Non-profit corporates​

Whether you can create a corporate with a companyType of NON_PROFIT_ORGANISATION now depends on the regulatory financial institution behind your programmeProgrammeA programme represents your application within Weavr. Everything you create - customers, instruments, and transactions - sits beneath a programme. When you register as an Embedder, you receive a programme in the Sandbox and, once approved, one in Live. A programme is not a Workspace: a workspace is your company's account, and it can hold several programmes.. Previously, non-profits had to be registered in Germany on every programmeProgrammeA programme represents your application within Weavr. Everything you create - customers, instruments, and transactions - sits beneath a programme. When you register as an Embedder, you receive a programme in the Sandbox and, once approved, one in Live. A programme is not a Workspace: a workspace is your company's account, and it can hold several programmes..

Depending on that institution, your programmeProgrammeA programme represents your application within Weavr. Everything you create - customers, instruments, and transactions - sits beneath a programme. When you register as an Embedder, you receive a programme in the Sandbox and, once approved, one in Live. A programme is not a Workspace: a workspace is your company's account, and it can hold several programmes. now accepts non-profits from any country it supports, from Germany only, or not at all. ProgrammesProgrammeA programme represents your application within Weavr. Everything you create - customers, instruments, and transactions - sits beneath a programme. When you register as an Embedder, you receive a programme in the Sandbox and, once approved, one in Live. A programme is not a Workspace: a workspace is your company's account, and it can hold several programmes. regulated by Paynetics keep the Germany-only rule. Contact our support team to confirm which applies to your programmeProgrammeA programme represents your application within Weavr. Everything you create - customers, instruments, and transactions - sits beneath a programme. When you register as an Embedder, you receive a programme in the Sandbox and, once approved, one in Live. A programme is not a Workspace: a workspace is your company's account, and it can hold several programmes..

When a non-profit isn't allowed, POST /corporates returns a 409 with COMPANY_TYPE_UNSUPPORTED. An unsupported registrationCountry still returns COUNTRY_UNSUPPORTED first.

Fixes​

• When a merchant tops up a pre-authorization, such as at a fuel pump or hotel, the top-up is now recorded on the same card payment as the original pre-authorization instead of as a separate payment.
• A transfer is no longer marked FAILED when an internal call times out before its outcome is known. It completes or fails once the outcome is confirmed.

• For some outgoing wire transfersWire TransferA transaction that moves funds between accounts. An incoming wire transfer moves funds from a third-party bank account to a Weavr managed account, while an outgoing wire transfer moves funds from a Weavr managed account to a third-party bank account. Wire transfers require the managed account to have an assigned IBAN (for EUR) or sort code and account number (for GBP)., our banking partner only accepts a limited character set and lines of up to 35 characters. We now adapt the beneficiaryBeneficiaryA trusted recipient for payments that includes both information about the business or individual as well as their bank account or instrument details. When using trusted beneficiaries, customers may be allowed to skip Strong Customer Authentication (SCA) when executing Outgoing Wire Transfer or Send transactions, reducing the number of approval steps required. Now referred to as a Trusted Payee. name, address, and payment reference to fit instead of the transfer failing: we drop accents, replace unsupported characters, and shorten lines that are too long. Transfers to a beneficiaryBeneficiaryA trusted recipient for payments that includes both information about the business or individual as well as their bank account or instrument details. When using trusted beneficiaries, customers may be allowed to skip Strong Customer Authentication (SCA) when executing Outgoing Wire Transfer or Send transactions, reducing the number of approval steps required. Now referred to as a Trusted Payee. with no address also no longer fail.

Card payment amounts and fees​

• displayAmount now follows a partial release of an authorization down to the amount still held, as documented. Previously it kept the first authorized amount.
• Platform fees on card payment events now report the fee charged to the cardholder. Previously they could report the scheme interchange, which the cardholder doesn't pay. Original credit events now carry their fees with the other_fees subtype.

Available to spend on debit cards​

Authorization webhooks for debit cards now report the correct availableToSpend when the spend limit is in a different currency from the card.

Corporate onboarding​

• Creating a corporate for an existing root userRoot userThe individual who creates the customer. For corporates, the root user needs to be a legal representative of the company, such as a director or someone with power of attorney. For consumers, the root user is the customer. Every customer must always have one root user., by passing rootUser.id, no longer requires that user's email address to be verified.
• When a corporate user is linked to a director verified during KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers., the user's date of birth is now set to the KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers.-verified one.

