The framework that defines who can obtain the Welo Badge

This Standard sets out the requirements an online business must meet to obtain and keep the Welo Badge, the method Welo uses to assess those requirements, and the rules Welo follows when it grants, renews, suspends, revokes or lets a certification expire.

This Standard is written for three audiences: businesses that apply for or hold the Welo Badge, consumers and business customers who rely on the badge and on the Welo Page, and Welo personnel who carry out verification.

The Standard governs certification decisions. Where marketing material, sales communications, help articles or any other Welo page describe the Welo Badge differently, this Standard prevails.

This Standard applies to every application for the Welo Badge received on or after the effective date, to every scheduled reassessment, risk-triggered review and appeal opened on or after that date, and to existing certificates in the manner described in Clause 29.4.

The Standard covers businesses that sell goods, digital content, software or services to consumers or to other businesses through a website they operate. Annex A and Annex B define the business model categories and the additional requirements that apply to each.

The Standard does not cover:

1. a)
   certification of individual products, product quality or product safety testing;
2. b)
   audits of financial statements, tax compliance, employment practices or corporate governance;
3. c)
   penetration testing, source code review or infrastructure audits, unless Welo and the business agree in writing to a separate engagement, which falls outside the Welo Badge;
4. d)
   individual sellers operating on a marketplace, which are not certified by the certification of the marketplace operator (Clause 5.4);
5. e)
   mobile applications, social media accounts and physical stores, except to the extent they form part of the purchase or support flow of a verified domain.

A Welo verification is an evidence-based assessment of a business against the published criteria of this Standard, carried out at an identifiable point in time by trained Welo reviewers.

The assessment has two levels. Foundation Requirements (Clause 9) are mandatory pass or fail conditions. Trust Topic Requirements (Clause 10) are scored criteria grouped into eight weighted topics that produce the Trust Score (Clause 11). A business that fails any Foundation Requirement cannot be certified, whatever its Trust Score.

Welo assesses what it can observe on the business's website and in independent sources, together with the evidence the business supplies. Where the two do not match, Welo cross-checks them and records which source it relied on (Clause 19).

Where material information cannot be verified, Welo places the assessment on hold and requests evidence. Welo does not estimate, assume or fill in missing information to reach a decision (Clause 19.5).

All criteria, criterion weights, topic weights and thresholds used to reach a certification decision are published in this Standard. Welo keeps certain antifraud detection methods confidential. A confidential method may prompt further checks; it may not be the sole stated ground for refusal, suspension or revocation. Every adverse decision cites the clause of this Standard that was not met and the evidence relied on (Clause 19.9).

When the words below state a requirement in this Standard, they have the following meanings.

Where an obligation is placed on Welo, the same words apply to Welo.

Clauses are numbered hierarchically (for instance 9, 9.3, 9.3.2). Clause numbers in this version are stable and will not be reused for different content in later versions; a deleted clause is marked "Withdrawn" in the following version.

Foundation Requirements carry the identifiers FR1 to FR12. Trust Topic Requirements carry the identifiers TTR1 to TTR8, and their scored criteria carry identifiers of the form TTR1.1. These identifiers are stable across versions. Where a later version changes an identifier, the changelog for that version maps the old identifier to the new one.

Text marked "NOTE" is informative. It explains or illustrates a requirement and does not add an obligation.

Unless a clause states otherwise:

1. a)
   failure to meet a Foundation Requirement prevents approval and, for a certified business, leads to suspension under Clause 23.4 and, if not remedied within the suspension period, to revocation under Clause 23.6;
2. b)
   failure to meet a scored criterion lowers the score for that criterion according to Annex D and has no other consequence;
3. c)
   a breach of an obligation in Clauses 16 to 18 that also meets the definition of a serious deceptive practice (Clause 17.3) is treated as a Foundation Requirement failure under FR4.

"Calendar days" includes weekends and public holidays. "Business days" means Monday to Friday, excluding public holidays. For a deadline that binds Welo, public holidays are those observed in Italy. For a deadline that binds a business, public holidays are those observed where the business's customer support operates, as declared in the application.

A period starts on the day after the notice that opens it is sent. A period expires at 23:59 Coordinated Universal Time (UTC) on its final day.

Notices are sent to the corporate email address registered with Welo (Clause 8.3). A notice is treated as received on the day it is sent, unless Welo receives a delivery failure.

For the purposes of this Standard the following terms apply. Defined terms are capitalized where they are used in their defined sense.

The Welo Badge states that, on the Latest Verification Date shown on the Welo Page, the business:

1. a)
   met every Foundation Requirement in Clause 9 that applied to it;
2. b)
   reached the Trust Score and Topic Score thresholds for the badge level shown (Clause 12);
3. c)
   operated the Verified Domain shown on the certificate, through the legal entity named on the certificate;
4. d)
   had not been found to engage in an activity listed in Annex A, Part A.2.

"Verified by Welo" means that Welo carried out an evidence-based assessment against the criteria of this Standard on an identifiable date. The phrase refers to that assessment. It does not refer to any later period, to any other website of the same owner, or to any matter outside the scope stated in Clause 1.2.

The badge level shown at any moment reflects the current certificate status. A suspended, revoked or expired certificate must not be shown as active by the Welo widget, the Welo Page or any Welo communication (Clause 26.3).

The Welo Badge is not a guarantee that a purchase will be free of problems, that goods or services will meet a particular quality, that delivery times will be met, or that the business will remain compliant after the Latest Verification Date.

The Welo Badge is not legal advice. It does not certify that the business complies with the law of any jurisdiction. Clause 28 explains how Welo uses legal and regulatory references.

The Welo Badge does not replace, limit or condition any right a consumer has under the law, any protection offered by a payment method, or any remedy available from a court, regulator or dispute resolution body.

The Welo Badge is not an authorization, license, registration or approval issued by a government body or regulator. Welo is not an accreditation body, a statutory regulator, a conformity assessment body under any product legislation, or a testing laboratory. Where this Standard requires a business to hold a regulatory authorization, Welo checks that the authorization exists and covers the activity; the authorization itself is granted by the competent authority (Annex B).

The certification of a marketplace operator does not certify the individual sellers on that marketplace (Clause 5.4).

A Certified Business may display the Welo Badge only:

1. a)
   on the Verified Domain named on its certificate;
2. b)
   through the official widget code supplied by Welo, without modification;
3. c)
   while its certificate is active.

A business must not copy, imitate, edit, animate, screenshot, re-host or otherwise reproduce the Welo Badge outside the official widget; display it on any domain, page, profile or advertisement not covered by its certificate; describe its certification as covering a different legal entity, website, product line or seller; or state or imply a badge level higher than the level shown on its Welo Page.

A business may refer to its certification in text (for instance "Verified by Welo, Blue Badge") on its Verified Domain and in its marketing, provided the statement links to its Welo Page, names the badge level accurately and is removed or corrected within five calendar days of a change in certificate status.

Use of the badge in breach of Clause 4.3 is assessed under FR4 where it misleads consumers, and in all other cases leads to an Evidence Request and a correction deadline of fourteen calendar days. Welo may disable the widget immediately where unauthorized use is found on a domain that is not covered by any certificate.

A certificate is issued to one legal entity: the entity that operates the Verified Domain and enters into contracts with the customers who buy through it. The certificate states the full registered name, the registration number and the country of registration of that entity.

Where a third party acts as merchant of record or reseller for the business (as some payment platforms do for software and digital products), the certificate is still issued to the entity that operates the website. The business must disclose the merchant of record to customers before purchase, as required by TTR4.2.

A trading name, brand or domain name is not a legal entity. Welo records trading names on the certificate only after confirming that the certified entity uses them.

Each application covers one website. A website is identified by its registrable domain (for instance example.com). A domain under a different registrable domain is a different website, unless it only issues a permanent redirect to the Verified Domain and serves no content of its own.

The certificate lists the hostnames under the registrable domain that form part of the assessed website, such as the storefront, the checkout, the customer account area and the help center. A hostname that is not listed is not covered. A hostname under the same registrable domain that runs a different business, brand or offering is a different website for the purposes of this Standard.

Language or country sections of the same website served under the Verified Domain (for instance example.com/de) are part of the same website and are assessed as such.

The business must demonstrate control of the Verified Domain under Clause 8.3 before the assessment begins.

Each distinct website requires its own application, its own assessment and its own certificate, even where several websites belong to the same owner or the same legal entity.

A certificate for one website does not transfer to, and must not be displayed on, any other website of the same owner.

Findings about one website may be taken into account when assessing another website of the same legal entity or of entities under common control, where the finding concerns identity, ownership, conduct toward customers or information supplied to Welo. A finding of Serious Fraud on one website is a finding about the legal entity and its controllers (Clause 25.6).

A marketplace operator may apply for the Welo Badge. The certificate covers the operator, its own conduct and the protections it provides to buyers. It does not cover the sellers that list on the marketplace.

A certified marketplace operator must not state or imply, through the badge, its wording or its placement, that the sellers on the marketplace are certified by Welo. The badge must not be placed on seller storefronts, product listings or seller profiles in a way that associates it with a seller.

Annex B, Part B.5 sets out the additional requirements for marketplace operators, including seller identification, prohibited product controls and buyer protection.

Welo determines the Markets Served by a business from:

1. a)
   the country of registration of the legal entity;
2. b)
   the markets the business declares in its application;
3. c)
   indications on the website and in its commercial activity that the business directs its activity to a country or region: delivery destinations offered at checkout, currencies and prices displayed, languages offered, country-specific pages or domains, local telephone numbers or addresses, customer support hours and languages, and advertising targeted at that market where Welo can observe it.

Where the website directs activity to a market that the business did not declare, Welo adds that market to the Markets Served and informs the business.

The business's Principal Markets are the Markets Served that the business declares as accounting for most of its customers or revenue, corroborated by the indications listed in Clause 5.5.1(c).

Welo assesses the requirements of this Standard against the obligations that apply to the business in its country of registration and in its Markets Served, within the following scope:

1. a)
   for the country of registration, Welo verifies the legal existence, registration status and identity of the entity in the official business register or an equivalent official source;
2. b)
   for Markets Served in the European Union and European Economic Area, the United Kingdom and the United States, Welo assesses the consumer-facing obligations covered by Clauses 15, 16 and 17 using the market checklists maintained under Annex F, Part F.3;
3. c)
   for any other Market Served, Welo applies the requirements of this Standard as written and checks market-specific obligations only where Annex B names them for the business's sector;
4. d)
   for regulated activities, Welo verifies the authorization in each Market Served where the activity is offered, as required by Annex B.

Welo does not assess tax compliance, product conformity marking, import and customs compliance, employment law, competition law, intellectual property clearance, or licensing for activities that Annex B does not list. A finding of non-compliance in these areas that becomes known to Welo through credible evidence may be assessed under TTR7.6 or FR4 where it affects consumers.

The Welo Page shows the Markets Served that were within the verification scope of the latest assessment (Clause 26.2).

The following Business Model Categories are eligible, subject to the requirements of this Standard and of Annex B where Annex B applies: ecommerce and direct-to-consumer retail; SaaS and software platforms; recurring subscription services; B2B agencies and professional services; marketplaces with third-party sellers; dropshipping retailers.

B2B businesses are eligible. Criteria that protect consumers specifically are marked in Annex D as not applicable to a business that sells only to business customers. A business that sells to both consumers and businesses is assessed as selling to consumers.

The following categories are eligible only after the enhanced checks set out in Annex B:

1. a)
   regulated financial brokers and investment businesses (Annex B, Part B.6);
2. b)
   crypto-asset exchanges and custodial services (Annex B, Part B.7);
3. c)
   healthcare providers and clinics (Annex B, Part B.8);
4. d)
   supplement sellers (Annex B, Part B.9);
5. e)
   trading evaluation programs (Annex B, Part B.11).

A business in a Higher-Risk Sector that does not hold the authorization, license or registration required for its activity in a Market Served fails FR11 for that market and is not eligible while it serves that market.

A business is not eligible for the Welo Badge if it sells, offers, promotes for its own commercial benefit or facilitates the sale of any of the following, as defined in Annex A, Part A.2:

1. a)
   gambling and betting;
2. b)
   tobacco products, nicotine products and vaping devices;
3. c)
   alcoholic beverages;
4. d)
   illegal drugs and controlled substances supplied outside a lawful prescription or license;
5. e)
   weapons, ammunition and activities directly connected with weapons;
6. f)
   adult services and sexually explicit content;
7. g)
   malware and malicious hacking services or tools;
8. h)
   content, products or organizations that promote hatred or violence;
9. i)
   dangerous activities and products as defined in Annex A, Part A.2.9;
10. j)
    counterfeit goods and counterfeit operations;
11. k)
    materially deceptive business models as defined in Annex A, Part A.2.11;
12. l)
    decentralized finance protocols and the issuance of crypto-assets, as defined in Annex A, Part A.2.12.

The exclusion applies to the whole business. A business that sells an excluded product is not eligible even where the excluded product represents a small share of its catalog or revenue. A general online retailer, grocery delivery service or supermarket that sells alcoholic beverages is excluded under Clause 6.3.1(c).

The exclusion in Clause 6.3.1(b) covers products that contain tobacco or nicotine and vaping devices together with their consumable and functional components. A business that sells only accessories for such products, as defined in Annex A, Part A.2.2, is not excluded under Clause 6.3.1(b); it is assessed like any other business and remains subject to every other clause of this Standard.

A marketplace operator facilitates the sale of excluded products within the meaning of Clause 6.3.1 if its seller rules permit excluded products or if it does not enforce a prohibition it has published. Annex B, Part B.5 describes the evidence Welo examines.

