About OnePay

Our Story

OnePay was launched in 2021 by Spemai (Pvt) Ltd, a technology company backed by a reputed Japanese corporate investor since 2019. What began as a bold idea to modernise digital payments in Sri Lanka has grown into the country's most trusted and scalable payment infrastructure. In just four years, OnePay has crossed LKR 10 billion in payment volume, onboarded 4,500+ active merchants, and earned the distinction of being Sri Lanka's first payment gateway to achieve ISO 27001 certification, the global gold standard for information security.

Why OnePay?

Who Can Use OnePay?

OnePay is built for a wide spectrum of Sri Lankan businesses. Whether you are a freelancer just starting out or a publicly listed company processing thousands of transactions a day, OnePay has a plan and a path for you.

Supported Business Types

Register business with OnePay partners: Click here.

Getting Started - The Onboarding Journey

Getting set up with OnePay is straightforward. We've designed the process to be paperless, fast, and fully guided. Here is exactly what to expect from the moment you decide to move with OnePay.

The 5-Step Onboarding Flow

Website Requirements Before Compliance Review

Before OnePay can submit your application to the Bank for card network clearance, your website must have the following three policy pages in place. This is a mandatory requirement from the card networks (VISA, Mastercard, etc.) and is not optional.

Download sample policies: Click

Payment Options & Currencies

OnePay gives your customers multiple ways to pay — making it easier to convert every visitor into a paying customer.

Supported Payment Methods

Supported Currencies

OnePay processes payments in Sri Lankan Rupees (LKR) for all domestic transactions. For merchants serving international customers, cross-border payment support is available. Please contact your Relationship Officer for more details on enabling multi-currency setups.

For more information, please refer to the official CBSL notice:https://www.cbsl.gov.lk/sites/default/files/cbslweb_documents/press/pr/press_20260212_foreign_currency_transactions_between_residents_of_srilanka_e.pdf

Pricing & Charges

OnePay believes in simple, transparent pricing. No hidden fees. No surprises. Here is everything you need to know.

Monthly Subscription

Merchant Discount Rate (MDR)

In addition to the monthly subscription, a Merchant Discount Rate (MDR) applies to each transaction. The MDR is a small percentage of the transaction value retained to cover card network fees, bank processing costs, and platform maintenance. Your specific MDR will be confirmed in your merchant agreement and depends on your business category and transaction volume. Speak to your Relationship Officer for a personalised rate.

Other Charges

Refund Process

Handling refunds professionally and promptly is one of the most effective ways to maintain customer trust and avoid chargebacks. OnePay makes the refund process simple.

When Should You Issue a Refund?

A refund should be issued when:

• 1. The customer did not receive the product or service they paid for
• 2. The product or service delivered was significantly different from what was described
• 3. A duplicate payment was made in error
• 4. The customer cancelled before fulfilment and is entitled to a refund per your policy
• 5. A technical error caused an incorrect charge
• 6. Item out of stocks

How to Process a Refund

Refunds can be initiated directly from your OnePay merchant dashboard. The process is as follows:

Refund Processing Timeframes

What if There Are No Funds in Your Payout Account?

If your future payout balance or recent transaction volume is insufficient to cover the refund amount, OnePay will contact you and request that you deposit the required funds to initiate the refund

• For local (LKR) transactions: you deposit the exact refund amount to the OnePay designated account.

• For foreign currency transactions: you must deposit the equivalent amount in LKR, calculated at the applicable FX rate on the date the refund is being processed. OnePay will provide you with the account details and the applicable FX rate at that time.

When Refunds Take Longer Than Expected

On rare occasions, refunds may take significantly longer than the standard timeframe due to bank reconciliation issues on the card issuer's side. In these cases, OnePay has no direct authority to follow up with the card-issuing bank on the cardholder's behalf.

If a refund has not appeared within the stated timeframe and the standard resolution steps have been exhausted, the cardholder should initiate a chargeback directly through their card-issuing bank.