Fixed​

• Fixed an issue on Android where dismissing the provisioning flow could cause it to reopen by itself

Added​

• Added visibilityIconTint and isVisibilityButtonEnabled props to SecurePasswordTextField to customize the native password-visibility toggle button, added in Android v3.15.0 and iOS v3.9.0
• Added onTextEntryComplete event to SecureSegmentedPasscodeTextField
• Added 3/4-digit shorthand hex support (e.g. #fff, #f0f8) to iOS's shared hex color parsing, used by all color props across the components

Changed​

• Bumped Android secure components SDK to 3.15.+
• Bumped iOS WeavrComponents dependency to ~> 3.9.0

Fixed​

• Fixed iOS SecureSegmentedPasscodeTextField's onTextEntryComplete event not firing

Added​

• Added visibilityIconTint and isVisibilityButtonEnabled props to SecurePasswordTextField to customize the native password-visibility toggle button, added in Android v3.15.0 and iOS v3.9.0
• Added onTextEntryComplete event to SecureSegmentedPasscodeTextField
• Added 3/4-digit shorthand hex support (e.g. #fff, #f0f8) to iOS's shared hex color parsing, used by all color props across the components

Changed​

• Bumped Android secure components SDK to 3.15.+
• Bumped iOS WeavrComponents dependency to ~> 3.9.0

Fixed​

• Fixed iOS SecureSegmentedPasscodeTextField's onTextEntryComplete event not firing

Fixed​

• Fixed Android provisioning sometimes starting again unexpectedly after returning from the Google Wallet app
• Fixed Android provisioning sometimes getting stuck and never completing if the app was closed by the system while provisioning was in progress

Where to find your pages​

The Home page also has shortcuts to your programmeProgrammeA programme represents your application within Weavr. Everything you create - customers, instruments, and transactions - sits beneath a programme. When you register as an Embedder, you receive a programme in the Sandbox and, once approved, one in Live. A programme is not a Workspace: a workspace is your company's account, and it can hold several programmes.'s pages. Available pages depend on your programmeProgrammeA programme represents your application within Weavr. Everything you create - customers, instruments, and transactions - sits beneath a programme. When you register as an Embedder, you receive a programme in the Sandbox and, once approved, one in Live. A programme is not a Workspace: a workspace is your company's account, and it can hold several programmes., environment, and permissions.

Fixed​

• Encrypted storage key generation race — fixed a race in EncryptedSharedPreferencesStore where concurrent key generation for the same Keystore alias could leave encrypt/decrypt calls bound to inconsistent key state, intermittently surfacing as UXComponents need to be initialised right after an app data clear.

Added​

• Password visibility toggle — SecurePasswordEditText now supports a show/hide button via the new isVisibilityButtonEnabled property (app:showVisibilityButton, defaults to false) and isPasswordVisible property. Toggling visibility only changes presentation - the field's text accessors and accessibility services still never expose the entered password.
• Visibility icon tint — added visibilityIconTint (app:visibilityIconTint) to SecurePasswordEditText, to tint the show/hide icon.

Added​

• Password visibility toggle — SecurePasswordField now supports a show/hide button via the new isVisibilityButtonEnabled property (defaults to false) and isPasswordVisible property. Disabling the button forces the password back to hidden. Toggling visibility only changes presentation - the field's text accessors still never expose the entered password.
• Visibility icon tint — added visibilityIconTint to SecurePasswordField, to color the show/hide icon independently of the field's tintColor. When not set, the icon follows tintColor.

Fixed​

• Disabling copy-to-clipboard on a secure label now removes the corresponding gesture handler, and enabling it repeatedly no longer adds duplicate handlers.

Security​

• Clipboard auto-clear for copied values — values copied from secure labels now expire from the device clipboard after 2 minutes and no longer sync to other Apple devices through Universal Clipboard.
• Prevented embedding applications from intercepting entered characters through a replacement text field delegate or accessibility value.

PDF statements​

Two new endpoints return a statement as a PDF: GET /managed_accounts/{id}/statement/pdf and GET /managed_cards/{id}/statement/pdf.

• Pass an IANA timezone, such as Europe/Rome, to render every date and time in your end customer's timezone. The PDF states which timezone it uses, and defaults to UTC.
• startPeriod and endPeriod are yyyy-MM-dd dates, resolved to local midnight in that timezone.
• The PDF contains every entry in the period rather than a single page. A period longer than 12 months, or containing more than 5,000 entries, returns a 400.

Requesting the existing statement endpoints with Accept: application/pdf is deprecated but continues to work. The JSON response isn't deprecated.

