Tier-2 Checklist

Tier-2 PSP partners (external banks / acquirers) follow this checklist before go-live. Tier-1 internal PSPs follow a separate, broader checklist managed by the Kesles integration team.

Scope

Tier-2 = external bank PSP with read-only access to merchants whose NMID is issued by that acquirer. Write endpoints (NMID assignment) are restricted to Tier-1.

Legal & Commercial

• NDA signed by both parties
• Commercial contract signed (bank code, fees, settlement window agreed)
• Technical PIC + Business PIC nominated and shared with Kesles
• Data Processing Agreement (DPA) signed if applicable

Network & Security

• Production IP range provided (CIDR) and added to Kesles allowlist
• Staging IP range provided (broader range OK for development)
• HMAC credentials received via 1Password / Bitwarden (never email)
• Credential storage hardened on the bank side — secrets vault, not config file
• 90-day rotation reminder scheduled (with 7-day grace)

Integration

• Signature computation verified locally against staging
• Lookup API — GET /api/psp/v1/merchants/by-nmid/{nmid} returns 200 on staging
• Events API — POST /psp/v1/events returns the expected ack on staging
• Timestamp freshness check (±300 seconds) implemented on bank side
• Exponential backoff implemented for 5xx and 429
• Idempotency verified — same external_event_id returns {"status":"duplicate_skipped"} (HTTP 200)
• Webhook receiver implemented + signature verification working
• All 12 test cases in Sandbox & Testing Guide pass

Operational

• Runbook for credential rotation in place on the bank side
• Incident escalation path documented (who to contact, SLA)
• Monitoring + alerts wired for: 4xx spike, 5xx spike, signature failures
• UAT sign-off from Kesles technical PIC

Go-Live

• Production credentials enabled by Kesles
• First production lookup successful (smoke test against a known NMID)
• First production event forward successful
• Bank confirms expected response times and rate-limit headroom

Onboarding contact: partner@kesles.com.