VylocaTrust and company information Product sandbox

Partner readiness pack · Version 2026-09-20.2

A diligence-ready path from sandbox to controlled deployment.

This pack gives licensed fintech partners a precise starting point for commercial, compliance and technical evaluation. It does not assume approval, exclusivity or a live-money launch.

Scope

Nigeria-wide partner programme

Current state

Provider-neutral sandbox

Regulated layer

Controlled by licensed partners

The proposed operating model

Vyloca originates and supports a visitor payment journey. An eligible international visitor receives a partner-approved quote and funding experience. The Nigerian beneficiary is validated before authorisation and receives the exact naira amount through its existing bank account.

Vyloca provides customer experience, demand capture, provider-neutral orchestration, status visibility and support routing. The licensed partner retains customer approval, funds control, foreign exchange, transfer execution, settlement, reversals and regulatory reporting.

No live-money assumption

The public product remains a sandbox and demand study. Production activation requires written agreement on the permitted model, controls, supported corridor and accountable licensed entities.

Funding capability gates

Sandbox demonstration

Just-in-time funding

Activation rule: The licensed provider must enable the funding method and approve each transaction.
Provider control: Identity, funding acceptance, FX, settlement, refunds and reporting.
Vyloca boundary: Presents the quote and submits a correlated payment instruction without receiving raw card data or funds.

Disabled pending provider approval

Licensed-provider trip balance

Activation rule: The provider must confirm issuance, safeguarding, ledger ownership, top-up, refund and redemption controls in writing.
Provider control: Issues and safeguards the balance, maintains the authoritative ledger and executes every movement.
Vyloca boundary: May display provider-reported available or pending amounts; never issues, safeguards or redeems the balance.

Responsibility and evidence matrix

Control	Vyloca	Licensed partner	Required evidence
Customer identity and eligibility	Collects only the minimum journey state required by the agreed integration.	Performs KYC, sanctions screening, eligibility checks and approval.	Partner decision reference and timestamp.
Provider-held balance, if approved	Displays provider-reported available or pending amounts and submits idempotent payment instructions.	Issues and safeguards the balance, owns the ledger, and controls top-up, refund, redemption and reporting.	Written product approval, provider balance reference and reconciliation record.
International funding	Initiates the approved partner-hosted funding journey and displays status.	Accepts and processes eligible funding methods within its licensed perimeter.	Provider payment reference and final funding status.
FX quotation	Displays the partner-supplied rate, fees, exact naira amount and expiry.	Prices, approves and executes currency conversion.	Quote ID, rate, fees, expiry and acceptance time.
Beneficiary validation	Captures the intended Nigerian bank account and presents the resolved name.	Resolves the account through authorised banking rails and returns the result.	Resolution reference, bank code and masked account.
Naira transfer and settlement	Orchestrates the request and communicates pending, successful or failed status.	Executes the transfer, safeguards funds and owns settlement.	Transfer reference, final status and settlement record.
Reversals and disputes	Routes status, support context and customer communication.	Decides and executes reversals, refunds, chargebacks and dispute outcomes.	Case reference, decision, value and completion time.
Audit and regulatory reporting	Keeps orchestration events, idempotency keys and correlation references.	Maintains regulated records and submits required reports.	Correlated audit trail without raw card or identity evidence in Vyloca.

Provider certification lifecycle

Every candidate provider begins with no live access. Progress is evidence-based, approval is time-bounded, and suspension takes effect before any further provider call.

Gate 1

Live access blocked

Due diligence

Confirm the licensed entity, permitted product structure, regulatory permissions, ownership and accountable teams.

Gate 2

Live access blocked

Technical validation

Pass contract, security, negative-path, idempotency, webhook, reversal and reconciliation tests in sandbox.

Gate 3

Live access blocked

Compliance and operations review

Approve data roles, disclosures, limits, safeguarding, support, incident response and mandatory stop conditions.

Gate 4

Live access eligible

Production approval

Record time-bounded written approval, verified evidence references and the specific funding modes authorised for production.