Online and wallet payments continue through a card renewal​

When a physical cardPhysical CardA payment card that is printed or embedded in wearables and sent to customers directly. Physical cards are created by first creating a virtual card and then upgrading it to a physical card. They are sent in an inactive state and must be activated by the card assignee before first use. is renewed and the old card reaches its expiry date before the new card is activated, we now restrict the card to virtual usage with the renewed details instead of leaving it unusable. Online and wallet payments keep working, and activating the new card restores full usage.

This needs no changes to your integration.

One KYB run per regulatory financial institution​

Each corporate now has a single KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers. run per regulatory financial institution in kybRuns[]. Starting KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers. again before approval, or after a rejection, reuses that run, and re-opens it if it was canceled, instead of creating a new one. Provider events no longer create additional runs.

Every run has a runType of INITIAL_ONBOARDING. REFRESH isn't currently returned.

Refunds linked to the original purchase​

Merchant refunds that arrive separately from the purchase they refund now carry relatedCardPaymentId, pointing to that purchase. If we can't identify the original purchase with confidence, the refund isn't linked.

Changed​

• Bumped Android secure components SDK to 3.14.0
• Restricted the Sumsub Maven repository to the com.sumsub.sns group and removed the now-unused JitPack and GitLab repositories

Fixed​

• Fixed Android Function blocks (startKyc, updateAccessToken, clearCache, initializePSA, setAppCheckToken) missing an explicit return@Function, letting Kotlin infer a mismatched lambda return type from a trailing log call and break the JS bridge on Expo 56 and newer.
• Fixed iOS fontStyle prop not registered on ExpoSecurePasscodeTextField, ExpoSecurePasswordTextField, ExpoSecurePinTextField and ExpoSecureSegmentedPasscodeTextField, so font style set from JS was silently ignored

Security​

• Clipboard auto-clear for sensitive values — values copied from secure fields (CVVCVV (Card Verification Value). Card Verification Value - the 3-digit security code printed on a payment card, used to authenticate card-not-present transactions. Weavr returns CVV in tokenized form on `GET /managed_cards/{id}` (with a stepped-up token); the value is only detokenized inside the SDK's secure CVV display component., card number, PINPIN (Personal Identification Number). Personal Identification Number - the numeric code a cardholder enters to authorize chip-and-PIN purchases and ATM withdrawals. PIN is only present on physical managed cards. Weavr returns it tokenized on `GET /managed_cards/{id}` (with a stepped-up token), and the SDK detokenizes it inside a secure PIN display component.) are now automatically cleared from the clipboard after 2 minutes, or as soon as the clipboard content changes. Copy confirmation labels are also now localized.

Changed​

• Standardized step-up copy — the step-up screens for each SCASCA (Strong Customer Authentication). Strong Customer Authentication - a two-factor authentication solution required by PSD2 regulations for when end-users are accessing their payment account sensitive information or initiating transactions. SCA requires at least two of the following: something you know (password), something you have (device), or something you are (biometrics). flow (login, payment authorization, beneficiaryBeneficiaryA trusted recipient for payments that includes both information about the business or individual as well as their bank account or instrument details. When using trusted beneficiaries, customers may be allowed to skip Strong Customer Authentication (SCA) when executing Outgoing Wire Transfer or Send transactions, reducing the number of approval steps required. Now referred to as a Trusted Payee. management, password fallback) now use distinct, consistent copy across all supported languages.
• Hardened error response parsing — malformed error payloads from the backend no longer crash the SDK.

Fixed​

• Close button color on biometric enrollment/OTP screens — the close button on the biometric enrollment consent and OTP screens no longer renders in the app's decline color, which could appear red for apps with a red declineTextColor. It now correctly uses the app's text color.
• PSAPSA (Push Step-up Authentication). Push Step-up Authentication - the mechanism in our mobile SDKs that delivers a step-up challenge to an enrolled device as a push notification and verifies it with the user's device biometrics. PSA covers device enrollment, biometric login, and biometric verification of SCA challenges for sensitive operations such as outgoing wire transfers or accessing card details. Exposed as `UXComponents.psa` on iOS and Android and via `initializePSA` on React Native. flow cancellation — fixed the PSAPSA (Push Step-up Authentication). Push Step-up Authentication - the mechanism in our mobile SDKs that delivers a step-up challenge to an enrolled device as a push notification and verifies it with the user's device biometrics. PSA covers device enrollment, biometric login, and biometric verification of SCA challenges for sensitive operations such as outgoing wire transfers or accessing card details. Exposed as `UXComponents.psa` on iOS and Android and via `initializePSA` on React Native. flow swallowing coroutine cancellation, so it now propagates correctly (e.g. when a hosting screen is dismissed mid-flow).