Documented fraud or counterfeiting leads to Technical Refusal under FR4 and may lead to an exclusion period under Clause 25.6.

Welo determines the Business Model Categories and any excluded activity of a business from its application, its website, its product catalog, its terms and its observable commercial activity, using the definitions in Annex A.

A business close to the boundary of an Excluded Sector is assessed against the objective definition in Annex A. Where the definition does not settle the question, the case is escalated, decided with a Second Reviewer and recorded with the reasons. The business may appeal under Clause 25.

A business that adds an excluded product or activity after certification has made a Material Change (Clause 22.6) and becomes subject to Clause 23.

An Applicant is eligible to be assessed if all of the following are true:

1. a)
   it is a legal entity registered and active in the official business register of its country of registration, or in an equivalent official source where no register exists;
2. b)
   it operates the website it applies for, and the website is live and publicly reachable;
3. c)
   it has at least twelve months of demonstrated commercial activity (Clause 7.2);
4. d)
   it is not engaged in an excluded activity (Clause 6.3);
5. e)
   it is not within an exclusion period set under Clause 25.6;
6. f)
   it has submitted the complete application required by Clause 8.

Eligibility to be assessed is not a finding that the Applicant meets the Foundation Requirements.

The Applicant must demonstrate at least twelve months of commercial activity before the date the application is complete. Commercial activity means selling goods or services to customers, shown by transactions, invoices or payment records spread over the period. The date of incorporation, the date of domain registration or the date the website went live do not on their own demonstrate commercial activity.

Accepted evidence includes payment processor statements or payout reports, issued invoices, tax filings or returns that show trading revenue, marketplace or platform sales reports, and audited or filed accounts. Welo may corroborate the evidence with archived copies of the website and independent records.

A legitimate restructuring does not reset the operating history. Where a business has moved to a new legal entity through a merger, conversion, asset transfer or similar transaction, the commercial activity of the predecessor counts toward the twelve months if the Applicant shows, with documents, that the same business (the same brand, website, operations and customer relationships) continued without interruption and that the new entity took over the predecessor's obligations toward customers.

An Applicant that cannot show twelve months of commercial activity is not eligible. It may apply again once it can.

A business that receives complimentary or discounted access to the Welo Badge, including under the Founding Member program, is assessed against exactly the same requirements, evidence standards and thresholds as any other Applicant.

The commercial terms of a business never change its eligibility, its scores or its badge level.

Each application covers one website under Clause 5.2. A business that operates several websites submits one application for each.

The Applicant must submit a complete application at the start of the process. The application form adapts its fields to the Business Model Categories the Applicant declares. Substantive verification begins only when every item required for those categories has been submitted.

Every application must include:

1. a)
   the full registered name, registration number, country of registration, registered address and trading names of the legal entity, with an extract or record from the official business register issued or retrieved no more than ninety days before submission;
2. b)
   the identity of the persons who own or control the business, and of the person submitting the application together with evidence of their authority to act for the entity;
3. c)
   the website's registrable domain and the hostnames to be covered (Clause 5.2);
4. d)
   the Business Model Categories that apply (Annex A);
5. e)
   the Markets Served and the Principal Markets (Clause 5.5);
6. f)
   a description of the goods, digital content, software or services sold, including any product line the Applicant considers close to an Excluded Sector boundary;
7. g)
   a declaration that the business does not sell, offer or facilitate any activity listed in Annex A, Part A.2;
8. h)
   evidence of at least twelve months of commercial activity (Clause 7.2);
9. i)
   the payment service providers used, and for any provider not listed in Annex C, Part C.1, the evidence required for an equivalence assessment (Annex C, Part C.3);
10. j)
    the customer support channels, the operating hours and the location from which support operates;
11. k)
    links to the legal documents required by FR3 for the Applicant's Business Model Categories;
12. l)
    any regulatory authorization, license or registration required by Annex B, with the register entry or reference number;
13. m)
    a declaration of any relationship between the business, its owners or managers and Welo, Welo's owners, managers or personnel, or any consultant, agency or referral partner engaged to prepare the application (Clause 20.6);
14. n)
    a declaration of any enforcement action, regulatory sanction, criminal conviction connected with the business, or civil judgment concerning consumer harm, involving the entity or its controllers in the preceding five years.

Annex B lists the additional documents required for each Business Model Category.

Welo checks the application for completeness and tells the Applicant which items are missing. An application that remains incomplete thirty calendar days after Welo's notice is closed without a decision on the merits. The Applicant may submit a new application at any time.

The Applicant must register its Welo account with an email address on the domain it applies for, and must confirm control of that mailbox through the verification link Welo sends.

Where the Applicant's operations use a mailbox on a different domain, that domain must belong to the same legal entity, and the Applicant must show this with evidence acceptable under Clause 8.3.4. Email addresses at free webmail services are not accepted for registration.

An application whose registration email domain does not match the applied domain, and for which no evidence under Clause 8.3.2 is provided, is held. Substantive verification does not begin until the mismatch is resolved.

Where control of the domain is uncertain, Welo may request additional evidence of control: a DNS TXT record with a value supplied by Welo, a file placed at a path supplied by Welo, or a statement from the domain registrar naming the legal entity as registrant.

Corporate email verification is the ordinary method of domain identification. It does not by itself prove that the person using the mailbox is authorized to act for the entity; Clause 8.2.2(b) applies.

During the assessment, Welo may send Evidence Requests. Each request identifies the requirement or criterion it concerns, describes the evidence needed and states the deadline.

The Applicant has fourteen calendar days to respond to an Evidence Request.

Welo may grant one extension where the Applicant shows a concrete reason why the evidence cannot be produced in time, such as a register that has not yet issued a document. The extension and its reason are recorded. An extension does not exceed fourteen calendar days.

If the evidence is not received by the deadline, the requirement or criterion it concerns remains undetermined, the evaluation remains incomplete, and Welo closes the application with the outcome "Closed, evidence not provided". This outcome is not a Technical Refusal and does not count as a failed assessment.

Documents must be legible, complete and unaltered. Documents in a language other than English or Italian must be accompanied by a translation. Welo may ask for a certified translation where a document is relevant to a Foundation Requirement and its content is disputed.

Applicants should remove from documents any personal data that Welo does not need, such as full payment card numbers, customer contact details or employee identification numbers. Welo handles the evidence it receives under Clause 27.

By submitting an application, the Applicant authorizes Welo to carry out the Passive Technical Checks described in Clause 13.5, to contact the business's customer support as an ordinary customer would, and to make test purchases under Clause 19.4.

Any test going beyond a Passive Technical Check requires the separate written authorization of the Applicant, given by a person entitled to authorize it, which states the scope, the systems and the time window of the test (Clause 13.6).

Applying for the Welo Badge and being verified are free of charge. The Applicant pays Welo only after a positive verification decision, as set out in Clause 21.

Each Foundation Requirement is assessed as Met, Not met or Undetermined. Undetermined means the evidence needed to decide has not yet been obtained; it leads to an Evidence Request and an Incomplete Evaluation (Clause 19.5). It is never treated as Met.

A business is certified only if every Foundation Requirement that applies to it is Met. A failed Foundation Requirement cannot be offset by a high Trust Score, by a high score in any topic, by the commercial plan or by any other consideration.

FR1 to FR10 and FR12 apply to every business. FR11 applies to businesses carrying on an activity for which Annex B requires an authorization, license or registration.

When a Foundation Requirement is Not met, Welo informs the Applicant of the clause concerned, the finding and the evidence relied on. Unless the failure involves Serious Fraud or Material Falsification, the Applicant may remedy the failure and reapply under Clause 25.5, or, during an open assessment, provide Corrective Action within the deadline of the Evidence Request.

The website must be live, publicly reachable from the Markets Served and materially complete. Pages that a customer needs to understand the offer, buy, contact the business or read its terms must load and contain real content.

The essential customer flows for the business model must work from start to finish: for a seller of goods or digital content, browsing, adding to cart, checkout and reaching the payment step; for a subscription or SaaS business, choosing a plan, creating an account and reaching the payment step; for a B2B service, requesting a quote or contacting sales and receiving the contractual conditions; for a marketplace, finding a listing, identifying the seller and reaching the payment step.

The website must describe the goods or services in a way that allows an ordinary customer to understand what is sold, at what price and on what terms.

Information that appears on several pages, such as prices, the name of the business, delivery terms and contact details, must be consistent.

FR1 is Not met where any of the following is found: a broken or unreachable checkout, account creation or contact flow; placeholder or template content on pages a customer relies on; products or services offered for sale that cannot be bought; prices that differ between the product page and the checkout without explanation; contradictory statements about who sells, what is sold or on what terms.

The legal entity must be registered and active in the official business register of its country of registration, or in an equivalent official source.

The legal name, registration details and address declared to Welo must match the official register, and must match the identity shown on the website and in its legal documents. Trading names used on the website must be traceable to the legal entity.

A business that sells to consumers must show on its website, in a place reachable from every page (such as the footer, a legal notice or the terms), its full legal name, a geographic address at which it can be contacted, and an electronic contact method.

The business must offer at least one working customer support channel (such as an email address, a contact form or a ticketing system) and must normally send an initial response to a customer inquiry within two business days. An automated acknowledgment without substantive content does not count as an initial response.

Welo tests contactability by sending an inquiry through the support channel shown on the website. If no initial response is received within two business days, Welo sends a second inquiry. FR2 is Not met where neither inquiry receives an initial response within two business days, unless the business shows that the delay was caused by a closure it had announced on its website in advance or by circumstances outside its control.

FR2 is Not met where any of the following is found: the entity is not in the register, is dissolved, struck off or in liquidation; the website identity does not match the registered entity and the business cannot explain the difference with documents; the operator of the website cannot be identified; the business uses the name, logo, address or registration details of another business without authorization (which is also assessed under FR4); the contact test in Clause 9.3.5 fails.

The business must publish the legal documents required for its Business Model Categories, listed in Annex B, Part B.0. Each document must:

1. a)
   be reachable from every page of the website and from the checkout or signup flow;
2. b)
   be written in the language or languages in which the website offers its goods or services;
3. c)
   identify the legal entity that issues it;
4. d)
   describe the rules the business actually applies, consistently with the checkout, the order confirmation and the business's conduct;
5. e)
   be readable by an ordinary customer, without contradictory clauses on the same subject.

Where the website sets non-essential cookies or uses non-essential tracking technologies and serves a market whose law requires prior consent for them, the website must present a consent mechanism before those technologies are activated, and the privacy or cookie notice must describe them.

Where the business runs a partner, affiliate or referral program open to the public, the program terms must be published.

FR3 is Not met where a required document is missing, unreachable, issued by a different entity without explanation, or contradicts the practice observed at checkout or in the business's conduct on a point that affects the customer's rights or payments.

The business must not engage in, and its website must not show evidence of, any of the following:

1. a)
   Serious Fraud, meaning fraud or counterfeiting established on substantiated evidence: the sale of counterfeit goods; taking payment with no intention or ability to supply; identity theft or impersonation of another business; phishing or collection of credentials or payment data under false pretenses; deliberate misrepresentation of the existence, nature or origin of the business;
2. b)
   impersonation or misuse of the identity, brand, trade marks, registration details or address of another business or person, until the legitimacy of the use is established;
3. c)
   a serious deceptive practice as defined in Clause 17.3;
4. d)
   distribution of malware, presence of the website on a reputable malware or phishing blocklist that the business does not resolve within the deadline of an Evidence Request, or compromise of the website used to attack visitors;
5. e)
   a recurring pattern of unresolved consumer harm shown by multiple independent, credible sources (Clause 18.11);
6. f)
   any listing of the entity or its controllers on a sanctions list that prohibits Welo from dealing with them under the law applicable to Welo.

A finding under Clause 9.5.1 requires evidence that meets the standard set in Clause 19.6. Where the evidence points to a possible issue but does not reach that standard, Welo requests clarification and evidence before deciding, and the requirement remains Undetermined in the meantime.

FR4 Not met on the ground of Serious Fraud or counterfeiting leads to Technical Refusal and may lead to an exclusion period under Clause 25.6. FR4 Not met on another ground leads to Technical Refusal with the possibility of Corrective Action under Clause 25.

The information and documents the business supplies to Welo must be true, complete on the points requested and unaltered.

An inaccuracy made in good faith, such as an outdated address, a clerical error or a misunderstanding of a question, may be corrected by the business when Welo identifies it or when the business notices it. A corrected good-faith inaccuracy does not lead to failure of FR5.

Material Falsification fails FR5. Material Falsification includes submitting a forged or altered document, presenting another entity's document as one's own, inventing transaction records, giving false answers about ownership, excluded activities, regulatory status or enforcement history, and arranging for false information to be given to Welo by third parties.

Failure of FR5 for Material Falsification leads to Technical Refusal, or to revocation of an existing certificate, and may lead to an exclusion period under Clause 25.6.

The business must not engage in any activity listed in Annex A, Part A.2, applying the whole-business rule of Clause 6.3.2.

FR6 is Not met where the business sells, offers, promotes for its own benefit or facilitates an excluded activity. A business that removes the excluded activity may reapply under Clause 25.5 once the removal has taken effect, and Welo may verify that the removal is real and lasting.

The business must demonstrate at least twelve months of commercial activity under Clause 7.2.

FR7 is Not met where the evidence does not establish twelve months of commercial activity. FR7 does not lead to any restriction on reapplication.

The business must control the Verified Domain and must have registered its Welo account with a corporate email address that meets Clause 8.3.

