Regulation and standards
Designed around what regulators and auditors ask for
Cardvoy does not make a bank compliant on its own. It gives the bank controls, deadlines and evidence that map to the rules it must follow, and shows where each one comes from.
Regulatory requirements and how Cardvoy supports them
| Requirement | Market | In Cardvoy |
|---|---|---|
| Captured on-us card collectable from the branch for a minimum period | PK | Pack floor of 5 working days; SLA clock on the pack calendar |
| Off-us captured card sent to the issuer the same day; issuer return within 2 days | PK | Routing rules and deadlines; issuer return workflow |
| Off-us captured cards destroyed by the acquirer and the issuer informed | BD | Destroy-and-notify route with issuer notice |
| Card records retained for 10 years | PK | Retention floor in the pack; long-term backups in the AWS package |
| Cards delivered only to the named customer or an authorised person | SA and all | OTP, ID match and signature at handover; authorised-representative rules |
| Dual control and audit trail for card destruction | All | Locked maker-checker, two witnesses, numbered certificates |
| Customer data residency and cloud outsourcing rules | AE, QA, SA, all | Deployment in-country, private cloud or on-premises; onboarding refuses non-compliant regions |
| Complaint statistics and captured-card registers | All | Regulator reports per pack |
Security standards
| Standard | How Cardvoy supports it |
|---|---|
| PCI DSS v4.0 | Card numbers rendered unreadable (tokenised and encrypted), masked display, access by role, audit logs, MFA. Cardvoy is not itself PCI DSS certified; it is designed to reduce the bank’s card data scope. |
| ISO/IEC 27001 | Access control, logging, change control through maker-checker, supplier controls for couriers. SMH Global aligns its development process; certification is not claimed. |
| OWASP ASVS | Input validation on every command, secure session handling, security headers, rate limiting, secrets kept out of code. |
Regulator and standard names belong to their owners. Cardvoy is not affiliated with or endorsed by them.
See Cardvoy with your own process.
Book a walkthrough: we configure your branches, CFC, couriers and country pack in a private POC and run a captured card from ATM to customer while you watch.