ONERWAY Issuing provides card data protection, transaction risk control, and compliance support capabilities for issuing. When creating cardholders, issuing cards, processing transactions, and managing cards, merchants should establish corresponding data security and compliance processes according to platform rules, card network requirements, and applicable regulatory requirements.
Issuing involves sensitive data such as card numbers, expiry dates, CVV, cardholder information, and transaction records. During integration and use, merchants should follow the principle of least necessity, access, transmit, and process related data only in authorized business scenarios, and take necessary technical and management measures to prevent data leakage, misuse, or unauthorized access.
ONERWAY handles card data according to Payment Card Industry Data Security Standard (PCI DSS) requirements and reduces card data leakage risks through access control, transmission encryption, and sensitive data display restrictions.
When merchants access or process sensitive card information, they should also follow these requirements:
| Information type | Protection requirement |
|---|---|
| Card number | Display only the last four digits by default. Full card numbers should be retrieved only when necessary and authorized. |
| CVV | Use only for necessary verification scenarios. Do not persist, cache, or store it long term. |
| Expiry date | Transmit through secure channels and restrict display, access, and usage scope. |
| Cardholder information | Use only for authorized scenarios such as cardholder creation, identity checks, transaction processing, and compliance review. |
The platform identifies and handles risks based on card status, transaction behavior, merchant category, region, amount, frequency, and other dimensions. In some high-risk scenarios, transactions may be declined, or cards may enter restricted statuses such as system freeze. Follow platform prompts or support processes for further handling.
| Risk control dimension | Description |
|---|---|
| Spending limits | Control single-transaction, daily, or periodic spending amounts |
| Merchant category | Determine whether a transaction complies with card usage rules based on MCC or merchant type |
| Region rules | Determine whether a transaction region is supported based on business scope, product rules, or risk strategy |
| Transaction frequency | Identify high-frequency transactions or abnormal transaction patterns within a short period |
| Card status | Determine whether a transaction is allowed based on active, frozen, system-frozen, terminated, expired, or other statuses |
Before using issuing capabilities, merchants should ensure that their business, cardholder sources, card usage scenarios, fund sources, and transaction purposes comply with platform rules, card network requirements, and applicable laws and regulations. Different products, regions, or business models may have different information collection and review requirements.
When creating cardholders, merchants usually need to complete required information collection and checks, including basic information, contact information, country or region information, billing address, and other information required by the platform. Actual fields depend on product rules, account configuration, and compliance requirements.
When enabling issuing capabilities, merchants need to complete business qualification review. Review items usually include business entity information, shareholder or legal representative information, business model, fund source, expected card usage scenarios, and compliance commitments.
The platform and merchants should jointly address anti-money laundering requirements, including suspicious transaction identification, sanctions or watchlist screening, transaction monitoring, abnormal behavior review, and necessary reporting or cooperation processes. Merchants should avoid using cards for transaction scenarios that do not comply with platform rules or regulatory requirements.
Before cardholders use cards, merchants should ensure that cardholders have read and agreed to the relevant agreements, such as cardholder service agreements, card usage terms, and privacy policies. Agreement confirmations, authorization records, and related operation records should be properly retained for future lookup, audit, or compliance proof.
If merchants or cardholders have questions about a transaction, see Transaction disputes.
Compliance responsibilities are usually shared by the platform and merchants. The specific division depends on the business flow, data processing method, integration model, and applicable rules. Merchants are responsible for the authenticity of their business, cardholder management, internal permission controls, and compliant card usage.
| Responsible party | Responsibilities |
|---|---|
| ONERWAY | Platform compliance framework, technical security controls, transaction risk control capabilities, and necessary regulatory and audit support |
| Merchant | Business authenticity, cardholder management, compliant card usage, sensitive information protection, internal permissions, and operation audit |
Merchants should integrate issuing capabilities into a controlled server-side environment and establish internal operation rules to avoid risks caused by key leakage, excessive permissions, card data misuse, or abnormal card usage.