Legal & Compliance

Welcome to SPPay, a payment platform managed by Kudi Systems Ltd ("Kudi," "we," "us," or "our"). These Terms and Conditions ("Terms") govern your access to and use of the SPPay platform and its services (collectively, the "Service"). By registering for, accessing, or using the Service, you ("User," "you," or "your") agree to be bound by these Terms and any additional terms referenced herein.

These Terms constitute a legally binding agreement between you and Kudi Systems Ltd, a company registered under the laws of Ghana. If you do not agree to these Terms, you must not access or use the Service.

Kudi Systems Ltd is in the process of securing a Payment Service Provider (PSP) Enhanced license from the Bank of Ghana (BOG). The provision of the Service is subject to obtaining and maintaining all necessary licenses and approvals from the BOG and other relevant regulatory authorities in Ghana.

For the purposes of these Terms, the following definitions apply:

• "User": Any individual or entity that registers for or uses the SPPay platform.
• "Service": The payment services provided by SPPay, including but not limited to mobile app payments, bulk collections, and bulk payouts.
• "Platform": The SPPay mobile application, web portal, APIs, SDKs, and any other digital or physical interfaces provided by Kudi for accessing the Service.
• "Transaction": Any financial operation conducted through the Platform, including payments, transfers, collections, or disbursements.
• "Account": The user account created on the Platform to access the Service.
• "PSP": Payment Service Provider, as defined under the Payment Systems and Services Act, 2019 (Act 987).
• "AML": Anti-Money Laundering regulations, as governed by the Anti-Money Laundering Act, 2008 (Act 749) and its amendments.
• "KYC": Know Your Customer requirements, as mandated by the Bank of Ghana.

To use the Service, you must:

• Be at least 18 years old or the age of majority in your jurisdiction.
• Be a resident of Ghana or a jurisdiction where SPPay is authorized to operate.
• Provide accurate, complete, and up-to-date information during registration, including valid identification documents as required for KYC compliance under BOG guidelines.
• Comply with all applicable laws and regulations, including AML and KYC requirements.

Kudi reserves the right to refuse service to any individual or entity at its sole discretion, particularly if there is suspicion of fraudulent activity or non-compliance with regulatory requirements.

SPPay provides a range of payment services, including but not limited to:

• Mobile App Payments: Peer-to-peer transfers, bill payments, and merchant transactions.
• Bulk Collections: Payment links, QR codes, recurring billing, and real-time reporting for businesses and organizations.
• Bulk Payouts: Disbursements to wallets, banks, and other accounts, with API integration for seamless processing.

Additional features include online checkout, payment links, invoices, storefronts, campaigns, subscriptions, dues, and market transactions, as detailed in the SPPay product documentation. All services are provided in compliance with the Payment Systems and Services Act, 2019 (Act 987) and BOG guidelines, including fund safeguarding and transaction reporting requirements.

Kudi is committed to protecting your personal data in accordance with the Data Protection Act, 2012 (Act 843). We collect, store, and process your data as described in our Privacy Policy, which is incorporated into these Terms by reference and available on the Platform. By using the Service, you consent to the collection and use of your data as outlined in the Privacy Policy.

• Data Security: Kudi implements industry-standard security measures, including end-to-end encryption, 2FA, and fraud detection, to protect your data.
• Data Sharing: Kudi will not share your personal data with third parties except as required by law (e.g., reporting to BOG or law enforcement) or with your explicit consent.
• Data Retention: User data is retained for the duration required by BOG guidelines and the Data Protection Act, 2012, and is securely deleted thereafter unless otherwise mandated by law.

Kudi Systems Ltd operates in full compliance with all applicable laws and regulations in Ghana, including but not limited to:

• Payment Systems and Services Act, 2019 (Act 987): Governs licensing, operations, and consumer protection for PSPs.
• Anti-Money Laundering Act, 2008 (Act 749) and its amendments: Mandates AML compliance and suspicious transaction reporting.
• Data Protection Act, 2012 (Act 843): Regulates the collection, processing, and storage of personal data.
• Electronic Transactions Act, 2008 (Act 772): Validates electronic agreements and communications.

You agree to:

• Comply with all applicable laws when using the Service.
• Provide any information required by Kudi to meet its regulatory obligations, including AML and KYC requirements (e.g., valid ID, proof of address).
• Refrain from using the Service for illegal purposes, such as money laundering, terrorism financing, or fraud.

