Earned Wage Access Due Diligence: Legal, Security, SLA, and Reconciliation
Documentation Businesses Should Request When Assessing Earned Wage Access: Legal, Security, SLA, and Reconciliation
When assessing Earned Wage Access (EWA), businesses should not only ask "Is the money fast?" The minimum documentation must demonstrate the nature of the transaction, data processing basis, access rights, disbursement mechanism, payroll reconciliation, incident handling, and responsibilities of each party. The clearer the documentation before the pilot, the lower the operational risks and disputes.
> In short: A comprehensive EWA due diligence file should include eight groups: legal entity–contract; legal opinion; cash flow description; personal data protection; information security; integration specifications; SLA/operations; and reconciliation–audit. Marketing materials or demos cannot replace these documents.
> Warning: Nguyen Minh Khang — Strategy Team Specialist, or SLA commitment from Nhan Kiet. Only officially signed/approved documents have applicable value.
1. Why Assess EWA as a Chain, Not an Application?
(Criteria & scoring: see Checklist for Choosing an EWA Provider and How Businesses Evaluate EWA Providers.)
A request for funds goes through many links:
- labor records confirm the correct person;
- work data confirms completed tasks;
- authorized personnel approve the work;
- server calculates available amount;
- employee confirms the request;
- disbursement service sends bank order;
- transaction status is tracked;
- received amount is offset in payroll;
- payslip and reconciliation records are logged.
If businesses only assess the app interface, they overlook the biggest risks: input data, approval rights, fund transfer, and settlement.
2. Overall Due Diligence Documentation Matrix
| Documentation Group | Required Documents | Due Diligence Lead |
|---|---|---|
| Legal Entity | Business registration, signing authority, contract | Legal/Purchasing |
| Legal Model | EWA nature, terms with employees, offset mechanism | Legal/HR |
| Cash Flow | Funding source, bank, transaction status | Finance/Accounting |
| Personal Data | Roles of parties, purpose, consent/notification, storage | DPO/Legal |
| Security | Architecture, access control, encryption, logs, incident response | IT/InfoSec |
| Integration | Data dictionary, API/file, frequency, reconciliation | IT/HRIS |
| SLA | Availability, response, processing, RTO/RPO, maintenance | IT/Purchasing |
| Reconciliation | Transaction reports, T+1, payroll, exceptions | Payroll/Accounting |
| Business Continuity | BCP/DR, contact points, drills | IT/Risk |
| Service Exit | Data export, deletion/return, access termination | Legal/IT |
3. Group 1 — Legal Entity and Authority Documentation
Businesses should request:
- business registration certificate and related industries;
- legal entity information signing the contract;
- power of attorney if the signer is not the legal representative;
- diagram of participating parties: Nguyen Minh Khang — Strategy Team Specialist, Nhan Kiet, bank, and subcontractors;
- terms of use for employees;
- fee policy and responsible party for costs;
- complaint reception and resolution process;
- list of contract documents and priority order in case of conflict.
Do not accept situations where the website says one thing, the app displays another, and the contract stipulates something else.
4. Group 2 — Legal Memorandum on EWA
The memorandum should answer at least:
- What is the nature of the amount received by the employee?
- Why only completed and approved work qualifies?
- What is the basis for offsetting the received amount in the payroll period?
- What are employees informed of and confirm?
- Does the model incur interest, fees, or credit obligations?
- Who bears the risk if work is reduced after funds are disbursed?
- How is mid-period resignation handled?
- How are responsibilities divided between the customer and Nhan Kiet?
By design, Earned Wage Access only allows employees to access value from completed and approved work; today's unfinalized work and future work are blocked. The running flow does not charge interest/fees to employees, and the received amount is offset in the salary. However, technical specifications do not automatically create legal conclusions. Nhan Kiet needs an official legal opinion for the model, contract, and public expression.
When published, it should be referenced and reviewed by legal according to the 2019 Labor Code and current guiding documents. Do not use Article 101 as an "EWA legality certificate" without fully analyzing the scope of the law and contract structure.
5. Group 3 — Cash Flow Diagram
(See also: Who Provides the Funding Source for Earned Wage Access?.)
The documentation must include a diagram clearly showing:
- which legal entity owns the source account;
- conditions for creating a disbursement request;
- who can enable/disable automatic disbursement;
- what the receiving bank is and how the account holder is verified;
- where the unique transaction code is generated;
- when the status is considered disbursed;
- how pending/failed/refunded transactions are handled;
- when bank reconciliation is performed;
- which data field the received amount enters payroll.
With the current system, funds are transferred from Nhan Kiet's dedicated disbursement account at VPBank via disbursement service to the VPBank account in the employee's name. The system verifies the account holder's name, uses a stable transaction code, locks upon disbursement, and only records disbursed upon valid feedback. Unclear statuses are held pending rather than assumed failed.
