ONERWAY Issuing provides card data protection, transaction risk control, and compliance support for issuing. When creating cardholders, issuing cards, processing transactions, and managing cards afterward, merchants should establish corresponding data security and compliance management processes according to platform rules, card network requirements, and applicable regulatory requirements.
Issuing involves sensitive data such as card numbers, expiry dates, CVV, cardholder information, and transaction records. During integration and use, merchants should follow the principle of least privilege. Access, transmit, and process related data only for authorized business scenarios, and adopt necessary technical and management controls to prevent data leakage, misuse, or unauthorized access.
ONERWAY processes card data according to Payment Card Industry Data Security Standard (PCI DSS) requirements and reduces card data leakage risks through access control, transport encryption, and sensitive data display restrictions.
When merchants access or process sensitive card information, they should also follow these requirements:
| Information type | Protection requirement |
|---|---|
| Card number | Display only the last four digits by default; retrieve the full card number only when necessary and authorized |
| CVV | Use only for required verification scenarios; do not persist, cache, or store long term |
| Expiry date | Transmit through secure channels and restrict display, access, and usage scope |
| Cardholder information | Use only for authorized scenarios such as cardholder creation, identity checks, transaction processing, and compliance review |
The platform identifies and handles risk based on card status, transaction behavior, merchant category, region, amount, frequency, and other dimensions. In some high-risk scenarios, transactions may be declined, or cards may enter restricted statuses such as system frozen. Further handling may be required based on platform prompts or support processes.
| Risk dimension | Description |
|---|---|
| Spend limits | Control single-transaction, daily, or periodic spend amounts |
| Merchant category | Determine whether a transaction complies with card usage rules based on MCC or merchant type |
| Region rules | Determine whether the transaction region is allowed based on business scope, product rules, or risk policy |
| Transaction frequency | Identify high-frequency transactions or abnormal transaction patterns within a short period |
| Card status | Determine whether transactions are allowed based on statuses such as active, frozen, system frozen, terminated, or expired |
Before using issuing capabilities, merchants should ensure that their business, cardholder source, card usage scenarios, fund source, and transaction purpose comply with platform rules, card network requirements, and applicable laws and regulations. Different products, regions, or business models may require different information collection and review requirements.
When creating cardholders, merchants usually need to complete the required information collection and checks, including basic information, contact information, country or region information, billing address, and other information required by the platform. The actual field scope depends on product rules, account configuration, and compliance requirements.
When merchants activate issuing, they need to complete business qualification review. The review usually covers entity information, shareholder or legal representative information, business model, fund source, expected card use cases, and compliance commitments.
The platform and merchants need to jointly address anti-money laundering requirements, including suspicious transaction identification, list screening, transaction monitoring, abnormal behavior review, and required reporting or investigation support. Merchants should not use cards for transaction scenarios that violate platform rules or regulatory requirements.
Before cardholders use cards, merchants should ensure that cardholders have read and agreed to related agreements, such as cardholder service agreements, card usage terms, and privacy policies. Agreement confirmations, authorization records, and related operation records should be retained for later lookup, audit, or compliance proof.
Compliance responsibilities are usually shared by the platform and the merchant. The specific division depends on the business flow, data processing method, integration model, and applicable rules. Merchants are responsible for the authenticity of their business, cardholder management, internal access control, and card usage compliance.
| Responsible party | Responsibilities |
|---|---|
| ONERWAY | Platform compliance framework, technical security controls, transaction risk control capabilities, and required regulatory and audit support |
| Merchant | Business authenticity, cardholder management, compliant card usage scenarios, sensitive information protection, internal permissions, and operation audits |
Merchants should integrate issuing capabilities into a controlled server-side environment and establish internal operating procedures to reduce risks caused by key leakage, excessive permissions, card data misuse, or abnormal card usage.