Legal and regulatory notices

The framing a partner's legal and compliance team needs. This page is a summary; the signed agreement prevails.

Document control#

Contracting entity and roles#

Maly Tech is a technology provider. It supplies the technical gateway that lets a partner platform instruct collections and payouts over mobile money. Maly is not a financial institution, is not a payment institution, and does not hold, own or take custody of funds at any point.

The licensed financial institution named in your agreement holds and manages everything of substance: the custody and safeguarding of all funds, customer information, and the merchant and customer wallets. All regulated payment activity is carried out by that institution under its own permissions.

Where Maly moves money, it does so only as a technical instruction within the mobile money system operated by that institution. Maly does not move or control funds outside that system. Ultimate custody of every wallet, merchant or customer, remains with the licensed institution at all times.

The wallet and balance fields#

The wallet and balance figures returned by this API (available, pending, total_inward, total_outward) are a view of the position held with the licensed institution, reported through the gateway for your convenience. They are not funds held by Maly, and they are not a deposit or stored-value balance issued by Maly. Custody of the underlying funds sits with the licensed institution.

Approved use and prohibited activity#

Integration approval covers only the countries, currencies, use cases and merchant categories agreed during onboarding. A transaction may be rejected, held or reversed, and an account suspended, where required for anti-money-laundering, sanctions, fraud, legal or regulatory reasons.

Prohibited data in free-text fields#

The reference, description and metadata fields accept text you supply and are stored and echoed back. Do not place sensitive data in them. In particular, never send:

• passwords, API keys or other authentication secrets;
• full card numbers, bank credentials or government identity numbers;
• images or scans of identity documents;
• health, biometric or special-category personal data.

Send only what you need for your own correlation, such as an order identifier. Apply the same data-minimisation rule to the customer object: send the identifier the method requires and no more.

Compliance responsibilities#

Responsibilities are allocated in your agreement. In outline: the licensed provider executes regulated payment activity under its permissions; Maly provides the technical platform and applies the controls agreed with the provider; and you remain responsible for your own customer relationship, for the legality of what you are charging for or paying out, and for your own regulatory obligations as a business.

Data protection#

The API transmits customer mobile numbers, which are personal data. The controller and processor roles, the data processing terms, retention, and any transfer of data outside the operating market are governed by your agreement and the applicable Congolese data protection law. Where this guide and those terms differ, those terms prevail.

Tax#

The gateway records the tax values you provide on a payment. It does not calculate tax, determine the applicable treatment, or give tax advice. Tax figures in examples are illustrative.