Kudi may monitor Transactions for compliance and security purposes and report suspicious activities to the Financial Intelligence Centre (FIC) or other authorities as required by law.

• Kudi shall provide the Service in accordance with these Terms, applicable laws, and BOG guidelines.
• Kudi reserves the right to modify, suspend, or discontinue any part of the Service at any time, with notice to users where required by law or BOG regulations.
• Kudi may update these Terms from time to time.

• You may use the Service for lawful purposes only and in compliance with these Terms.
• You are responsible for ensuring that all Transactions comply with applicable laws.
• You agree not to engage in any activity that could harm the Platform, including fraud, hacking, reverse engineering, or misuse of APIs/SDKs.
• You must provide accurate and complete information during registration and keep your Account information up to date.

• Service Availability: The Service is provided "as is," and Kudi does not guarantee uninterrupted access. Downtime may occur due to maintenance, technical issues, or force majeure events (e.g., natural disasters).
• Maximum Liability: Kudi’s total liability for any claim arising from these Terms or the Service shall not exceed the amount of fees paid by you to Kudi in the six (6) months preceding the claim.

• Entire Agreement: These Terms, together with the Privacy Policy and any other referenced documents, constitute the entire agreement between you and Kudi regarding the Service, superseding any prior agreements.
• Severability: If any provision of these Terms is found to be invalid or unenforceable under Ghanaian law, the remaining provisions shall remain in full force and effect.
• Waiver: No waiver of any provision of these Terms shall be deemed a further or continuing waiver of such provision or any other provision.
• Assignment: You may not assign your rights or obligations under these Terms without Kudi’s prior written consent. Kudi may assign its rights and obligations at any time.
• Force Majeure: Kudi shall not be liable for delays or failures in performance due to events beyond its reasonable control, such as natural disasters or government actions.
• Electronic Communications: You consent to receive communications from Kudi electronically (via email or the Platform), in accordance with the Electronic Transactions Act, 2008 (Act 772).
• Accessibility: Kudi strives to make the Platform accessible to all users, including those with disabilities, in line with best practices and applicable laws.

For any questions, complaints, or concerns regarding these Terms or the Service, please contact us at:

• Phone: 030 225 3840
• Email: compliance@kudisystems.com
• Physical Address: C/146/3 Esseefo Road, Asylum Down, Accra, Ghana
• Digital Address: GA-049-6007

Kudi Systems Ltd. is a Ghanaian fintech company headquartered at:

• Physical Address: C/146/3 Esseefo Road, Asylum Down, Accra, Ghana
• Digital Address: GA-049-6007
• Contact: compliance@kudisystems.com | 030 225 3840

We operate SPPay, a secure digital payment solution facilitating mobile payments, collections, and disbursements. We are registered as a Data Controller with Ghana’s Data Protection Commission under the Data Protection Act, 2012 (Act 843), and we comply with applicable laws including the Payment Systems and Services Act, 2019 (Act 987), and international standards like ISO 27001 and PCI-DSS.

• Name, email address, phone number, residential/business address.
• Date of birth, gender, national identification (e.g., Ghana Card).
• Biometric information (e.g., fingerprint or facial recognition, where enabled).

• Business name, registration details, TIN (Tax Identification Number), bank account details, proof of business address.

• Payment, disbursement, and collection of records.
• Billing and settlement history.
• Device and session details: IP address, browser/device type, geo-location.

• Usage patterns, preferences, feedback.
• Fraud risk signals such as velocity, unusual transaction behaviour, or device fingerprint.

We process your information for the following purposes:

• To provide, operate, and improve our Services.
• To onboard and verify your identity (KYC).
• To process payments, disbursements, and collections.
• To comply with AML/CFT, tax, and regulatory requirements.
• To detect and prevent fraud, unauthorized access, and other illegal activities.
• To communicate with you about your account, transactions, and Service updates.
• To analyse usage for service improvement and innovation.

We process your information lawfully under one or more of the following bases:

• Your consent, where explicitly given.
• Performance of a contract with you (e.g., payment processing).
• Compliance with legal obligations (e.g., reporting to the Bank of Ghana).
• Our legitimate interests, such as improving security, preventing fraud, and enhancing our Services.

