Audit, Compliance Governance & Risk Escalation Policy

Operated by: Keynoverse FZC
Platform: KeynoBite
Contact: onboarding@keynobite.com

Part A — Compliance Governance Framework

A.1 Overview

This document is the KeynoBite Compliance Governance Framework. It describes how Keynoverse FZC governs merchant compliance, maintains audit trails, preserves records, escalates and resolves risk, and supports PSP partner and regulatory oversight.

KeynoBite operates as a non-custodial technology platform. It is not a payment service provider, merchant acquirer, payment facilitator, or merchant-of-record.

A.2 Policy Document Suite

A.3 Framework Coverage Matrix

A.4 Suggested Public URLs

Minimum for PSP submission: Merchant Onboarding & Compliance URL + this URL.

A.5 Platform Capabilities Referenced

• 9-step merchant onboarding (KB-VAPP-XXXXXX references)
• Review states: kyc_review → psp_review → approved → pushed
• UBO collection with PEP declarations
• Document packages: trade license, MOA, tenancy, DEWA, premises photos, bank letter, passport, Emirates ID
• PSP API bridge review states: pending_review, needs_correction, credential_submitted, review_completed
• Structured audit_logs for onboarding and admin actions

Part B — Audit & Record-Keeping

B.1 Introduction

Keynoverse FZC maintains audit trails, operational logs, compliance records, and retention practices to support merchant onboarding integrity, platform security, payment partner oversight, and regulatory cooperation.

This applies to the merchant onboarding portal, restaurant operations platform, PSP onboarding API bridges, and administrative/agency activities.

B.2 Purpose

1. Maintain reliable audit trails for onboarding, compliance, and administrative actions
2. Support investigation and dispute resolution for merchants, customers, and PSP partners
3. Enable risk monitoring and detection of suspicious activity
4. Satisfy PSP partner audit and compliance expectations
5. Preserve records for regulatory, legal, and contractual obligations

B.3 Scope of Audited Activities

B.4 Onboarding Portal Audit Logging

Structured audit logs capture timestamp (UTC), acting user ID, action type, target entity, payload summary, IP address, and user agent.

Examples: admin logins, status transitions (kyc_review, psp_review, approved, rejected, pushed), agency approvals, PSP API key rotation, escalation tier changes.

Logs are stored in audit_logs with indexed action and target fields.

B.5 Merchant Application Audit Trail

Each application maintains unique reference (e.g. KB-VAPP-XXXXXX), section statuses, UBO/PEP declarations, document timestamps, reviewer milestones, rejection/correction history, and provisioning log.

B.6 Restaurant Platform Operational Records

• Order identifiers, status history, amounts, PSP payment status references
• Refund and cancellation events with merchant order number integrity
• Firebase phone authentication audit records (where enabled)
• Admin configuration changes (roles, menus, gateway settings metadata)

B.7 PSP & Payment Partner Audit Support

KeynoBite maintains records for KYC package retrieval, PSP review tracking, secure credential handoff (secrets not in logs), order reference preservation, and refund traceability.

KeynoBite does not store full card PANs, CVV, or wallet PINs. PSPs remain the system of record for authorization and settlement.

B.8 Access Controls

B.9 Monitoring & Review

Periodic and event-driven audit review covers unauthorized access, unusual approval patterns, document inconsistencies, abnormal order/refund velocity, agency anomalies, and escalation outcomes.

B.10 Record Retention

B.11 Data Security & Integrity

Records protected via HTTPS/TLS, access-controlled storage, environment separation, restricted admin access, and backup procedures. Audit logs are append-oriented; corrections tracked through updated records and review notes.

B.12 Internal Audit & Compliance Review

Keynoverse FZC may internally review onboarding quality, KYC completeness, audit log coverage, escalation consistency, PSP integration compliance, and incident response effectiveness.

B.13 External Audit & Regulatory Cooperation

KeynoBite cooperates with lawful requests from licensed PSP/wallet partners, regulatory authorities, and external auditors, subject to authority verification and data protection law.

B.14 Incident Documentation

Incidents documented with identifier, affected systems, evidence reviewed, containment actions, PSP/regulatory notifications, and post-incident review.

B.15 Merchant Cooperation

Merchants must preserve business records, cooperate with audit and escalation inquiries, provide accurate information, and not tamper with records relevant to ongoing inquiries.

B.16 Limitations

KeynoBite audit records reflect platform activity. They do not replace PSP settlement records, bank statements, or merchant accounting systems.