FR8 is Not met where the business cannot demonstrate domain control under Clause 8.3, where the domain is controlled by a person other than the Applicant and no authorization is shown, or where the application is submitted for a website the Applicant does not operate.

The website must meet the mandatory technical security baseline set out in Clause 13.3. The baseline covers HTTPS on all relevant pages, the minimum TLS configuration, the minimum HTTP protections proportional to the website's risk profile, and the absence of serious, exploitable, known vulnerabilities in publicly exposed software.

FR9 is Not met where Welo finds any condition listed in Clause 13.4. A business that fails FR9 may provide Corrective Action within the deadline of the Evidence Request; Welo then repeats the relevant checks.

Each payment service provider used on the website to accept payments from customers must either be a Recognized Payment Provider listed in Annex C, Part C.1, or pass an equivalence assessment under Annex C, Part C.3.

Where the website collects payment card data on its own pages rather than through a provider-hosted page or provider-hosted fields, the business must provide a current PCI DSS Attestation of Compliance or equivalent validation appropriate to its merchant level.

FR10 is Not met where a payment provider is neither recognized nor shown to be equivalent, where card data is collected on the business's own pages without the validation required by Clause 9.11.2, or where the payment flow sends customers to a payment page on a domain that is not identified as belonging to the business or its payment provider.

A business that carries on an activity for which Annex B requires an authorization, license or registration must hold it, in its own name or through an authorized entity it identifies, for each Market Served in which it offers the activity. The authorization must cover the activity actually offered.

Welo verifies the authorization in the official register of the competent authority. A document supplied by the business does not replace the register check where a public register exists.

FR11 is Not met where the authorization is missing, expired, suspended, limited in a way that excludes the activity offered, held by a different entity without a documented arrangement, or where the business presents itself as authorized in a market where it is not.

Before the customer is bound to pay, the business must show:

1. a)
   the total price of the order, including all mandatory charges, taxes the business is required to include, and delivery charges, or, where these cannot be calculated in advance, the way they will be calculated;
2. b)
   for any recurring charge or free trial that converts to a paid plan: the amount of each charge, its frequency, the date or event on which charging starts, the minimum term if any, and how to cancel;
3. c)
   the existence and main conditions of any right of withdrawal, return or refund, or the fact that no such right applies where the law permits.

A business that sells recurring contracts must provide a cancellation method that is accessible, that does not require more steps or effort than enrollment, and that meets the cancellation requirements of the Markets Served (Clause 16.4).

A business must not charge a consumer for an optional paid addition by means of a pre-selected option where the law of the consumer's market requires the consumer's express consent to that payment (Clause 17.2).

FR12 is Not met where any element of Clause 9.13.1 is missing or materially inaccurate, where recurring charges are taken without the disclosure in Clause 9.13.1(b), where no workable cancellation method exists, or where Clause 9.13.3 is breached.

The Trust Topic Requirements are eight scored topics. Each topic contains criteria listed in Annex D with a criterion weight and an applicability rule. The topic weights are fixed, public and identical for every Business Model Category.

• TTR1 · Identity and Ownership
  15%
• TTR2 · Security
  15%
• TTR3 · Privacy and Data Handling
  10%
• TTR4 · Payments and Checkout
  15%
• TTR5 · Legal Policies and Consumer Protection
  15%
• TTR6 · Support and Dispute Handling
  10%
• TTR7 · Reputation and Behavior
  10%
• TTR8 · Risk Signals
  10%

Total 100%

The topic weights in Clause 10.1.1 are the weights published in WTS v2.4. They must not be adjusted for an individual business, a Business Model Category or a commercial plan. Differences between business models are handled only through criterion applicability within a topic (Clause 11.3.3).

Every topic contains criteria that apply to every business. No topic can become wholly not applicable, and every topic contributes its full weight to the Trust Score.

TTR1. Identity and Ownership measures how clearly and consistently the business identifies itself and the persons behind it, and how well that identity holds up against official registers and independent sources. Criteria: TTR1.1 Legal identity disclosure on the website; TTR1.2 Consistency of identity across register, application, website and documents; TTR1.3 Ownership and control transparency; TTR1.4 Physical presence and reachable address; TTR1.5 Domain and brand control; TTR1.6 Operating history depth and continuity; TTR1.7 Consistency of external business presence.

TTR2. Security measures the security of the website above the mandatory baseline of FR9, as far as it can be observed through Passive Technical Checks and evidence supplied by the business. Criteria: TTR2.1 TLS configuration quality; TTR2.2 HTTP security headers; TTR2.3 Software currency and known vulnerabilities; TTR2.4 Payment data handling and customer authentication; TTR2.5 Email domain authentication; TTR2.6 Customer account security; TTR2.7 Security contact and incident handling; TTR2.8 Third-party script and content integrity.

TTR3. Privacy and Data Handling measures whether the privacy information is complete and accurate, whether consent is handled as the Markets Served require, and how personal data requests are dealt with. Criteria: TTR3.1 Privacy notice completeness; TTR3.2 Accuracy of the notice against observed processing; TTR3.3 Cookie and tracker consent; TTR3.4 Data subject rights handling; TTR3.5 Data minimization at collection points; TTR3.6 Processors, recipients and international transfers; TTR3.7 Children's data and sensitive data safeguards.

TTR4. Payments and Checkout measures price transparency, the clarity of billing and renewal terms, consent to charges and the absence of pressure in the purchase flow. Criteria: TTR4.1 Total price presentation; TTR4.2 Seller, merchant of record and charge identification; TTR4.3 Optional extras and default selections; TTR4.4 Recurring charge disclosure and consent; TTR4.5 Cancellation of recurring contracts; TTR4.6 Order confirmation and transaction records; TTR4.7 Absence of pressure tactics in the purchase flow; TTR4.8 Market-appropriate payment information.

TTR5. Legal Policies and Consumer Protection measures whether the rules on returns, refunds, cancellation, delivery and guarantees are complete, usable and suited to the business and its markets, whether material claims are supported, and whether essential pathways are accessible. Criteria: TTR5.1 Terms of sale or service; TTR5.2 Withdrawal and return rights; TTR5.3 Refund terms and timing; TTR5.4 Delivery terms; TTR5.5 Legal guarantee and warranty information; TTR5.6 Policy accessibility and version history; TTR5.7 Substantiation of claims; TTR5.8 Accessibility of essential pathways.

TTR6. Support and Dispute Handling measures access to real support, response times, the quality of answers and the existence of a path to resolve disputes. Criteria: TTR6.1 Support channels and visibility; TTR6.2 Initial response time; TTR6.3 Quality of resolution in test contacts; TTR6.4 Complaint and escalation procedure; TTR6.5 Dispute resolution information; TTR6.6 Support coverage for Markets Served.

TTR7. Reputation and Behavior measures patterns in what customers, regulators and payment partners report about the business over time, and how the business collects and responds to reviews. Criteria: TTR7.1 Independent review footprint; TTR7.2 Recurring unresolved complaint themes; TTR7.3 Review solicitation practices; TTR7.4 Incentivized review disclosure; TTR7.5 Conduct in public responses; TTR7.6 Regulatory and legal history; TTR7.7 Payment dispute indicators.

TTR8. Risk Signals measures indicators associated with deceptive or unstable operations that do not on their own establish a Foundation Requirement failure. Criteria: TTR8.1 Domain registration age and history; TTR8.2 Hosting and infrastructure signals; TTR8.3 Authenticity of website content; TTR8.4 Consistency between marketing and the website; TTR8.5 Legitimacy of displayed trust marks and endorsements; TTR8.6 Adverse media and watchlists; TTR8.7 Stability of business behavior over time.

A risk signal scored under TTR8 that reaches the evidence standard of Clause 19.6 for a condition listed in FR4 is assessed under FR4 as well.

The Trust Score is calculated only when every applicable Foundation Requirement has been determined and every applicable criterion has received a score. While any applicable criterion is Pending, the evaluation is incomplete and no Trust Score is calculated or published.

Each applicable criterion receives one of the following scores, applying the level descriptors for that criterion in Annex D:

A criterion has two further possible states, neither of which is a score:

1. a)
   Not Applicable (N/A): the applicability rule in Annex D excludes the criterion for this business. N/A criteria are left out of the calculation.
2. b)
   Pending: the criterion applies, but Welo does not yet hold the evidence needed to score it. A Pending criterion must not be scored 0, and must not be scored at any other level, until the evidence is obtained.

A score of 0 records a finding supported by evidence. A missing document, an unanswered Evidence Request or a check that could not be run is recorded as Pending, never as 0. Where the deadline for an Evidence Request expires, Clause 8.4.4 applies.

For each topic t, let A(t) be the set of applicable criteria in that topic, w(c) the criterion weight of criterion c from Annex D, and s(c) its score from 0 to 4. The Topic Score is:

Topic Score T(t) = 100 × [ Σ over c in A(t) of ( w(c) × s(c) ) ] ÷ [ 4 × Σ over c in A(t) of w(c) ]

The Topic Score ranges from 0 to 100. It equals 100 only if every applicable criterion in the topic scores 4.

When a criterion is Not Applicable, its weight is removed from both the numerator and the denominator of its own topic. The weights of the remaining applicable criteria in the same topic therefore increase in proportion. Weights are never moved from one topic to another.

The Trust Score S is the weighted sum of the eight Topic Scores:

S = 0.15 × T(TTR1) + 0.15 × T(TTR2) + 0.10 × T(TTR3) + 0.15 × T(TTR4)
  + 0.15 × T(TTR5) + 0.10 × T(TTR6) + 0.10 × T(TTR7) + 0.10 × T(TTR8)

The Trust Score ranges from 0 to 100.

Topic Scores and the Trust Score are calculated without intermediate rounding. Where software stores the values in decimal form, it must keep at least six decimal places.

Every threshold in this Standard is compared with the unrounded value. A value meets a threshold only if it is equal to or greater than the threshold.

Published scores are the unrounded values truncated to a whole number (the decimal part is dropped). Because every threshold in this Standard is a whole number, a published score meets a threshold exactly when the unrounded value meets it. A Trust Score of 74.98 is published as 74 and does not meet the Blue Badge threshold of 75.

Annex E contains a complete worked calculation and the threshold tests at 74, 75, 89 and 90 for the Trust Score and at 59, 60, 84 and 85 for Topic Scores.

The level descriptors in Annex D are written so that two Reviewers examining the same evidence reach the same score. Where a Reviewer considers that a case falls between two levels, the Reviewer applies the lower level and records the reason. A Second Reviewer resolves any disagreement under Clause 20.5.

A business qualifies for the Blue Badge when all of the following are true:

1. a)
   every applicable Foundation Requirement is Met;
2. b)
   the Trust Score is at least 75;
3. c)
   every Topic Score is at least 60;
4. d)
   the evaluation is complete under Clause 11.1.

A business whose Foundation Requirements are all Met but whose Trust Score is below 75, or whose Topic Score is below 60 in any topic, receives a Technical Refusal on the ground of score, with the scores and the criteria that limited them (Clause 25.2).

A business qualifies for the Gold Badge when all of the following are true:

1. a)
   every applicable Foundation Requirement is Met;
2. b)
   the Trust Score is at least 90;
3. c)
   every Topic Score is at least 85;
4. d)
   at least twelve months have passed since the Issue Date of the business's first Welo certificate for the same Verified Domain;
5. e)
   the business has completed, after the twelve-month period in item (d), a full verification cycle with a positive outcome, which is either its Scheduled Reassessment or a full reassessment requested for Gold consideration;
6. f)
   a Second Reviewer has confirmed the findings and the scores under Clause 20.5;
7. g)
   the business has not had its certificate revoked, and has not had it suspended on a ground that was upheld, during the twelve months before the Gold decision.

The twelve-month period in Clause 12.2.1(d) runs from the Issue Date of the first certificate. The age of the business, the length of its commercial relationship with Welo before certification, and the commercial plan it holds do not shorten that period.

The Gold Badge cannot be purchased. No commercial plan, payment, discount, partnership or referral grants the Gold Badge, accelerates eligibility for it or changes any of the conditions in Clause 12.2.1.

Welo grants the Gold Badge to every business that meets Clause 12.2.1. Welo does not apply a quota or a discretionary selection.

At a Scheduled Reassessment, the badge level is set again from the new results. A Gold Badge holder that meets the Blue Badge conditions but not the Gold Badge conditions receives a Blue Badge certificate. A business that meets neither is not renewed, and its certificate expires at the expiration date unless Clause 23 applies earlier.

Where a Risk-Triggered Review rescores criteria during a certification cycle:

1. a)
   if the business still meets the conditions for its current level, the level is unchanged;
2. b)
   if a Gold Badge holder no longer meets the Gold Badge conditions but meets the Blue Badge conditions, the badge level changes to Blue for the rest of the cycle;
3. c)
   if a business no longer meets the Blue Badge conditions, the certificate is suspended under Clause 23.4.

Every change of level is recorded with its date and reason and shown on the Welo Page under Clause 26.

This clause sets the security conditions every certified website must meet (assessed under FR9) and the method Welo uses to observe them. Security above the baseline is scored under TTR2.

Welo assesses security from the outside, through Passive Technical Checks, and from evidence supplied by the business. Welo does not perform penetration testing, source code review, infrastructure audits or social engineering as part of the Welo Badge. A certificate is not a statement that the website has no vulnerabilities.

The baseline in Clause 13.3 depends on the risk profile of the website:

A website that meets the description of more than one profile is assessed under the highest profile.

