controls 9,000 CVS planogram positions. No competitor replicates without a separate retail negotiation. | Only card that IS health identity + payment + DeFi. No incumbent combines all three. | NFC-tap DeFi UX is the first mass-market abstraction. Non-technical users access full DeFi stack invisibly. |
| vs. Green Dot | No fee. No reload fee. Adds remittance. Self-custody. | No health product. | No blockchain or yield product. |
| vs. Western Union | <1% vs 4–8%. 5s vs 1–3 days. Card included. | No health product. | No DeFi product. |
| vs. Remitly | Lower fee. Card product. Cash-in. Self-custody. | No health product. | No DeFi product. |
05 Tangem Partnership
Tangem produces an NFC hardware wallet in standard credit card form factor, certified at Common Criteria EAL6+ — the highest level of the international security certification standard, used for US passports, government smart IDs, and SIM cards. The private key is generated inside the secure element at setup and never leaves it — not during signing, not during backup, not ever. Extraction is physically impossible without destroying the card.
Tangem offers a formal co-branding program allowing custom card design in a partner's brand identity. The program includes direct-ship capability to the partner's distribution center. This covers the physical product layer completely — no custom hardware development, no separate manufacturing relationship required.
Contact: [email protected] (Tangem co-branding team)
MOQ: To be confirmed in partnership discussions. Estimated 25,000–100,000 units for pilot order.
Tangem Pay is a Visa card product built on Rain Financial's issuing infrastructure. It uses a "siloed compliance model" — KYC for the spending account is handled by Rain independently, while the self-custody wallet remains entirely private. The card program is already live; Salud Vault needs to determine whether co-branded access to Tangem Pay rails is available or whether a direct Rain relationship is the path.
Key question for partnership call: Can Salud Vault access Tangem Pay infrastructure under a white-label arrangement?
Tangem's SDK is published on GitHub under the MIT license (tangem/tangem-sdk-ios and tangem/tangem-sdk-android). This means Salud can build a fully white-labeled Salud Vault app incorporating NFC card authentication, key generation, backup linking, and transaction signing with no royalties or SDK fees. The SDK handles all NFC communication protocol, APDU command sets, and secure channel establishment — Salud writes product logic on top.
06 Healthcare Credential Vault
The addition of the healthcare credential vault to the Salud Vault product transforms it from a fintech product into a healthcare access platform. The strategic significance is that CVS Health is simultaneously the distribution channel (planogram), the healthcare provider (MinuteClinic), the pharmacy benefit manager (87M Rx members), and the health insurer (Aetna, 37M members). No other retailer in the US has this vertical integration. Salud Vault is positioned to become the credential layer for this entire stack.
Health insurance credentials (member ID, group number, plan type), HSA/FSA account identifiers and balance references, CVS Pharmacy prescription benefit plan data, ExtraCare loyalty identifiers, and MinuteClinic access tokens. None of this data transits through or is stored on Salud Capital's servers — the chip presents credentials directly to point-of-care reader systems.
The credential vault architecture aligns with HIPAA's minimum necessary standard because health data is never transmitted to or stored by a covered entity's server infrastructure. The Tangem chip is the "vault" — analogous to a physical insurance card but cryptographically authenticated. This design positions Salud Vault as a credential presenter, not a healthcare data processor, which significantly simplifies the regulatory compliance path.
The healthcare credential layer requires a formal data agreement with CVS Health / Aetna for credential provisioning and point-of-care reader integration. Given Salud's existing supplier relationship for the planogram positions, this is a warm introduction path rather than a cold sales process. The initial pilot would focus on ExtraCare loyalty integration (lowest regulatory complexity) before advancing to insurance credential and HSA/FSA integration.
