Skip to main content

​
📄 Guide

Compliance and security are the entry ticket to card issuing, and DCS carries the heaviest parts for you: licensing and BIN ownership, the PCI data environment, KYB / KYC due diligence, risk control and sanctions screening. This page explains the due-diligence machinery and the hard rules you need to follow.

​
KYB and KYC: who reviews what

Both reviews are asynchronous: the endpoint returns only the application ID + PENDING synchronously (accepted ≠ approved); the final state arrives over webhooks, with the query endpoints as the polling fallback. The pre-issuing risk review is asynchronous too, and all share the same application state machine.

​
The right path after a rejection: resubmit

After a KYB / KYC rejection, correct the key fields (company: legal name / registration number; employee: name) and call resubmit under the same the application ID — never reapply under a new external ID. Three hard rules:
  • Resubmission is allowed only while the state is REJECTED; in-flight or approved applications return STATUS_CONFLICT;
  • The partner-side external ID (organizationRef / customerRef) cannot change;
  • An employee name change re-triggers KYC review: with a KYC already in flight the call returns KYC_IN_REVIEW — retry after the result lands.

​
Global uniqueness and occupation

The following details are globally unique within one partner, and once taken they are never released, even after a rejection: To change any of them, go through resubmit or the employee-update endpoint — never reapply under a new external ID.

​
Sanctions screening and custodians

  • Sanctions screening: a shipping-address country on the sanctions list returns COUNTRY_SANCTIONED (checked at creation and on address updates).
  • Custodian: regulation requires every company card to name an active (ACTIVE) employee of that company as its custodian. The custodian is contacted when something is wrong with the card, and completes verification when a purchase triggers a 3DS challenge.

​
The two sources of freezes

Freezes come from two sources: partner-initiated freezes can be lifted self-service over the API; risk / regulatory / judicial freezes cannot, and go through support. On granularity, freezing a card stops only that card, while freezing an employee makes every card under them decline; the 5 freeze capability domains are defined in State machines and freezing.

​
Data security and card data protection

  • Channel security: DCS issues each partner an AK / SK pair. The SK never appears in any request in clear text; it is used only to compute the HMAC-SHA256 signature locally, and requests carry a timestamp and nonce against replay. Your identity is established by the gateway from the AK signature check; any institution identifier carried in the body is ignored.
  • Card data protection: regular query endpoints never return the full PAN — only the first 6 digits (BIN) and the last 4. The full PAN / CVV2 / expiry are returned only by the secure card endpoint, AES-GCM encrypted, and only to allowlisted PCI DSS-certified partners; partners without PCI DSS can integrate the DCS hosted secure card page. Details in Secure card details.

​
Next steps