How are PCI-DSS compliance responsibilities shared between Square and the Business Square Account holder?

For remittance businesses processing card payments via Square, understanding PCI-DSS compliance responsibilities is essential for security and regulatory adherence. Square, as a Level 1 PCI-DSS compliant service provider, manages the majority of technical and operational requirements—such as secure payment processing infrastructure, tokenization, encrypted data transmission, and regular third-party audits.

The Square Account holder (i.e., your remittance business) retains critical shared responsibilities. These include safeguarding login credentials, restricting physical and digital access to cardholder data, maintaining secure devices and networks, installing anti-virus software, and never storing prohibited data (e.g., full track data or CVV after authorization). Even when using Square’s secure tools, your internal policies, employee training, and network hygiene directly impact compliance.

Failure to uphold your portion of PCI-DSS obligations may expose your business to data breaches, fines, or termination of processing privileges—risks especially consequential in high-volume, cross-border remittance operations. Square provides resources like Security Guides and Self-Assessment Questionnaires (SAQ-A), but completing these accurately rests with you.

Staying compliant isn’t optional—it’s foundational to trust, licensing, and seamless global payouts. Partner confidently with Square while proactively managing your accountability: regularly review PCI-DSS requirements, conduct staff training, and audit internal practices quarterly. Doing so strengthens your remittance platform’s integrity—and your customers’ confidence.

Is two-factor authentication (2FA) mandatory for all admin users in a Business Square Account?

For remittance businesses operating on Business Square, security isn’t optional—it’s foundational. As financial transactions flow through your platform daily, safeguarding admin access is critical to prevent fraud, data breaches, and regulatory non-compliance.

Yes, two-factor authentication (2FA) is mandatory for all admin users in a Business Square Account. This requirement applies universally across remittance operators, regardless of business size or transaction volume. Enforcing 2FA ensures that even if passwords are compromised, attackers cannot gain unauthorized access without the second verification factor—typically a time-based OTP or authenticator app code.

This policy aligns with global AML/KYC standards and supports compliance with regulations like PCI DSS and local financial authority mandates. For remittance firms handling cross-border payments, robust identity verification directly mitigates risks tied to money laundering and account takeovers.

Business Square automatically enforces 2FA upon admin account creation and blocks login attempts without successful two-step verification. Admins cannot disable this feature—ensuring consistent, enterprise-grade protection across your team.

Strengthening admin security isn’t just about technology; it builds client trust and protects your brand reputation. In an industry where speed meets scrutiny, enforcing 2FA is both a regulatory necessity and a strategic advantage for remittance businesses.

How do I configure location-specific operating hours, service areas, or delivery zones in my Business Square Account?

Configuring location-specific operating hours, service areas, or delivery zones in your Business Square Account is essential for remittance businesses serving diverse geographic markets. Accurate settings ensure customers see real-time availability, eligibility, and estimated payout times—boosting trust and reducing support inquiries.

To configure these settings, log into your Business Square Account, navigate to *Settings > Location & Operations*, then select your branch or service hub. Here, you can define custom operating hours per time zone, assign service areas by ZIP/postal code or radius, and set dynamic delivery zones based on partner agent networks or cash pickup locations.

For remittance providers, precise zone configuration directly impacts compliance—restricting transactions in sanctioned or high-risk regions—and improves operational efficiency by auto-routing transfers to nearby payout partners. You can also schedule temporary holiday hours or regional service pauses without affecting other locations.

Business Square supports API-based sync with your core remittance platform, enabling automatic updates when your agent network expands or regulatory requirements change. Regular audits of these settings help maintain adherence to local financial regulations and enhance customer experience across borders.

Optimizing location-specific parameters isn’t just administrative—it’s a strategic lever for conversion, compliance, and scalability in global remittance operations. Start configuring today to deliver faster, safer, and more transparent cross-border payments.

Can I export raw sales and customer data in CSV/JSON format without requiring developer access?

For remittance businesses, accessing raw sales and customer data is critical for compliance reporting, financial reconciliation, and customer segmentation. The ability to export this data in standard formats like CSV or JSON—without developer intervention—empowers finance, operations, and compliance teams to act swiftly and independently.

Most modern remittance platforms now offer built-in self-service data export tools within their admin dashboards. These features allow authorized users to filter transactions by date range, currency, sender/receiver country, status (e.g., completed, failed), and even regulatory tags (e.g., SAR-flagged transfers). With one click, you can generate and download structured CSV or JSON files—no coding, no API keys, no IT ticket required.

This capability directly supports anti-money laundering (AML) audits, quarterly financial reviews, and real-time business intelligence. Exported data includes essential fields: transaction ID, timestamps, sender/receiver details, amounts, fees, FX rates, KYC verification status, and IP/device metadata—ensuring full traceability and audit readiness.

Before selecting a remittance solution, verify that its export functionality meets your jurisdiction’s data retention and format requirements (e.g., FATF guidelines or EU GDPR-compliant anonymization options). Prioritize platforms that support scheduled automated exports and role-based access controls to maintain security while enabling agility.

What support tiers (e.g., phone, chat, priority response) are included with different Business Square Account plans?

For remittance businesses relying on Square for seamless payment processing, understanding support tiers is critical to maintaining compliance, resolving transaction disputes quickly, and minimizing downtime. Square’s Business Account plans—Basic, Plus, and Premium—offer escalating levels of customer support tailored to operational scale and urgency.