Gate 5

Live access blocked

Suspension

Immediately block new live provider calls when approval, evidence, reconciliation, security or regulatory standing becomes invalid.

Partner qualification checklist

Permitted transaction model and licensed entities confirmed in writing

Supported originating countries, currencies and foreign-issued funding methods

Funding-mode capability manifest, including written approval for any provider-held balance

Nigerian account-name resolution and NIP payout capability

Partner-hosted KYC, sanctions screening and transaction approval

Quote creation with rate, fees, exact naira amount and expiry

Idempotent payment and payout commands

Signed webhooks with timestamp and replay protection

Final-status, reversal, dispute and reconciliation APIs

Production limits, fraud rules, support escalation and stop conditions

Commercial pricing, settlement timetable and liability ownership

Provider onboarding questions

These questions must be answered with evidence before provider-specific engineering begins. A commercial introduction is not treated as technical or regulatory approval.

Question 1

Identify every licensed entity and regulated banking or card-processing participant in the proposed flow.

Question 2

Confirm which entity issues and safeguards any provider-held balance and maintains the authoritative financial ledger.

Question 3

Provide the account-resolution, quotation, payment, status, refund, reversal, dispute and reconciliation contracts.

Question 4

Document webhook signing, timestamp tolerance, event identity, retry, ordering and finality semantics.

Question 5

Define merchant-credit evidence, payout-reference uniqueness and the authoritative reconciliation record.

Question 6

Provide outage SLOs, support coverage, incident severity definitions, escalation contacts and regulatory notification ownership.

Question 7

Describe card-data scope, PCI responsibility, KYC, sanctions, fraud, source-of-funds and identity-evidence custody.

Question 8

Provide sandbox access, negative-path fixtures, rate limits, idempotency guarantees and production change controls.

Question 9

Define refund, redemption, chargeback, dispute and customer-complaint ownership and service levels.

Question 10

Confirm retention periods, evidence access, deletion duties, sub-processors and cross-border data-transfer controls.

Operational resilience controls

Provider circuit breaking and bounded retries with the original idempotency identity

Alerts for dependency failures, webhook failure rate, stale payments, reconciliation and dead-letter backlogs

Durable dead-letter and operational-alert records containing references rather than sensitive payloads

Two-person maker/checker resolution for financial-status ambiguity

Eighteen mandatory provider certification scenarios with evidence references

Documented incident, reconciliation, recovery and provider-suspension runbooks

Controlled programme gates

1. Qualify

Confirm licensing, model, corridors, limits, pricing, risk ownership and named accountable teams.

2. Integrate

Map sandbox APIs, verify negative paths, test idempotency, webhook security, reversals and reconciliation.

3. Authorise

Launch only after written compliance approval, operational sign-off, support readiness and agreed stop conditions.

Evidence used to evaluate the programme

Qualified visitor demand by originating country and funding currency

Account-resolution success rate

Funding authorisation and completion rate

Merchant-credit success rate and time to final status

Reversal, dispute and manual-review rate

Support contacts per completed transaction

Partner revenue, processing cost and contribution margin

Targets and thresholds are not presented as predetermined facts. They must be agreed with the selected partner after the supported corridor, risk model, pricing and operational capacity are confirmed.

Mandatory stop conditions

Deployment pauses when a control boundary cannot be evidenced.

Unresolved uncertainty about licensing or the permitted transaction model
Material mismatch between the beneficiary shown and the account credited
Duplicate debit or duplicate payout outside agreed recovery controls
Loss of signed-webhook verification or reliable reconciliation
Exposure of raw card data, identity evidence, bank credentials or partner secrets
Risk, fraud, support or settlement performance outside agreed thresholds

Technical entry points

API contract Capability manifest schema Download diligence pack Machine-readable pack Service health Trust centre

Start a fit review

Commercial, compliance and technical teams should evaluate the model together.

Please include your licensed entity, supported originating markets, funding methods, FX capability, Nigerian payout rails and relevant API documentation. Do not send credentials, production keys or customer information.

Request a fit review