Changed​

• Bumped Android secure components SDK to 3.14.0
• Restricted the Sumsub Maven repository to the com.sumsub.sns group and removed the now-unused JitPack and GitLab repositories

Fixed​

• Fixed Android Function blocks (startKyc, updateAccessToken, clearCache, initializePSA, setAppCheckToken) missing an explicit return@Function, letting Kotlin infer a mismatched lambda return type from a trailing log call and break the JS bridge on Expo 56 and newer.
• Fixed iOS fontStyle prop not registered on ExpoSecurePasscodeTextField, ExpoSecurePasswordTextField, ExpoSecurePinTextField and ExpoSecureSegmentedPasscodeTextField, so font style set from JS was silently ignored

Changed​

• Bumped Android push provisioningPush ProvisioningA method that allows cardholders to add their card to a digital wallet (such as Apple Pay or Google Pay) directly from your app. The card details are securely tokenized and sent to the wallet provider, streamlining the process and enhancing the user experience compared to manual provisioning. This feature is currently in beta. SDK to 2.2.0 to fix a version conflict with the components SDK's analytics dependency
• Cleaned up Android transitive dependencies.

Added​

• Added support for Unified Push ProvisioningPush ProvisioningA method that allows cardholders to add their card to a digital wallet (such as Apple Pay or Google Pay) directly from your app. The card details are securely tokenized and sent to the wallet provider, streamlining the process and enhancing the user experience compared to manual provisioning. This feature is currently in beta. for Google Pay.

Changed​

• initializeWeavrSDK() now throws if it's called again while initialization is already in progress.

Fixed​

• Fixed a case where coroutine cancellation could be swallowed instead of propagated.

Users who operate across multiple corporates​

An individual can now belong to more than one corporate using a single set of login credentials, as the Root UserRoot userThe individual who creates the customer. For corporates, the root user needs to be a legal representative of the company, such as a director or someone with power of attorney. For consumers, the root user is the customer. Every customer must always have one root user. of one corporate and/or a non-root userRoot userThe individual who creates the customer. For corporates, the root user needs to be a legal representative of the company, such as a director or someone with power of attorney. For consumers, the root user is the customer. Every customer must always have one root user. of others, instead of needing a separate, duplicate account per corporate.

Switching access to another corporate doesn't require signing in again: the current access token simply needs to be exchanged for one scoped to another corporate, and a stepped-up (SCASCA (Strong Customer Authentication). Strong Customer Authentication - a two-factor authentication solution required by PSD2 regulations for when end-users are accessing their payment account sensitive information or initiating transactions. SCA requires at least two of the following: something you know (password), something you have (device), or something you are (biometrics).) session carries across the exchange. The result is one seamless sign-in for end users who operate across several CorporatesCorporates (Corporate Identity). Business entities that can be onboarded as customers on Weavr. Corporate customers represent companies and require Know Your Business (KYB) verification. They can have multiple authorised users and issue cards to card assignees..

This is a non-breaking change and needs no additional configuration to enable.

See Get an access token and Give a user access to another corporate for the API flows.

Clearer KYB status and run information​

We've simplified how KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers. status is communicated across the API and webhooks. Instead of reading the effective kybStatus and ongoing ongoingKybStatus fields together, use corporateKybStatus as the single lifecycle status for a corporate's acceptance to use financial services:

• NEW
• PENDING
• APPROVED
• REJECTED
• CLOSED

The deprecated kybStatus maps to the new status as follows:

CLOSED now shows when the corporate account is closed, which kybStatus never reported. REJECTED describes the latest outcome, not the corporate's complete KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers. history.

GET /corporates/kyb returns every KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers. run in kybRuns[]. Each run has its own ID, identifies whether it is initial onboarding or a KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers. refresh, and exposes detailed progress including collection, review, resubmission, approval, rejection, and cancellation. This helps you show end customers where they are in the KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers. process.

These fields are included in GET /corporates/kyb, the corporate KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers. status webhook, and the Identity Activated and Identity Deactivated webhooks. Webhook events include the latest run for each regulatory financial institution.

For managed-onboarding programmesProgrammeA programme represents your application within Weavr. Everything you create - customers, instruments, and transactions - sits beneath a programme. When you register as an Embedder, you receive a programme in the Sandbox and, once approved, one in Live. A programme is not a Workspace: a workspace is your company's account, and it can hold several programmes., COLLECTION.READY_TO_START is the new signal that a corporate can begin KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers.. Until Weavr finishes preparing the case, Start KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers. returns MANAGED_ONBOARDING_PENDING. When preparation completes, the KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers. status webhook reports PENDING and COLLECTION.READY_TO_START; Start KYBKYB (Know Your Business). Know Your Business - the identity verification process for corporate customers. This process allows you to securely verify your business customer's identity. Weavr asks users to submit the information and documentation they need for approval by financial providers. then succeeds.

