Compliance, attestations and global frameworks
Marseille UPG operates regulated, audited payment infrastructure. We maintain certifications and attestations that allow regulated customers to rely on our platform without compromising their own posture.
- Last audit
- Q1 2026
- Auditor
- BDO UK
- Coverage
- All production regions
Highest tier service-provider attestation. AoC refreshed annually by a Qualified Security Assessor.
Continuous reporting on Security, Availability and Confidentiality trust principles.
Certified Information Security Management System covering all production environments.
Privacy Information Management System extension built on top of ISO 27001.
Standard Contractual Clauses, UK IDTA, transfer impact assessments and a registered DPO.
Strong Customer Authentication routing, exemption strategy and 3DS2 orchestration.
The compliance programme
Compliance at Marseille UPG is a continuous engineering programme, not a yearly checkbox. Controls are codified, monitored and tested in production. Evidence is collected automatically and reviewed by an independent internal audit function that reports directly to the Audit Committee.
- Control library mapped against PCI DSS v4.0, SOC 2, ISO 27001/27701 and CSA CCM.
- Continuous control monitoring with automated evidence capture and exception management.
- Quarterly internal audits; annual external assessments; surprise sampling on critical controls.
- Risk register reviewed monthly by the CISO and quarterly by the board.
Regulatory frameworks
We support customers operating across the following frameworks. Where you act as the regulated entity, we act as a sub-contracted service provider with appropriate flow-down obligations.
- GDPR (2016/679)
- PSD2 (2015/2366)
- EBA RTS on SCA
- DORA readiness
- UK GDPR + DPA 2018
- FCA expectations for outsourced services
- PSR 2017
- CCPA / CPRA
- GLBA Safeguards Rule
- State money-transmission framework alignment
- Singapore PDPA
- Australia Privacy Act
- Japan APPI
- Hong Kong PDPO
- Brazil LGPD
- Mexico LFPDPPP
- Argentina PDPA
- PCI DSS v4.0
- PCI 3DS Core SDK
- Visa, Mastercard, Amex compliance programs
AML, sanctions and merchant due diligence
Marseille UPG is not a money services business and does not hold customer funds. We nonetheless operate a risk-based programme to ensure that the platform is not used to facilitate financial crime, including:
- Know-Your-Business onboarding for every customer organisation, refreshed at least annually.
- Sanctions screening (OFAC, EU, UK, UN) on customers, beneficial owners and configured providers.
- Transaction-level rules engine for typology detection, with case management and SAR support.
- Direct cooperation with law enforcement subject to lawful, valid requests.