Governance and assurance
Anyone can move money. The question a regulator, an auditor and a correspondent bank all ask is whether you can prove how you moved it, months later, without reconstructing it. Payzone produces that proof as a by-product of operating, because evidence assembled afterwards is not evidence.
Financial and compliance records are append-only at the database level, not by convention. A correction is a compensating entry with its own authorisation and reason; the original is never edited and never disappears. Agent, country and currency ledgers are kept separately so one entity's position can never be netted against another's.
Evidence for binding decisions is written to storage with object-lock retention, so it cannot be altered or deleted inside its retention period — by an administrator, by the platform, or by us. Each artefact is bound to the exact workflow, agent and country it belongs to.
Maker–checker on binding instructions, step-up authentication on privileged actions, and dual control on high-risk compliance decisions. Restricted SAR and STR material sits in its own compartment, reachable only by the roles legally permitted to see it. A role is a ceiling — policy may narrow it, never widen it.
If a control cannot run, the transaction holds. Screening is not skipped because a vendor is slow, and an unknown payout outcome stays unknown until it is reconciled against the provider. Nothing is recorded as settled because a request returned successfully.
Residency, retention, legal hold and disposition are applied per jurisdiction, and regulatory filings run through a country-specific outbox with its own deadlines and acknowledgement tracking.
Data and reporting for one regulator are never commingled with another's. Separation is structural, not a filter applied at report time.
A filing obligation carries its due date and its acknowledgement. Late is a state the system knows about, not something discovered in a review.
Tested by drill, with the result recorded as evidence rather than asserted.
Hash-chained audit events, verified rather than trusted.
Every actor release carries its own evidence trail.
Access grants scoped to the exact operation, not to the environment.
Production readiness is computed from the live estate, not hand-kept.
POS, kiosk and API entry points pass one authorisation boundary.
Records are tamper-evident against everyone, and become tamper-proof against us only once a chain head is published outside the platform. Verification reports how many entries have accrued since that happened rather than showing a green tick — the mechanics are on Clearing and settlement.
Payzone holds no regulatory approval and no third-party certification. The repository carries a SOC 2 control catalog and deterministic evidence assertions, which is engineering work toward an audit — it is not an attestation report, and we will not describe it as one until an auditor issues it. Any vendor claiming a certification should be able to name the standard, the auditor and the report date; if we cannot, the honest answer is this paragraph.
What we can put in front of your risk team today is the control evidence itself: how a decision was authorised, by whom, against which rule, and where the immutable record of it sits.
The governance questions are better asked early, and they are the ones we would rather answer first.