PSD-12, SmartPay, and step-up 2FA on every payment initiation

Mobile money and SmartPay expectations in Namibia converge on one user truth: paying should feel fast, but must be safe. Bank of Namibia supervisory material—including PSD-12 operational and cybersecurity standards—frames strong authentication on payment initiation, not merely at login. The NamPost Innovation Sandbox encodes that in API contracts and portal UX.

Why login-only MFA fails

Shared devices at counters, merchant phones, and USSD sessions mean login state is not payment intent. Step-up per PIS call closes the gap between “someone is signed in” and “someone authorised this debit.”

Sandbox enforcement

• POST /api/v1/nampost/bill-payment and NAMQR settle paths return 403 STEP_UP_REQUIRED without X-Step-Up-Token.
• Explorer modal: “Confirm it's you before paying.”
• Observation Deck tracks 2FA on PIS % (7d)—regulator KPI.

Product discipline

• Disclose fees before confirm (PSD-10 pattern in agency responses).
• Idempotent retries for USSD (Ndishi persona).
• Incident playbooks for auth gateway outages—status page at /status.

Builder path

1. Map money paths in your UX.
2. Wire step-up on each initiation.
3. Run INT scenarios with MFA simulator.
4. Submit progress reports with 2FA metrics.

Namibia's payments future is integrated—SmartCard, account-based, QR—under national standards. Execution quality wins.