Operator cutover playbook for migrating to a new electronic voucher management system – MoboGage EVD System

Migrating to a New Electronic Voucher Management System: An Operator Cutover Playbook

Definition. An electronic voucher management system (EVMS) is the software that controls the whole life of prepaid vouchers, from generation or intake through dealer allocation, sale, redemption into charging and reconciliation. MoboGage EVD System is an EVMS and electronic voucher distribution platform built for telecom operators and VAS partners.

TL;DR for migration owners

  • A voucher platform migration is a ledger move, not a software install. Treat stock, PIN data and dealer balances like money, because they are.
  • Map every legacy lifecycle state to a target state before you move a single serial range.
  • Drain offline POS caches and resolve unknown-status top-ups before you snapshot dealer wallets.
  • Run both platforms in parallel until reconciliation closes with zero unexplained variance, and write the rollback trigger down before cutover weekend.

Most operators do not wake up wanting a new voucher platform. They get there because the old one has become expensive to keep alive: a vendor that no longer ships fixes, or a reporting layer finance has quietly replaced with spreadsheets. By the time the replacement is signed, the commercial team wants the new dealer app live “next month”.

That is where migrations go wrong. The new electronic voucher management system is rarely the problem. The problem is what you carry into it: millions of PINs in a dozen states, a dealer hierarchy that drifted from the contracts years ago, and wallet balances that distributors will check to the last unit the morning after cutover.

This playbook is the sequence we would follow from the operator side of the table. It is written for prepaid product owners, channel managers, IT leads and the SI partner running delivery.

Why voucher platform migrations fail

They almost never fail on the user interface. They fail on three quiet things.

State drift. The legacy system calls a batch “active” when it means “printed and sitting in a warehouse”. The new platform reads “active” as sellable. Within a day, stock nobody has received is showing on dealer screens.

Balance disputes. A top-tier distributor’s wallet shows a different number on Monday than it did on Friday. Even if the difference is a single pending transaction, the trust damage lasts longer than the fix.

Orphaned channels. An API partner nobody remembered still points at the old endpoint, or a batch of rural POS terminals never picked up the new app. They keep selling against stock the old system no longer owns.

None of these need clever technology to prevent. They need a written inventory, a state map, a freeze window and reconciliation gates someone senior signs off.

Step 1: Inventory what actually has to move

Before anyone talks about cutover dates, list every object the old platform holds and decide what happens to it. Some things migrate, some get rebuilt cleanly in the new platform, and some are archived read-only for audit.

Object Migrate, rebuild or archive What to verify Typical owner
Product catalogue and denominations Rebuild (cleaner) Every live SKU has a target product with the same face value and charging profile Prepaid product
Voucher batches and serial ranges Migrate Count by batch, by state and by serial range matches the legacy export Voucher ops
Encrypted PIN data Migrate under key ceremony Record counts and checksums match; no clear-text exposure at any step Security / IT
Dealer hierarchy and contracts Migrate, then clean Every dealer has one parent, one tier and a current contract Channel sales
Wallet and float balances Migrate at snapshot Sum of balances per tier matches the signed snapshot Finance
Credit limits and commission plans Rebuild Plans match signed commercial terms, not legacy configuration Channel finance
Open disputes and pending transactions Resolve before snapshot Zero unknown-status transactions at freeze Ops + finance
POS terminals and app versions Re-enrol in waves Each terminal is registered, on the target app and drained of offline stock Field ops
API partner credentials Reissue Every partner tested in sandbox against the new endpoint Partner management
Transaction history Archive read-only Retention period agreed with audit and regulators Finance / compliance

The rebuild column matters more than it looks. Legacy commission plans carry years of one-off exceptions. Rebuilding them from the signed agreements is slower for a week and saves a year of disputes.

Step 2: Map lifecycle states before moving stock

This is the step most teams skip, and the one that causes the worst first week. Every voucher platform has its own state vocabulary. Write them side by side and agree the rule for each.