07 DeFi Consumer Gateway
ERC-4337, deployed on Ethereum mainnet March 1, 2023, enables smart contract wallets without any protocol-level changes to Ethereum. The key innovation for Salud Vault: it decouples authentication (who authorizes the transaction) from gas payment (who pays the network fee). This is the Paymaster mechanism — Salud Vault's Paymaster contract pays gas on behalf of users. Users never hold ETH, never see a gas fee, never interact with any blockchain directly.
When a user taps their Tangem card to their phone, the NFC field powers the chip and the phone sends a signing request. The EAL6+ secure element executes the signing operation inside the tamper-proof hardware and returns only the signature — the private key never leaves the chip. This signature is what authorizes an ERC-4337 UserOperation.
A UserOperation is a structured intent object that can bundle multiple actions: pay a healthcare copay, route a portion to HSA, log the transaction, and distribute an ExtraCare reward — all in a single tap. This is the batch transaction capability that makes DeFi genuinely useful for non-technical consumers.
The Ethereum Pectra upgrade (May 7, 2025) introduced EIP-7702, which allows existing Externally Owned Accounts to temporarily execute smart contract code via delegation. This is complementary to ERC-4337, not a replacement. For Salud Vault, EIP-7702 means a user's existing wallet address can gain ERC-4337 capabilities without deploying a new contract — simplifying the account migration path for users who may already hold USDC in a standard wallet before purchasing a Vault card.
Alchemy's AccountKit provides production-ready bundler and paymaster infrastructure for ERC-4337. This is the recommended integration path for the pilot phase.
DeFi (Decentralized Finance) is a set of financial services — savings accounts that earn yield, instant international transfers, automated payments — that run on blockchain infrastructure. The problem has always been that using DeFi requires technical knowledge (MetaMask, seed phrases, gas fees, wallet addresses). ERC-4337 solves this by making the wallet itself smart enough to handle all that complexity. Combined with the Tangem card, the user experience is: tap the card, the thing happens. That's it. The blockchain is infrastructure, like TCP/IP is infrastructure for email — invisible, but essential.
08 CVS Distribution Strategy
Salud Capital's retail supply chain business manages prepaid card and gift card categories for a Fortune 20 retailer, including planogram positions in 9,000+ CVS Health locations. The Salud Vault × Tangem two-card set launches as a standard gift card SKU under this existing supplier relationship. No category buyer negotiation, no new vendor onboarding process, no planogram pitch — the positions are already controlled.
Green Dot has shelf space at CVS. So do Vanilla, PayPal, and a dozen other prepaid products. Every one of those companies negotiated independently with CVS Health's category buyers for their planogram position. Salud controls the planogram. We introduce SKUs under our existing supplier relationship. Our competitors, to match our shelf position, must run a separate retail sales process with CVS Health that could take 12–24 months. We start from day one.
CVS registers already process PayNearMe reload transactions for Green Dot and other prepaid cards. The barcode-based reload infrastructure is in place at every CVS location. Salud Vault integrates via the PayNearMe API — when a customer wants to load cash, the app generates a barcode, the CVS cashier scans it, the customer pays cash, and USDC settles to the Vault balance within seconds. PayNearMe handles all the money movement; Salud provides the barcode generation and webhook integration.
The Q3 2025 pilot targets 500 CVS locations in the top-5 US–Mexico remittance markets by volume: Los Angeles, Houston, Chicago, Dallas, and Phoenix. These five metros account for approximately 65% of total US–Mexico remittance flow. The concentration of unbanked and underbanked Hispanic/Latino consumers in these markets is the highest in the country, and CVS store density in these areas is high. The pilot will measure: kit sell-through rate, cash load attachment rate per kit sold, 30/60/90-day active user rate, remittance transaction attach rate, and average USDC balance.