Every website must meet the following conditions:

1. a)
   every page and every resource of the listed hostnames is served over HTTPS, and every request made over plain HTTP is permanently redirected to HTTPS;
2. b)
   the TLS certificate is valid, unexpired, issued for the hostname and trusted by current versions of the major browsers;
3. c)
   the server accepts only TLS 1.2 or later, and does not accept SSL 2.0, SSL 3.0, TLS 1.0 or TLS 1.1;
4. d)
   the server does not accept cipher suites without encryption (NULL), export-grade cipher suites, cipher suites using RC4, or anonymous key exchange;
5. e)
   no page loads active content (scripts, stylesheets, frames or other executable resources) over plain HTTP;
6. f)
   the website does not expose, in publicly served files or response headers, a software component whose identified version has a known vulnerability that is listed in the CISA Known Exploited Vulnerabilities catalog, or that has a CVSS base score of 9.0 or higher and is exploitable over the network without authentication, unless the business shows that a vendor patch or mitigation has been applied.

A Profile 2 or Profile 3 website must also meet the following conditions:

1. a)
   cookies used for login sessions or authentication carry the Secure attribute;
2. b)
   responses include an HTTP Strict Transport Security header;
3. c)
   pages with login or payment forms are protected from being framed by other sites, through the Content-Security-Policy frame-ancestors directive or the X-Frame-Options header.

A Profile 3 website must also meet one of the following conditions on pages where payment data is entered: the payment fields are hosted by the payment provider (redirect, hosted payment page or provider-hosted fields), or the business applies a Content Security Policy that restricts the sources of scripts on those pages and supplies the PCI DSS validation required by Clause 9.11.2.

FR9 is Not met where any condition in Clause 13.3 that applies to the website's profile is not met, or where Welo finds that the website is compromised (for instance, injected scripts, unauthorized redirects or defacement).

Welo informs the business of every failed condition, the observation that shows it and the date of observation. The business may provide Corrective Action within the deadline of the Evidence Request. Welo then repeats the relevant checks and records the new result.

Under the authorization given by the application (Clause 8.6.1), Welo may perform the following Passive Technical Checks:

1. a)
   connecting to the website over HTTPS and recording the certificate, the protocol versions and the cipher suites offered;
2. b)
   recording the HTTP response headers and cookies returned for pages an ordinary visitor can reach;
3. c)
   loading pages in a browser and recording the resources loaded, the scripts executed, the third parties contacted and the cookies set, before and after interaction with any consent mechanism;
4. d)
   reading publicly served files that ordinary browsers or crawlers request, such as robots.txt, sitemap files and the security.txt file;
5. e)
   identifying software components and versions from information the website publishes in its pages, headers or public assets, and comparing them with public vulnerability databases;
6. f)
   querying DNS records (such as MX, SPF and DMARC records), registration data services (WHOIS or RDAP), Certificate Transparency logs and reputation or blocklist services;
7. g)
   examining email messages that Welo receives from the business in the ordinary course of the verification, including their authentication results;
8. h)
   consulting archived copies of the website held by public archive services;
9. i)
   making test contacts and test purchases as an ordinary customer (Clause 19.4).

Passive Technical Checks are performed at a request rate no higher than that of an ordinary visitor.

Welo performs the following only with the specific written authorization described in Clause 8.6.2: active vulnerability scanning; requests designed to discover files, directories or endpoints that the website does not link to or publish; testing of login, password reset or account functions beyond ordinary use; any test that submits unusual or malformed input to forms or interfaces; port scanning beyond the standard web ports.

A business is not required to authorize these checks. Refusing authorization does not affect any Foundation Requirement or score. Where a business supplies results of its own security testing, Welo may take them into account under TTR2.

As part of the Welo Badge, Welo does not perform penetration testing, source code review, review of server or cloud configuration, denial-of-service or load testing, physical security assessment, or social engineering of the business's staff.

Annex C, Part C.1 lists the Recognized Payment Providers. A provider is included in the list when Welo has confirmed, from public and official sources, that it meets the provider requirements in Clause 14.2.

A business that uses only Recognized Payment Providers, and uses them through the provider's hosted or tokenized integration, meets FR10 for the choice of provider. The business still has to meet the merchant requirements in Clause 14.3.

A payment service provider meets the provider requirements when all of the following are shown:

1. a)
   PCI DSS validation. For services that store, process or transmit payment card data, a current PCI DSS Attestation of Compliance as a service provider, or listing as a validated service provider in a registry maintained by a major card network;
2. b)
   Encryption in transit. Cardholder and payment data are transmitted over HTTPS with a TLS configuration that meets Clause 13.3.1(c) and (d);
3. c)
   Card data protection. The provider offers tokenization, a hosted payment page or provider-hosted payment fields, so that merchants can accept cards without card data reaching their own servers, or demonstrates equivalent controls;
4. d)
   Customer authentication. The provider supports 3-D Secure and the strong customer authentication required by the law of the markets where the merchant uses it;
5. e)
   Fraud controls. The provider operates fraud detection and prevention measures appropriate to the payment methods it offers;
6. f)
   Regulatory standing. The provider, or the regulated entity through which it operates, holds the authorizations required to provide payment services in the markets where it offers them, and documents the allocation of security responsibilities between itself and its merchants;
7. g)
   Continuing compliance. The provider's validation and authorization are current at each review of the list under Clause 14.5.

A business that accepts online payments must:

1. a)
   accept card payments through the provider's hosted page, redirect or provider-hosted fields, or provide PCI DSS validation under Clause 9.11.2;
2. b)
   apply strong customer authentication where the law of the market requires it, and not configure its payment flow to avoid authentication where an exemption does not apply;
3. c)
   ensure that the name shown on customers' card or bank statements allows customers to identify the business (TTR4.2);
4. d)
   direct any bank transfer only to an account held in the name of the certified entity, or of a payment agent the business discloses;
5. e)
   refund payments through the original payment method, or another method the customer accepts, within the period required by law or stated in the business's terms, whichever is shorter.

A business must not direct customers to pay to a personal account, to an account in the name of a person other than the certified entity or its disclosed payment agent, or through gift cards, prepaid vouchers or crypto-asset transfers presented as the only way to complete a purchase of ordinary goods or services. A breach of this clause is assessed under FR4.

A business that uses a payment service provider not listed in Annex C, Part C.1 must supply the evidence listed in Annex C, Part C.3. Welo assesses whether the provider meets each requirement of Clause 14.2.

Where the provider meets every requirement, Welo records the assessment, and the provider counts as equivalent for that business. Welo may rely on the same assessment for other businesses using the same provider for up to twelve months from the date of the assessment.

Where the provider does not meet a requirement, FR10 is Not met for as long as the business uses that provider to accept payments on the Verified Domain.

Welo reviews the Recognized Payment Provider list at least once a year and whenever Welo becomes aware that a listed provider has lost a validation or authorization, has suffered a significant security incident affecting merchants, or has stopped offering a service.

Where a provider is removed from the list, each Certified Business using it is notified and is assessed under Clause 14.4 at its next Scheduled Reassessment, or earlier through a Risk-Triggered Review where the reason for removal creates a Material Risk.

Welo assesses the privacy information published by the business, the consent mechanisms on the website, the behavior of the website as observed through Passive Technical Checks, and the business's process for handling requests about personal data. Welo does not carry out a full data protection audit and does not certify compliance with any data protection law.

The privacy notice must identify the business as the party responsible for the personal data, give a contact for privacy questions, and describe in a way an ordinary customer can understand:

1. a)
   the categories of personal data collected and their sources;
2. b)
   the purposes of processing and, where the law of a Market Served requires it, the legal basis for each purpose;
3. c)
   the categories of recipients, including service providers that process data on the business's behalf;
4. d)
   transfers of personal data to other countries and the safeguards relied on, where the law of a Market Served requires this information;
5. e)
   how long the data is kept, or the criteria used to decide;
6. f)
   the rights available to customers and how to exercise them, including any right to complain to a supervisory authority;
7. g)
   the use of cookies and similar technologies, or a link to a separate notice that describes them;
8. h)
   any sale or sharing of personal data for advertising, where the law of a Market Served requires this disclosure, together with the method to opt out.

The privacy notice must describe the processing the business actually carries out. Welo compares the notice with the forms on the website, the third parties contacted by the website, the cookies and trackers observed, and the business's communications. A material difference is scored under TTR3.2. A statement in the notice that is contradicted by the website's behavior on a point that matters to customers, such as a statement that no data is shared with advertisers while advertising trackers are active, is a serious deceptive practice under Clause 17.3.

Clause 9.4.2 sets the mandatory condition. Beyond it, Welo scores under TTR3.3 whether non-essential technologies stay inactive until consent where consent is required, whether refusing is as easy as accepting, whether consent can be withdrawn at any time, and whether the website honors browser-based opt-out signals in Markets Served whose law gives them effect.

The business must provide a channel through which customers can exercise their rights over their personal data, and should answer within the period set by the law of the customer's market. Welo assesses the channel, the documented procedure and any records the business supplies. Welo does not submit false requests to test the procedure.

Marketing emails and messages must identify the business and include a working method to unsubscribe. Where the law of a Market Served requires consent for marketing communications, the business must obtain it before sending. Welo assesses this from the sign-up flows and from any marketing messages it receives during the verification.

Where a business directs its services to children, or processes health data, biometric data or other categories of data that the law of a Market Served protects specifically, the business must describe the additional safeguards it applies, and Welo scores them under TTR3.7.

The terms of sale or service must identify the seller, describe how a contract is formed, state the main characteristics of the goods or services or refer to where they are stated, explain pricing and payment, delivery or performance, cancellation, withdrawal, returns and refunds, guarantees, complaints, and the law and forum that apply where the business is free to choose them.

A term that would deprive consumers of a right the law of their market grants them, or that is presented in a way that suggests such a right does not exist, is scored at 0 under TTR5.1 and, where it is used to refuse a consumer a right in practice, is assessed under FR4.

Where consumers in a Market Served have a statutory right to withdraw from a distance contract, the business must inform them of the right, its period, its conditions and how to exercise it, including any withdrawal function the law of that market requires for contracts concluded online, and must honor withdrawals made in accordance with the law.

Where the law permits an exception to the right of withdrawal for a type of product, the business may apply it only if it informs the consumer before the contract and, where the law requires, obtains the consumer's acknowledgment.

A business that offers a voluntary returns policy more generous than the law must state its conditions, and must not present the voluntary policy in a way that hides or reduces the statutory right.

The business must state when and how refunds are made, through which payment method, which costs are refunded and which are borne by the customer, and the maximum time from the event that triggers the refund to the refund itself. Where the law of a Market Served sets a maximum time, the stated time must not exceed it.

A business that sells recurring contracts must:

1. a)
   allow customers who enrolled online to cancel online, through a method that is easy to find and use and that does not require more steps, contacts or effort than enrollment;
2. b)
   not require a telephone call, a chat with a retention agent or a written letter as the only way to cancel a contract concluded online, unless the law of the customer's market expressly permits it and the business also offers an online method;
3. c)
   confirm the cancellation to the customer in writing, with the effective date;
4. d)
   send any renewal, trial-end or price-change notices required by the law of the customer's market;
5. e)
   stop charging from the effective date of cancellation.

Presenting offers to retain a customer during cancellation is permitted where the law of the customer's market permits it, where the customer can decline in one step, and where declining leads directly to completion of the cancellation.

A business that sells physical goods must state the destinations it delivers to, the delivery costs, the estimated delivery times, the country from which goods are shipped where it differs from the business's country, and who bears any customs duties or import taxes. Annex B, Part B.10 sets additional requirements for dropshipping retailers.

A business that sells goods or digital content to consumers must inform them of any statutory guarantee of conformity in their market and must not present a commercial warranty in a way that suggests it replaces or limits the statutory guarantee.

The business must provide at least one working support channel and must normally send an initial response within two business days (FR2, Clause 9.3.4). The business should provide support in the languages in which it sells, should publish its support hours, and should publish how complaints are escalated when a first answer does not resolve them.

The business must inform consumers of any alternative dispute resolution body it is obliged to use, or has committed to use, in a Market Served.

Welo assesses whether customers using assistive technology or keyboard navigation can complete the essential pathways of the website: finding products or plans, reading the price and the terms, completing checkout or signup, contacting support and cancelling a recurring contract. Welo uses the success criteria of the Web Content Accessibility Guidelines at level AA as its reference for this assessment and scores the result under TTR5.8.

Where the law of a Market Served imposes accessibility requirements on the business, the business is responsible for meeting them. Welo's assessment under Clause 16.8.1 covers the essential pathways only and is not a statement of conformity with any accessibility law or standard.

Prices must be shown in a way that allows the customer to know the total amount to be paid before committing to the transaction (FR12). Mandatory charges must be included in the price shown or stated next to it with equal prominence; they must not be added only at the final step of checkout.

Where the business announces a price reduction to consumers in a market whose law regulates the reference price, the reference price must meet that law. Where no such law applies, the reference price must be a price at which the business genuinely offered the product for a substantial period before the reduction.

An optional paid addition is any goods, service, insurance, warranty, donation or fee that the customer can decline without losing the main purchase.

A business may present an optional paid addition as pre-selected only where all of the following are true:

1. a)
   the law of the customer's market permits a pre-selected option for that payment in that type of transaction;
2. b)
   the addition and its price are shown next to the selection control and in the order summary before payment;
3. c)
   the customer can deselect it in one step without leaving the checkout;
4. d)
   the addition is not described in a way that suggests it is mandatory.

For consumer contracts in markets that require the consumer's express consent to any payment beyond the main obligation, including the member states of the European Union and the European Economic Area, a pre-selected paid addition does not obtain that consent and is not permitted. Using one is a failure of FR12 (Clause 9.13.3).