We may share your information only as necessary and as permitted by law:

• With regulatory bodies such as the Bank of Ghana and the Data Protection Commission.
• With third-party service providers (e.g., hosting, security, KYC verification) under strict confidentiality agreements.
• With financial institutions and payment networks for transaction processing.
• With law enforcement or authorities where required by law.
• In connection with a merger, acquisition, or transfer of assets.

We do not sell or rent your personal information to third parties.

We implement robust technical and organizational measures to protect your data:

• End-to-end encryption of sensitive data.
• 2FA/MFA for account access.
• Secure hosting on DigitalOcean (backend), Netlify (frontend), protected by Cloudflare.
• Compliance with ISO 27001 and PCI-DSS standards.
• Regular vulnerability scans, penetration testing, and audits.

However, no system is completely secure. We encourage you to also take precautions to safeguard your information.

We retain your information:

• For as long as your account is active or as needed to provide Services.
• As required by law (e.g., AML record retention).
• Until expiry of statutory or regulatory retention periods.

We securely delete or anonymize data when no longer required.

Under Ghana’s Data Protection Act, 2012 (Act 843), you have rights to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Object to or restrict processing of your data.
• Withdraw consent (where applicable).
• Request deletion of your data (subject to legal and regulatory obligations).

To exercise your rights, contact us at: compliance@kudisystems.com.

We use cookies and similar technologies to:

• Maintain secure sessions.
• Improve user experience.
• Analyse traffic and usage patterns.

You can adjust your browser settings to block cookies, but this may impact the functionality of our Services.

Kudi Systems Ltd (“KUDI”) operates the SPPay platform, a digital payments solution for mobile app payments, collections, and disbursements.

As a prospective Payment Service Provider (PSP) under the Payment Systems and Services Act, 2019 (Act 987), KUDI is committed to preventing money laundering (ML), terrorist financing (TF), and proliferation financing of weapons of mass destruction (PF).

This policy aligns with:

• Anti-Money Laundering Act, 2020 (Act 1044)
• BoG AML/CFT/CPF Guidelines 2025
• Anti-Terrorism Act, 2008 (Act 762)
• Payment Systems and Services Act, 2019 (Act 987)
• Data Protection Act, 2012 (Act 843)
• FATF Recommendations
• PCI-DSS and ISO 27001 standards

This AML/CFT/CPF Policy establishes KUDI’s framework for:

• Ensuring compliance with Act 1044 and BoG Guidelines.
• Implementing a risk-based approach (RBA) to identify and mitigate ML/TF/PF risks.
• Protecting KUDI’s customers, reputation, and the integrity of Ghana’s financial system.
• Embedding PCI-DSS and ISO 27001 controls into AML/CFT/CPF practices.

Applies to:

• All KUDI employees, directors, and contractors.
• Third-party service providers.
• All transactions via SPPay (mobile app, collections, disbursements).

• Inward Remittance: Excluded until a separate application is submitted.

• Participation in an organized criminal group and racketeering;
• Terrorism, including terrorist financing;
• Trafficking in human beings and migrant smuggling;
• Sexual exploitation, including sexual exploitation of children;
• Illicit trafficking in narcotic drugs and psychotropic substances;
• Illicit arms trafficking;
• Illicit trafficking in stolen and other goods;
• Corruption and bribery;
• Fraud;
• Counterfeiting currency;
• Counterfeiting and piracy of products;
• Environmental crime;
• Murder, grievous bodily injury;
• Kidnapping, illegal restraint and hostage-taking;
• Robbery or theft;
• Smuggling;
• Tax Evasion;
• Extortion;
• Forgery;
• Piracy; and
• Insider trading and market manipulation.
• Any other predicate offence under the Anti-Money Laundering Act, 2020 Act 1044 as amended and Anti-Terrorism Act 2008, Act 762 as amended and Criminal and Other Offences Act, 1960 (Act 29).

The Board ensures:

• Approval and annual review of the policy, compliance program, training program, and the internal risk assessment framework.
• Approving the appointment of the AMLRO.
• Quarterly review of AML/CFT/CPF risk reports.
• Oversight of compliance with culture and risk management.
• The AMLRO receives training on an ongoing basis to effectively perform his duties.
• The AMLRO is resourced adequately in terms of personnel, IT systems and budget to implement, administer and monitor the AML/CFT/CPF program effectively.
• Receipt of at minimum four (4) compliance reports in a year on the AML/CFT/CPF function from the AMLRO for its information and necessary action.
• It receives requisite training at least once a year.

