Compliance & Certifications

KATSOFT LIMITED (operating as Katpay) is committed to maintaining the highest standards of regulatory compliance, data security, and operational integrity. We adhere to all applicable Nigerian laws and international best practices to protect our merchants and their customers.

3.1 Nigeria Data Protection Act (NDPA) 2023

We comply with all provisions of the NDPA 2023, including:

• Lawful, fair, and transparent data processing
• Purpose limitation and data minimization
• Data accuracy and integrity maintenance
• Storage limitation and secure retention
• Accountability and demonstrable compliance

3.2 General Application and Implementation Directive (GAID) 2025

Katpay adheres to the GAID 2025 directives issued by the Nigeria Data Protection Commission (NDPC), including:

• Data Protection Impact Assessments (DPIA) for high-risk processing
• Appointment of a Data Protection Officer (DPO)
• Data breach notification procedures
• Cross-border data transfer safeguards
• Annual compliance audits and reporting

In compliance with the Money Laundering (Prevention and Prohibition) Act (MLPPA) 2022 and Terrorism (Prevention) Act 2022, Katpay implements:

• Know Your Customer (KYC): Mandatory identity verification using BVN/NIN for all merchants
• Transaction Monitoring: Real-time detection of suspicious transaction patterns
• Sanctions Screening: Automated checks against global watchlists and PEP databases
• Reporting: Suspicious Transaction Reports (STRs) filed with the Nigerian Financial Intelligence Unit (NFIU)
• Record Keeping: 10-year retention of KYC documents and transaction records
• Staff Training: Regular AML/CFT awareness programs for all employees

5.1 PCI-DSS Level 1 Compliance

Katpay maintains PCI-DSS Level 1 certification, which requires:

• Firewall protection for cardholder data environments
• Strong encryption of transmitted cardholder data
• Regular vulnerability scans and penetration testing
• Secure development and change management processes
• Quarterly ASV scans and annual on-site assessments

5.2 ISO 27001 Information Security Management

Our information security management system follows ISO 27001 best practices:

• Risk assessment and treatment framework
• Access control and authentication policies
• Incident response and business continuity plans
• Employee security awareness training
• Third-party security assessments

5.3 SOC 2 Type II Audit

We undergo annual SOC 2 Type II audits to verify our controls for:

• Security: Protection against unauthorized access
• Availability: System uptime and reliability
• Confidentiality: Protection of sensitive information
• Processing Integrity: Accurate and timely transaction processing
• Privacy: Collection, use, and disclosure of personal data

Katpay complies with the Federal Competition and Consumer Protection Act (FCCPA) 2018:

• Transparent pricing with no hidden fees
• Clear terms and conditions in plain English
• Fair dispute resolution processes
• Protection against fraudulent transactions
• Responsive customer support

In accordance with the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, we implement:

• Advanced threat detection and prevention systems
• Encryption of data at rest and in transit (AES-256, TLS 1.3)
• Regular security audits and vulnerability assessments
• Incident response and cyber insurance coverage
• Compliance with NITDA cybersecurity frameworks

Katpay undergoes regular third-party audits to ensure ongoing compliance:

• Annual PCI-DSS Audit: Conducted by Qualified Security Assessor (QSA)
• Quarterly Vulnerability Scans: Performed by Approved Scanning Vendor (ASV)
• Annual Penetration Testing: Independent ethical hacking assessments
• SOC 2 Type II Audit: 12-month control effectiveness review
• Data Protection Audit: NDPC compliance verification

As a Katpay merchant, you are responsible for:

• Complying with all applicable laws in your jurisdiction
• Maintaining valid CAC registration and business licenses
• Implementing your own data protection measures
• Reporting suspicious transactions to Katpay
• Keeping accurate transaction records for 10 years
• Not engaging in prohibited activities (see Terms of Service)

For compliance-related inquiries, audit requests, or regulatory questions: