PCI DSS & tokenization
Use hosted payment fields and token references to reduce card-data exposure. Verify current PCI DSS AOC, assessed entity and service scope; outsourcing does not remove all platform obligations.
SCA / EMV 3DS
Route authentication according to transaction channel and eligible exemptions. Plug & Charge is a charging interaction, not a blanket exemption from payment authentication.
Merchant & funds-flow governance
Identify the merchant of record, acquiring entity and settlement recipients. Document who handles refunds, chargebacks and funds; accounting allocation is not a money-transmission licence.
AFIR payment readiness
Map public ad-hoc acceptance, payment devices and price disclosure to site power and deployment dates. Software integration alone does not establish site-wide AFIR conformity.
GDPR & data governance
Define controller / processor roles, access rights, retention and deletion. Document international-transfer safeguards, including SCCs where applicable.
Tax-ready reconciliation
Separate legal-entity ledgers, currency, fees and VAT / GST references. Support auditable reporting; tax calculation, filing and invoice obligations depend on jurisdiction and contract.