This is additive and non-breaking. kybStatus, ongoingKybStatus, status, ongoingStatus, and details are deprecated but remain populated. They derive from the same data as the new fields, so the old and new payloads cannot conflict. Existing corporatesCorporates (Corporate Identity). Business entities that can be onboarded as customers on Weavr. Corporate customers represent companies and require Know Your Business (KYB) verification. They can have multiple authorised users and issue cards to card assignees. require no migration.

Update your integration to read corporateKybStatus and kybRuns[] when you're ready. See Corporate due diligence and KYB and corporate webhook events for the full flow.

Fix to Managed Account IBAN upgrade​

Managed AccountManaged AccountAn account held at a financial institution that can be created and managed through the Weavr platform. Each account has a balance where customers can hold funds. Optionally, an IBAN can be assigned to enable wire transfers to bank accounts outside of Weavr. IBANIBAN (International Bank Account Number). International Bank Account Number - a standardized international bank account identifier. Managed accounts can be assigned an IBAN to enable wire transfers to and from bank accounts outside of Weavr. IBANs are required for EUR accounts and enable SEPA transfers. upgrade no longer returns ALLOCATED when bankAccountDetails are not yet available from async IBANIBAN (International Bank Account Number). International Bank Account Number - a standardized international bank account identifier. Managed accounts can be assigned an IBAN to enable wire transfers to and from bank accounts outside of Weavr. IBANs are required for EUR accounts and enable SEPA transfers. providers.

In line with our existing documentation, the response will be PENDING_ALLOCATION until bank details are ready to use. An account update webhook is sent with state UPDATED which will contain the bankAccountDetails. Once this is updated, the GET /managed_accounts/{id}/iban endpoint can also be called and will return the ALLOCATED status (along with the same bankAccountDetails).

Changed​

• WeavrComponents is now distributed as an Apple mergeable library (MERGEABLE_LIBRARY = YES), allowing Xcode to merge it directly into the app binary at build time instead of always embedding it as a separate dynamic framework. This can improve app launch time and reduce app size.

Fix​

• Fixed cannot link directly with 'SwiftUICore' because product being built is not an allowed client of it, which occurred when an app extension (for example, an Autofill or Wallet extensionWallet ExtensionAn iOS app extension that integrates an issuer app with Apple Wallet. The UI Wallet Extension provisions a card from the issuer app into Wallet (the in-app provisioning flow). The Non-UI Wallet Extension exposes the issuer's card-management actions (such as 'View card details') from inside Wallet itself. Apple requires both for a primary issuer-app integration.) statically linked WeavrComponents. Being a mergeable library lets Xcode merge the framework into the extension's binary instead of requiring a direct link against SwiftUICore.

Courier-only delivery for US physical cards​

Physical cardsPhysical CardA payment card that is printed or embedded in wearables and sent to customers directly. Physical cards are created by first creating a virtual card and then upgrading it to a physical card. They are sent in an inactive state and must be activated by the card assignee before first use. shipped to a US address must now be sent by courier only.

POST/managed_cards/{id}/physical now validates that when deliveryAddress.country is US, deliveryMethod must be COURIER. Requests specifying any other delivery method for a US address are rejected with a 400 error. Delivery to non-US addresses is unaffected.

See physical cards for the full request details.

Suppress the password-changed alert email per programme​

We send end-users a "Your password has been changed" security notification email whenever their password is changed. This is the correct default behaviour for user-initiated changes, but creates noise if you are managing users on your own embedderEmbedder (Embedded Finance Provider). A company or developer that integrates Weavr's embedded finance services into their own application to provide financial services to their end customers.-corporate.

You can now turn off this automated email for your programmeProgrammeA programme represents your application within Weavr. Everything you create - customers, instruments, and transactions - sits beneath a programme. When you register as an Embedder, you receive a programme in the Sandbox and, once approved, one in Live. A programme is not a Workspace: a workspace is your company's account, and it can hold several programmes.. Contact your Weavr account representative or open a support ticket to configure it.

Added​

• Added identity, credentials and requiresTokenExchange to WeavrSecureLoginData to support the Single User Multiple Identities (SUMI) token exchange flow

Changed​

• Updated iOS WeavrComponents dependency to 3.8.0
• Updated Android WeavrComponents dependency to 3.13.1