> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thedecard.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance and KYC

> KYB for companies, KYC for employees: review flows and the shared application state machine, resubmission under the same application ID, global uniqueness and sanctions screening, custodians, freeze sources and card data protection.

## 📄 Guide

Compliance and security are the entry ticket to card issuing, and DCS carries the heaviest parts for you: licensing and BIN ownership, the PCI data environment, KYB / KYC due diligence, risk control and sanctions screening. This page explains the due-diligence machinery and the hard rules you need to follow.

## KYB and KYC: who reviews what

| Subject  | Due diligence                  | What is reviewed                                                | Where to submit                                         | Result notification                              |
| -------- | ------------------------------ | --------------------------------------------------------------- | ------------------------------------------------------- | ------------------------------------------------ |
| Company  | KYB (business due diligence)   | Legal name, registration number and other corporate credentials | [Company onboarding](../how-to-use/company-onboarding)  | `ORGANIZATION_CREATED` / `ORGANIZATION_REJECTED` |
| Employee | KYC (individual due diligence) | Name screening                                                  | [Creating employees](../how-to-use/employee-onboarding) | `CUSTOMER_CREATED` / `CUSTOMER_REJECTED`         |

Both reviews are **asynchronous**: the endpoint returns only the application ID + `PENDING` synchronously (accepted ≠ approved); the final state arrives over webhooks, with the query endpoints as the polling fallback. The pre-issuing risk review is asynchronous too, and all share the same [application state machine](./states-and-freezing).

## The right path after a rejection: resubmit

After a KYB / KYC rejection, correct the key fields (company: legal name / registration number; employee: name) and **call resubmit under the same the application ID** — never reapply under a new external ID. Three hard rules:

* Resubmission is allowed only while the state is `REJECTED`; in-flight or approved applications return `STATUS_CONFLICT`;
* The partner-side external ID (`organizationRef` / `customerRef`) cannot change;
* **An employee name change re-triggers KYC review**: with a KYC already in flight the call returns `KYC_IN_REVIEW` — retry after the result lands.

## Global uniqueness and occupation

The following details are **globally unique within one partner**, and once taken they are **never released, even after a rejection**:

| Dimension                                                    | Conflict code                    |
| ------------------------------------------------------------ | -------------------------------- |
| Company email                                                | `EMAIL_DUPLICATE`                |
| Company registration number                                  | `COMPANY_REGISTRATION_DUPLICATE` |
| Employee email                                               | `EMAIL_DUPLICATE`                |
| Employee phone (area code + number, unique across companies) | `PHONE_DUPLICATE`                |

To change any of them, go through resubmit or the employee-update endpoint — never reapply under a new external ID.

## Sanctions screening and custodians

* **Sanctions screening**: a shipping-address country on the sanctions list returns `COUNTRY_SANCTIONED` (checked at creation and on address updates).
* **Custodian**: regulation requires every company card to name an active (ACTIVE) employee of that company as its custodian. The custodian is contacted when something is wrong with the card, and completes verification when a purchase triggers a 3DS challenge.

## The two sources of freezes

Freezes come from two sources: **partner-initiated freezes** can be lifted self-service over the API; **risk / regulatory / judicial freezes** cannot, and go through support. On granularity, freezing a card stops only that card, while freezing an employee makes every card under them decline; the 5 freeze capability domains are defined in [State machines and freezing](./states-and-freezing).

## Data security and card data protection

* **Channel security**: DCS issues each partner an AK / SK pair. The SK never appears in any request in clear text; it is used only to compute the HMAC-SHA256 signature locally, and requests carry a timestamp and nonce against replay. Your identity is established by the gateway from the AK signature check; any institution identifier carried in the body is ignored.
* **Card data protection**: regular query endpoints never return the full PAN — only the first 6 digits (BIN) and the last 4. The full PAN / CVV2 / expiry are returned only by the secure card endpoint, AES-GCM encrypted, and only to allowlisted PCI DSS-certified partners; partners without PCI DSS can integrate the DCS hosted secure card page. Details in [Secure card details](../how-to-use/secure-card-details).

## Next steps

* Endpoint details for company onboarding and resubmission: [Company onboarding and review](../how-to-use/company-onboarding)
* Endpoint details for employee creation and rename-triggered re-review: [Creating employees](../how-to-use/employee-onboarding)