Where pre-selection is lawful and the conditions of Clause 17.2.2 are met, the practice is scored under TTR4.3. Pre-selection lowers the score of that criterion compared with an unselected option.

Clause 17.2 does not authorize any practice that the law of a Market Served prohibits. A business remains responsible for the consent requirements of every market it serves.

A serious deceptive practice is a practice that is likely to cause an average customer to take a decision to buy, subscribe, pay or stay subscribed that they would not otherwise have taken, by giving false information or by presenting true information in a misleading way. The following are serious deceptive practices for the purposes of FR4:

1. a)
   countdown timers, deadlines or "offer ends" messages that reset, restart or continue after the stated time without the offer ending, or that refer to a deadline that does not exist;
2. b)
   statements about limited stock, limited places or demand ("only 2 left", "15 people are viewing this") that are false or generated without reference to actual stock or activity;
3. c)
   notifications of purchases by other customers that did not take place;
4. d)
   reference prices or discounts that are fictitious;
5. e)
   enrolling customers in a recurring contract, or charging them a recurring fee, without the disclosure and consent required by FR12;
6. f)
   fake, purchased or fabricated reviews or testimonials, reviews written by the business or its insiders without disclosure, or reviews presented as coming from customers when they do not;
7. g)
   displaying trust marks, certifications, awards, partnerships or media mentions that the business has not obtained;
8. h)
   claims of government, regulatory or official approval that do not exist;
9. i)
   offering a product at a price with no intention of supplying it at that price, in order to sell a different product;
10. j)
    concealing the identity of the seller, the country from which goods are shipped, or the fact that the seller is a reseller, where this information affects the customer's rights or costs;
11. k)
    material claims about performance, earnings, health effects or results that the business cannot support with evidence meeting Clause 17.4;
12. l)
    any practice listed as prohibited in all circumstances by the consumer protection law of a Market Served.

Countdowns, low-stock messages and time-limited offers are permitted when they are true. The business must be able to show Welo the rule or the data on which the message is based.

A practice that misleads in a minor way, without a likely effect on the customer's decision, is scored under the relevant criterion and is not an FR4 failure.

A business must be able to support with suitable evidence every material claim it makes about its goods, services, results, performance, earnings potential, health effects, environmental characteristics, origin, awards or customer numbers. Suitable evidence is evidence of a type and quality that experts in the relevant field would accept for the claim made; for health and earnings claims, Annex B sets specific requirements.

Welo examines a sample of the material claims on the website and in the business's advertising that Welo can observe. Claims the business cannot support are scored under TTR5.7, and claims that meet Clause 17.3.1(k) are assessed under FR4.

Where the business uses endorsements by influencers, affiliates or experts, the commercial relationship must be disclosed in the endorsement where the law of a Market Served requires it. Undisclosed paid endorsements presented as independent opinions are scored at 0 under TTR8.5 and, where they reach the level of Clause 17.3.1(f), assessed under FR4.

This clause covers three different things, which Welo keeps separate:

1. a)
   Welo Reviews, which Welo collects and publishes on the Welo Page (Clauses 18.2 to 18.8);
2. b)
   the review practices of the business itself on its own website and on third-party platforms (Clauses 18.9 and 18.10);
3. c)
   the reputation of the business as shown by independent sources, scored under TTR7 (Clause 18.11).

Welo's review collection system gives every genuine customer the same opportunity to leave a review, whatever their experience. When a business uses Welo's system to invite customers, it must submit every customer who completed a transaction in the period covered by the invitation, or connect an integration that sends all of them automatically. The business must not select, exclude or time invitations according to the experience, satisfaction or expected rating of the customer.

A customer who has bought from a Certified Business may submit a Welo Review without an invitation, by providing proof of the transaction.

Welo publishes a Welo Review with the label "Verified customer" only when Welo has linked it to a transaction or to other proof that the reviewer was a customer of the business. Welo describes on every Welo Page how it checks that reviews come from customers.

Welo compares the number of invitations a business submits with the transaction volumes it has declared or that Welo can observe. A material and unexplained gap leads to an Evidence Request. Where Welo finds that a business has selected invitations by expected sentiment, Welo stops accepting invitations from that business, publishes a notice on the Welo Page stating that the business's invitations were found to be selective, and assesses the conduct under FR4.

Welo does not import reviews collected by the business or by other platforms into the Welo Review collection or into the Welo rating. Reviews published on the Welo Page as Welo Reviews were all submitted to Welo directly.

The Welo Page may show links to the business's profiles on other review platforms, identified with the name of the platform. Ratings from other platforms, where shown, are displayed separately, with their source and the date they were retrieved, and are never combined with the Welo rating.

Every Welo Review keeps its original submission date. An edit by the reviewer is shown with the date of the edit. Welo does not change the content, the rating, the date or the source of a review, except to remove content under Clause 18.6.1(c) and to record the edit.

The Welo rating is calculated from all published Welo Reviews using a method Welo describes on the Welo Page. Welo does not weight reviews by the business's commercial plan, its response to the review, or its request.

A business, or Welo on its behalf, may offer customers an incentive to write a review only where the incentive is the same for every customer invited, is not conditional on the review being positive or on any particular rating or content, and is disclosed on the published review.

An incentive that is conditional, expressly or by implication, on the sentiment of the review is prohibited and is assessed under FR4.

Welo removes a Welo Review, or part of it, only on one of the following grounds:

1. a)
   Not a genuine experience. Welo has established that the review does not reflect a genuine experience of the reviewer with the business, because the reviewer was not a customer, the review was written by or for the business, a competitor or a person acting for either, or the review was generated or purchased;
2. b)
   Undisclosed conflict of interest. The reviewer is an owner, manager, employee or relative of the business or of a competitor, and the relationship is not disclosed;
3. c)
   Content in breach of the content rules. The review contains unlawful content, threats, hate speech, personal data of another person, confidential information, spam, or material unrelated to the reviewer's experience with the business; where possible, Welo removes only the offending part;
4. d)
   Withdrawal by the reviewer. The reviewer asks Welo to withdraw or change the review, of their own choice;
5. e)
   False central factual allegation. The central factual allegation of the review was untrue at the time the review was written (for instance, the review states that no refund was made when the refund had already been made before the review was written), the business has shown this with evidence, and the reviewer, after being informed and given fourteen calendar days to respond, has not provided evidence to the contrary;
6. f)
   Wrong business or duplicate. The review concerns a different business or duplicates a review by the same reviewer about the same transaction.

Resolution of the problem after the review was written is not, by itself, a ground for removal. When a business shows that it has resolved the issue described in an authentic review:

1. a)
   Welo adds to the review a visible "Resolved by the business" label with the date and the business's description of the resolution, after checking the evidence;
2. b)
   Welo informs the reviewer and offers the reviewer the option to update the review, add a comment, or withdraw it;
3. c)
   the review remains published and counted in the Welo rating unless the reviewer chooses to change or withdraw it, or another ground in Clause 18.6.1 applies.

Welo retains discretion to remove a review after a demonstrated resolution only where one of the grounds in Clause 18.6.1 applies. Welo does not remove an authentic review because the business has refunded, compensated or satisfied the reviewer afterwards, because the business asks for removal, or because the review is negative.

A business must not make a refund, replacement, compensation or any other benefit conditional on the customer removing, changing or not writing a review, and must not threaten customers with legal action or other consequences because of a truthful review. A breach of this clause is assessed under FR4.

Welo publishes on each Welo Page, for the preceding twelve months, the number of Welo Reviews removed or partly removed for each ground in Clause 18.6.1, and the number of reviews carrying the "Resolved by the business" label.

A business may publish one public response to each Welo Review and may update it. Responses are moderated under the content rules in Clause 18.6.1(c). A response must not disclose personal data of the reviewer beyond what the reviewer published, and must not contain threats or accusations not supported by evidence.

When Welo removes, partly removes, labels or refuses to remove a review, it informs the reviewer and the business of the decision, the ground in Clause 18.6.1 or 18.6.2 relied on, and how to appeal.

Welo keeps a record of every moderation action, including the review concerned, the ground, the evidence considered, the person who decided, the date and time, and any appeal.

The reviewer and the business may appeal a moderation decision within six months of the notice. The appeal is decided by a person who did not take the original decision. Welo normally decides a complete moderation appeal within fifteen business days.

Welo assesses how the business collects, displays and responds to reviews on its own website and on other platforms, using the criteria TTR7.3 to TTR7.5.

Selective solicitation. Selective solicitation (also called review gating) means inviting customers to leave public reviews, or directing them to a public review platform, according to their expected or stated satisfaction, while steering dissatisfied customers to a private channel. Under this Standard, selective solicitation outside Welo's system is scored at 0 under TTR7.3. The score reduction is a Welo scoring rule. It is not a statement that selective solicitation is lawful in any market; the business remains responsible for the law of its Markets Served and for the rules of the platforms it uses.

Selective solicitation is assessed under FR4, in addition to TTR7.3, where any of the following is true:

1. a)
   it is used with Welo's review system (Clause 18.2.1);
2. b)
   the business presents the resulting reviews or rating as complete or representative of its customers;
3. c)
   it is combined with the suppression or concealment of negative reviews;
4. d)
   the law of a Market Served prohibits it.

Display of reviews on the business's website. A business that displays reviews on its website must not hide, delete or demote reviews because they are negative while presenting the remaining reviews as all or most of the reviews it received. Where it selects which reviews to display, it must say so next to the reviews. A breach of this clause is assessed under FR4.

Fake and insider reviews. Practices listed in Clause 17.3.1(f) are assessed under FR4.

Welo reads independent reviews and complaints about the business on platforms not controlled by the business, and in public complaint records, to assess TTR7.1 and TTR7.2. Welo weighs each source according to whether it verifies purchases, how it handles fake reviews, and whether the business can respond.

For the purposes of FR4, a recurring pattern of unresolved consumer harm exists where complaints from at least five different customers, published or recorded in at least two independent sources within the preceding twelve months, describe the same type of harm (such as goods paid for and not delivered, charges the customer did not authorize, or refunds owed by law and not made), and the business cannot show with evidence that the complaints were resolved or unfounded.

Complaints that the business has resolved, complaints shown to be unfounded, and complaints that Welo cannot connect to genuine transactions do not count toward the pattern.

Welo relies on the following sources:

1. a)
   official registers kept by public authorities, such as business registers, regulatory registers and court records;
2. b)
   independent third-party sources, such as payment network registries, reputation and blocklist services, review platforms, public complaint records, archives and media;
3. c)
   Welo's direct observation of the website, including Passive Technical Checks, test contacts and test purchases;
4. d)
   documents supplied by the business whose origin can be checked, such as documents issued by authorities, banks or payment providers;
5. e)
   declarations of the business.

Welo cross-checks the evidence supplied by the business against independent sources wherever this is reasonably possible. Each finding that a Foundation Requirement is Met records at least one source of type (a), (b) or (c) in Clause 19.1.1, except where no such source exists for the point in question, in which case the record states why.

Where sources conflict, the source higher in the list in Clause 19.1.1 prevails unless the business shows that it is out of date or wrong. The conflict and its resolution are recorded.

The depth of evidence Welo requires depends on risk. The rules do not change between levels; the amount of proof needed to reach a conclusion does.

If the evidence available is not enough for the level that applies, the requirement concerned remains Undetermined and the evaluation remains incomplete.

Welo may contact the business's support and may buy goods or services from the business as an ordinary customer would, at its own expense, including requesting a cancellation, return or refund that the business's terms or the law allow.

Welo does not disclose in advance which contacts or purchases are tests. Welo does not use a test to cause loss to the business, and returns goods or cancels services only within the rights any customer has.

When material information cannot be verified, Welo sends an Evidence Request and places the requirement or criterion on hold. Welo does not assume a favorable or unfavorable answer.

While any Foundation Requirement is Undetermined or any applicable criterion is Pending, the evaluation is incomplete, no Trust Score is issued and no approval or refusal on the merits is made, except that a Foundation Requirement found Not met may lead to Technical Refusal without waiting for other items.

A finding that a Foundation Requirement is Not met, or a score of 0 or 1 on a criterion, must rest on evidence that is recorded, dated, attributable to its source, and sufficient for a Second Reviewer looking only at the record to reach the same finding.

A finding of Serious Fraud or Material Falsification must rest on either one conclusive item of evidence (such as confirmation by the issuing authority that a document is forged, confirmation by a brand owner that goods are counterfeit, or a register showing that the declared entity does not exist) or at least two independent items of evidence that point to the same conclusion. Such a finding is always confirmed by a Second Reviewer.

An allegation by a third party, including a Consumer Report, is not on its own evidence of a breach. It is a reason for Welo to look for evidence (Clause 24).

Welo distinguishes information the business states from information Welo has verified. Welo applies the label "Verified" to a specific item on the Welo Page only under the following rules:

An item that does not meet these rules may be shown on the Welo Page only as a statement of the business, labeled as such, or not at all.

Each finding is recorded with the date of the observation or of the evidence it relies on. Evidence older than the following limits is not relied on for a new decision without being refreshed: official register extracts, ninety days; technical check results, thirty days; test contacts and test purchases, ninety days.

Every approval, refusal, suspension, revocation, change of badge level and moderation decision is recorded with the clauses applied, the findings, the evidence relied on, the Reviewer who decided, any Second Reviewer, and the date.

Every adverse decision communicated to a business states the clauses not met and summarizes the evidence relied on. Where part of the evidence came from a confidential antifraud method, Welo states the finding and the clause, and the decision rests on evidence the business can be told about. A confidential method that has not led to evidence the business can be told about is not a ground for an adverse decision.