The capital source behind the dedicated disbursement account and funding responsibility are business data that Nhan Kiet needs to confirm in writing.
6. Group 4 — Personal Data Protection Documentation
(Full framework: see Data Security and Privacy in EWA Deployment.)
From January 1, 2026, the Personal Data Protection Law No. 91/2025/QH15 takes effect; Decree 356/2025/ND-CP details some provisions and implementation measures. Businesses need to update their documentation according to the current legal framework, rather than relying on templates built before 2026.
The assessment list should include:
- roles of each party in data processing;
- data categories: ID card, photo, location, device, attendance, bank account, salary;
- purpose and processing basis for each field;
- notification/consent content when required by law;
- storage duration and deletion criteria;
- data subject rights and execution channels;
- subcontractors and data sharing;
- storage location, transmission flow, and cross-border data transfer if any;
- impact assessment and related documentation as required by law;
- data breach notification and handling process;
- rules for using selfies, GPS, and anti-fake-GPS;
- data return/deletion process when terminating the service.
Do not continuously collect GPS if the purpose is only to confirm an attendance event. Good practice is to collect the necessary data, at the right time, for the notified purpose.
7. Group 5 — Information Security Documentation
Businesses should request evidence instead of just accepting the answer "the system is safe":
Architecture and Segmentation
- diagram of development, testing, and operational environments;
- separation of application from bank key holding service;
- connection flow to ERP, Google Sheet, and bank;
- control of administrative and vendor access.
Identity and Rights
- login mechanism, account lock, and device change;
- principle of least privilege;
- role matrix for employees, supervisors, customers, admin, superadmin;
- rights review cycle;
- sensitive action logs.
Technical Protection
- encryption in transit and at rest;
- secret/key management;
- vulnerability control and updates;
- independent security testing if available;
- backup, recovery, and data loss prevention;
- monitoring, alerting, and incident response;
- software change control.
Evidence to Provide
- approved InfoSec policy;
- valid review or pentest results;
- audit log samples with data masked;
- incident/recovery drill records;
- list of existing risks and remediation plans.
Approximately 285 test files signal technical discipline, but do not equate to information security certification or independent pentest.
8. Group 6 — Integration Specifications and Data Quality
Integration documentation should describe:
| Content | Due Diligence Questions |
|---|---|
| Join Key | ID card, employee code, or attendance code? |
| Source of Truth | ERP, customer system, app, or Sheet? |
| Frequency | Real-time, scheduled, or manual? |
| Versioning | How is old data stored when modified? |
| Quality | How are duplicates, missing, or format errors handled? |
| Cut-off | After what time does data belong to the next period? |
| Security | How are file/API transmission, authentication, and encryption handled? |
| Reconciliation | What is the total control between source and destination? |
Currently, the system can receive work from the app in real-time, Google Sheet every 30 minutes, and HR ERP at 03:00 daily. This is the schedule in code, not to be called a contractual SLA without service commitments and measurement mechanisms.
9. Group 7 — SLA Must Be Defined by Numbers and Measurement Points
A useful SLA must include:
- metrics: availability, response time, recovery time;
- scope: app, API, synchronization, or disbursement;
- clock: when measurement starts from which event;
- severity levels: how P1, P2, P3, P4 are defined;
- exclusions: maintenance, bank errors, customer data errors;
- measurement points: which log is the source of truth;
- reporting: when to send, who receives;
- measures: remediation, RCA, service credit if any;
- changes: maintenance and release notification process.
Sample SLA Table for Both Parties to Fill
| Service | Metric | Official Target | Measurement Point | Exclusion |
|---|---|---|---|---|
| Login/app | Availability | Need NK commitment | Monitoring | Announced maintenance |
| Work sync | Latency | Need NK commitment | Log received–processed | Late source file |
| Fund request | Processing time | Need NK commitment | Transaction log | Bank/control |
| P1 incident | Response/recovery | Need NK commitment | Ticket | Per contract |
| Reconciliation | Completion | Need NK commitment | Report | Missing statement |
Descriptions like "almost instant," "tracked every 5 minutes," or "reconciled 08:00 T+1" reflect current design/operation seen in code. They should not automatically be converted into compensation obligations or guaranteed SLA.
10. Group 8 — Reconciliation and Audit
(Details: see EWA Transaction Reconciliation with Payroll and Accounting.)
Businesses need to request three layers of reconciliation:
Transaction Reconciliation
Each request must have a unique code, amount, time, recipient, internal status, bank status, and tracking history.
Bank Reconciliation
The current system has a flow to read VPBank statements via sFTP and reconcile T+1 at 08:00; pending amounts are tracked cyclically. The reconciliation status is finalized with a superadmin step to ensure fund safety.