Senior Management shall ensure that:

• Recommendations made by internal and external auditors and regulators are addressed in a timely manner.
• Relevant, adequate and timely information regarding AML/CFT/CPF matters is provided to the Board.
• There is an ongoing employee training programme (at least twice a year).
• The Policy is implemented effectively across business areas and contains succession planning for the AMLRO function.
• There are reviews of policies and procedures periodically for consistency with the AML/CFT/CPF Program.

The Compliance Officer is responsible for:

• Developing and maintaining this policy.
• Filing STRs with the Financial Intelligence Centre (FIC).
• Conducting risk assessments and training.
• Direct reporting to the Board.
• Liaising with the BOG and the FIC and as a point-of-contact for all employees on issues relating to ML/TF&P.
• Update second point to include receive and vet suspicious (unusual) transaction/activity reports from the employees, file suspicious, Electronic Currency, Politically Exposed Persons Reports and other relevant regulatory reports with the BOG and FIC.
• Submit at minimum four (4) reports to the Board and Senior Management regarding the adequacy of the AML/CFT/CPF framework or any associated issues.

• Reviews shall be performed by the internal audit function and external auditors who have had an appropriate training and appropriate level of knowledge of the regulatory requirements and guidelines.
• The report of the independent testing/review of AML/CFT/CPF compliance function by the internal audit function shall be submitted to the BOG and FIC no later than January 15 of every financial year. The external audit report shall be included in the annual financial report to be submitted to the BoG within the stipulated time.

Risk categories:

• Customer Risk (e.g., PEPs, NGOs).
• Product/Service Risk (collections, bulk payouts).
• Geographic Risk (high-risk jurisdictions).
• Transaction Risk (high-value, unusual activity).

Lower Risk Categories of Customers:

• Financial Institutions subject to the requirements of AML/CFT/CPF
• Public companies listed on the stock exchange
• Life insurance policies
• Insurance policies for pension schemes
• Any other low risk, as may be determined by the National Risk Assessment (NRA) findings.

The risk register is updated quarterly.

• EDD for high-risk clients.
• Automated monitoring and anomaly detection.
• Sanctions screening.

This is the identification and verification of both the client and beneficiary of an account and continuous monitoring of the account.

Where Kudi is unable to perform requirements under this manual;

• It shall not open the account, commence business relationships, or perform transactions.
• Submit SAR/STR to the FIC within 24 hours.

• Individuals: Ghana Card, full bio data.
• Merchants: Incorporation documents, TIN, beneficial ownership.

• PEPs, NGOs, high-value merchants, cross-border activity.
• Source of wealth/funds verification.

• Automated screening for suspicious patterns.
• Bi-annual KYC refresh for merchants.
• Annual KYC refresh for individuals.

Red flags include:

• Unexplained high-value transactions.
• Activity inconsistent with profile.
• Transactions with sanctioned countries.

• Internal escalation (immediately)
• STR filed with FIC within 24 hours

• Retained for 7 years in secure, encrypted storage.

Kudi shall undertake due diligence on prospective employees. At a minimum, Kudi shall;

• Verify applicant’s identity and personal information on a risk-based approach.
• Maintain an ongoing approach to screening for specific positions.
• Subject employees’ accounts including Key Management Personnel to same AML/CFT/CPF procedures

The AMLRO’s account should be reviewed by the Internal Audit.

• Annual AML/CFT/CPF training for all staff.
• Scenario-based training (fraudulent NGOs, high-risk disbursements).
• PCI-DSS & ISO 27001 awareness integrated into training.

Kudi’s directors, officers and employees are prohibited from disclosing the fact that an STR or related information is being reported to the FIC. The identity of the reporting officer or any designated officer investigating such a transaction shall not be revealed.

• Vendors must comply with Act 1044, AML Guidelines, PCI-DSS, ISO 27001.
• Contracts include AML/CFT/CPF compliance clauses and termination rights.

• Regulatory: fines, license suspension, public disclosure.
• Internal: disciplinary action, dismissal, regulatory reporting.

KUDI will cooperate with:

• BoG, FIC, and law enforcement.
• Provide reports, attend AML/CFT/CPF workshops.
• Support investigations.

• Annual review or when laws/regulations change.
• Updates approved by the Board of Directors.

Compliance Department

• compliance@kudisystems.com
• C/146/3 Esseefo Road, Asylum Down, Accra, Ghana
• Digital Address: GA-049-6007

This Service Level Agreement (“SLA”) outlines the expected levels of service, responsibilities, and support commitments between Kudi Systems Ltd (“Kudi”), operator of SPPay, and its customers and merchants.

