Request
A merchant states the transaction purpose and requests consent from the relevant customer.
Consent Policy — implementation draft
Consent must be informed, specific and verifiable.
Verification
OTP verifies consent. Plaintext OTP must never be stored or shown to staff.
Control
Expiry, revocation and permitted use must follow the final production policy and applicable law.