The Basic plan includes email support with standard response times (1–2 business days) and access to online help resources—sufficient for low-volume remittance startups. The Plus plan adds live chat and priority email response (within 24 hours), ideal for growing fintechs handling cross-border payouts daily.

Premium subscribers receive 24/7 phone support, guaranteed response within 15 minutes for urgent issues (e.g., failed batch transfers or regulatory hold alerts), plus a dedicated account manager. This tier is essential for high-volume remittance providers needing real-time troubleshooting during peak settlement windows.

Unlike generic merchant accounts, Square’s remittance-friendly infrastructure integrates KYC verification, FX rate transparency, and audit-ready reporting—making responsive, knowledgeable support non-negotiable. Choosing the right tier directly impacts SLA adherence, sender satisfaction, and regulatory audit outcomes.

Before scaling, assess your average transaction volume, geographic coverage, and compliance complexity—then align your Square plan with support responsiveness that matches your operational rhythm. Optimize reliability without overpaying: many mid-tier remittance firms thrive on Plus, while enterprise corridors demand Premium.

How does Square handle GDPR or CCPA compliance requests (e.g., data deletion, access) for Business Square Account holders?

For remittance businesses operating in the EU or California, GDPR and CCPA compliance isn’t optional—it’s essential. Square supports Business Square Account holders by providing clear, self-serve tools to fulfill data subject requests. Account holders can access, export, or delete personal data directly via the Square Dashboard under “Account & Settings” > “Privacy.” This empowers remittance firms to respond promptly to customer access or deletion requests—critical when handling sensitive financial and identity data across borders.

Square’s Privacy Policy outlines its role as a data processor for business customers, meaning it acts on instructions from the remittance business (the data controller). When a customer submits a request to the remittance company, Square enables swift action through documented workflows and API endpoints for programmatic data management—ideal for high-volume cross-border payment operations.

Additionally, Square maintains SOC 2 Type II certification and adheres to PCI DSS standards, reinforcing trust in its data handling practices. Remittance providers leveraging Square’s ecosystem benefit from built-in compliance scaffolding—reducing manual overhead and audit risk. For full transparency, Square publishes its Data Processing Addendum (DPA), which includes GDPR-compliant clauses and CCPA-aligned commitments.

Staying compliant strengthens customer trust and avoids penalties—especially vital in regulated financial services. Partner with Square confidently: your remittance business gets scalable infrastructure *and* robust privacy safeguards.

Can I assign custom SKU-level cost of goods sold (COGS) tracking and margin reporting in the account?

For remittance businesses handling diverse cross-border payment products—such as cash pickups, bank deposits, and mobile wallet transfers—tracking profitability at the SKU level is critical. Unlike traditional retail, your “SKUs” may represent service types, corridors (e.g., USD to PHP), or delivery methods—each with distinct processing fees, FX spreads, compliance costs, and partner payouts.

Yes, you can assign custom SKU-level COGS tracking and margin reporting in modern accounting and fintech operations platforms. By mapping each remittance product variant to a unique SKU code, you can allocate direct costs—including FX loss, agent commissions, AML screening fees, and settlement charges—to that specific offering. This granular visibility reveals which corridors or channels are truly profitable—and which mask losses under aggregated revenue.

Accurate margin reporting empowers strategic decisions: optimizing pricing per corridor, renegotiating partner terms, or sunsetting low-margin services. Leading remittance platforms integrate with ERP or accounting tools (e.g., NetSuite, QuickBooks Online) via APIs to automate COGS assignment and real-time margin dashboards. Ensure your system supports custom cost attributes—not just inventory-based COGS—to reflect the service-oriented nature of your business.

Implementing SKU-level COGS tracking isn’t just best practice—it’s essential for regulatory transparency, investor reporting, and sustainable growth in competitive remittance markets.

What audit trail features exist to monitor changes made by team members (e.g., discount edits, refund approvals)?

For remittance businesses, maintaining transparency and regulatory compliance is critical—especially when handling sensitive financial actions like discount edits or refund approvals. Robust audit trail features ensure every change made by team members is securely recorded, time-stamped, and attributed to the responsible user.

Modern remittance platforms offer granular audit logs that capture who initiated a change, what was modified (e.g., amount, beneficiary details, fee waivers), when it occurred (down to the second), and the IP address or device used. These logs are immutable and tamper-proof, satisfying global AML/KYC and PCI-DSS requirements.

Advanced systems also support role-based filtering—allowing compliance officers to isolate edits by permission level—and integrate with SIEM tools for real-time alerts on high-risk activities (e.g., bulk refund approvals). Some platforms even provide exportable, PDF-auditable reports for internal reviews or regulator submissions.

By leveraging comprehensive audit trails, remittance firms reduce fraud risk, accelerate dispute resolution, and strengthen stakeholder trust. Choosing a solution with end-to-end traceability isn’t just best practice—it’s essential for operational resilience and license renewal in highly regulated markets.

 

 

About Panda Remit

Panda Remit is committed to providing global users with more convenient, safe, reliable, and affordable online cross-border remittance services。
International remittance services from more than 30 countries/regions around the world are now available: including Japan, Hong Kong, Europe, the United States, Australia, and other markets, and are recognized and trusted by millions of users around the world.
Visit Panda Remit Official Website or Download PandaRemit App, to learn more about remittance info.