Standards and compliance
Mapped to what you are inspected against
Every control in Recondora is mapped to the standards and rules customers are audited and inspected against, so compliance evidence comes out of daily operation. Mapping is not certification: SMH claims no certification until it has been independently audited.
| Family | Standards and rules | What Recondora provides |
|---|---|---|
| Payment messages and data | ISO 20022; Swift MT and CBPR+; ISO 8583 card messages; ISO 4217, ISO 9362 (BIC), ISO 13616 (IBAN), ISO 17442 (LEI); National switch formats | Parsers and templates per standard; structured-address readiness; three-decimal currencies. |
| Card schemes | Visa Rules; Mastercard Rules; UnionPay, American Express, JCB; mada, PayPak, Jaywan, Meeza and other domestic schemes; EMVCo specifications | Clearing and settlement reconciliation, dispute clocks per scheme rules, fee and interchange checks. |
| Payment card security | PCI DSS v4.0.1; PCI PIN Security; PCI Secure Software Standard v2.0 | No full card numbers stored, so card data scope stays small; secure development lifecycle. |
| Information security | ISO/IEC 27001:2022; NIST CSF 2.0; NIST SP 800-63-4; CIS Controls; OWASP ASVS 5.0; Swift Customer Security Programme; AICPA SOC 2 | Control library mapped to each framework; evidence exported per audit. |
| Internal control, audit and reporting | COSO; COBIT 2019; IIA Global Internal Audit Standards; Basel operational resilience principles; IFRS 9, 15 and 17; AAOIFI | Maker-checker, segregation of duties, hash-chained audit log, evidence packs, sign-off registers. |
| Financial crime | FATF Recommendations; National AML/CFT laws; UN and other sanctions programmes | Alerts on clustered breaks; suspense and dormant-balance reporting; hand-off to the customer's screening system. |
| Data protection | Saudi PDPL (SDAIA); UAE federal, DIFC and ADGM laws; Egypt Law 151 of 2020; Bangladesh Personal Data Protection Ordinance 2025; Sri Lanka PDPA 2022; EU GDPR where it applies | Data residency per tenant, masking, retention and data-subject request support. |
| Regulator frameworks | SAMA Cyber Security Framework; NCA ECC-2:2024; SBP Cyber Shield 2025-2030; SBP Regulations for Payment Card Security; Bangladesh Bank ICT Security Guideline v4.0 | Control mappings and regulatory returns in each country pack. |
| The customer's own policies | Reconciliation, suspense and write-off; Delegation of authority; Records retention and information classification; Outsourcing, continuity and fraud | The company layer maps each policy clause to a configured control and its evidence. |
Links go to the publishers' official pages. Names belong to their owners; Recondora is not affiliated with or endorsed by any of them.
Country rules live in country packs
Each country pack lists the official regulations and scheme rules it implements, with version and effective date, and the configuration screen shows them next to the settings they govern. A new circular becomes a pack version with its own test evidence.
See it with your own files.
Book a walkthrough: we load sample files from two of your rails, run them through Recondora and show you every match, break and approval.