Document library

Internal control objectives aligned to the Payment Card Industry Data Security Standard for any system that stores, processes or transmits cardholder data.

Defines eligibility, approval limits and activation rules for issuing new consumer payment cards.

Operational steps for intake, investigation and resolution of card network chargebacks, including reason-code handling.

Retention periods and secure-deletion requirements for cardholder data and related transaction records.

How RPC applies 3-D Secure 2.x authentication flows, exemptions and liability-shift rules for card-not-present transactions.

Step-by-step checklist for underwriting and activating a new card-acquiring merchant.

Severity classification and response steps for confirmed or suspected card fraud incidents.

Requirements for deleting RPC data — including indexes, embeddings, logs and backups — once a vendor engagement, pilot or PoC concludes.