A step-by-step guide on how to initiate a chargeback.

Understanding Chargebacks

A chargeback is when a customer contacts their bank or card issuer to dispute a transaction and request a forced reversal of funds bypassing the merchant entirely. Chargebacks are one of the most serious issues a merchant can face, and understanding them is essential.

How a Chargeback Happens

Here is the typical chargeback flow:

Common Chargeback Reasons

How to Win a Chargeback Dispute

Evidence is everything. When OnePay notifies you of a chargeback, compile the following as quickly as possible:

• Order confirmation with date, amount, and product/service details
• Proof of delivery (courier tracking, digital delivery logs)
• Customer communication (emails, WhatsApp messages accepting delivery)
• Terms & conditions shown at checkout (including your refund and return policy)
• IP address and device fingerprint of the transaction (available from your dashboard)

Chargeback Ratio - Keep It Low

Card networks (VISA, Mastercard) set strict thresholds for acceptable chargeback ratios. If your monthly chargeback rate exceeds these thresholds, your account may be flagged, suspended, or your merchant agreement terminated. The standard industry threshold is below 1% of monthly transactions.

Account Termination

OnePay reserves the right to terminate a merchant account in the following circumstances:

• Repeated breach of the merchant agreement terms
• Sustained <DocStrong>high</DocStrong> chargeback or fraud ratio exceeding card network thresholds
• Discovery that the business falls into a restricted category
• Failure to comply with document verification requests
• Fraudulent activity or misrepresentation
• Transacting outside the approved scope of business operations

In most cases, OnePay will attempt to work with the merchant to resolve the issue before proceeding to termination. If your account is at risk, you will receive a formal notice with a defined cure period.

Consequences of Termination - What You Must Know

If a merchant account is terminated due to a compliance breach or policy violation, the consequences extend far beyond losing access to OnePay. Here is what happens:

3D Secure - How OnePay Protects Every Transaction

All transactions processed through OnePay are secured using 3D Secure (3DS) authentication. OnePay does not support 2D (non-authenticated) transactions under any circumstances. Understanding the difference between 3DS and 2DS is important for both merchants and customers.

What is 2D (Non-Authenticated) Payment?

A 2D transaction also called a non-3DS or card-not-present transaction is a basic payment where the customer enters their card number, expiry date, and CVV. There is no additional identity verification step. The payment is either approved or declined purely based on card data.

• No additional authentication required from the cardholder
• Faster checkout experience with fewer steps
• Higher fraud risk: stolen card details can be used to make purchases
• In the event of fraud, the liability falls on the merchant

What is 3D Secure (3DS)?

3D Secure is a global authentication protocol developed by the card networks (Visa calls it Verified by Visa; Mastercard calls it Mastercard Identity Check). It adds an additional verification step after the customer enters their card details, typically a One-Time Password (OTP) sent to their registered mobile number by their issuing bank.

• The customer enters their card number, expiry date, and CVV
• The issuing bank sends a one-time password (OTP) to the customer's registered mobile number
• The customer enters the OTP to authenticate the payment
• Only after successful OTP verification does the transaction proceed

3DS vs 2DS - Risk Comparison

3DS Enabled vs Disabled Cards

Not all cards have 3DS enabled. The decision to enable or disable 3DS on a card rests entirely with the card-issuing bank, not with OnePay or the merchant.

Cards with 3DS Disabled

Some issuing banks disable 3DS authentication on certain cards or for certain transaction types. Common scenarios include:

• Certain international cards where 3DS adoption is limited
• Specific card products designed for certain transaction categories
• Corporate or prepaid cards where OTP-based authentication is not configured

Who Bears the Risk When 3DS is Disabled?

When a card does not support 3DS and a transaction is completed without authentication, the liability for any resulting fraud or dispute does NOT fall on the merchant. In this scenario:

• The card-issuing bank assumes full liability for the transaction
• The merchant is protected from chargebacks arising from fraudulent use
• This is a deliberate liability-shift policy enforced by Visa and Mastercard