09 Partner Stack & Integration Requirements
| Partner | Role | What Salud Needs | Priority | Contact Path |
|---|---|---|---|---|
Tangem Hardware wallet manufacturer |
EAL6+ NFC card hardware · co-brand program · MIT SDK · Tangem Pay infrastructure | Co-branding agreement · MOQ / unit pricing · SDK integration access · Tangem Pay white-label discussion | Critical Path | [email protected] (co-branding) · tangem.com/en/co-branding |
Rain Financial Card issuing + BIN sponsor |
Visa card issuance · BIN sponsorship · Tangem Pay partnership · KYC compliance silo | Access to Rain card issuing under co-branded or white-label terms · API for card provisioning | Critical Path | Via Tangem partnership discussion or direct at rain.com |
Circle USDC stablecoin infrastructure |
USDC minting/redemption · Programmable Wallets API · Cross-border USDC rails | Programmable Wallets API access · USDC liquidity for cash-in conversion · Circle Mint account | High | circle.com/en/programmable-wallets · BD contact via circle.com |
PayNearMe CVS cash-in network |
CVS register barcode reload · cash-to-USDC on-ramp · existing CVS POS integration | API integration for barcode generation · cash load webhook · CVS-specific contract terms | High | paynearm.com/contact — reference existing CVS relationship |
Alchemy ERC-4337 infrastructure |
AccountKit for smart account deployment · Bundler for UserOperations · Paymaster for gas sponsorship | AccountKit enterprise plan · Paymaster policy configuration · Polygon PoS node access | Medium | alchemy.com/account-abstraction · enterprise sales |
Bitso / dLocal FX & remittance off-ramp |
USDC → MXN (Bitso) · USDC → BRL/PHP/GTQ/USD (dLocal) · SPEI/PIX settlement | API for USDC liquidity conversion · corridor pricing · SPEI integration for Mexico | High | bitso.com/business · dlocal.com/contact |
Aave Protocol USDC yield on idle balance |
Aave v3 USDC supply — generates aUSDC yield tokens · Polygon deployment | No partnership needed — Aave is a permissionless protocol · Integrate via Aave v3 contracts on Polygon | Medium | aave.com/developers · open-source contracts on GitHub |
Persona KYC / identity verification |
Tiered KYC: Tier 1 (phone), Tier 2 (ITIN/passport), Tier 3 (full KYC) · AML screening | Persona API integration · ITIN and foreign passport support · BSA/SAR reporting hooks | High | withpersona.com · startup pricing available |
CVS Health / Aetna Healthcare credential issuer |
Insurance credential provisioning · HSA/FSA account linking · MinuteClinic reader integration · ExtraCare loyalty | Data use agreement for credential provisioning · Point-of-care NFC reader integration · Aetna plan API access | Phase 2 | Via existing CVS supplier relationship — warm introduction path |
BaaS Bank Partner MSB / MTL coverage |
State money transmitter license coverage via bank charter · FDIC pass-through for stored value · BSA officer | Bank charter sponsorship for prepaid product · MTL coverage in top-15 remittance states | Critical Path | Evolve Bank · Thread Bank · Stride Bank — all have active BaaS programs |
10 Competitive Positioning
| Metric | Green Dot | Western Union | Remitly | Salud Vault |
|---|---|---|---|---|
| Monthly fee | $5.95–$9.95 | N/A | N/A | $0–$2 target |
| Reload / cash-in fee | $3–$5/load | Agent-only | None available | $0 at CVS |
| Remittance fee | Not offered | 4–8% | 2–4% | <1% target |
| Settlement speed | 1–3 days | Min–3 days | Min–1 day | ~5 seconds |
| Visa debit card | Prepaid only | None | None | Yes · self-custody |
| CVS cash-in | Yes (fee) | Agent only | None | Yes · $0 fee |
| Self-custody | No | No | No | Yes · EAL6+ hardware |
| Healthcare credentials | No | No | No | Yes · on-chip HIPAA |
| DeFi / yield | No | No | No | Yes · Aave v3 USDC |
| Retail distribution | CVS (negotiated) | Agent network | App-only | CVS (controlled) |
"The fundamental competitive insight is not that Salud Vault is better on any single dimension — it's that no competitor has assembled the complete stack. Green Dot is good at prepaid. Western Union is good at remittance. Neither has the other's product, and neither has self-custody, healthcare, or DeFi. Salud Vault is the only product that covers all five consumer financial access needs simultaneously."
