MUCC provider use terms
Proposed rules for technology and other providers referencing MUCC records.
Draft for ASMRAF review · Version 0.2 · 14 October 2026
Prepared for the South African launch. This document sets out proposed rules; it does not confirm that staff, services or legal arrangements have been put in place.
1. Non-exclusive participation
Any provider meeting ASMRAF’s requirements may apply on the same terms. MinePay is a technology provider under the owner-confirmed non-exclusive agreement dated 9 November 2025. That relationship gives it no role in verification decisions and no automatic right to all private records.
2. Use only authorised data
Agree the purpose, data fields, access method, roles and retention before integration. Authenticate service access, protect secrets and prevent public enumeration of mines or applicants. Use the minimum necessary information and do not copy raw identity data without an explicit lawful purpose and written arrangement.
3. Represent status accurately
Show provisional, certified, suspended and withdrawn states clearly. Record when status was checked and handle service failures without assuming approval. Do not represent a MUCC as a government licence, proof of payment or guarantee of mineral origin. Describe planned capabilities as planned and identify the limits of the evidence.
4. Preserve records and separation
Keep sale, lot, document and settlement references linked without allowing one action to fabricate another. A document upload is not approval; approval is not payment; a payment instruction is not confirmed recipient receipt. Providers may not change ASMRAF verification status or grant themselves verification authority.
5. Assurance and exit
Agree testing, incident reporting, change management, suspension and termination arrangements. On exit, revoke access, return or securely delete records as lawfully required and retain only justified audit evidence. Legal, intellectual-property, service-level and liability terms require a signed provider agreement before operational use.
Before this document is adopted
Approve provider admission and data-sharing agreements, operational contacts and integration acceptance tests.
Proposed accountable role: ASMRAF standards and legal leads. Named appointments and an adoption date must be recorded before operation.