Cardvoy

Country packs

Each regulator’s rules, built in and referenced

A country pack is a versioned set of rules, limits, calendars and formats for one market. Every limit shows the circular and clause behind it. Packs are maintained by SMH and updated when a regulator changes its rules. Current version: 2026.2.

CoreThe same for every bank in every country. Changed only by SMH releases.
Country packDeadlines, destruction rules, record retention, ID types, mobile formats, calendar, languages, residency and regulator returns.
OrganisationYour structure, couriers, templates and policies, within the limits the pack allows.

How the limits work

  • Floors and ceilings: a bank can be stricter than the regulator, never looser. A value outside the limit is refused with the clause that sets it.
  • Locked rules: some rules cannot be switched off at all, for example dual control for destruction.
  • Working days: deadlines count working days on the pack calendar, with the country weekend and public holidays.
  • Sources: each pack lists the regulator documents it implements and marks any rule that still needs confirmation from the bank’s compliance team.

Eight markets

Country packs in v1.0

PK

Pakistan

State Bank of Pakistan (SBP)

  • On-us card kept at the branch at least 5 working days (BC&FRF 2025, cl. 3.2.2.1(4))
  • Off-us card sent to the issuer the same day (PSD CL 4/2010)
  • Issuer returns within 2 working days
  • Card records kept 10 years (PSD C-05/2016)
  • Destruction under maker-checker with 2 witnesses
  • CNIC / SNIC, NICOP, POC and passport; English and Urdu
BD

Bangladesh

Bangladesh Bank (BB)

  • Customer application settled within 7 working days (PSD Circular 04/2017, cl. 1.6)
  • Off-us cards destroyed by the acquirer and the issuer informed
  • Destruction under maker-checker with 2 witnesses
  • Friday–Saturday weekend
  • NID, birth registration and passport; English and Bengali
SA

Saudi Arabia

Saudi Central Bank (SAMA)

  • Cards delivered only to the named customer or an authorised person
  • Records kept at least 5 years
  • Destruction under dual control
  • National ID, Iqama and passport; Arabic and English
  • In-Kingdom hosting
AE

United Arab Emirates

Central Bank of the UAE (CBUAE)

  • Records kept at least 5 years (Consumer Protection Standards)
  • Destruction under dual control
  • Saturday–Sunday weekend
  • Emirates ID and passport; Arabic and English
  • Customer data stays in the UAE
BH

Bahrain

Central Bank of Bahrain (CBB)

  • Destruction under dual control
  • Outsourcing rules for courier and cloud providers
  • CPR and passport; Arabic and English
KW

Kuwait

Central Bank of Kuwait (CBK)

  • Destruction under dual control
  • Complaint response within 5 working days
  • Civil ID and passport; Arabic and English
OM

Oman

Central Bank of Oman (CBO)

  • Destruction under dual control
  • Financial consumer protection framework
  • Resident / Civil ID and passport; Arabic and English
QA

Qatar

Qatar Central Bank (QCB)

  • Destruction under dual control
  • Data handling and cloud computing rules
  • QID and passport; Arabic and English
  • Customer data stays in Qatar

Summaries of the v1.0 packs. Each bank’s compliance team confirms its pack before go-live; rules marked “to confirm” in the product are not yet verified against a published circular.

In the product

Every rule with its reference

Administrators see the whole pack on one screen: locale, identity rules, data residency, and every constraint with its regulatory reference. The SMH platform team publishes new pack versions to all banks at once.

The Pakistan country pack: constraints with their SBP references.
The Pakistan country pack: constraints with their SBP references.

See Cardvoy with your own process.

Book a walkthrough: we configure your branches, CFC, couriers and country pack in a private POC and run a captured card from ATM to customer while you watch.

Book a walkthroughOpen the live demo