Trust
What is in force, what is an application, and what is neither.
Payments companies tend to publish their regulatory position as a row of logos. This is the same information as a table, with a status against every line, because the difference between a licence that has been granted and one that has been applied for is the entire difference. Nothing on this site claims a status this table does not carry.
The register
| Authority | Claim | Status | What is true today |
|---|---|---|---|
| Financial Sector Conduct Authority (FSCA) | Financial services provider licence | Application lodged | An FSP licence application is being prepared for lodgement. WynkPay does not render financial services to the public and will not do so before a licence is granted. No FSP number has been issued, so none is published. |
| National Credit Regulator (NCR) | Credit provider registration | In force | Personal loans, merchant cash advances, stock on credit, BNPL and overdraft are credit agreements under the National Credit Act 34 of 2005. WynkPay is a registered credit provider, NCRCP17266. Affordability assessment, Reg 42 initiation fees, Reg 43 service fees, Reg 44 interest caps and the NACR disclosure are implemented and tested in the platform. |
| Sponsor bank | Settlement and trust-account sponsorship | Application lodged | WynkPay is not a bank and does not take deposits. The operating model places wallet float in a trust account at a registered South African bank, which also sponsors clearing and ISO 20022 settlement. Commercial terms are under negotiation; no sponsorship agreement is in force and no bank is named as a partner until one is. |
| BankservAfrica / PayShap | PayShap Phase 1 participation | Built, not yet live | The open-loop rail is implemented against the PayShap Phase 1 proxy model and exercised end to end in test. Live participation is reached through the sponsor bank and has not started. |
| PCI Security Standards Council | PCI DSS Level 1 service provider | In certification | Card data is never stored, processed or transmitted in the clear by WynkPay systems; the scope is reduced by tokenisation at the acquirer. A Level 1 assessment path is defined and the evidence set is being assembled. No Attestation of Compliance has been issued. |
| PCI Security Standards Council / Halo.dot | Contactless Payments on COTS (CPoC) | In certification | Tap-to-phone runs on the Halo.dot CPoC kernel. The certification belongs to the kernel provider and the solution-level assessment for the WynkPay integration is in progress. Tap-to-phone is not available to merchants until it completes. |
| Information Regulator (South Africa) | POPIA compliance programme | Built, not yet live | POPIA is an obligation rather than a certification: there is nothing to be issued. An Information Officer is appointed, the section 18 notice is published, personal information is minimised in logs and analytics, and identity numbers are masked wherever they are stored or displayed. |
| Financial Intelligence Centre (FIC) | FICA customer due diligence | Built, not yet live | Three KYC tiers with FICA-aligned transaction and balance limits are implemented and enforced server-side. Accountable-institution registration follows the FSP licence. |
The sponsor-bank model
WynkPay is not a bank, and the money is not ours.
A closed-loop wallet balance is not a deposit. Under the intended model, every rand of consumer and merchant float sits in a trust account at a registered South African bank, separately from WynkPay's own operating money, and is not lent out or invested. The bank is also the clearing route: interbank legs — PayShap, card settlement, payouts to a merchant's own bank account — leave the platform as ISO 20022 messages through the sponsor.
- Wallet float is held in trust at a registered bank, not on WynkPay's balance sheet.
- WynkPay does not take deposits, does not pay interest on balances and is not a deposit-taking institution.
- Interbank settlement is executed by the sponsor bank; WynkPay never holds a settlement account at the clearing house in its own name.
- The closed loop is a ledger movement between two accounts inside the platform. It is faster and cheaper because there is no interbank leg — not because a control has been skipped.
- No sponsorship agreement is in force yet, and no bank is named as a partner on this site until one is signed.
Card data
The safest card number is the one we never hold.
WynkPay does not store, process or transmit a primary account number in the clear. On tap-to-phone the card is read by the Halo.dot CPoC kernel and the data leaves the device encrypted to the acquirer; on a Sunmi terminal it is read by a certified EMV L1/L2 stack in the same way. What comes back to WynkPay is a token, a masked PAN and a scheme reference. There is no card vault to breach, and no PIN ever reaches WynkPay in any form.
- No PAN, track data, CVV or PIN block is persisted by any WynkPay service.
- Terminal keys are injected remotely into managed hardware and are never present in the app.
- The tap-to-phone kernel is a certified third-party CPoC component; WynkPay integrates with it rather than implementing a card kernel.
- Offline tap is bounded by a per-transaction floor limit and a per-terminal daily exposure cap, enforced on the device and re-checked server-side.
Questions we would ask
If a claim on this site matters to your decision, ask us for the evidence.
Every row in the register above corresponds to a document — an application reference, an assessment scope, a signed agreement or a test report. Partners, sponsors and regulators can have any of them. If something here is out of date, that is a defect and we would like to know.
Read the security posture