CONFIDENTIAL CONTACT
Has outsourced support moved into data or payment operations?
Describe the difference between the agreed service and the current workflow. Do not send passwords, private keys or communications obtained without authority.
Outsourcing due diligence should follow the work. A contract says customer support, but the daily tasks gradually expand into refunds, account checks or payment instructions. Each request seems small. Together they can change who touches data and money.
Payment-related support is not automatically improper. The question is whether the expanded role was understood, authorised and reviewed. A familiar contact cannot supply the missing approval after a dispute begins.
Establish the facts needed for the decision, then identify the missing records.
On 23 September 2026, Taichung prosecutors announced charges against 30 people, alleging that two companies operated customer-service bases for cross-border laundering involving NOW PAY and X PAY. Charges are not convictions, and this article does not assume every employee knew of wrongdoing.
Our analysis concerns the general outsourcing question: does the client know what work is performed, who approves it and where data goes? It does not claim access to unpublished evidence in the case.
Ask for an anonymised example showing how a request enters the service, which systems and roles handle it and how it is closed. Compare that workflow with the contract. This is more useful than asking for a general assurance that the vendor complies with everything.
For each use of transaction or identity data, establish necessity, approval, retention and onward recipients. A service can expand legitimately. Data access and payment authority should not expand by assumption alongside it.
No. A term is not evidence of an offence. Establish what service is actually provided, which permissions or registrations are relevant and whether the documents match the operation. Virtual-asset activity should not be treated as inherently criminal.
Rules differ across jurisdictions. Registration in one place is not a global permission to perform regulated activities. Qualified legal and compliance advisers should assess applicability, using current official sources and a record of the scope examined.
Preserve contracts, change requests and lawfully held work and access records. Responsible managers should decide which permissions remain necessary. Where restrictions are warranted, document them and avoid destroying the history by casually deleting accounts.
Ask specific questions about the operation: who approved this refund or why did this file go to another entity? Do not ask staff to secretly record colleagues, enter another person’s account or copy customer data to private devices.
We can compare public company information, the contract and authorised workflow records. Deliverables may include an operating-role map, a timeline, an evidence-gap list and a factual summary for counsel. The scope should match the decision rather than collecting everything available.
We cannot promise to identify every controller through public sources or replace a lawful investigation by authorities. Agree confidentiality, permitted data and intended use before sharing sensitive material.
Choose the latest task added to the support team and find its approval record. If a chat message is the only authority for handling customer identity data or payments, that change needs a proper review.
Describe the difference between the agreed service and the current workflow. Do not send passwords, private keys or communications obtained without authority.