This SLA is aligned with:

• The Payment Systems and Services Act, 2019 (Act 987)
• Bank of Ghana's Consumer Protection Guidelines
• Anti-Money Laundering Act, 2020 (Act 1044)
• BoG Circulars and PSP Licensing Directives

Kudi provides the following digital payment services via the SPPay platform:

• Mobile App Payments: Peer-to-peer transfers, bill payments, and merchant transactions.
• Bulk Collections: Payment links, QR codes, recurring billing.
• Bulk Payouts: Disbursements to wallets, banks, and other accounts, with API integration for seamless processing.

Additional features include online checkout, payment links, invoices, storefronts, campaigns, subscriptions, dues, and market transactions, as detailed in the SPPay product documentation. All services are provided in compliance with the Payment Systems and Services Act, 2019 (Act 987) and BOG guidelines, including fund safeguarding and transaction reporting requirements.

Kudi commits to:

• Maintaining PCI-DSS certified infrastructure
• Implementing robust AML/CFT and fraud detection systems
• Enforcing real-time monitoring, device fingerprinting, and geo-IP controls
• Keeping users informed about system changes, downtime, and updates

Customers and merchants agree to:

• Maintain accurate KYC and account information
• Secure login credentials and access tokens
• Avoid prohibited or illegal transactions
• Report suspicious activity immediately
• Comply with applicable limits and regulations

Users may file complaints through any support channel. Kudi will:

• Acknowledge receipt within 2 business days
• Provide resolution or update within 7 business days
• Escalate unresolved issues to internal compliance or BoG per guidelines

For unresolved complaints, customers may escalate to: Bank of Ghana

• Confidentiality & Data Protection
• Kudi will handle user data in accordance with the Data Protection Act, 2012 (Act 843).
• Personal data will not be shared with third parties except as required by law or regulatory obligation.
• Secure protocols including 2FA, encryption, and device whitelisting will be enforced.

Kudi may suspend or terminate access for:

• Violation of BoG regulations or internal policies
• Submission of false documents or fraud
• Prolonged inactivity (after 12 months) with no balance

Users may close accounts via written request or dashboard option, subject to final settlements and audit.

For any questions, complaints, or concerns regarding these SLAs, please contact us at:

• Phone: 030 225 3840
• Email: compliance@kudisystems.com
• Physical Address: C/146/3 Esseefo Road, Asylum Down, Accra, Ghana
• Digital Address: GA-049-6007

Kudi Systems Ltd ("KUDI") processes personal data to deliver its digital payments services through the SPPay platform. KUDI is committed to protecting the privacy, integrity, and security of personal data in compliance with:

• The Data Protection Act, 2012 (Act 843)
• The Payment Systems and Services Act, 2019 (Act 987)
• Relevant Bank of Ghana (BoG) directives and guidelines
• International best practices under ISO 27001 and PCI-DSS

KUDI ensures that personal data is:

• Processed lawfully, fairly, and transparently.
• Collected only for specified, explicit, and legitimate purposes.
• Adequate, relevant, and limited to what is necessary.
• Accurate and kept up to date.
• Kept no longer than necessary.
• Processed securely to prevent unauthorized or unlawful processing, loss, destruction, or damage.

This policy applies to all employees, contractors, vendors, and third parties who process personal data on behalf of KUDI.

This policy covers all personal data processed by KUDI across its platforms, systems, and business activities, including:

• Customers (individuals & merchants)
• Employees and prospective employees
• Vendors and partners
• Website and app visitors

It applies to all processing activities conducted through:

• SPPay Mobile App
• Web portals
• Backend & frontend services
• Administrative operations

• Personal Data: Information about an identifiable individual (e.g., name, contact details, ID number).
• Special Category Data: Sensitive data requiring extra protection (e.g., biometrics, race, health).
• Data Controller: KUDI — the entity determining the purpose and means of processing personal data.
• Data Processor: Any third party processing data on behalf of KUDI.
• Data Subject: Any individual whose personal data is processed by KUDI.

• CEO (Accountable Officer):Overall responsibility for data protection compliance.
• Data Protection Officer (DPO): Advises, monitors, and reports on data protection compliance.
• All Employees:Required to comply with this policy and protect personal data as part of their duties.