A Second Reviewer is required for:

1. a)
   every Gold Badge decision;
2. b)
   every Technical Refusal, revocation or exclusion period based on FR4, FR5 or FR6;
3. c)
   every case the Reviewer records as materially ambiguous, meaning a case in which the outcome depends on a definition in Annex A or a level descriptor in Annex D that the Reviewer cannot apply without a judgment that could change the outcome, a case with unresolved conflicting evidence on a Foundation Requirement, or a case in which the Trust Score or a Topic Score is less than two points from a threshold that determines the outcome;
4. d)
   every decision on an appeal.

Clause 20.5 sets out how a second review is conducted.

Verification decisions are taken only by Reviewers authorized under Clause 20.2, applying this Standard. A decision is valid only when it is recorded with the information required by Clause 19.9.

Personnel whose role is commercial (sales, account management, partnerships, marketing) must not take, change or approve a verification decision, assign scores, mark a Foundation Requirement as Met, or instruct a Reviewer on the outcome of a case. They may pass to Reviewers information received from a business, which the Reviewer records as a declaration of the business.

Where the same person holds a commercial role and a Reviewer role, which can happen in a small team, that person must not review a business they sold to, negotiated with or manage commercially, and Clause 20.8 applies.

Before a person is authorized as a Reviewer, Welo must record that the person has completed training on this Standard, the Verification and Enforcement Manual, evidence handling and confidentiality, Passive Technical Checks, and the sector annexes for the categories they will review, and has passed a documented competence assessment that includes scoring sample cases.

Reviewers must complete training on each new version of this Standard before applying it.

Welo authorizes Reviewers for specific Business Model Categories. Cases in Higher-Risk Sectors are assigned only to Reviewers authorized for that sector.

The pay, bonus, commission or any other benefit of a Reviewer or Second Reviewer must not depend, directly or indirectly, on the number or proportion of approvals, on badge levels granted, on revenue generated by the businesses they review, or on the outcome of any case.

Commissions or incentives paid to commercial personnel must not be calculated in a way that rewards them for influencing a verification outcome. Welo may pay commercial personnel on revenue from businesses that are approved, provided they have no role in the decision under Clause 20.1.2.

Businesses pay Welo only after a positive verification decision (Clause 21). Welo recognizes that this creates a commercial incentive to approve, and controls it through the following measures, each of which is mandatory:

1. a)
   every criterion, weight and threshold is public, so that every approval can be checked against published rules;
2. b)
   Reviewers' compensation is independent of outcomes (Clause 20.3);
3. c)
   commercial personnel have no decision authority (Clause 20.1.2);
4. d)
   the Reviewer does not see the commercial plan or the price offered to the business while assessing it, where Welo's systems allow this separation, and in any case does not take it into account;
5. e)
   Gold Badge decisions, serious refusals, ambiguous cases and appeals require a Second Reviewer (Clause 19.10);
6. f)
   approvals and refusals are sampled for quality review (Clause 20.9);
7. g)
   every decision is logged with its evidence (Clause 19.9), so that a later review can reconstruct it;
8. h)
   the annual transparency report publishes approval and refusal figures (Clause 26.4).

A Second Reviewer reviews the record of the case and, where needed, the evidence and the website. The Second Reviewer records whether they agree with each Foundation Requirement finding and with each score that affects the outcome.

Where the Reviewer and the Second Reviewer disagree on a point that affects the outcome, they record their positions. The disagreement is decided by a person authorized to decide escalations under the Verification and Enforcement Manual, who did not take part in the case. Until the disagreement is decided, the decision is not issued.

Every Applicant declares any relationship with Welo and with consultants, agencies or referral partners under Clause 8.2.2(m).

Every Reviewer declares, before starting a case, any personal, family, financial, employment or commercial relationship with the business, its owners or managers, its competitors or any consultant involved. Every Reviewer also completes a general declaration of interests each year. A Reviewer with a conflict must not work on the case.

A business that is owned, controlled, managed or financed, in whole or in part, by Welo, by a Welo owner, director or manager, or by a member of their immediate family, is an affiliated business. An affiliated business:

1. a)
   is assessed against the same requirements, evidence levels and thresholds as any other business;
2. b)
   must declare the affiliation in its application;
3. c)
   is assessed by a Reviewer and a Second Reviewer who have no reporting line to the affiliated person; where Welo cannot assign two such persons, Welo engages a qualified reviewer outside its management line under a written confidentiality agreement, or does not assess the business;
4. d)
   has the affiliation disclosed on its Welo Page.

A consultant, agency or referral partner that helps a business prepare for or apply for the Welo Badge has no role in the verification decision and no access to Welo's internal assessment of the case. Welo does not accredit, endorse or recommend any consultant, agency or referral partner, and the involvement of one does not make approval more or less likely.

A consultant must not state or imply that it can guarantee or accelerate approval, that it is part of Welo, or that it is endorsed by Welo, unless Welo has given a written authorization that states exactly what the consultant may say.

Documents and statements submitted through a consultant are the responsibility of the Applicant under FR5.

Welo separates commercial and verification roles wherever its staffing allows. Where one person must hold both roles, Welo applies all of the following: the restriction in Clause 20.1.3; a Second Reviewer for every approval that person decides, until the separation of roles is achieved; and a higher sampling rate in quality review for that person's cases, set in the Verification and Enforcement Manual.

The controls that depend on having additional qualified personnel, and the date by which Welo plans to have them, are recorded in the Verification and Enforcement Manual and reviewed at each review of this Standard.

Welo reviews, at least once per calendar quarter, a sample of completed approvals and refusals selected at random, together with every case that was appealed. The reviewing person checks that each finding is supported by the record and that each score follows Annex D.

Where quality review finds a scoring difference that would have changed an outcome, Welo reopens the case, informs the business and decides it again under this Standard. Where it finds a recurring difference in how a Reviewer applies a criterion, Welo retrains the Reviewer and reviews that Reviewer's other open cases on that criterion.

Applying, providing evidence, being assessed and receiving a decision are free of charge. Welo receives the commercial payment for the Welo Badge only after a positive verification decision.

Payment covers the commercial services that come with an active certification, such as the badge widget, the Welo Page and review collection. Payment does not buy the verification outcome, does not influence any score and cannot change any decision.

When a business receives Technical Approval, Welo sends a notice stating the badge level, the Trust Score and the Topic Scores, the commercial terms and the payment deadline.

The business must complete the payment required by the commercial terms within fourteen calendar days of the notice of Technical Approval. The Technical Approval remains valid for activation during those fourteen calendar days.

The certificate is activated, and the badge becomes visible, when the payment is received or when an authorized complimentary arrangement under Clause 21.5 takes effect. The Issue Date is the date of Activation.

The badge must not be activated before payment, unless an authorized complimentary arrangement applies.

If payment is not received within fourteen calendar days, the application is closed with the Commercial Status "Rejected, nonpayment". The verification outcome stays recorded as Technical Approval.

A commercial rejection for nonpayment:

1. a)
   is not a Technical Refusal and is not a finding that the business failed any requirement of this Standard;
2. b)
   is reported separately from Technical Refusals in the transparency report and in any statistic Welo publishes about verification outcomes;
3. c)
   is not shown on any public page in a way that suggests a trust, security, identity or other verification failure;
4. d)
   does not restrict reapplication; the business may apply again at any time, and Clause 25.5.3 governs the reuse of evidence.

A certificate may be activated without payment only under a complimentary arrangement authorized in writing by a person with authority to do so under the Verification and Enforcement Manual, such as a Founding Member arrangement. The arrangement is recorded with its terms and duration.

A complimentary arrangement concerns only payment. It does not change any requirement, evidence level, threshold, timing rule or decision (Clause 7.3).

Welo records four statuses separately for every business:

A certificate is Active only when the verification outcome is Technical Approval or a successful reassessment, the certificate has not expired, been suspended, revoked or withdrawn, and the Commercial Status is Paid or Complimentary.

An active Subscription does not make a certificate Active, does not extend a certificate and does not prevent suspension, revocation or expiration.

Where the Commercial Status becomes Unpaid or cancelled during a certification cycle, the certificate status becomes Lapsed, the badge is no longer displayed as active, and the Welo Page states that the certification is not currently active without stating or suggesting a verification failure. If payment is restored before the expiration date, the certificate returns to Active with its original expiration date, unless a Material Change has occurred in the meantime, in which case Clause 22.6 applies first.

A certificate is valid for twelve months from its Issue Date. It expires at 23:59 UTC on the day before the first anniversary of the Issue Date, unless it has been renewed under Clause 22.3, or ended earlier by revocation or withdrawal.

The validity of a certificate does not depend on the duration of the Subscription. A Subscription that continues beyond the expiration date does not extend the certificate. A Subscription that ends before the expiration date is handled under Clause 21.6.4.

Every Certified Business undergoes a full Scheduled Reassessment against the version of this Standard in force, every twelve months.

Welo opens the Scheduled Reassessment no later than sixty calendar days before the expiration date and informs the business of the updated information and evidence required. The business must provide them within the deadline in the notice, which is not shorter than fourteen calendar days.

Where the reassessment is completed with a positive outcome before the expiration date, the new certificate takes effect on the day after the expiration date of the previous certificate, so that validity is continuous, and the badge level is set from the new results (Clause 12.3.1).

Where the reassessment is not completed with a positive outcome by the expiration date, for any reason, the certificate expires. It is not extended. Where the reassessment is completed afterwards with a positive outcome, a new certificate is issued with a new Issue Date, and the Welo Page shows the period during which the business was not certified.

The twelve-month cycle of reassessment is the same for every commercial plan. No plan shortens, lengthens or replaces it.

Welo may carry out additional Risk-Triggered Reviews during a certification cycle for businesses in Higher-Risk Sectors or with risk indicators recorded at the last assessment, according to the triggers in Clause 23.3. The frequency of additional reviews is determined by those triggers and the business's risk profile, and never by its Subscription or commercial plan.

A certificate cannot be transferred to another legal entity or another domain. A new legal entity or a new domain requires a new application, except as provided in Clause 22.6.3.

A Certified Business must inform Welo in writing within fourteen calendar days of any of the following changes, and within one business day for the changes in items (e) and (h):

1. a)
   a change in the persons who own or control the business;
2. b)
   a change of the legal entity operating the website, through merger, conversion, asset transfer or otherwise;
3. c)
   a change of the Verified Domain or of the hostnames used for checkout, accounts or support;
4. d)
   the addition of a Business Model Category, of a Market Served in which a regulated activity is offered, or of a product line close to an Excluded Sector boundary;
5. e)
   the loss, suspension, restriction or expiry of an authorization required by Annex B;
6. f)
   a change of payment service provider, or the start of collection of card data on the business's own pages;
7. g)
   a change to the cancellation, refund, return or subscription terms that reduces customers' rights or makes cancellation harder;
8. h)
   a security incident that has led, or may lead, to unauthorized access to customers' personal data or payment data;
9. i)
   the start of any regulatory or enforcement proceedings concerning consumer protection, data protection or financial services.

Welo assesses each Material Change and decides, with reasons, whether the certificate continues without review, whether a Risk-Triggered Review is needed, or whether Clause 23.4 applies.

Where the legal entity changes in a way that meets Clause 7.2.3 and the website, operations and customer relationships continue, Welo may transfer the remaining validity of the certificate to the new entity after a Risk-Triggered Review of FR2, FR5, FR8 and FR11. In every other case of a change of entity, the certificate ends and the new entity applies under Clause 8.

A Material Change that the business does not report within the period in Clause 22.6.1, and that Welo discovers, is a ground for Risk-Triggered Review and is scored under TTR8.7; where the change affects a Foundation Requirement, Clause 23.4 applies.

Where the Verified Domain is unreachable, or the business stops taking orders or providing its services through it, for more than thirty consecutive calendar days, the certificate is suspended under Clause 23.4 until the business shows that it is operating again. A website outage that the business shows was caused by a technical incident it was actively resolving does not count toward the period.

A certificate states the result of an assessment on a specific date. Welo watches for changes during the certification cycle within the limits of Clause 23.2, and acts on credible information under Clauses 23.3 to 23.9.

Welo does not monitor Certified Businesses continuously and does not operate automated scanning of certified websites. A certificate is not a statement that the business has been under observation since the Latest Verification Date.

During a certification cycle, Welo:

1. a)
   assesses every Consumer Report under Clause 24;
2. b)
   reviews Welo Reviews and moderation signals concerning the business;
3. c)
   assesses every Material Change notified under Clause 22.6;
4. d)
   acts on information about the business that reaches it from regulators, payment providers, official registers, blocklist services, other review platforms or the media;
5. e)
   may carry out unannounced checks of any requirement, using the methods in Clauses 13.5 and 19.4.

Where Welo introduces automated checks, it will first describe them in this clause, with their scope and frequency, through a new version or an erratum under Clause 29, and will not describe them elsewhere before then.

Welo opens a Risk-Triggered Review when it obtains credible information of any of the following:

1. a)
   removal or material change of a required legal document, in particular cancellation, refund or return terms;
2. b)
   Consumer Reports or Welo Reviews that describe the same type of harm from several customers in a short period, or a single report supported by documentary evidence of a breach of a Foundation Requirement;
3. c)
   a significant change in billing, checkout or subscription flows;
4. d)
   a security incident, a compromise of the website, a failed baseline condition in Clause 13.3 or a listing on a malware or phishing blocklist;
5. e)
   regulatory action, enforcement proceedings or loss of an authorization;
6. f)
   a Material Change under Clause 22.6;
7. g)
   the sale or promotion of an excluded product or activity;
8. h)
   misuse of the badge or of the Welo name;
9. i)
   credible media or public reports of conduct that would breach this Standard.

