Acceptance Criteria

Acceptance Criteria: {{PROJECT_NAME}}Drop — Fintech Payment App

Project: {{PROJECT_NAME}}Drop — Remittance + QR Payments Version: {{VERSION}}1.0 Date: {{DATE}}2026-02-23 Author: {{AUTHOR}}John (AI Director) Status: Draft | In Review | Approved Reviewers: {{REVIEWERS}}Alem Bašić (CEO)

Document History

Version	Date	Author	Changes
0.1	{{DATE}}2026-02-23	{{AUTHOR}}John	Initial draftAC based on integration tests and E2E test suite

---

1. Purpose & Methodology

1.1 What Are Acceptance Criteria?

Acceptance criteria aredefine the conditions thatunder awhich systemDrop mustfeatures satisfyare toconsidered bedone and accepted by athe stakeholder.business. They answer the question:answer: "How will we know when this feature is done?"

Good acceptance criteria are:

• Testable — Can be verified with a specific test procedure
• Clear — Unambiguous; no room for interpretation
• Complete — Cover happy path, error paths, and edge cases
• Agreed — Signed off by the business BEFORE development begins

1.2 Format: Given / When / Then (Gherkin-Style)

Given [an initial context / precondition that is true]precondition]
When  [an action or event occurs]
Then  [the expected outcome is observed]
And   [additional expectedchained outcomes, chained]

Example — User Login:

Given a registered user with valid credentials
When the user submits the login form
Then the user is redirected to the dashboard
And a session token is created and stored in a secure cookie
And the last login timestamp is updated in the databaseoutcomes]

1.3 Categories of Acceptance Criteria

Category	Description	Example
Positive (Happy Path)	System works as expected with valid inputs	Successful login
Negative (Sad Path)	System handles invalid inputs gracefully	Wrong password error
Edge Case	Boundary conditions and unusual but valid scenarios	Login at exact session timeout
IntegrationSecurity	SystemInjection, worksauth, correctlyabuse with external services	Payment processed via Stripeprevention
Non-FunctionalCompliance	Performance,Regulatory accessibility, security criteria	Page loads in < 2 seconds
Data	Correct data storage, retrieval, and validation	Fields saved with correct typesrequirements

---

2. Feature Acceptance Criteria

---

Module: {{MODULE_1_NAME}}Authentication & Onboarding

---

Feature: {{FEATURE_1_NAME}}User Registration — 3-step Onboarding (FR-{{XXX}})001)

Feature Description: {{BRIEF_DESCRIPTION}}New residents register via email + DOB validation → OTP → PIN. BankID replaces DOB in Phase 2. Business Requirement: BR-{{XXX}}001, BR-002 Linked User Stories: US-{{XXX}}, US-{{XXX}}001

Positive Scenarios:

#	Scenario	Given	When	Then
AC-001	{{SCENARIO_NAME}}Successful registration	{{PRECONDITION}}Valid email, password ≥8 chars, Norwegian phone (+47), DOB ≥18 years	{{ACTION}}User submits registration form	{{EXPECTED_RESULT}}201 created; user proceeds to OTP step; no password hash in response
AC-002	OTP verification passes	Account created; OTP sent to phone	User enters correct 6-digit OTP	User proceeds to PIN setup
AC-003	PIN setup completes	OTP verified	User enters and confirms 4-digit PIN	Account activated; JWT cookie set; redirect to dashboard

Negative Scenarios:

#	Scenario	Given	When	Then
AC-003004	{{INVALID_INPUT_SCENARIO}}Under-18 rejected	{{PRECONDITION_WITH_BAD_DATA}}DOB indicating age < 18	{{ACTION}}User submits registration	{{ERROR_MESSAGE_OR_BEHAVIOR}}422 with message "Du må være minst 18 år"
AC-004005	Duplicate email	Existing account for email	User submits same email	409 "Email already in use"
AC-006	Missing required field	Registration form	User submits without first_name	422 validation error with field details array
AC-007	Short password	Password < 8 characters	User submits	422 "Password must be at least 8 characters"
AC-008	Invalid phone format	Non-+47 phone number	User submits	422 validation error

Edge Cases:

#	Scenario	Given	When	Then
AC-005009	{{BOUNDARY_CONDITION}}Boundary age (exactly 18)	{{EDGE_CONDITION}}DOB = today minus 18 years exactly	{{ACTION}}Registration submitted	{{EXPECTED_RESULT}}Account created successfully
AC-010	Invalid JSON body	Malformed JSON in request	POST /api/auth/register	400 "Invalid JSON body"

Non-FunctionalSecurity Acceptance Criteria:

#	Category	Criterion
AC-006	Performance	Feature completes in < {{X}} seconds under normal load
AC-007	Accessibility	Feature is fully operable by keyboard; ARIA labels present
AC-008	Security	{{SECURITY_CRITERION_IF_APPLICABLE}}