Contact the DPO at: compliance@kudisystems.com

KUDI processes data on the following legal grounds:

• Consent of the data subject.
• Contractual necessity.
• Legal obligation.
• Legitimate interests of KUDI, provided it does not override data subjects’ rights.
• Public interest, where applicable.

KUDI upholds the following rights of data subjects:

• Right to be informed — Transparent communication on data use.
• Right of access — Obtain a copy of personal data held.
• Right to rectification — Correct inaccuracies or complete incomplete data.
• Right to erasure (‘right to be forgotten’) — Delete data under certain conditions.
• Right to restrict processing — Limit use of data in certain scenarios.
• Right to object — Stop processing based on legitimate interests or direct marketing.
• Right to data portability — Transfer data to another controller upon request.
• Rights related to automated decision-making & profiling — KUDI does not make solely automated decisions that significantly affect individuals.

Requests can be made via info@kudisystems.com and will be responded to within one month.

KUDI implements appropriate technical and organizational measures to protect data, including:

• End-to-end encryption of data in transit and at rest.
• Access controls and authentication (2FA, MFA, biometric login).
• Secure hosting environments (Cloudflare, DigitalOcean, Netlify).
• Regular penetration testing and vulnerability scans.
• Compliance with ISO 27001 and PCI-DSS.

All employees must follow the Information Security Policy.

Any suspected or actual data breach must be reported immediately to the DPO. KUDI will:

• Investigate the breach.
• Notify the Data Protection Commission and affected data subjects where required.
• Implement corrective actions to prevent recurrence.

All staff undergo mandatory data protection and security training:

• Onboarding training for new hires.
• Annual refresher sessions.
• Role-specific training where applicable.

• Cryptographic keys must only be transmitted over secure, encrypted channels such as TLS 1.2+ or SSH2.
• Keys must never be sent in plaintext via email, chat, or unencrypted file transfer.
• Out-of-band verification (e.g., phone confirmation) must be performed before accepting shared keys.
• Public key exchange should use secure protocols (e.g., PKI, Diffie-Hellman/ECDH).

• Keys must be stored in secure, access-controlled environments (e.g., Hardware Security Modules (HSMs), secure key vaults).
• Keys must not be stored in plaintext on local drives, application code, or configuration files.
• Keys must be encrypted when stored and restricted to the fewest possible custodians necessary.
• Access to keys must be logged and subject to monitoring and audit.

• Keys must only be used for their intended purpose and associated data protection function.
• Application systems must not allow unauthorized duplication, export, or misuse of keys.
• When keys are used in manual processes, operations must enforce split knowledge and dual control.

• Keys must be rotated periodically (at least annually) or immediately upon suspected compromise.
• New keys must be generated securely using approved cryptographic random number generators.
• Old or retired keys must be securely destroyed and must not be reused.
• Customers must ensure dependent systems are updated promptly when keys are replaced.

• Customers must immediately notify Kudi Systems Ltd. if a cryptographic key is suspected to be compromised, lost, or misused.
• KUDI will coordinate with the customer to revoke, replace, and re-secure affected systems in accordance with the Incident Response Plan.

By accepting and using cryptographic keys shared by Kudi Systems Ltd., customers agree to:

• Follow the secure key management practices outlined in this document.
• Protect shared keys against unauthorized access or disclosure.
• Maintain an internal record of designated key custodians and access permissions.
• Participate in periodic audits or reviews of key management practices if requested by Kudi Systems Ltd.

For further guidance or clarification, please contact:

Head of Risk & Compliance, Kudi Systems Ltd.
Email: compliance@kudisystems.com

This Information Security Policy establishes the principles, objectives, and rules that guide Kudi Systems Ltd (“KUDI”) in protecting its information assets, systems, and infrastructure against unauthorised access, disclosure, alteration, or destruction.

The policy ensures compliance with:

• Bank of Ghana (BoG) directives and guidelines
• Payment Systems and Services Act, 2019 (Act 987)
• Data Protection Act, 2012 (Act 843)
• ISO/IEC 27001: Information Security Management Standard
• PCI-DSS: Payment Card Industry Data Security Standard
• Other applicable Ghanaian laws and international best practices.

This policy applies to:

• All employees, contractors, board members, and third-party service providers who access KUDI’s information systems.
• All information assets: hardware, software, networks, data, and intellectual property belonging to or entrusted to KUDI.
• The SPPay platform (Laravel API backend, VueJS frontend, mobile apps) and supporting infrastructure (GitHub, Netlify, DigitalOcean, Google/Apple app stores).