Part C — Merchant Risk & Escalation Framework

C.1 Purpose

This section defines how KeynoBite identifies, escalates, and resolves merchant-related compliance and operational risks — from onboarding through offboarding — with consistent, documented, and auditable decision-making.

C.2 Risk Governance Structure

Merchant lifecycle: Application → KYC Review → PSP Review → Approved → Live → Monitor → Review/Refresh → [Suspend] → Offboard

Each stage transition is audit-logged with actor, timestamp, and rationale.

C.3 Risk Classification Summary

Merchants are classified Low, Medium, or High risk per the Merchant Onboarding & Compliance Policy §7.

Risk tier may be upgraded immediately upon trigger events; downgrades require compliance review.

C.4 Escalation Tiers

Tier 1 — Information Request (IR)

Triggers: Incomplete documentation, minor inconsistencies, expiring license (≤30 days), low-severity profile variance.

Actions: Request correction via onboarding portal; set deadline (7–14 business days); pause PSP credential activation if applicable.

Outcome: Resolved → continue; Unresolved → Tier 2

Tier 2 — Compliance Hold (CH)

Triggers: Unresolved Tier 1 past deadline, medium-risk EDD, moderate transaction deviation, elevated complaints, PSP info request, potential sanctions/adverse media match.

Actions: Restrict payment or limit to COD; assign compliance owner; document investigation; notify PSP if channels active.

Outcome: Cleared → release hold; Confirmed risk → Tier 3

Tier 3 — Suspension (SUSP)

Triggers: Suspected fraudulent documents, confirmed sanctions/unacceptable PEP, transaction laundering, PSP credential revocation/fraud alert, prohibited category, serious policy violations, failed mandatory re-verification.

Actions: Immediate suspension of platform and/or payment access; preserve records; notify PSP; initiate investigation; notify merchant where practicable.

Outcome: Reinstatement (rare) or Tier 4 termination

Tier 4 — Termination (TERM)

Triggers: Confirmed fraud/forged docs, confirmed sanctions/prohibited business, repeated Tier 3 violations, legal/regulatory directive, PSP permanent rejection, failure to cooperate.

Actions: Permanent access revocation; credential deactivation; internal denial list entry; PSP/authority notification; records retained per Part B.

C.5 Operational Risk Indicators

Thresholds are internal guidelines applied with human review — not automated termination.

C.6 Re-Verification Triggers

Event-driven re-verification may escalate to Tier 1 or Tier 2: license expiry, ownership/UBO change, bank account change, new branch, business model change, PSP KYC refresh, risk tier upgrade, periodic review due date.

Failure to complete re-verification → Tier 2 hold → Tier 3 suspension if unresolved.

C.7 Multi-Branch & API Onboarding Escalation

Multi-branch: Undeclared branches, licensing gaps, or inconsistent premises evidence → require per-branch documentation; restrict undeclared branches.

API/agency onboarding: Audit log review of submission source; cross-reference rejected applications; elevated monitoring first 90 days. Non-compliant referral patterns → agency suspension (Tier 3/4).

C.8 PSP Coordination Escalation

KeynoBite does not override PSP compliance decisions.

C.9 Suspicious Activity Reporting

Report to onboarding@keynobite.com with merchant/application reference, date, description, evidence (audit log IDs), and recommended tier.

Compliance maintains an escalation register with resolution status, decision maker, and timestamps. Regulated SAR obligations for payment transactions remain with licensed PSPs.

C.10 Merchant Notification & Appeals

Where practicable, merchants receive email notice of Tier 2 holds and Tier 3 suspensions with general reason category and compliance contact.

Appeals may be submitted within 14 business days to onboarding@keynobite.com with reference, point-by-point response, and supporting documentation. Appeals do not guarantee reinstatement.

C.11 Offboarding Procedure

Upon Tier 4 termination or voluntary exit:

1. Deactivate platform access and payment integrations
2. Retain all KYB/KYC and audit records
3. Notify PSP to revoke credentials
4. Add entity/UBO to internal denial list where appropriate
5. Confirm subscription/billing cessation
6. Retain records minimum 5 years

C.12 Escalation Documentation Requirements

Every escalation must record:

Part D — Policy Governance

D.1 Updates

This Policy may be updated to reflect platform changes, PSP requirements, security enhancements, or legal developments. Continued use constitutes acceptance. Reviewed at least annually and after material incidents or significant onboarding volume growth.

D.2 Contact

KeynoBite is a technology platform operated by Keynoverse FZC. This document combines compliance governance, audit and record-keeping, and merchant risk escalation controls.