Process for Data Access | Template for FCA authorised firms

Process in place to file, monitor, track and restrict access to sensitive payment data

As an SPI/API, we only accept cash payments from clients physically presenting themselves to ourselves. This is due to the high risk involved in accepting alternatives forms of payment, and owing to these high risks, we have taken the aforementioned decision.

Filing data:

When a client wishing to perform a money transfer transaction approaches our office, the client is asked for a contact number or an ID number as per their photo ID which maybe either a European driving licence or valid passport. These are either matched in the case of a returning client to previous data held in the system, or captured in the case of a new client.

Data Access. How data is accessed, stored and protected and how breaches are identified and address:

This data is only accessible to authorised staff who require all of five means in order to log in to our system:

1. A password
2. An access card with encrypted credentials
3. A code is generated on the system log-in interface. This code is then input into a tailored application on a mobile device which then generates a token.
4. This token is then input into the system which if correct, allows the user access into the system.
5. The aforementioned token generation is linked to the IMEI number of the mobile device, which ensures that only a specific mobile device may be used, which in itself also requires biometric and facial recognition to access the token generating application.

How the data stored on our server and how breaches are prevented and addressed:

Client and transactional data is stored remotely on an AES 256 bit end-to-end encrypted device which allows access to devices with a specific MAC address. As each device has its own unique MAC address, no other devices will be allowed access to the file storage device, even if the correct credentials are provided. This eliminates the possibility of a data breach from external devices. Only two specific devices can be allowed access to the aforementioned file storage device. The file storage device self-destructs its data contents if physically connected to any other device except for the pre-registered two devices. The possibility of a breach is therefore reduced to practically nil. An identical device is used as a failsafe which follows the same security protocol in the event of a failure of the primary storage device.

Monitoring data and how data is used.

Monitoring algorithms as per the FCA handbook have been programmed to monitor in real-time all transactions, comparing them with previous transactions. An upper threshold of GBP 10,000 per year per customer has been pre-defined. This algorithm cross-references transactional information with the recipient of funds as well, which is set to the same threshold. This is to say, a sender cannot remit more than GBP 10,000 in a calendar year, nor can a recipient receive more than GBP 10,000 per calendar year. Any attempt to surpass this limit is automatically denied by the system.

Data is not used for any other purposes internally nor externally as we only remit funds to one specific country from face-face clients who are known to us. Only contact numbers (without names) are stored on a separate database, which is used to provide clients with limited information such as planned closures or opening hours during bank holidays.

Data is automatically monitored via in-built algorithms and any client attempting to exceed the yearly limit is automatically logged and a report is automatically generated to be sent to the FCA as per the reporting procedures detailed in the FCA guidelines. All log-in attempts, whether successful or otherwise are logged and reviewed on a bi-weekly basis by senior staff and an accompanying report is filed.

The principles and definitions applicable to the collection of statistical data on fraud.

Procedures in place to collect statistical data based on performance, transactions and fraud

Our system automatically rejects any attempt to remit funds once the aforementioned threshold is reached, either by remitter or beneficiary. We further have a total daily transactional limit of GBP 10,000, which once reached, the system will not process any further transactions. Any client attempting to exceed this yearly limit is automatically logged and a report is automatically generated to be sent to the FCA as per the reporting procedures detailed in the FCA guidelines.