53 bilingual terms across regulation, payment rails, cross-border & FX, technical infrastructure, and ASEAN-specific instant-payment systems — written by the team building Kaadxpay.
§ 1
An interim approval issued by a financial regulator confirming an applicant has met the substantive criteria for a licence, subject to final conditions (capital lock-up, staffing, systems audits). Operating activities cannot begin until the full licence is issued.
The combined regulatory framework requiring financial institutions to detect, prevent and report money laundering and terrorism financing. Covers KYC, sanctions screening, transaction monitoring, suspicious-activity reporting and recordkeeping. The global baseline is set by FATF; each jurisdiction layers its own statute on top.
The standard set of identity, ownership and risk checks a regulated entity performs at onboarding and on an ongoing basis. CDD typically covers identity verification, beneficial-ownership disclosure, source-of-funds attestation and sanctions screening.
The deeper level of due diligence triggered by elevated risk factors — high-risk jurisdictions, PEPs, complex ownership structures, unusual transaction patterns. EDD typically adds source-of-wealth review, in-person verification and more frequent reviews on top of standard CDD.
The intergovernmental body that sets global standards for AML/CFT. Publishes the 40 Recommendations, conducts mutual evaluations of member jurisdictions, and maintains the "grey" and "black" lists that drive enhanced due-diligence expectations on counterparties from listed jurisdictions.
The business-side counterpart to KYC: verifying the legal existence, ownership structure, beneficial owners, directors and operating substance of a corporate customer before onboarding. Required for merchant onboarding in any regulated payment business.
The set of identity-verification and risk-assessment checks performed on individual customers at onboarding and on an ongoing basis. The retail-side counterpart to KYB. Tiered KYC (lighter checks for low-value flows, deeper checks for higher value) is the dominant pattern across ASEAN regulators.
The statutory financial-services regulator for the federal territory of Labuan, Malaysia. Issues licences (including PSO) under the Labuan Financial Services and Securities Act 2010. Recognised globally as a credible offshore licensing jurisdiction with FATF-aligned AML/CFT requirements.
An individual entrusted with prominent public functions (heads of state, senior politicians, senior judiciary, senior military, senior executives of state-owned enterprises), plus their close associates and immediate family. PEP status triggers enhanced due-diligence requirements under FATF standards.
A regulatory licence class — in Malaysia / Labuan, Singapore and several other ASEAN jurisdictions — authorising the holder to operate cross-border payment systems including collection, payout, FX conversion and settlement. The Labuan FSA PSO is the licence Kaadxpay holds AIP under.
The process of checking customers, counterparties, beneficial owners and transaction parties against international sanctions lists (OFAC SDN, EU, UN, UK HMT, plus local lists). Modern programmes screen at onboarding, before each transaction and on list updates, with documented case management.
A FATF Recommendation 16 obligation requiring originators and beneficiaries of certain financial transfers (including virtual-asset transfers above thresholds) to exchange identity information alongside the funds. Implementation specifics vary by jurisdiction; ASEAN regulators are progressively adopting it for crypto and cross-border fiat.
The natural person(s) who ultimately own or control a legal entity, typically defined as ≥25% ownership or effective control via voting rights, board appointments or contractual arrangements. UBO identification is a baseline AML/CFT requirement under FATF Recommendation 24.
§ 2
A financial institution (typically a bank or licensed processor) that holds the merchant relationship, authorises card transactions on the merchant's behalf and settles funds into the merchant's account. The counterpart to the issuer on the cardholder side.
The step where an issuer confirms that a card or account has sufficient funds and is permitted to make the requested payment. An authorisation places a hold but does not move funds — capture and settlement do. Authorisations expire if not captured within the scheme-defined window (typically 7-30 days for cards).
The first 6 to 8 digits of a payment card number, identifying the issuing bank, card scheme, card type (credit/debit/prepaid) and issuing country. BINs are used for routing decisions, interchange calculation and fraud rules. Modern BIN tables include 8-digit ranges following the ISO/IEC 7812 migration.
The step that converts a held authorisation into a request for actual fund movement. In card flows, capture is typically initiated when goods ship or services are delivered. Partial captures (capturing less than the authorised amount) are supported by most schemes.
A scheme-arbitrated reversal of a card transaction initiated by the cardholder via their issuer. Common reasons: fraud, non-receipt of goods, "not as described". Chargebacks impose both the disputed amount and a per-case fee on the merchant, and high ratios can trigger scheme monitoring programmes.
The post-authorisation process where transaction details are exchanged and matched between acquirer, scheme and issuer, producing the net amounts each party owes. Clearing precedes — and is logically distinct from — settlement (the actual fund movement).
The fee paid by the acquirer to the issuer for each card transaction, set by the card scheme and varying by card type, merchant category, region and channel (CP vs CNP). Interchange is the largest component of the merchant discount rate (MDR). Many ASEAN markets have interchange-cap regulation (typically 30-80 bps domestic).