• Information security risks shall be identified and reported annually and as and when there are any security incidents.
• Establish and enforce access control policies and procedures, including password policies, authentication and authorization mechanisms, and physical access controls continually.
• Continually ensuring compliance with all relevant legal, regulatory, and contractual obligations related to information security, including data protection regulations.
• Information security awareness shall be made available to all employees on quarterly basis and other interested parties where appropriate.
• Third parties' information security risk assessment shall be identified during onboarding and conducted on yearly basis.
• Information security incident management shall be reported and analysed continually.

• Approve and oversee implementation of this policy.
• Ensure alignment with KUDI’s risk appetite and regulatory obligations.

• Allocate resources for implementation of security measures.
• Appoint a Chief Information Security Officer (CISO) or equivalent.

• Ensure adherence to regulatory and internal security standards.
• Lead periodic risk assessments and audits.

• Comply with this policy, standards, and procedures.
• Promptly report security incidents to the Head of Risk & Compliance.
• Review and acknowledge their individual information security roles and responsibilities upon onboarding and annually thereafter.
• Participate in mandatory awareness and role-specific training.
• Protect KUDI and SPPay assets by adhering to confidentiality, integrity, and availability principles.

KUDI is committed to:

• Implementing appropriate controls to manage identified information security risks.
• Ensuring all systems are protected by strong access control, encryption, and monitoring mechanisms.
• Conducting regular vulnerability assessments and internal audits.
• Preserving the confidentiality, integrity, and availability of information assets.
• Maintaining compliance with ISO 27001:2022 and relevant frameworks (BoG, PCI-DSS, DPA).

Leadership Commitment

Top management is committed to:

• Satisfying all applicable information security requirements, including legal, regulatory, contractual, and other obligations.
• Continual improvement of the ISMS to ensure its ongoing effectiveness, relevance, and alignment with organizational objectives.

Top management shall ensure:

• The integration of information security requirements into organizational processes, systems, products, and services.
• The provision of adequate financial, technical, and human resources necessary for the effective implementation, operation, monitoring, and continual improvement of the ISMS.
• Roles, responsibilities, and authorities related to information security are defined, assigned, communicated, and understood across the organization.
• A culture of information security awareness is promoted, ensuring that employees, contractors, and relevant third parties understand and fulfill their information security responsibilities.
• ISMS performance is regularly reviewed through management reviews, nonconformities are addressed, and corrective actions are implemented effectively to achieve intended outcomes.

All information shall be classified as follows:

Handling rules:

• Confidential & Restricted data must be encrypted in transit and at rest.
• No customer data shall be shared with third parties without consent or legal obligation.
• Data retention and disposal must follow regulatory and contractual requirements.

• Access to systems and data shall be based on the principle of least privilege and need-to-know.
• Multi-Factor Authentication (MFA) shall be enforced for all administrative and privileged accounts.
• User accounts shall be promptly disabled upon employee exit or role change.

• All servers and endpoints shall be hardened, patched, and regularly scanned for vulnerabilities.
• Source code shall be securely managed in GitHub, with controlled access and code reviews.
• SPPay backend hosted on DigitalOcean and frontend on Netlify shall implement firewall rules, DDoS protection, and monitoring.
• Mobile applications shall be secured against reverse engineering and meet Google/Apple store security standards.

• All sensitive data shall be encrypted using industry-standard algorithms.
• TLS 1.2+ must be enforced for all communications.
• Cryptographic keys shall be securely generated, stored, rotated, and retired.

• Network segmentation shall be implemented to limit the scope of attacks.
• Intrusion detection/prevention systems (IDS/IPS) shall monitor traffic.
• Remote access to systems shall be via secure VPN and MFA.

• Third-party service providers must demonstrate compliance with ISO 27001, PCI-DSS, or equivalent.
• Data stored or processed in the cloud must meet the same security standards as on-premise systems.
• Regular due diligence and contract reviews shall ensure third-party compliance.

• Compliance with the Data Protection Act, 2012 (Act 843) is mandatory.
• Personal data of customers and merchants shall be collected, processed, and retained lawfully and only for specified purposes.
• Data subjects shall be informed of their rights and mechanisms for exercising them.

