Only HABKPAY and HABKSUP can execute payment transactions - Only HABKPAY can UPDATE the payment file - All payment transactions write to the audit journal - PCI-DSS Requirement 10 compliance: every card data access logged