Administration
Business verification
Why and how CentraPoint verifies every business (KYB) before it can accept live payments: required documents, statuses, the sandbox-only restriction and the compliance_required API error.
On this page
Overview#
Card schemes, banks and South African law (FICA) require us to know every business that collects money through CentraPoint. New accounts therefore start unverified: you can explore everything with test (sandbox) gateways straight away, and live payments unlock once our team has approved your business documents. Approval usually takes 1-2 business days after you submit.
Organisations created before business verification existed were approved automatically. Internal GSS applications do not need verification.
What works before approval#
| Allowed | Blocked until approved |
|---|---|
| Sandbox (test mode) gateways: payment links, invoices, hosted checkout, subscriptions and EFT orders that pay through them | Enabling a gateway with Sandbox / test mode switched off |
| Customers, products, packages, invoices, coupons, reports, users, API keys | Live checkouts, stored-card charges and EFT orders on a live EFT gateway |
| Debit order set-up on a sandbox Netcash account | Live debit order mandates and collection batches |
| Paying your own CentraPoint subscription | - |
Payers only see gateways you are allowed to use. While you are unverified your live gateways are hidden from payment pages, and the dashboard shows a banner with your verification status.
Verifying your business#
- Go to Settings → Compliance (new accounts are taken there after sign-up).
- Fill in the business details: business type, registered name, registration and VAT numbers, contact details and address, and the representative (a director, owner, trustee or authorised signatory) with their SA ID or passport number. Click Save details; the business type decides which documents you need.
- Upload the documents (PDF, PNG or JPEG; up to 10 MB per upload - upload in more than one go if needed). A new file for a document replaces the previous one unless it was already accepted.
- Tick the declaration, type your full name to sign it and click Submit for review. We email you when the review starts and when it is done.
Required documents#
Every business uploads:
- ID of the director / owner / signatory - SA ID (both sides of a smart card) or passport.
- Business proof of address - utility bill, lease or municipal account in the business name, not older than 3 months.
- Bank confirmation letter - bank-stamped letter or statement in the business name, not older than 3 months.
| Business type | Also required | Optional |
|---|---|---|
| Sole proprietor | - | - |
| Private company (Pty) Ltd, Close corporation, Public company | CIPC registration certificate (CoR14.3 / CK1) | - |
| Non-profit company (NPC) | CIPC registration certificate | NPO / PBO certificate |
| Trust | Trust deed, and letters of authority (upload as Other supporting document) | - |
| Partnership | Partnership agreement | - |
| Other | - | CIPC registration certificate |
A VAT registration certificate is required when you enter a VAT number. A tax compliance status (TCS) PIN letter and other supporting documents are always optional.
Number formats#
| Field | Format |
|---|---|
| Company registration number (CIPC) | YYYY/NNNNNN/NN |
| VAT number | 10 digits starting with 4 |
| Income tax reference | 10 digits |
| Representative ID | 13-digit SA ID (checked with the Luhn check digit) or a 5-20 character passport number |
Statuses#
| Status | Meaning | Can you edit? |
|---|---|---|
not_started | Nothing submitted yet. | Yes |
submitted | Waiting for review. | No |
in_review | Our team is checking your documents. | No |
changes_requested | Something needs fixing; see the reason and document notes. | Yes |
approved | Live payments are enabled. An approval may have a re-verification date. | No (re-verify once it expires) |
rejected | We could not approve the business. Contact support. | No |
API behaviour#
GET /api/v1/me includes the verification status, so integrations can show a helpful message:
"compliance": { "status": "in_review", "approved": false }While your business is not approved, requests that would start a live payment return 403 with compliance_required (see Errors). This applies to creating payment links or invoice pay links when your only gateways are live, EFT orders on a live EFT gateway, checkout sessions, customer subscriptions on a live gateway and debit order mandates on a live Netcash account. The same requests succeed with sandbox gateways.
{
"error": "compliance_required",
"message": "Your business verification is not approved yet. Complete it under Settings > Compliance. Until then you can only use test (sandbox) gateways."
}How documents are stored#
- File types are checked from the file contents, not the name. Only PDF, PNG and JPEG are accepted.
- Documents are encrypted at rest (AES-256-GCM) and a SHA-256 fingerprint of each file is kept.
- ID numbers are stored encrypted and shown masked. Every document view and ID reveal is written to the audit log.
- Documents are only visible to your account administrators and the CentraPoint verification team.
Who can manage it#
The compliance:read and compliance:write permissions (see Roles & permissions) are given to Admin users by default. Custom roles can grant them to others.