How a FinTech group used Process Street to build the control framework behind a new Payment Institution licence — and to prove it was being followed
The Business
Magnus 1265 Ltd is a fintech business operating a card-present payment gateway and payment facilitator back-office software. It is certified to both PCI DSS and PCI PIN, two of the most demanding security standards in the card payments industry.
Elgar Payments Ltd is the group’s regulated arm: a payment institution authorised and supervised in Gibraltar.
The Challenge
Getting Elgar authorised meant satisfying a regulator that the business had real, working controls across every process that matters in a payment institution — customer onboarding, risk assessment, KYC review, transaction monitoring, vendor and partner management, and more.
That is a considerably higher bar than having the processes written down. A regulator does not simply ask whether a control exists. It asks who performed it, when, on what basis, who reviewed it, and where the record is. Demonstrating that a process exists is not the same as demonstrating that it is followed.
It was a trap the team had seen before.
“We didn’t want to fall into the trap that I think we’ve fallen into before, of getting lots of written processes down in a Word document. And then that Word document sits in a folder somewhere and nobody ever looks at it, and people just do the processes from memory anyway.”
— Chris Jamieson, CTO, Magnus Group
For a group already holding PCI DSS and PCI PIN certification, the pattern was familiar. Certification and authorisation turn on the same thing: evidence generated by the work itself, not assembled afterwards when someone comes asking.
The Approach
Rather than drafting procedures and hoping they were followed, the group built its core operational processes as Process Street workflows and made the platform the way the work actually gets done. Onboarding, risk assessment, KYC review, transaction monitoring and vendor and partner management all run as workflows the team must complete step by step, not as reference material consulted when someone remembers it exists.
The group also committed real resources to the implementation. A third-party consultant was engaged to work through informal SOPs and undocumented practice, turn them into workflows that reflect how the business genuinely operates, and make sure the team knew how to run them. Getting the most out of the platform was treated as a project in its own right rather than a side task.
Because the work happens inside Process Street, several things are captured automatically as a by-product of doing the job:
- Timestamps — showing when each step was completed.
- Separation of duties — showing that the person who performed a step was not the person who checked it.
- Managerial approvals — showing sign-off wherever the process required it.
- A complete run history — every instance of the process, retrievable on demand.
None of that is a reporting exercise. It is a record the process produces on its own.
The Result
The firm’s regulator conducted an on-site assessment of the firm, an important part of the regulatory application process. They asked to see how the business handles critical processes including onboarding, KYC and transaction monitoring. Elgar did not simply present a policy document and ask to be taken at its word. It showed the live processes, and the evidence that they had been followed.
“We’ve got these processes formalised within Process Street. We were able to show the timestamps, the separation of duties and the managerial approvals. It certainly helped us move through the process, and to demonstrate to the regulator that we’ve got our head screwed on.”
— Chris Jamieson, CTO, Magnus Group
Elgar Payments Ltd was granted its licence in April 2026. The group considers Process Street to have been an important enabler on that journey.
“An application of this kind is really a sustained test of whether your controls are genuine. Having onboarding, risk assessment, KYC review and transaction monitoring running as live workflows meant that when we were asked a question, we could answer it with the actual record rather than a description of what should have happened. That changes the character of the conversation with a regulator.”
— Yael Massias, Head of Compliance, Elgar Payments Ltd
Beyond the regulator, the everyday benefit comes from exactly the same mechanism:
“You’ve got to work through the checklist. You’ve got no option. You’ve got to tick the boxes, you’ve got to follow the steps. We definitely find that it reduces error and makes the team a lot more focused on the task at hand.”
— Chris Jamieson, CTO, Magnus Group
Why It Matters
For any regulated or certified business, the gap between a documented process and a followed process is where audit risk lives. Process Street closes that gap by making the completed record a by-product of the work itself, rather than something reconstructed later.
Magnus did not adopt Process Street in order to pass a regulatory application. It adopted the platform to stop the team working from memory. When the regulator asked, the evidence was already there.