---

Feature: User Registration (FR-020)

Feature Description: New users can create accounts using email and password. Business Requirement: BR-{{XXX}} Linked User Stories: US-{{XXX}}

Positive Scenarios:

returnedAPIstarts

#	Scenario	Given	When	Then
AC-010	Successful registration	A user visits /register with a valid, unregistered email	User submits form with valid email, strong password, and required fields	Account is created; confirmation email sent; user redirected to email verification page
AC-011	Email verification sentAuth	AccountPassword washash justnot created	Systemin processesany registration	Verification email arrives within 2 minutes with unique, expiring linkresponse
AC-012	Verification link worksAuth	Userbcrypt receivesused verification(hash email	Userwith clicks$2); verificationSHA-256 link	Email verified; user redirected to login; account marked as verifiedrejected

Negative Scenarios:

min

#	Scenario	Given	When	Then
AC-013	DuplicateRate emaillimiting	An10+ accountregistrations alreadyfrom existssame with [email protected]	User submits registration with [email protected]	Error "An account with this email already exists" shown; no new account created
AC-014	Weak password	User is on registration form	User submits password "abc123"	Inline error shown: "Password must be at least 8 characters and include uppercase, number, and special character"
AC-015	Invalid email format	User is on registration form	User submits "notanemail"IP in email1 field	Inline→ validation error shown before form submission
AC-016	Empty required field	User is on registration form	User submits with required field empty	Inline error shown; form not submitted

Edge Cases:

#	Scenario	Given	When	Then
AC-017	Email with plus addressing	User submits [email protected]	Registration submitted	Account created; treated as valid email
AC-018	Verification link expiry	Verification link generated 25+ hours ago	User clicks expired link	Error "Verification link has expired"; option to resend verification email shown
AC-019	Double registration attempt	User submits form; due to slow network submits twice	Two identical POST requests sent	Only one account created; second request returns appropriate error429

---

Feature: User Login (FR-021)002)

Business Requirement: BR-001 Linked User Stories: US-002

Positive Scenarios:

#	Scenario	Given	When	Then
AC-020	Successful login	A verifiedRegistered user with valid credentials	UserPOST submits /api/auth/login form	Authenticated;200; redirectedJWT toin dashboard;httpOnly sessioncookie; createduser object returned
AC-021	RememberAuthenticated route access	Valid JWT cookie	GET /api/auth/me	A200; verifiedcurrent user checksobject "Remember Me"	User submits login form	Session persists for 30 days; user stays logged in after browser closereturned

Negative Scenarios:

#	Scenario	Given	When	Then
AC-022	Wrong password	A registeredRegistered user exists	User submitsSubmits incorrect password	Generic error401 "Invalid email or password" (no enumeration); login not granted
AC-023	Non-existent email	No account forwith thisthat email	UserLogin submits loginsubmitted	Same generic error401 "Invalid email or password" (preventsame usererror — no enumeration)
AC-024	AccountRate lockedlimiting	User10+ has made 5 failedlogin attempts from same IP in 1 minute	UserNext attempts login againattempt	Message:429 rate limit response
AC-025	Missing credentials	Empty email or password	Login submitted	400 "AccountEmail temporarilyand locked.password Try again in 15 minutes."required"

Edge Cases:

#	Scenario	Given	When	Then
AC-025	Session expiry	User has been idle for 31 minutes	User attempts to navigate	Redirected to login; session cleared; unsaved work warning shown
AC-026	LoginInvalid on unverified accountJSON	AccountMalformed created but email not verifiedbody	UserPOST attempts to log in/api/auth/login	Error400 "PleaseInvalid verifyJSON your email before logging in" with option to resendbody"

---

Module: Remittance (Send Money)

---

Feature: {{NEXT_FEATURE_NAME}}Remittance Transaction (FR-{{XXX}})020)

Business Requirement: BR-003, BR-005 Linked User Stories: US-010

Positive Scenarios:

#	Scenario	Given	When	Then
AC-{{NEXT}}030	Successful remittance	Authenticated + KYC-approved user; valid recipient; sufficient balance	POST /api/transactions/remittance with amount=1000, currency=RSD	201; transaction created; fee = 5 NOK (0.5%); transaction in history
AC-031	Fee calculation correct	Amount = 2000 NOK	Remittance submitted	fee = 10 NOK; recipient_amount = 2000 NOK (gross)
AC-032	Transaction in history	Successful remittance	GET /api/transactions	Transaction appears with status=completed

Negative Scenarios:

#	Scenario	Given	When	Then
AC-{{NEXT}}033	Unauthenticated user	No JWT cookie	POST /api/transactions/remittance	401 Unauthorized
AC-034	KYC not approved	kyc_status=pending	Remittance submitted	403 "KYC verification required"
AC-035	Recipient not found	Invalid recipientId	Remittance submitted	404 "Recipient not found"
AC-036	Insufficient balance	Balance < (amount + fee)	Remittance submitted	402 "Insufficient balance"
AC-037	Amount below minimum	amount = 99 NOK	Submitted	400 "Amount must be between 100 and 50000 NOK"
AC-038	Amount above maximum	amount = 50001 NOK	Submitted	400 validation error
AC-039	Invalid amount (NaN)	amount = "abc"	Submitted	400 "Invalid amount"

EdgeCompliance Cases:Criteria:

#	Category	Criterion
AC-040	AML	Transaction > 50,000 NOK rejected; daily limits enforced
AC-041	Pass-through	No balance column in users table; DB test verifies absence

---

Feature: Exchange Rates API (FR-021)

Positive Scenarios:

#	Scenario	Given	When	Then
AC-{{NEXT}}050	All rates returned	GET /api/rates	Called	6 NOK exchange rates returned (RSD, BAM, PKR, TRY, PLN, EUR)
AC-051	Single rate returned	GET /api/rates/RSD	Called	NOK→RSD rate returned
AC-052	Case insensitive	GET /api/rates/rsd (lowercase)	Called	Same result as /api/rates/RSD

Negative Scenarios:

#	Scenario	Given	When	Then
AC-053	Unsupported currency	GET /api/rates/XXX	Called	404 Not Found

---

Module: QR Payments

---

Feature: QR Payment — Consumer (FR-030)

Business Requirement: BR-004, BR-005 Linked User Stories: US-020

Positive Scenarios:

#	Scenario	Given	When	Then
AC-060	Successful QR payment	Authenticated + KYC-approved user; valid merchantId; sufficient balance	POST /api/transactions/qr-payment with amount=129, merchantId=valid	201; merchant_fee = 1.29 NOK (1%); transaction created
AC-061	Fee calculation	amount = 200 NOK	QR payment submitted	merchant_fee = 2 NOK (1%)

Negative Scenarios:

#	Scenario	Given	When	Then
AC-062	Invalid merchant	Non-existent merchantId	Payment submitted	404 "Merchant not found"
AC-063	Amount < 1 NOK	amount = 0	Submitted	400 validation error
AC-064	Missing merchantId	No merchantId in body	Submitted	400 "Merchant ID is required"
AC-065	Unauthenticated	No JWT	Submitted	401 Unauthorized

---

Feature: Merchant Registration + QR Generation (FR-031)

Positive Scenarios:

#	Scenario	Given	When	Then
AC-070	Merchant registered	Authenticated user	POST /api/merchants with business_name, bank_account	Merchant created with unique QR code value
AC-071	QR code retrievable	Registered merchant	GET /api/merchants/me	Merchant details + QR code returned

---

Module: Security (Cross-cutting)

---

Feature: Input Validation (FR-001 through FR-080, all)

#	Scenario	Given	When	Then
AC-080	XSS in name field	<script>alert(1)</script> as firstName	Registration submitted	422 validation error; no script executed
AC-081	SQL injection in email	'; DROP TABLE users;-- as email	Registration submitted	422 validation error; no DB mutation
AC-082	10KB password	10,000 character password	Registration submitted	422 "Password too long" or validation error
AC-083	Unicode in name	Bosnian chars (š, đ, ć, č, ž) in name	Registration submitted	201 created; name stored correctly
AC-084	Underage DOB	DOB indicating 17 years old	Registration submitted	422 age validation error

---

Module: Compliance

---

Feature: PCI-DSS Card Data Protection (FR-080, Cards feature)

#	Scenario	Given	When	Then
AC-090	No CVV in DB	Cards table	DB schema check	cards table has NO card_number or cvv columns
AC-091	No balance in users	Users table	DB schema check	users table has NO balance column (pass-through model)
AC-092	Only last_four returned	Authenticated user	GET /api/cards/[id]	Response contains last_four only; no full card number

---

3. Integration Scenarios

in

#	Integration	Scenario	Expected Behavior	Test Environment
INT-001	{{EXTERNAL_SERVICE}}Sumsub KYC	{{SCENARIO}}KYC webhook callback (approved)	{{EXPECTED}}User kyc_status updated to 'approved'	SandboxMock /webhook Mockin integration tests
INT-002	EmailBaaS providerPISP	TransactionalPayment email deliveryinitiation	EmailTransaction receivedrecorded; withinconfirmation 2 minutesreturned	MailtrapMock /PISP stagingin NEXT_PUBLIC_SERVICE_MODE=mock
INT-003	{{PAYMENT_PROVIDER}}BaaS AISP	SuccessfulBalance paymentread from bank	TransactionUser recorded;account confirmationbalance shown;returned webhookfrom receivedBaaS	StripeMock testAISP modeservice
INT-004	{{PAYMENT_PROVIDER}}Exchange rates	PaymentRate declineddata missing	UserError seeshandled friendlygracefully; error;GET no/api/rates/XXX order→ created; no double-charge404	StripeIntegration test mode
INT-005	{{THIRD_PARTY_API}}BaaS unavailable	BaaS API timeoutdown	System shows user-friendly error; requesttransaction logged;not no data corruptioncreated	Mocked timeout
INT-006	{{THIRD_PARTY_API}}	API unavailable	System degrades gracefully; non-dependent features still work	Service unavailable mocktests

