01
PCI DSS & tokenization
Use hosted payment fields and token references to reduce card-data exposure. Verify current PCI DSS AOC, assessed entity and service scope; outsourcing does not remove all platform obligations.
SECURITY & TRUST
Compliance by design.
Control at every layer.
From merchant onboarding and authentication to settlement and audit: define the controls, evidence and responsibilities behind each payment journey.
COMPLIANCE CONTROL PLANE
A compliance control plane.
From onboarding to audit.
Build the evidence and responsibility model alongside the payment flow. Align platform controls with your provider, merchant entity and local-market requirements.
01Onboard
02Authenticate
03Process
04Settle
05Audit
02
SCA / EMV 3DS
Route authentication according to transaction channel and eligible exemptions. Plug & Charge is a charging interaction, not a blanket exemption from payment authentication.
03
Merchant & funds-flow governance
Identify the merchant of record, acquiring entity and settlement recipients. Document who handles refunds, chargebacks and funds; accounting allocation is not a money-transmission licence.
04
KYB / KYC & AML controls
Define business verification, beneficial-owner checks, sanctions / PEP screening and escalation with the licensed payment provider. Responsibilities follow the operating model.
05
GDPR & data governance
Define controller / processor roles, access rights, retention and deletion. Document international-transfer safeguards, including SCCs where applicable.
06
AFIR payment readiness
Map public ad-hoc acceptance, payment devices and price disclosure to site power and deployment dates. Software integration alone does not establish site-wide AFIR conformity.
07
Refunds & dispute governance
Expose method-level refund rules and expected timing. Retain consent, descriptors, session / CDR evidence and dispute-response deadlines; card disputes differ from wallet complaints.
08
Tax-ready reconciliation
Separate legal-entity ledgers, currency, fees and VAT / GST references. Support auditable reporting; tax calculation, filing and invoice obligations depend on jurisdiction and contract.
DUE DILIGENCE / EVIDENCE
Compliance evidence. Clearly scoped.
Request entity-level licence / registration records, current PCI DSS AOC, data-processing terms and a responsibility matrix. MSO / MSB status does not replace local acquiring permission or constitute regulatory endorsement.
Responsibilities that travel with the transaction.
Charger control, tariff inputs, session data and the platform user experience.
Integration orchestration, normalized events, policy configuration and reconciliation references.
Regulated acceptance and fund handling within the provider’s licence and contracted services.
Underlying charging service, merchant obligations, customer terms and local tax duties.
FAQ
A little more clarity.
Is CpoPay a charging management platform?+
CpoPay focuses on payment infrastructure for CPMS providers and CPO businesses. Your CPMS continues to manage chargers, sessions and energy.
Can one payment flow work in every country?+
The integration pattern can be shared, but payment methods, merchant onboarding, settlement and regulatory requirements vary by market and provider.
How is a charging session connected to a payment?+
A shared session reference links payment events to the CPMS. Your integration should handle asynchronous status updates, duplicate notifications and final reconciliation.
THE NEXT MOVE IS YOURS
Build your next
payment advantage.
Discuss your CPMS architecture, launch markets and commercial model with our team.
CPMS / TECHNICAL & COMMERCIAL
Start a technical conversation.
Send your CPMS architecture, target countries and payment priorities. Our team will help scope the integration and commercial model.