A Risk-Triggered Review covers the requirements and criteria affected by the trigger. Welo may extend it to other requirements where the findings show that this is necessary. The outcome is recorded as one of: certificate confirmed; badge level changed under Clause 12.3.2; certificate suspended under Clause 23.4; certificate revoked under Clause 23.6.

A Risk-Triggered Review does not replace or postpone the Scheduled Reassessment.

Welo suspends a certificate:

1. a)
   immediately, without prior notice, where there is a Material Risk;
2. b)
   after notice, where Welo finds during a certification cycle that a Foundation Requirement is Not met and the business does not remedy the finding within the deadline of the Evidence Request;
3. c)
   where the business does not respond to an Evidence Request issued during a Risk-Triggered Review within its deadline;
4. d)
   in the cases described in Clause 12.3.2(c) and Clause 22.7.

A change of Commercial Status under Clause 21.6.4 is not a suspension.

Material Risk includes, among other conditions: malware or phishing on the website; evidence that the website has been compromised; credible evidence of counterfeit goods, non-delivery on a significant scale or unauthorized charges; loss of a required authorization; a listing on a sanctions list that prohibits Welo from dealing with the business; payment instructions directing customers to accounts that do not belong to the business; a security incident affecting customers' payment data.

During a suspension, the badge is not displayed as active and the Welo Page shows the status "Suspended", the date, and the category of the reason (Clause 26.2).

After an immediate suspension, Welo sends the business, within one business day, a notice stating the reason, the evidence relied on, the requirements concerned and the evidence or Corrective Action required. The business has fourteen calendar days from the notice to respond, unless continuing protective action is needed for consumers in the meantime.

An ordinary suspension lasts no longer than thirty calendar days. Before the end of that period, Welo decides whether to reinstate the certificate (Clause 23.5) or revoke it (Clause 23.6). Welo may extend the suspension once where the outcome depends on a step outside the business's and Welo's control, such as a decision by a regulator or a registry; the extension, its reason and its length are recorded and the business is informed.

Welo reinstates a suspended certificate when it has verified that the cause of the suspension has been removed and that every affected requirement is Met. The certificate keeps its original expiration date.

The Welo Page keeps a record of the suspension and the reinstatement for twelve months.

Welo revokes a certificate where:

1. a)
   the cause of a suspension has not been removed by the end of the suspension period;
2. b)
   Welo finds Serious Fraud or Material Falsification;
3. c)
   the business engages in an excluded activity and does not stop within the deadline of the Evidence Request;
4. d)
   the business continues to misuse the badge after a correction deadline under Clause 4.3.4;
5. e)
   the certificate has been suspended three times within twelve months on grounds that were upheld.

Revocation takes effect when the notice is sent. The notice states the clauses, the findings, the evidence relied on, any exclusion period under Clause 25.6, and the right of appeal.

After revocation, the Welo Page shows the status "Revoked", the date and the category of the reason for twelve months.

A Certified Business may end its certification at any time by written notice. The certificate status becomes "Withdrawn".

Where the business withdraws while a Risk-Triggered Review, a suspension or a revocation procedure is open, Welo completes the procedure on the evidence available, records its outcome, and shows on the Welo Page that the certification was withdrawn during a review.

A certificate that is not renewed under Clause 22.3 expires at the expiration date. From that moment, the badge is not displayed as active and the Welo Page shows the status "Expired" with the date.

Whenever a certificate stops being Active, for any reason, Welo deactivates the badge display within the time stated in the Verification and Enforcement Manual, and the Welo Page shows the new status. A suspended, revoked, expired or withdrawn certificate must not continue to be displayed as active by any Welo system.

The business must remove any reference to its certification from its website and marketing within five calendar days of the change of status, other than the official widget, which Welo controls.

Any consumer, customer or other person may report to Welo conduct of a Certified Business that may breach this Standard, through the reporting path on the Welo Page or the contact channels published on welobadge.com.

A report should include the order or account reference, the dates, a description of what happened and any documents or screenshots that support it. Welo asks the reporter for contact details so that it can request further information; Welo does not publish them.

Welo is not a party to the contract between the business and its customer, does not decide individual disputes, does not order refunds and does not act as an alternative dispute resolution body. A report is used to assess whether the business still meets this Standard. Welo informs the reporter of the business's published complaint channel and of any dispute resolution body the business uses.

Welo reviews each report and assigns it to one of the following categories within five business days of receipt:

1. a)
   Individual dispute without indication of a breach. Welo records the report, informs the reporter under Clause 24.2.1 and takes it into account under TTR7.2 at the next assessment;
2. b)
   Possible breach of this Standard. Welo asks the reporter for evidence where needed, asks the business for its response under Clause 24.5, and opens a Risk-Triggered Review where the evidence meets Clause 23.3.1(b);
3. c)
   Possible Material Risk. Welo assesses the report immediately and applies Clause 23.4.1(a) where the evidence establishes a Material Risk.

Welo decides on the basis of evidence, not on the number or tone of reports. A report that cannot be connected to a genuine transaction or interaction with the business, where such a connection would be expected, carries little weight until it is.

Where there are indications that a report comes from a competitor or a person acting for a competitor, Welo asks the reporter to declare any relationship with the business and its competitors, and assesses the report only on its documentary evidence. Welo may refuse further reports from a person who has knowingly submitted false reports, and may inform the business concerned of the fact that a report was found to be false, without disclosing the reporter's identity unless the law requires it.

Welo does not suspend, revoke or downgrade a certificate on the basis of an allegation that has not been verified, except for an immediate suspension under Clause 23.4.1(a), which requires evidence of a Material Risk.

Before taking any adverse action on the basis of a report, other than an immediate suspension, Welo informs the business of the substance of the report and gives it fourteen calendar days to respond with evidence. Welo shares the reporter's personal data with the business only to the extent needed for the business to identify the transaction, and only where the reporter has agreed or the law permits it.

Welo informs the reporter that the report has been assessed and whether it led to a review. Welo does not disclose to the reporter confidential information about the business.

Welo publishes aggregated figures on reports received and their outcomes in the transparency report.

A business may appeal a Technical Refusal, a revocation, a suspension, a decision on badge level, a classification under Annex A, and an exclusion period. Consumers and businesses may appeal review moderation decisions under Clause 18.8.3.

A closure for missing evidence (Clause 8.4.4) and a commercial rejection for nonpayment (Clause 21.4) are not appealable; the business may apply again at any time.

With every Technical Refusal, Welo gives the business the clauses not met, the findings and evidence relied on, and, where the refusal is on the ground of score, every Topic Score and the criteria that scored 2 or lower. Where the refusal is not based on Serious Fraud or Material Falsification, Welo adds an improvement summary describing what the business would need to change to meet the requirements.

The improvement summary describes requirements. It is not consulting advice, and acting on it does not guarantee approval.

An appeal must be submitted in writing within thirty calendar days of the notice of the decision. It must state which findings are contested and why, and include any evidence the business relies on.

The appeal is decided by a Reviewer who took no part in the original decision, with a Second Reviewer (Clause 19.10.1(d)). The appeal reviewer examines the original record and any new evidence.

Welo normally sends its decision on a complete appeal within fifteen business days. Where Welo needs more information, it sends an Evidence Request, and the fifteen business days run from receipt of the complete response.

The appeal decision upholds, reverses or varies the original decision, with reasons. Each decision can be appealed once.

A suspension or revocation remains in effect while an appeal is pending, unless the appeal reviewer decides otherwise on the evidence.

An appeal does not limit any right the business has under the law.

A business that receives a finding may propose Corrective Action. Welo verifies the Corrective Action through the same type of evidence used for the original finding before changing any finding or score.

After a Technical Refusal that did not involve Serious Fraud or Material Falsification, the business may reapply at any time once it can show that the findings have been remedied. The new application is a full assessment.

After a revocation, the business may reapply once any exclusion period has ended and it can show that the causes of the revocation have been remedied.

After a closure for missing evidence or a commercial rejection for nonpayment, the business may reapply at any time. Welo may rely on evidence from the earlier application that is still within the age limits of Clause 19.8.1.

Where Welo finds Serious Fraud, it may exclude the legal entity, and any entity under the control of the same persons, from applying for thirty-six months from the decision. Where Welo finds Material Falsification, it may exclude them for twenty-four months. A second finding of Serious Fraud or Material Falsification concerning the same persons leads to permanent exclusion.

An exclusion period is set in the decision, with reasons, and can be appealed under Clause 25.3.

The Welo Page of a business shows:

1. a)
   the full legal name, any trading names, the country of registration and the registration number of the certified entity;
2. b)
   the Verified Domain and the hostnames covered;
3. c)
   the certificate status and the badge level;
4. d)
   the Issue Date, the Latest Verification Date and the expiration date;
5. e)
   the published Trust Score (Clause 11.5.3) and the version of this Standard applied at the latest assessment;
6. f)
   the Markets Served within the verification scope (Clause 5.6.3) and the Business Model Categories;
7. g)
   the items labeled as verified under Clause 19.7, each with the date of verification;
8. h)
   the Welo Reviews, the Welo rating and how it is calculated, how Welo checks that reviewers are customers, and the moderation figures required by Clause 18.6.5;
9. i)
   for the preceding twelve months, every change of certificate status and badge level, with its date and the category of the reason;
10. j)
    any affiliation disclosed under Clause 20.6.3(d);
11. k)
    a path for consumers to submit a report (Clause 24.1).

The Welo Page may show the Topic Scores.

The Welo Page and the badge widget use the following wording:

The categories of reason are: identity; security; payments and checkout; legal terms; reviews and reputation; sector eligibility; information provided to Welo; regulatory authorization; inactivity. Welo does not publish the details of the evidence.

The badge widget shows the badge as active only while the certificate is Active, and links to the Welo Page. When the certificate stops being Active, the widget stops showing the badge as active (Clause 23.9).

Welo publishes once a year a transparency report covering the preceding calendar year. It contains at least:

1. a)
   the number of applications received, completed assessments, and applications closed for missing evidence;
2. b)
   the number of Technical Approvals at each badge level;
3. c)
   the number of Technical Refusals, divided by the Foundation Requirement not met and by refusals on the ground of score;
4. d)
   the number of commercial rejections for nonpayment, reported separately and identified as unrelated to verification findings;
5. e)
   the number of suspensions by category of reason, reinstatements, revocations, expirations and withdrawals;
6. f)
   the number of appeals by type of decision and by outcome;
7. g)
   the number of Consumer Reports received, by triage category and outcome;
8. h)
   review moderation figures by ground for removal, and the number of "Resolved by the business" labels;
9. i)
   the median time from complete application to decision, and from complete appeal to appeal decision.

The report contains aggregated figures only and does not identify any business or person.

Where information on a Welo Page is wrong, Welo corrects it as soon as it has verified the correct information, and records the correction.

Welo uses the information and evidence it receives for verification, monitoring, enforcement, appeals, quality assurance and the defense of legal claims connected with them, and for aggregated statistics. Welo does not sell it and does not use it for marketing to third parties.

Welo keeps each category of information only as long as needed for the purposes in Clause 27.1.1. The default periods are:

A longer period applies where the law requires Welo to keep information longer, or while information is needed for an open appeal, dispute, investigation or legal claim. Each exception is recorded with its reason.

The twenty-four month default does not authorize keeping personal data that is not needed. Personal data in evidence that Welo does not need is deleted or redacted when the evidence is reviewed.

Access to evidence is limited to the persons who need it for the purposes in Clause 27.1.1. Welo does not disclose evidence to third parties except to service providers bound by confidentiality and processing terms, to authorities where the law requires, or with the consent of the business.

A business may update or replace a document it supplied through Welo's official channels. The previous version is deleted when it is no longer needed for a decision already taken or for an open procedure.

The Welo Privacy Policy describes how Welo processes personal data, including the data of reviewers and reporters.

Many requirements of this Standard are informed by consumer protection, privacy, payment security and sector regulation in the markets Welo covers. Annex F lists the main references.

A reference to a law, regulation, guideline or industry standard in this Standard describes the source Welo used to set or assess a requirement. It is not a statement that Welo certifies compliance with that source, that Welo is accredited under it, or that a certified business complies with it.

Where the law of a Market Served imposes a stricter obligation than this Standard, the business must meet the law; this Standard does not reduce it. Where this Standard is stricter than the law, the business must meet this Standard to be certified.

Welo reviews Annex F at each review of this Standard and when it becomes aware of a relevant change in a referenced source. A change in law that affects a requirement may lead to an amendment under Clause 29.

Each version of this Standard has a version number, a publication date, an effective date and a changelog. A change to a requirement, criterion, weight, threshold, deadline or procedure that affects businesses is made only through a new version.

Corrections that do not change the meaning of a requirement, such as typographical corrections or broken references, may be made as errata. Errata are listed in the changelog with their date.

Each version is published on welobadge.com as a web page and as a downloadable PDF with the same text. Previous versions remain available in a public archive with their publication and effective dates.

Welo informs Certified Businesses and Applicants with open applications of a new version at least thirty calendar days before its effective date, except where a change is needed urgently to meet a legal obligation or to protect consumers.

Applications submitted on or after the effective date of this version are assessed under this version.

Applications that were complete before the effective date and have not yet been decided are assessed under WTS v2.4, unless the Applicant asks to be assessed under this version.

Businesses certified under WTS v2.4 move to this version at their next Scheduled Reassessment. Until then, their certificate continues on the basis of the v2.4 assessment.