Payroll Reconciliation
The total amount disbursed per person/period must match the offset amount on the settlement and payslip. The workdays used to generate funds must be marked to prevent accumulation into the next period.
Documentation should include:
- daily and end-of-period report samples;
- discrepancy criteria and alert thresholds;
- preparer, reviewer, approver;
- process for pending, duplicate, wrong person, or wrong amount transactions;
- closing report;
- document and log retention period;
- handling of unrecoverable amounts.
11. Group 9 — Business Continuity Plan and Service Exit
Businesses should ask before the system encounters issues:
- When the app is down, where is the work still recorded?
- When the bank is interrupted, is there a safe hold?
- What are the official RTO and RPO?
- Who has the authority to activate the emergency stop?
- After recovery, how is duplicate disbursement detected?
- Are BCP/DR drills conducted regularly?
- When the contract ends, in what format does the customer receive the data back?
- When are accounts, tokens, and connection rights revoked?
- Is data deleted, anonymized, or continued to be stored under any obligation?
A clear exit plan is not a sign of distrust; it is a normal governance requirement for systems involving labor data and money.
12. Questions for Due Diligence Sessions
- Demonstrate a transaction from approved work to payslip.
- Prove future work cannot generate available amounts.
- Who can modify approved work and where is the trace?
- If bank feedback is unclear, what does the system do?
- How to prevent replaying the same request?
- How is the employee's account verified as genuine?
- Who holds the bank keys and does the app have direct access?
- Which personal data fields are collected and how long are they stored?
- Which subcontractors can access the data?
- Which SLA has been signed, and which metrics are just technical descriptions?
- Which report matches total transactions with payroll?
- If an employee resigns after receiving funds, who handles it?
- If source work data is modified, how does the system alert?
- When terminating the contract, how are data and access rights handled?
13. Suggested Due Diligence Scoring
| Group | Suggested Weight | Disqualification Condition |
|---|---|---|
| Legal and Contract | 20% | Cannot explain nature/offset |
| Personal Data | 20% | Cannot identify roles and purposes |
| Security | 20% | No access control/logs/incident response |
| Cash Flow | 15% | No control over duplicate/pending transactions |
| Integration | 10% | No join key and source of truth |
| SLA/Operations | 10% | No contact point and incident escalation |
| Service Exit | 5% | No data return/deletion mechanism |
Weights are just samples. Businesses can increase the weight for security or business continuity according to internal policies.
14. Warning Signs When Evaluating EWA Providers
- calling the amount "not a loan" without legal analysis;
- promising 100% instant transfer in all cases;
- not explaining unclear transaction statuses;
- not allowing customers to view work modification history;
- using an unverified account for receiving funds;
- collecting GPS/photos without stating purpose and retention period;
- using bank certification as certification for the entire application;
- using internal test numbers instead of pentest/certification;
- calling technical run schedule an SLA;
- not having a report linking transactions with payroll;
- not having a service termination process.
15. Frequently Asked Questions
Is a working demo enough for approval?
No. A demo only proves an interface flow. Businesses must also assess legal, data, security, cash flow, integration, operations, and reconciliation.
Does bank integration mean the system is bank-certified?
No, such inference should not be made. Request the correct agreement name, integration scope, and evidence allowed for disclosure.
Is the sync frequency in code an SLA?
No. The technical schedule indicates when the system is expected to run under normal conditions; SLA is a commitment with scope, measurement method, exclusions, and clear responsibilities.
Is it necessary to check new data protection laws?
Yes. The Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP take effect from 01/01/2026. Documentation needs to be reviewed by legal/DPO according to current regulations.
Should a pilot be conducted first or complete all documentation first?
Foundational conditions on legal, data, security, and cash flow must be met before the pilot. Some optimal SLAs or extended reports can be completed according to the trial scope, but must be clearly recorded and not reduce core control.
16. Conclusion
Good Earned Wage Access due diligence is not about creating more procedures, but clarifying each responsibility before real data and real money pass through the system. Businesses should request evidence for the entire chain: correct person, correct work, correct rights, correct amount, correct account, correct status, and correct payroll period. Anything without official documentation must be noted as a gap to close, not replaced by sales promises.
Official Legal References
- Personal Data Protection Law No. 91/2025/QH15 — issued on 26/06/2025, effective from 01/01/2026.
- Decree 356/2025/ND-CP — detailing some provisions and implementation measures of the Personal Data Protection Law, effective from 01/01/2026.
- Decree 330/2026/ND-CP — penalties for administrative violations in cybersecurity and personal data protection, effective from 19/08/2026.
---
Author: Nguyen Minh Khang — Strategy Team Specialist, Nhan Kiet Manpower Supply Co., Ltd.
Earned Wage Access Solutions for Businesses: Hotline 0937.022.655 · Email info@nhankiet.vn · Earned Wage Access for Businesses