Compliance

Compliance is the bottom line of our business

Behind flexible business innovation is a strict compliance system and information security guarantee.

AML / KYC

Compliance Focus

Follow FATF recommendations and industry best practices: merchant due diligence (MDD), transaction monitoring, suspicious transaction reporting (STR), and multi-source sanctions/reputation list screening. The following are examples of screening and monitoring dimensions. The scope of implementation is subject to the contract and current audit.

Screening dimensions

politician

sanctions list

former politician

Reputation risk

public figure

Enforcement list

Politician-affiliated companies

Gambling Risk Intelligence

state-owned enterprises

politically connected persons

Controls

Certification and Control Measures

The following is a summary of platform-level security controls. The scope of implementation is subject to the contract and the current audit report.

PCI DSS

Level 1

Payment card data environment (CDE) partitioning, strict access and log auditing meet the highest level requirements of the payment card industry.

Applicable to: card brand related processing and custody processes

ISO

27001

The Information Security Management System (ISMS) covers policies, assets, suppliers and incident response, and is reviewed annually.

Applicable to: Company-wide information assets

TLS

1.3

TLS 1.3 is preset for external APIs and consoles, weak cipher suites are disabled, and keys and certificates are rotated periodically.

Applicable: public network transmission link

AES-256

encryption at rest

Sensitive fields and backup data are encrypted using hierarchical keys and envelopes, and key materials are separated from applications.

Applicable to: database and object storage

HSM

Key protection

Signature and root key operations are completed within the hardware security module, reducing the risk of software leakage.

Applies to: Signature, Tokenization Critical Path

Pentest

third party testing

Entrust an independent team to conduct penetration testing and defect closed loop, and add testing after major changes.

Applicable to: core payment and management backend

Privacy & Treasury

Privacy and financial operations

data privacy

Jurisdiction: Comply with the Hong Kong Personal Data (Privacy) Ordinance; follow the GDPR principles of minimization and purpose limitation when involving EU subjects.
shared: No selling of personal data; sharing with third parties only in fulfillment of contract or legal requirements and by agreement binding sub-processors.
life cycle: Archive and delete according to retention policy; merchant may request export or deletion (to the extent permitted by law).

Funds and Reconciliation

isolation: Merchant funds and company operating funds are managed separately, and processes and reports can be provided on a monthly basis.
hosting: The balance is deposited in a licensed financial institution. The specific name of the institution shall be subject to disclosure in the business contract.
Reconciliation: The system provides regular reconciliation and abnormal alarms; large-amount or high-risk transactions enter the review queue.
Insurance: Regular corporate governance arrangements such as directors and officers liability insurance (D&O).