---

4. Non-Functional Acceptance Criteria

4.1 Performance

#	Criterion	Target	Test Method
NF-AC-001	Allbcrypt pages load within targethashing time	< 3s initial, < 1.5s subsequent1,000ms	Lighthouse on stagingapi-benchmarks.test.ts
NF-AC-002	AllRate APIlimit endpointscheck respond within targettime	< 500ms at p95 under normal load50ms	k6 load testapi-benchmarks.test.ts
NF-AC-003	CoreDB WebSELECT Vitals passquery	LCP < 2.5s, CLS < 0.1, FCP < 1.8s10ms	Lighthouseapi-benchmarks.test.ts
NF-AC-004	DB INSERT query	< 20ms	api-benchmarks.test.ts
NF-AC-005	50 concurrent rate limit calls	< 2,000ms total	api-benchmarks.test.ts

4.2 AccessibilitySecurity

checker

#	Criterion	Target	Test Method
NF-AC-010	NoSHA-256 criticalpasswords accessibility violationsrejected	0verifyPassword criticalreturns violationsfalse for SHA-256 hashes	axe-core automated scanauth.test.ts
NF-AC-011	KeyboardJWT navigationtampered completetokens rejected	AllInvalid featuressignature operable→ without mouseexception	Manual testauth.test.ts
NF-AC-012	ColorRate contrastlimiting compliantblocks after limit	≥11th 4.5:1request text/backgroundfrom same IP → 429	Contrastmiddleware.test.ts
NF-AC-013	Input validation completeness	10+ validation test cases pass	validation.test.ts
NF-AC-014	Foreign key constraints enabled	Sessions cannot be created for non-existent users	db.test.ts

4.3 SecurityCompliance

#	Criterion	Target	Test Method
NF-AC-020	No OWASPbalance Topcolumn 10in vulnerabilitiesusers table	0users critical/hightable findingsschema has no 'balance'	OWASP ZAP scandb.test.ts
NF-AC-021	AllNo usercard_number/cvv inputsin sanitizedcards table	Nocards XSS/injectiontable vulnerabilitieshas no 'card_number' or 'cvv'	SAST + manual testingdb.test.ts
NF-AC-022	NoTransaction sensitivetypes data in client-side codelimited	NoOnly API'remittance' keys,and tokens'qr_payment' in browseraccepted	Code review + browser DevToolsdb.test.ts

---

5. UAT Scenario Mapping

AC ID	AC Description	UAT Scenario ID	UAT Tester	StatusPriority
AC-010001	Successful registration	UAT-001	{{TESTER}}	Not StartedCritical
AC-011004	EmailUnder-18 verification sentrejected	UAT-002		Critical
AC-020	Successful login	UAT-003		Critical
INT-003AC-030	PaymentSuccessful successremittance	UAT-010		Critical
NF-AC-060	Successful QR payment	UAT-020	Critical
AC-090	No CVV in DB	UAT-SEC-001	Page load performance	UAT-P01		Critical

---

6. Traceability to Requirements

AC ID	Acceptance Criterion	FR Reference	BR Reference	US Reference
AC-001	{{CRITERION}}Successful registration	FR-{{XXX}}001	BR-{{XXX}}001	US-{{XXX}}001
AC-010004	Under-18 rejected	FR-001	BR-002	US-001
AC-020	Successful registrationlogin	FR-002	BR-001	US-002
AC-030	Successful remittance	FR-020	BR-{{XXX}}003, BR-005	US-{{XXX}}010
AC-060	Successful QR payment	FR-030	BR-004, BR-005	US-020
AC-090	No CVV in DB	FR-080	BR-005, RUL-010	—
NF-AC-020	No balance column	FR-001	BR-005, RUL-003	US-001

Full traceability:traceability matrix: [requirements-traceability-matrix.md](requirements-traceability-matrix.md)

---

Approval

Approved

Role	Name	Date	Signature
Author	John (AI Director)	2026-02-23	Approved (AI)
ReviewerQA Engineer	Validator agent	2026-02-23
Business Analyst			(AI)
Product Owner	John	2026-02-23
QA Engineer			Approved
AI Director (John)	John	2026-02-23	Approved
ClientCEO Representative(Alem)	Alem Bašić	TBD