• Security incidents must be reported immediately to the Head of Risk & Compliance.
• An Incident Response Plan shall define roles, communication protocols, and escalation paths.
• BoG, DPC, and affected parties shall be notified of breaches as required by law.

• KUDI shall maintain a documented Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP).
• Systems and data shall be backed up regularly and tested for recovery.
• Critical systems shall be designed for redundancy and high availability.

• All critical systems shall have audit trails enabled and retained per regulatory requirements.
• Logs shall be regularly reviewed for anomalies and retained securely.
• Real-time monitoring shall detect and alert on suspicious activity.

• All employees and contractors shall undergo mandatory information security and data protection training at onboarding and annually thereafter.
• Specialized training shall be provided to technical and privileged users.

• Regular internal audits and independent assessments shall verify adherence to this policy.
• Gaps identified in audits shall be addressed promptly with documented corrective actions.
• Periodic reviews shall ensure alignment with updated laws, regulations, and industry standards.

• This Information Security Policy shall be formally distributed to all employees, contractors, Board members, and third-party service providers with access to KUDI information assets.
• Distribution will be conducted through secure channels such as the corporate intranet, official email, or approved document management system.
• All recipients must provide documented acknowledgment of receipt and understanding of the policy.
• Acknowledgments will be maintained by the Head of Risk & Compliance and Human Resources as auditable evidence of compliance.
• Updated versions of this policy shall require renewed acknowledgment from all relevant personnel, vendors, and partners.
• Non-compliance with acknowledgment requirements will be escalated to Executive Management and may result in disciplinary or contractual action.

Applies to all employees, contractors, vendors, third parties working with KUDI. Covers SPPay backend (DigitalOcean), frontend (Netlify), mobile apps, GitHub codebase, cardholder data (CHD), PII, and internal assets.

KUDI is committed to:

• Coordinated incident management.
• Immediate reporting and effective handling.
• Root cause investigation.
• Data security & privacy protection.
• Compliance with BoG, Data Protection Act, ISO 27001, PCI-DSS.

• Detect incidents promptly.
• Ensure swift containment, mitigation, and recovery.
• Communicate with stakeholders including regulators.
• Maintain incident records for compliance.
• Continually improve processes through lessons learned.

• Incident Response Manager: Coordinates the entire incident response process and ensures timely resolution.
• Incident Handler: Investigates, contains, and eradicates the incident’s technical root cause.
• Risk & Compliance / Legal Liaison: Ensures compliance with legal, regulatory, and policy requirements during the response.
• Communications / Management Liaison: Manages internal and external communications and escalations.
• Business Continuity / Operations Support: Maintains operational continuity and supports system and service recovery.
• All Employees: Report incident via reporting channel below.

• Report via incidents@kudisystems.com
• Must include description, detection details, systems/data involved, actions taken.
• Complete Incident Report Form.

Lifecycle: Preparation → Detection & Reporting → Assessment & Classification → Containment → Eradication → Recovery → Notification → Post-Incident Review & Lessons Learned.

• No storage of sensitive authentication data post-auth.
• CHD & PII encrypted in transit/at rest.
• Secure disposal when no longer required.
• Any incident with CHD/PII triggers PCI-DSS & Data Protection Act requirements.

In the event that Primary Account Numbers (PAN) are discovered outside the defined Cardholder Data Environment (CDE), the Incident Response Team (IRT) shall:

• Immediately retrieve and securely delete or migrate the data into the CDE.
• Verify whether any Sensitive Authentication Data (SAD) is stored with the PAN.
• Conduct a root cause analysis to determine how the data was placed outside the CDE.
• Remediate any data leaks or process gaps that caused the occurrence.
• All actions must be logged in the incident register, with corrective measures tracked to closure.

• Report incidents to BoG / DPC within timelines.
• Maintain evidence ≥6 years.
• Cooperate with regulators.
• PCI-DSS 12.10.1 Update: For incidents involving CHD, KUDI shall follow payment brand incident response and reporting procedures (Visa, Mastercard, Amex, Discover, UnionPay), including notifying acquirers and regulators as required.

• Mandatory staff training.
• Annual refreshers and simulations.

• The Incident Response Policy shall be formally reviewed at least annually and following significant incidents.
• Annual testing, including simulations, shall be performed covering all PCI-DSS 12.10.1 elements (roles, responsibilities, containment, eradication, recovery, communication, payment brand notifications, and evidence handling).
• Results must be documented and used to update this policy.