RANAPAY

Defines the compliance framework for gift-card and voucher activities and the use of authorised PPI or regulated partners, including regulatory mapping, product restrictions and escalation.

Controls onboarding, due diligence, contractual governance, operational coordination, service levels, settlement, escalation and review of PPI issuers, banks and regulated partners.

Defines customer identification, verification, risk-based due diligence, record maintenance, enhanced review and customer information controls where applicable.

Provides controls for AML/CFT risk assessment, customer risk, transaction monitoring, escalation, investigation, record keeping and applicable reporting obligations.

Establishes controls for suspicious activity detection, transaction monitoring, fraud rules, velocity checks, investigation, holds, blocks and escalation.

Controls product onboarding, denominations, validity, issuer or partner approval, product terms, issuance configuration and governance.

Defines customer-facing terms relating to purchase, activation, redemption, expiry, restrictions, refund, cancellation and applicable product conditions.

Controls refunds, cancellations, reversals, chargebacks, disputes, approvals, timelines, evidence and reconciliation.

Defines complaint intake, acknowledgement, investigation, resolution, escalation, tracking, records and management review.

Provides procedures for suspected unauthorised transactions, customer verification, investigation, temporary restrictions, partner coordination, resolution and records.

Controls payment processing, settlement, partner statements, reconciliation, exceptions, refunds, outstanding balances and financial controls.

Establishes the information-security framework covering assets, access, network, endpoints, applications, data, logging, vulnerabilities, backups and security awareness.

Defines detection, reporting, containment, evidence preservation, investigation, customer protection, partner coordination, recovery and post-incident review.

Controls collection, use, sharing, access, protection, retention, disposal and privacy handling of customer, employee and business information.

Controls vendor due diligence, risk classification, onboarding, contracts, security, monitoring, incidents, subcontractors, continuity and exit.

Controls identity, role-based access, MFA, privileged access, service accounts, API authentication, authorisation, keys, logging, testing and revocation.

Provides continuity and recovery controls for critical systems, operations, partners, backups, outages, cyber incidents, disaster scenarios and recovery testing.

Controls identification of reporting obligations, preparation, review, submission, evidence, retention, legal holds, record integrity and retrieval.

Covers the full operational lifecycle from product setup and issuance through activation, delivery, redemption, balance, expiry, blocking, reissue, refund and reconciliation.