The following clauses apply to every business, including those certified under WTS v2.4, from the effective date, because they govern Welo's own conduct, the display of status or urgent protection of consumers: Clause 4.1.3, Clause 4.3, Clause 9.5 (FR4) where a Material Risk is found, Clause 18 as it governs Welo Reviews and their moderation, Clause 21.4, Clause 21.6, Clauses 23.3 to 23.9, Clauses 24 to 27.

Where the law requires action before the next Scheduled Reassessment, or where Welo finds a Material Risk, Welo acts under this version without waiting for the transition.

This Standard is issued by Welobadge, LLC, a Delaware limited liability company. The version owner is responsible for keeping the Standard accurate, for proposing amendments and for the changelog. [Version owner: TO BE CONFIRMED.]

A new version takes effect only when approved in writing by [TO BE CONFIRMED: approving person or body] and published under Clause 29.2.

The document information table at the top of this Standard records the publication date, the effective date and the next scheduled review as separate fields. The next scheduled review takes place no later than twelve months after the effective date.

Questions about this Standard, its application or a decision taken under it can be sent through the contact channels published on welobadge.com.

The English text of this Standard is authoritative. Translations are published for convenience, are labeled with the same version number, and are updated at the same time as the English text.

An activity is excluded when the business sells it, offers it, promotes it for its own commercial benefit (including through affiliate links or paid referrals), or, as a marketplace operator, permits or fails to enforce a prohibition of it (Clause 6.3.4). The exclusion applies to the whole business (Clause 6.3.2).

Where a product or activity is not clearly inside or outside a definition in Part A.2, the Reviewer records the question, the facts and the definitions considered, and the case is decided with a Second Reviewer under Clause 6.4.2. Welo records the decision in a register of boundary decisions so that later cases with the same facts are decided in the same way. Where a boundary decision changes how a definition is applied, the definition is clarified in the next version of this Standard.

The business must show, on each product page or before checkout, the main characteristics of the product, the total price, delivery costs and estimated delivery times for the customer's destination.

The business must hold or have reliable access to the stock it advertises as available, or must state clearly that a product is made to order or shipped later, with the expected time.

Welo makes at least one test purchase, or examines evidence of fulfilled orders, for businesses assessed at the Enhanced or Full evidence level.

The business must describe what is included in each plan, any usage limits, and what happens to the customer's data when the account is closed.

The business must describe how customers can export their data where the service stores customer content, and should publish its service availability commitments or status page where it offers them.

Where the business processes customer data as a service provider to business customers, it should make a data processing agreement available.

The business must meet FR12 and Clause 16.4 for every recurring offer, including trials.

Before the customer agrees, the business must show next to the button that completes the order: the recurring amount, the billing interval, when the first charge occurs, when a trial ends, the minimum term if any, and how to cancel. The order button must make clear that the customer is agreeing to pay.

The business must send a confirmation that records the recurring terms and how to cancel, and must send the reminders required by the law of the customer's market before a trial converts or a contract renews.

Welo assesses subscription businesses at least at the Enhanced evidence level and, where feasible, tests the cancellation path end to end.

The business must make its contractual conditions available to prospective clients before a contract is concluded, including the scope of services, pricing or pricing method, payment terms, term and termination, liability and the handling of client data.

Criteria in Annex D that protect consumers specifically are Not Applicable where the business shows that it sells only to business customers, through its website text, its terms and its sales process.

Claims about results, clients and partners are assessed under Clause 17.4 and Clause 19.7; client logos and case studies must relate to real engagements.

The operator must identify, on each listing or seller profile, the seller's name and whether the seller is a trader or a private individual, and must make available to customers the seller's contact details and the trader information required by the law of the Markets Served.

The operator must collect and verify trader information about sellers to the extent required by the law of the Markets Served, and must be able to show Welo its seller onboarding and verification procedure.

The operator must publish seller rules that prohibit every activity listed in Annex A, Part A.2, and must show Welo how it detects and removes prohibited listings. Welo searches the marketplace for prohibited items as part of the assessment.

The operator must explain to buyers what protection the operator itself provides (such as payment protection, dispute handling or refunds) and what is the responsibility of the seller.

The operator must not display the Welo Badge on listings, seller storefronts or seller profiles, and must not describe sellers as verified by Welo (Clause 5.4.2).

Only businesses authorized by the competent authority for the activities they offer, in each Market Served where they offer them, are eligible (FR11). Welo checks the authorization in the public register of the competent authority, including its scope and status.

The business must display its authorization details (authority, register number and the authorized entity's name) on the website, and must show the risk warnings and disclosures required by the law of the Markets Served, including warnings on leveraged products where required.

The business must explain how client money and assets are held, the fees and costs of each product, how withdrawals are requested and how long they take, and how complaints are handled, including any financial ombudsman or compensation scheme available.

Earnings, performance and return claims are assessed under Clause 17.4. Statements of past performance must state the period and basis and must not present simulated or hypothetical results as actual results.

Welo assesses these businesses at the Full evidence level and examines public warnings issued by regulators about the business, its brands and its domains.

Businesses that sell paid trading evaluations or challenges without acting as a broker or investment firm are assessed under Part B.11. Where such a business, or an entity in its group, also acts as a broker or investment firm, both Parts apply.

The business must hold the authorization or registration required for crypto-asset services in each Market Served where it offers them, and Welo verifies it in the register of the competent authority (FR11).

The business must describe how client crypto-assets and funds are held and segregated, whether and how client assets are protected in insolvency, the fees for each service, withdrawal procedures and times, and the main risks of crypto-assets.

The business must not promise guaranteed returns or present crypto-assets as risk-free.

Welo assesses these businesses at the Full evidence level and examines public regulatory warnings, enforcement records and reported security incidents.

A provider of non-custodial software wallets, which never holds or controls clients' crypto-assets or private keys, is assessed as a SaaS and software platform (Part B.2) and must also meet Parts B.7.2 (for the risks of crypto-assets and the fees it charges) and B.7.3. Decentralized finance protocols and the issuance of crypto-assets are excluded (Annex A, Part A.2.12).

Each healthcare professional or facility that provides services through the website must hold the license or registration required in the Market Served where the patient is located, and Welo verifies the licenses of the facility and of a sample of the professionals named on the website in the official registers.

A business that sells medicines online must hold the pharmacy or distance-selling authorization required in each Market Served and must display any official logo or registration the law requires for online sale of medicines, linked to the official register.

Prescription-only medicines must be supplied only on a valid prescription issued after the consultation the law of the Market Served requires.

Claims about treatments, outcomes and professionals' qualifications are assessed under Clause 17.4. Testimonials about treatment outcomes must not be presented as typical results.

The business must describe the additional safeguards it applies to health data (TTR3.7).

Welo assesses these businesses at the Full evidence level.

The business must be able to show that each product's composition is permitted in the Markets Served, that any notification or registration required for food supplements in those markets has been made, and that the product labels shown on the website include the information the law requires.

Health claims must be limited to claims permitted by the law of the Market Served. Claims that a product prevents, treats or cures a disease are not permitted for supplements and are assessed under FR4 where they are made.

The business must show, where the law requires it, the disclaimers and warnings that apply to supplements, including warnings on recommended daily dose and on use by specific groups.

The business must not sell products containing ingredients prohibited in the Markets Served or listed as controlled substances (Annex A, Part A.2.4).

Welo assesses these businesses at the Full evidence level and examines a sample of product pages, labels and advertising claims.

The business must identify itself as the seller and the party responsible to the customer for the contract, returns, refunds and guarantees.

The business must state the country or countries from which goods are shipped, realistic delivery times for each destination, and the carrier or tracking arrangements.

The business must state who bears customs duties, import taxes and handling charges, and must not leave customers to discover them on delivery where the business could have stated them.

The business must state the address to which returns are sent and who pays the cost of returning goods. Return costs that are disproportionate to the value of the goods, or a return address in a country not stated before purchase, are scored under TTR5.2 and TTR5.4.

Product images and descriptions must correspond to the goods supplied. Welo assesses businesses in this category at least at the Enhanced evidence level and, where feasible, makes a test purchase.

This Part applies to businesses that sell paid trading evaluations or challenges as defined in Annex A, Part A.1. These businesses are eligible after the enhanced checks below and are assessed at the Full evidence level.

The business must not present itself as a broker, an investment firm or a provider of investment services, and must not offer to manage customers' money, unless it holds the authorization required for that activity (FR11). It must state clearly, before purchase, whether trading during the evaluation takes place in a simulated or demo environment, and that the fee is paid for the evaluation service.

The complete program rules must be published and reachable before purchase, including: fees and what they include; account sizes; profit targets; daily and overall loss or drawdown limits; time limits, if any; prohibited trading strategies and instruments; consistency or minimum-activity rules; conditions, schedule and methods of payouts; conditions under which an account is terminated or a payout refused; refund conditions for fees. Changes to the rules must not apply to accounts already purchased, unless the change is favorable to the customer.

The business must identify, on its website, the legal entity that sells the evaluation, the entity that pays rewards or payouts, and the trading platform and market data provider used. Where the business or an entity in its group also operates a brokerage, the relationship must be disclosed to customers.

The business must supply Welo with evidence of the payouts made in the last twelve months: the number of payout requests, the number paid, the number refused with the categories of reasons, and the median time to payment, together with payment records that allow Welo to verify a sample of payouts.

When the business refuses a payout or terminates an account, it must give the customer written reasons that identify the rule concerned and the trades or data relied on, and a way to contest the decision. Recurring complaints about refused payouts are assessed under TTR7.2 and, where they meet Clause 18.11, under FR4.

Claims about payouts and earnings are material claims under Clause 17.4. Totals paid, "top trader" results or payout examples must state the period, the number of customers concerned and the share of customers who received any payout in that period. The business must not promise income, describe the programs as risk-free, or present simulated results as actual trading results. The business should publish the share of customers who pass each evaluation stage.

The business must restrict purchases to adults, and must not market or sell the programs in a Market Served where a regulator has prohibited or restricted them. Welo checks public regulatory warnings and statements concerning the business, its brands and its domains in each Market Served.

A business connected to Welo's owners or managers is an affiliated business and is assessed under Clause 20.6.3.

The following providers are Recognized Payment Providers for the purposes of FR10, when the business uses them through the provider's own hosted, redirect, tokenized or provider-hosted field integration:

Inclusion in the list is based on the provider requirements in Clause 14.2. Welo verifies each listed provider against those requirements at each review of the list under Clause 14.5 and records the sources used. [Verification of each listed provider: TO BE COMPLETED BEFORE PUBLICATION, see the Manual, Part 8.]

The requirements are those set out in Clause 14.2: PCI DSS validation for card services; encryption in transit; card data protection through tokenization, hosted pages or provider-hosted fields, or equivalent controls; support for 3-D Secure and strong customer authentication; fraud detection and prevention; regulatory authorization and documented allocation of security responsibilities; continuing compliance confirmed at each review.

A business that uses a provider not listed in Part C.1 must supply, or allow Welo to obtain from public sources:

1. a)
   the provider's legal name, country, and the authorization, license or registration under which it provides payment services in each Market Served, with the register reference;
2. b)
   for card payments, the provider's current PCI DSS Attestation of Compliance as a service provider, or evidence of its listing as a validated service provider in a registry maintained by a major card network;
3. c)
   a description of the integration the business uses (hosted page, redirect, provider-hosted fields, direct API) and, for a direct API integration, the business's own PCI DSS validation;
4. d)
   evidence that the provider supports 3-D Secure and strong customer authentication where the Markets Served require them;
5. e)
   a description of the provider's fraud prevention tools available to the business;
6. f)
   the provider's dispute and chargeback procedure and refund capability;
7. g)
   any public record of enforcement action or significant security incident concerning the provider in the preceding three years.

Welo records the assessment against each requirement of Clause 14.2 and its outcome. The outcome is "Equivalent" only where every requirement is met.

Payment methods that do not involve a payment service provider, such as bank transfer to an account in the name of the certified entity or cash on delivery, are permitted. Clause 14.3.1(d) and Clause 14.3.2 apply to them.

Each criterion lists its code, its name, its criterion weight (W) within the topic, its applicability rule, and the descriptors for scores 4 to 0. The general meaning of each score is set out in Clause 11.2. Where the facts match more than one level, the Reviewer applies the lower level and records why (Clause 11.6.1).

"All" means the criterion applies to every business. A criterion with a narrower applicability rule is Not Applicable where the rule is not met. Criteria marked "All" can never be Not Applicable, which keeps every topic applicable (Clause 10.1.3).

Where a level 0 descriptor describes a condition that is also a Foundation Requirement failure, the Foundation Requirement is Not met as well, and the business cannot be certified until the condition is corrected (Clause 9.1.2). Scores are calculated on the facts after any Corrective Action accepted during the assessment.

Where a criterion depends on the law of the Markets Served, the descriptor is applied to each Market Served within the verification scope, and the lowest resulting level is the score.

Durations in descriptors (such as months of history) are measured on the date the application became complete or, for a reassessment, on the date the reassessment opened.

The references below inform requirements of this Standard. Listing a reference does not mean that Welo certifies compliance with it (Clause 28.2). Status information was checked on November 7, 2026, and is reviewed at each review of this Standard.

Under Clause 5.6.1(b), Welo maintains assessment checklists for the European Union and European Economic Area, the United Kingdom and the United States. For the United States, the checklist covers federal requirements and the California requirements listed in Part F.2 as the reference state requirements; other state requirements are assessed where Annex B names them or where a business's Principal Markets make them relevant.