The modern XML-based standard for financial-messaging, replacing the legacy ISO 8583 (cards) and MT/SWIFT (correspondent banking) formats in most rails. ISO 20022 carries richer structured data — full party details, end-to-end remittance information, structured purpose codes — which improves AML screening and straight-through processing.
A financial institution (typically a bank) that issues payment instruments — cards, accounts, e-money wallets — to end customers, authorises transactions on their behalf and is liable for funded balances. The counterpart to the acquirer on the merchant side.
The all-in percentage fee a merchant pays per card transaction, typically composed of interchange (to the issuer), scheme fees (to Visa/Mastercard/UnionPay/etc.) and acquirer margin. ASEAN domestic MDRs range roughly 0.4-1.8% for debit and 1.2-3.0% for credit depending on segment and regulation.
The card-industry security standard maintained by the PCI Security Standards Council, mandatory for any entity that stores, processes or transmits cardholder data. Levels 1-4 scale validation effort by transaction volume; Kaadxpay operates as a PCI-DSS Level 1 service provider when in scope.
The actual movement of funds between parties to complete a transaction, distinct from clearing (which only matches and computes net amounts). Settlement timing is described as T+0 (same day), T+1 (next business day), etc. Faster settlement reduces merchant working-capital needs but increases acquirer credit risk.
The routing layer that receives a payment request and forwards it to the correct downstream rail (card scheme, bank API, wallet, instant-payment system) based on instrument, currency, amount, cost and availability. Switching logic — and how it handles retries, failover and least-cost routing — is the defining capability of a payment-orchestration platform.
§ 3
A unit equal to 1/100 of one percent (0.01% = 1 bp). Used to express small differences in fees and FX spreads with precision — e.g. "the FX spread is 25 bp" means 0.25%. Standard pricing language across professional payment and treasury work.
A specific directional flow between two countries or currencies — e.g. "MY→ID corridor" or "USD→PHP corridor". Each corridor has its own pricing, partners, regulatory requirements and operational realities. Operators talk about adding or hardening corridors as a fundamental unit of business growth.
The difference between the rate a customer is quoted and the mid-market rate. A 25 bp spread on a USD 10,000 conversion costs the customer USD 25. Most "low-fee" remittance products embed economics into the spread rather than a visible fee line — comparing spread to mid-market is the only honest way to evaluate cost.
The midpoint between the buy and sell rates for a currency pair on the wholesale interbank market — the "true" reference rate. No retail customer transacts at the mid; every operator quotes a rate worse than the mid, with the difference being the FX spread. Mid-market is the standard benchmark for honest cost comparison.
Correspondent-banking terminology. A nostro account is "our account held with you" (an account a domestic bank holds at a foreign-currency correspondent); a vostro account is the same account viewed from the correspondent's side. The nostro/vostro pair is how cross-border funds traditionally settle, with associated funding-and-reconciliation overhead.
A cross-border person-to-person money transfer, typically from a migrant worker sending earnings home. Global remittance flow runs ~USD 800B+/year, with ASEAN among the largest receive regions (PH, VN, ID, MM, KH). Regulated more lightly than B2B FX in most jurisdictions but with strict per-transaction limits and recipient identification.
The global financial-messaging network used by banks for cross-border payment instructions. SWIFT itself moves messages, not money — actual funds settle through correspondent-banking nostro/vostro chains. SWIFT MT (MT103, MT202) formats are progressively being replaced by ISO 20022 messages.
Settlement-timing notation. T+0 means same-day settlement (the most aggressive). T+1 is next business day (the modern norm for many ASEAN rails). T+2 is the legacy correspondent-banking baseline. Faster settlement reduces working-capital pressure on merchants but requires the operator to assume more credit risk pre-clearing.
§ 4
An authentication protocol (Visa Secure, Mastercard Identity Check, etc.) that adds a cardholder-side challenge step to high-risk card transactions. Successful 3DS shifts fraud liability from the merchant to the issuer for most chargeback reason codes. 3DS2 reduced friction via risk-based authentication — most transactions now pass without a visible challenge.
A holding queue for messages (webhooks, payment events, settlement reports) that have failed processing after the retry budget is exhausted. DLQs prevent silent data loss, allow human investigation of edge cases, and enable safe replay once the root cause is fixed. A DLQ-less payment system is one outage away from losing transactions.
A cryptographic message-authentication code computed by hashing a payload together with a shared secret. Used to prove that a webhook or API request originated from the expected sender and has not been tampered with in transit. Kaadxpay signs every outbound webhook with HMAC-SHA256 over the JSON body plus a timestamp; receivers verify the signature before processing.
The property that performing the same operation multiple times produces the same effect as performing it once. In payment APIs, achieved by attaching a unique idempotency key to each request — the server caches the first response and returns it for any subsequent request with the same key, preventing duplicate charges from retries, network blips or client-side bugs.
