Data security and compliance requirements

Learn about card data protection, transaction risk control, identity checks, AML requirements, and compliance responsibility boundaries in issuing.

ONERWAY Issuing provides card data protection, transaction risk control, and compliance support for issuing. When creating cardholders, issuing cards, processing transactions, and managing cards afterward, merchants should establish corresponding data security and compliance management processes according to platform rules, card network requirements, and applicable regulatory requirements.

Data security

Issuing involves sensitive data such as card numbers, expiry dates, CVV, cardholder information, and transaction records. During integration and use, merchants should follow the principle of least privilege. Access, transmit, and process related data only for authorized business scenarios, and adopt necessary technical and management controls to prevent data leakage, misuse, or unauthorized access.

PCI DSS compliance

ONERWAY processes card data according to Payment Card Industry Data Security Standard (PCI DSS) requirements and reduces card data leakage risks through access control, transport encryption, and sensitive data display restrictions.

When merchants access or process sensitive card information, they should also follow these requirements:

  • Do not record full card numbers in logs, tickets, screenshots, or uncontrolled systems
  • Do not store CVV in plaintext, and do not use CVV outside authorized scenarios
  • Use secure channels such as HTTPS to transmit sensitive data
  • Apply least-privilege access to sensitive data lookup or display capabilities
  • Keep necessary audit records for operations that involve card data access, lookup, or export

Sensitive information protection

Information typeProtection requirement
Card numberDisplay only the last four digits by default; retrieve the full card number only when necessary and authorized
CVVUse only for required verification scenarios; do not persist, cache, or store long term
Expiry dateTransmit through secure channels and restrict display, access, and usage scope
Cardholder informationUse only for authorized scenarios such as cardholder creation, identity checks, transaction processing, and compliance review

Risk control capabilities

The platform identifies and handles risk based on card status, transaction behavior, merchant category, region, amount, frequency, and other dimensions. In some high-risk scenarios, transactions may be declined, or cards may enter restricted statuses such as system frozen. Further handling may be required based on platform prompts or support processes.

Real-time transaction monitoring

  • Perform real-time or near-real-time risk assessment on transaction requests
  • Identify abnormal amounts, abnormal frequency, abnormal regions, abnormal merchant categories, or unusual card usage
  • Decline, block, review, or monitor high-risk transactions
  • Trigger system freezing, permission restrictions, or manual review when necessary

Common risk rules

Risk dimensionDescription
Spend limitsControl single-transaction, daily, or periodic spend amounts
Merchant categoryDetermine whether a transaction complies with card usage rules based on MCC or merchant type
Region rulesDetermine whether the transaction region is allowed based on business scope, product rules, or risk policy
Transaction frequencyIdentify high-frequency transactions or abnormal transaction patterns within a short period
Card statusDetermine whether transactions are allowed based on statuses such as active, frozen, system frozen, terminated, or expired

Compliance requirements

Before using issuing capabilities, merchants should ensure that their business, cardholder source, card usage scenarios, fund source, and transaction purpose comply with platform rules, card network requirements, and applicable laws and regulations. Different products, regions, or business models may require different information collection and review requirements.

KYC

When creating cardholders, merchants usually need to complete the required information collection and checks, including basic information, contact information, country or region information, billing address, and other information required by the platform. The actual field scope depends on product rules, account configuration, and compliance requirements.

KYB

When merchants activate issuing, they need to complete business qualification review. The review usually covers entity information, shareholder or legal representative information, business model, fund source, expected card use cases, and compliance commitments.

AML

The platform and merchants need to jointly address anti-money laundering requirements, including suspicious transaction identification, list screening, transaction monitoring, abnormal behavior review, and required reporting or investigation support. Merchants should not use cards for transaction scenarios that violate platform rules or regulatory requirements.

User agreements and electronic signing

Before cardholders use cards, merchants should ensure that cardholders have read and agreed to related agreements, such as cardholder service agreements, card usage terms, and privacy policies. Agreement confirmations, authorization records, and related operation records should be retained for later lookup, audit, or compliance proof.

Compliance responsibilities

Compliance responsibilities are usually shared by the platform and the merchant. The specific division depends on the business flow, data processing method, integration model, and applicable rules. Merchants are responsible for the authenticity of their business, cardholder management, internal access control, and card usage compliance.

Responsible partyResponsibilities
ONERWAYPlatform compliance framework, technical security controls, transaction risk control capabilities, and required regulatory and audit support
MerchantBusiness authenticity, cardholder management, compliant card usage scenarios, sensitive information protection, internal permissions, and operation audits

Security recommendations

Merchants should integrate issuing capabilities into a controlled server-side environment and establish internal operating procedures to reduce risks caused by key leakage, excessive permissions, card data misuse, or abnormal card usage.

  • Keep API Key, Webhook Secret, and other sensitive credentials secure, and do not expose them in clients, frontend code, or public repositories
  • Rotate keys regularly and use different credentials for sandbox and production environments
  • Configure IP allowlists, access controls, and operation audits for sensitive endpoints
  • Review card usage regularly and freeze or handle abnormal cards promptly
  • Establish internal approval, permission separation, abnormal reporting, and emergency handling processes