partners

Due-diligence pack

What banks and processors ask before onboarding a payments platform, and the state of each item at apay. Use it as the checklist to prepare before the first partner call.

Items marked to prepare need input from apay’s founders and counsel. Do not send the pack until they are filled in; a partial pack costs credibility.

1. Corporate and ownership

Item Status
Legal entity name, registration number, jurisdiction, incorporation certificate to prepare
Registered address and operating address to prepare
Directors and officers, with IDs to prepare
Ultimate beneficial owners (25% and above, and anyone with control), with IDs and proof of address to prepare
Group structure chart to prepare
Source of funds and last financial statements or bank statements to prepare
Sanctions and PEP screening of directors and UBOs (self-declaration plus partner screening) to prepare

Banks in Singapore, Hong Kong, the UAE and the Philippines screen for Russian or Belarusian beneficial ownership first. Have a clear, documented answer on residency, citizenship and source of funds of every UBO before outreach.

2. Licensing and regulatory position

Item Status
Statement of regulatory position: apay is a technology provider and does not hold client funds; regulated activities are performed by the partner ready (see partner overview)
Planned licensing route if any (for example AIFC payment licence, Singapore PSA exemption analysis, PH OPS registration) to prepare with counsel
Legal opinion or memo on the model in the first target market to prepare

3. AML/CFT and merchant onboarding

Item Status
AML/CFT policy (risk-based approach, KYB, sanctions screening, transaction monitoring, reporting) to prepare (template available)
Named compliance officer / MLRO to prepare
Merchant onboarding procedure and prohibited business list aligned with card scheme rules to prepare (draft aligned to Visa/Mastercard high-risk lists)
Transaction monitoring rules in the platform (velocity, amount, geography, card testing guard) ready (platform fraud rules, card-testing guard, 3DS policies)
Record retention policy to prepare (5 to 7 years per market)

4. Information security

Item Status
Security policy and access control to prepare (baseline: SSH keys only, MFA on dashboard, least privilege)
Infrastructure description: Amsterdam VPS, Docker, Caddy TLS, private network, ufw, fail2ban, nightly encrypted backups ready
Data-flow diagram showing where card data goes (SDK → vault → processor) ready
Vulnerability management and patching cadence to prepare
Incident response plan and breach notification commitments to prepare
Penetration test report to prepare (schedule before pilot)
Business continuity and backup testing partly ready (backups nightly; restore drill to document)

5. PCI DSS

Item Status
PCI scope statement: hosted checkout keeps merchants in SAQ A; apay switch and vault are in scope ready
SAQ D (service provider) or Attestation of Compliance to prepare (QSA engagement before live)
Vault approach: apay card vault with HSM/KMS-backed keys in production; mock vault in sandbox ready in design, to deploy for live

6. Operations and support

Item Status
Support model, hours, escalation path to prepare
SLA proposal: 99.9% API availability, RTO 4 h, RPO 24 h (sandbox), tighter for platform tier ready as draft
Monitoring and alerting description ready (health checks, logs; metrics dashboards to add)
Reconciliation process and report samples to prepare with the first partner’s file format

7. Commercial

Item Status
Business plan: target segments, first merchants, 12-month volume forecast per market to prepare
Pricing to merchants and expected partner economics draft in pricing page
Pilot proposal: merchants, volume caps, duration, success criteria ready (see client PoC playbook)
Insurance (professional indemnity, cyber) to prepare

8. Product evidence

Item Status
Live sandbox with hosted checkout, dashboard and webhooks ready: apay.to/checkout, app.apay.to
Integration documentation ready: apay.to/docs
Technology stack description ready under NDA
Connector certification checklist ready: integration requirements