A TLS variant where both client and server present and verify certificates, providing two-way cryptographic identity. Stronger than one-way TLS (where only the server is authenticated) and standard for bank-grade API connections in ASEAN. Kaadxpay supports mTLS for sensitive endpoints (settlement, payout, beneficiary management).
A retry strategy where the wait between attempts grows exponentially (e.g. 1s, 2s, 4s, 8s, 16s, plus jitter), capped at a maximum and a total retry budget. Prevents thundering-herd amplification of upstream outages and gives stressed systems time to recover. Always paired with idempotency keys when used for state-changing payment operations.
Replacing sensitive data (typically a primary account number / PAN) with a non-sensitive surrogate value (a "token") that maps back to the original only via a secure vault. Reduces PCI-DSS scope (most merchant systems never see raw card numbers) and limits blast radius if a downstream system is breached.
An HTTP callback delivered from a server to a customer-controlled endpoint when a relevant event happens (payment succeeded, settlement landed, dispute opened). The push-vs-poll alternative; far more efficient than periodically polling an API. Production-grade webhooks must include HMAC signing, retries with backoff, a DLQ, and idempotent receiver logic.
§ 5
Cambodia's central-bank-issued instant payment system, launched by the National Bank of Cambodia in 2020. Cleared in both KHR and USD (reflecting Cambodia's dual-currency reality), live cross-border with Thailand (PromptPay) since 2024 and Lao PDR. One of the world's first production retail CBDC-adjacent systems.
Malaysia's national instant payment system operated by PayNet on behalf of Bank Negara Malaysia. Includes DuitNow Transfer (account-to-account), DuitNow QR (interoperable merchant QR) and DuitNow AutoDebit (recurring). Live cross-border with Singapore (PayNow QR) since 2024 and Thailand (PromptPay QR) since 2024.
Hong Kong's instant payment system, launched by HKMA in 2018. Supports HKD and CNY clearing, addressable by mobile, email, FPS ID or account number, 24/7/365 real-time. Reach is universal among HK retail banks plus major SVF wallets (AlipayHK, WeChat Pay HK).
Malaysia's long-standing bank-redirect online-banking payment rail (analogous to Indonesian VA or Thai bill payment, but addressed to Malaysian banks). Still meaningful share of MY e-commerce checkout, particularly for higher-ticket transactions where consumers prefer the bank-redirect flow over QR.
The Philippines' dominant mobile wallet (operated by Mynt, a partnership between Globe Telecom, Ant Group and Ayala). Roughly 90M+ registered users, near-universal merchant acceptance via QR Ph, deep BSP-regulated remittance receive partner. Inseparable from any Philippines payment design in 2026.
Vietnam's instant interbank transfer rail, operated by NAPAS (National Payment Corporation of Vietnam). 24/7 real-time, ~95% Vietnamese bank coverage, per-transaction limits typically VND 500M (~USD 20K). Underlies most "send to bank" flows in Vietnam.
Hong Kong's contactless-card system, originally launched in 1997 for the MTR transit network, now ubiquitous for retail micropayments. Stored-value (offline-capable), with online top-up. ~13M cards issued (more than Hong Kong's population — many users hold multiple). O! ePay extends Octopus into online and P2P flows.
Singapore's national instant payment system, operated by ABS. Addressable by mobile, NRIC, UEN or QR; 24/7 real-time; mandatory across MAS-regulated retail banks and major payment institutions. Live cross-border with India (UPI), Thailand (PromptPay), and Malaysia (DuitNow QR).
Thailand's national instant payment system, operated by NITMX on behalf of BoT and Thai banks. Addressable by national ID, mobile number, e-wallet ID or business tax ID. Roughly 70M registered users (out of 71.7M total population). Live cross-border with Singapore (PayNow), Malaysia (DuitNow QR), Indonesia (QRIS), Vietnam (NAPAS QR) and Cambodia (Bakong) — the most-connected ASEAN rail.
Indonesia's unified merchant QR standard, mandated by Bank Indonesia in 2019. Interoperable across all participating banks and wallets (GoPay, OVO, DANA, ShopeePay ID, LinkAja). Acceptance is essentially universal for QR-receiving merchants. Live cross-border with Thailand (PromptPay) since 2022 and Malaysia (DuitNow) since 2024.
Vietnam's unified merchant QR standard, launched by NAPAS in 2022 and now mandatory for QR-receiving merchants. Interoperable across all participating banks and major wallets (MoMo, ZaloPay, VNPay, ViettelPay). Live cross-border with Thailand (PromptPay) since 2025; Cambodia (Bakong) in pipeline.
MISSING A TERM?
If a payment, regulation or ASEAN-rail term is missing, tell us — we'll add it in the next revision.
Suggest a termOur insights cover the same topics in depth — corridor deep-dives, regulation explainers, and engineering posts on the rails behind cross-border money.