Compliance & Licensing | Legal

1. Regulatory Status

RohoPay operates an in-house payments extension service. We do not hold a standalone payments license, but with the merchant’s consent and discretion, we use our accounts through licensed payment service providers, working as conduits for safe transactions to final destination.

The payments service providers of choice in Uganda are:

Relworx Limited — Licensed Telecom Payments Aggregator by Bank of Uganda (BoU). Website: relworx.com
Flutterwave Uganda Limited — Licensed Payment Service Provider by BoU. Website: flutterwave.com
Iotec Uganda Limited — Licensed Payment Service Provider by BoU. Website: iotec.io

RohoPay is a product of Roho Technologies Limited, a company registered in Uganda. We comply with Ugandan regulations including the Data Protection and Privacy Act 2019, Anti-Money Laundering Act 2013, and Bank of Uganda guidelines. Where applicable, we also align with EU GDPR and PSD2 standards via our Providers.

2. Anti-Money Laundering (AML) / Counter-Terrorism Financing (CTF)

RohoPay maintains a comprehensive AML/CTF program aligned with Uganda's Anti-Money Laundering Act, 2013 (as amended) and Financial Action Task Force (FATF) recommendations.

Key Controls:

Customer Due Diligence (CDD): KYC on all Merchants before live processing (see Terms §3).
Enhanced Due Diligence (EDD): For high-risk Merchants (PEPs, complex structures, high-volume, cross-border).
Sanctions Screening: Real-time screening against OFAC, EU, UN, UK, and Uganda consolidated lists. Daily re-screening.
Transaction Monitoring: Automated risk scoring (velocity, geography, amount patterns, new beneficiaries).
Suspicious Activity Reporting (SAR): Filed with Uganda Financial Intelligence Authority (FIA) and Providers as required.
Record Keeping: All KYC, transaction, and monitoring records retained for 7 years minimum.
Training: Annual AML/CTF training for all staff; specialized training for compliance team.
Independent Audit: Annual independent audit of AML program.

3. Know Your Customer (KYC) Requirements

All Merchants must complete KYC before receiving live API keys. Requirements:

Entity: Certificate of Incorporation/Registration, Memorandum & Articles of Association, TIN certificate.
Beneficial Owners: Government-issued ID (passport, national ID), proof of address, % ownership for all ≥25% owners.
Directors/Authorized Signatories: IDs, board resolution authorizing RohoPay account.
Business Proof: Functional website/app, business description, expected monthly volume, average ticket size.
Banking: Bank account verification (statement/letter), settlement account must match legal entity name.
Ongoing: Annual re-verification; ad-hoc on material changes (ownership, business model, volume).

4. Data Protection & Privacy

RohoPay complies with:

Uganda Data Protection and Privacy Act, 2019 (DPA) — Registered with Personal Data Protection Office (PDPO).
EU GDPR — Where applicable (EU Merchants, EU Customers). DPO appointed.
PCI DSS — Card payments use provider-hosted entry. The applicable scope and SAQ must be confirmed with our acquiring bank or a qualified assessor; hosted checkout alone is not a certification.

See Privacy Policy for details on data processing, rights, retention, and security measures.

5. Security Certifications & Standards

PCI DSS scope — Assessment and attestation requirements are being confirmed against the deployed payment flow with the acquiring bank or a qualified assessor.
ISO 27001 — Alignment in progress (target certification Q4 2025).
SOC 2 Type II — Annual audit (security, availability, confidentiality).
Encryption: AES-256 at rest, TLS 1.2+ in transit, HSM for key management.
Penetration Testing: Quarterly external, annual internal, plus bug bounty program.
Vulnerability Management: Continuous scanning, 30-day SLA for critical patches.
Incident Response: 24/7 SOC, defined playbooks, 1-hour notification for confirmed breaches.

6. Consumer Protection

Transparent pricing — no hidden fees (see Pricing).
Clear Terms of Service, Acceptable Use Policy, Refund Policy.
Dispute resolution process with defined timelines (see Refund & Dispute Policy).
Fraud reporting channel: /report-fraud.
Merchant settlement transparency — real-time dashboard, detailed reports.

7. Provider Compliance

We only integrate with Providers that hold valid licenses from the relevant central bank/regulator. Our Provider due diligence includes:

License verification (BoU, CBK, BoT, SARB, etc.)
AML/CTF program assessment
Data protection & security review
Financial stability & capital adequacy
Operational resilience & disaster recovery
Contractual data processing agreements (DPAs)
Ongoing monitoring (license status, enforcement actions, outages)

8. Cross-Border & FX Compliance

Settlements in local currency (UGX, KES, TZS, etc.) via licensed local Providers.
FX conversions at Provider rates + transparent margin (disclosed on Pricing).
No cross-border fund flows without licensed corridor.
Compliance with Uganda Foreign Exchange Act and BoU guidelines.

9. Regulatory Reporting

Monthly transaction volume reports to Providers.
Quarterly AML/CTF reports to FIA (via Providers).
Annual PCI DSS attestation.
Incident notifications per BoU/PDPO/GDPR timelines.
Cooperation with law enforcement investigations (with proper legal process).

10. Compliance Contacts

Chief Compliance Officer: cco@rohopay.com
Data Protection Officer (DPO): dpo@rohopay.com
AML Reporting: aml@rohopay.com
Security Incidents: security@rohopay.com
Regulatory Inquiries: legal@rohopay.com

Provider Contact Points

Relworx: relworx.com/contact
Flutterwave: flutterwave.com/contact
Iotec: iotec.io/contact

11. Whistleblower / Responsible Disclosure

We encourage reporting of compliance concerns, security vulnerabilities, or ethical violations:

Whistleblower: whistleblower@rohopay.com (confidential, protected)
Security Vulnerabilities: security@rohopay.com (PGP key available)
Bug Bounty: Managed via HackerOne (private program)
Company Website: rohotechnologies.com

12. Changes

This compliance overview is updated as regulations evolve. Material changes notified to Merchants. For the most current regulatory status, contact compliance@rohopay.com.