- PCI DSS Level 1
- Vault, switch and tokenisation are PCI DSS Level 1 service-provider components; sub-merchants inherit the posture across every channel.
- PCI MPoC for SoftPOS
- Tap-to-Phone deliveries sit with partners whose SoftPOS apps follow the PCI MPoC programme; topropay handles the back-end orchestration.
- EMV & scheme rules
- Card-present transactions follow scheme rules (Visa, Mastercard, Amex, Discover); contactless caps, CVM thresholds and PIN bypass policy per region.
- SCA & PSD2 (online leg)
- Selective 3DS2 on the online surface keeps approval high in Europe without skipping the compliance bar; card-present flows clear under their own CVM rules.
- Sanctions & AML alignment
- Sanctions screening at onboarding; AML monitoring tuned per merchant vertical, volume and channel mix.
- Licensed verticals only
- Licensed gaming, regulated financial services and other compliance-bound verticals supported only where current operating licences exist. Grey and black-market verticals are out of scope regardless of acceptance channel.