Use case summary
Card data stays inside a PCI DSS Level 1 environment, the platform is registered with the card schemes as a third-party agent, authentication rules adapt per market, EU VAT is applied at checkout, and every transaction and change is recorded. Result: the compliance list you work through per market is shorter than it looks.
- Payment Manager
- Finance & CFO
Why the compliance list looks longer than it is
Each market you add brings its own requirements. Some concern how customers must be authenticated, some how card data is handled, some tax, some the security credentials your acquirer will ask you to produce.
They arrive from different directions and land on different teams, with no single list anywhere. Items surface one at a time, usually in the middle of a launch, and each one looks like a project until someone establishes whether it actually is.
A good part of that list is already settled at the payment layer. Teams that do not know which part to spend the launch confirming work that has been done, while the items that genuinely need their attention wait.
Which payment compliance requirements are already handled
Six things are in place on Corefy before your first transaction in a new market.
- 1
Card data stays in a certified environment
Corefy is certified as a PCI DSS Level 1 Service Provider and assessed annually by an independent Qualified Security Assessor. Where card data is captured on the hosted page or in embedded fields, it does not enter your systems, which is what keeps your own validation small. The detail is on reducing PCI scope.
- 2
Scheme registration is already done
The platform is registered in Visa's Third Party Agent program and Mastercard's Merchant Registration Program. Acquirers check this before contracting, so it is one of the first questions answered each time you onboard a new one.
- 3
Authentication adapts to each market
Rules decide whether a transaction is challenged with 3D Secure, CVV, or a one-time password, set on attributes such as country, amount, or card issuer. Markets expect different things, and entering a stricter one is a rules change rather than development work.
- 4
EU VAT is applied at the moment of payment
For EU sales, the rate of the customer's country is applied at checkout, and the invoice is issued with the VAT amount included, drawn from a maintained rate table rather than one your team keeps current.
- 5
Screening can run inside the payment flow
Firewall rules can call external services for additional information or decisions, including sanction lists, so screening happens as part of processing rather than as a separate check beside it.
- 6
Evidence accumulates as you work
Transactions keep full histories with provider responses, configuration changes are recorded with the user and IP behind them, and data can be exported. That covers what a review or a procurement questionnaire asks for, as described on audit readiness.
What you get
We settle core requirements before your first transaction in every market you enter.
Acquirer onboarding without a pause
PCI Level 1 certification and scheme registration are the first things a new acquirer asks to see, so the conversation moves to commercial terms instead of stopping for a vendor review.
A stricter market entered with a rules change
Authentication requirements differ by market, and meeting a stricter one means editing rules rather than scheduling development work against a launch date.
Tax handled at the point of sale in the EU
The rate of the customer's country is applied when they pay, so nobody maintains a rate table across twenty-seven jurisdictions or corrects invoices afterward.
The schemes require your payment platform to be registered before you use it
Visa states that third-party agents that store, process, transmit, or have access to Visa cardholder data must be registered in its Third Party Agent Registration Program before issuers, acquirers, and merchants can use their services. Registration sits on top of PCI DSS rather than replacing it: an agent has to be PCI validated, enrolled in Visa's Account Information Security program, and submit its validation documents every year. Acquirers use the resulting registry as a due diligence checkpoint before contracting, which is where a platform's registration becomes your concern too.