Salud Capital Internal Analysis11 Business Model & Unit Economics
Card interchange: Visa interchange on debit card transactions is approximately 0.8–1.5% of transaction value. For an active user spending $500/month, this generates ~$5–7.50/month in interchange revenue.
Remittance margin: Target total corridor cost <1%. If Salud sources FX at 0.4% and charges 0.8%, the spread is 0.4% per transaction. On a $500 remittance, that's $2 gross margin.
Plan subscription: Tiers from $0 (financial-only) to $55/month (Premium with all three pillars). Even at 30% conversion to paid plans, the ARR per active user is meaningful.
Aave yield spread: Aave v3 USDC currently yields ~4–6% APY. If Salud passes 3% to users and retains 1–2%, on a $300 average wallet balance that's ~$3–6/user/year — small individually but scalable.
Healthcare interchange & fees: HSA/FSA payment interchange + potential revenue share on ExtraCare health loyalty integration.
Hardware COGS: Tangem 2-card set at retail is ~$25–28. Wholesale co-brand pricing to be confirmed but estimated at $15–20 per kit. Retail price of $19–28 with $5–10 margin on kit sale alone.
Infrastructure: Circle Programmable Wallets API, Alchemy AccountKit, PayNearMe fees (est. $0.50–1.00/load), Persona KYC (est. $0.50–1.50/verification), Rain Financial BIN fees, Bitso/dLocal FX liquidity costs.
Regulatory: FinCEN MSB registration (one-time ~$2K) + state MTL fees (varies; ~$50K-150K total for top-15 states) OR bank charter sponsorship fee (annual, typically 50–100bps of transaction volume).
Unit economics target: Break-even at approximately 15,000 active users generating regular transaction volume. Pilot of 500 CVS locations with 2% kit sell-through at 50 kits/location = 500 users in Month 1.
12 Roadmap & Milestones
13 Risk Register
14 Immediate Action Items
Week 1–2: Contact Tangem co-branding team ([email protected]). Request partnership call covering: co-brand MOQ/pricing, Tangem Pay white-label terms, SDK integration scope. Share this brief as context.
Week 1–2: Engage BaaS bank partner candidates (Evolve, Thread Bank, Stride Bank). Request terms for prepaid card program with MSB/MTL coverage. This is the critical path item for Q3 2025 launch.
Week 2–3: Open PayNearMe commercial discussion. Reference existing CVS supplier relationship. Request API documentation for barcode-based cash reload integration.
Week 2–4: Create Circle account at circle.com. Review Programmable Wallets API documentation. Deploy Polygon testnet smart account using Alchemy AccountKit.
Week 3–4: Engage Persona for KYC API. Confirm ITIN and foreign passport support. Review tiered KYC pricing for projected volume.
Month 2: Tangem SDK integration — build NFC card tap, wallet activation, and balance display in iOS/Android prototype. This is the core UX proof-of-concept needed for partnership and investor discussions.
Month 2–3: Initiate CVS Health / Aetna ExtraCare loyalty API discussion via existing supplier relationship. This is a low-risk, high-value starting point for the healthcare credential layer.
Month 3: Target working prototype demo: customer taps Tangem card to phone, USDC balance displays, remittance send flow completes. This demo is the foundation for Series A / impact investor conversations.
The BaaS bank partner and Tangem partnership are the two critical path items. Everything else — Circle integration, PayNearMe, Persona, Alchemy — can proceed in parallel and is lower risk. If either the BaaS bank or Tangem partnerships take longer than expected to close, the Q3 2025 pilot timeline moves accordingly. Both should be the first two calls made.