Legacy state (example wording) What it usually means Target state Migration rule
Generated PINs created, not yet sent to print or channel Generated / inactive Move as inactive; never sellable on arrival
Printed / in transit File released to print house or courier In custody (inactive) Hold inactive until goods receipt is confirmed
Received Physical stock in warehouse Warehouse stock Activate only on allocation
Allocated Assigned to a distributor or dealer Allocated to the same node Verify the node exists in the new hierarchy first
Active / sellable Can be sold and redeemed Active Cross-check against charging before cutover
Sold Sold, not yet redeemed Sold Keep redeemable; preserve sale timestamp
Redeemed / used Consumed in charging Redeemed (archive) Migrate for audit; block any re-use
Blocked / stolen / damaged Withdrawn from sale Blocked Never reactivate during migration
Expired Past validity Expired Migrate for reporting, or archive

Ask your vendor two direct questions here. Does the target platform hold state per PIN or per serial range? And what happens to a range that is half sold? If the answer is vague, the migration plan is not ready.

Step 3: Move PIN data without ever seeing it

PIN files are the most sensitive thing in the programme. The rule is simple to say and hard to keep: no person and no intermediate system should see clear-text PINs during migration.

In practice: a key ceremony with dual control, PINs re-encrypted from legacy to target keys inside a hardware security module or equivalent protected environment, and record counts plus checksums compared on both sides. Transfer files are deleted on schedule and the deletion is logged.

If the vendor proposes exporting PINs to a spreadsheet “just for validation”, stop the call. We cover the wider custody model, including what encrypted-until-sale should mean, in our guide to voucher reconciliation and PIN security in an EVMS.

Step 4: Freeze, drain and snapshot dealer float

Dealer wallets are where migrations become personal. A distributor who sees a wrong balance on Monday will phone your commercial director, not your IT team.

A sequence that holds up:

  1. Announce the freeze window early. Dealers should know a week ahead when stock purchases and wallet transfers pause, and for how long.
  2. Drain offline POS caches. Handheld terminals that sell offline hold cached vouchers and unsynced sales. Push a sync, then block offline sales for the final 24 to 48 hours so nothing appears after the snapshot.
  3. Resolve unknown-status top-ups. Any PINless recharge sitting in a timeout or unknown state must be confirmed against charging and either completed or reversed before the snapshot. Our electronic top-up system guide explains why float, not stock, is the real inventory in eTopup.
  4. Snapshot and sign. Export balances per dealer and per tier, share them with the top distributors and get written acknowledgement before go-live.
  5. Load and re-verify. After load, the sum per tier in the new platform must equal the signed snapshot. Not roughly. Exactly.

If your hierarchy has more than two or three tiers, check that each sub-dealer lands under the right parent and inherits the right credit limit. The patterns in our piece on multi-tier reseller voucher distribution are a useful sanity check for that review.

Step 5: Cut over channels in waves

Do not switch every channel on the same night. A sensible order is usually:

  • API partners first, in sandbox and then a controlled production window, because their traffic is easiest to watch and roll back.
  • Dealer web portal next, starting with a small group of top-tier distributors who agreed to be early.
  • POS fleet in regional waves, pushed through terminal management, with field teams ready in each region on the day.
  • USSD and SMS last, because routing changes touch the network side and need their own change window.

Keep old endpoints answering with a clear “moved” response for a while. It is the cheapest way to find the partner nobody remembered.

Step 6: Parallel run and reconciliation gates

Run both platforms side by side long enough to close several full business days, including at least one weekend and one month-end if you can. Each gate has a pass condition and a rollback trigger agreed in advance.

Gate Pass condition Rollback or hold trigger
Stock count Counts by product, state and serial range match the legacy export Any unexplained difference in sellable stock
Dealer balances Sum per tier equals the signed snapshot Any distributor balance dispute not resolved within the agreed window
Sales vs charging Every sale has a matching redemption or a valid sold-not-redeemed record Redemptions in charging with no sale record
Commissions Sample of dealers recalculated by finance matches the platform Systematic commission mismatch in any tier
Channel health Every live channel transacting on the new platform Any channel still hitting the old endpoint after the deadline
Day-close Day-close pack produced and accepted by finance Day-close cannot close without manual journals

Write the rollback decision into the plan with a named owner and a deadline. A rollback decided at 4 a.m. by whoever is still awake is not a plan.

GCC and MEA notes

Timing matters as much as engineering in Gulf markets. Avoid the Ramadan and Eid peaks, when recharge volumes and dealer activity change sharply. Remember that weekends differ: the UAE moved to a Saturday–Sunday weekend in 2022, while Saudi Arabia, Qatar and Kuwait keep Friday–Saturday. A cutover planned on a European calendar can land on your busiest dealer day.

Bilingual dealer communication, data-residency language in the contract and SI partner responsibilities should all be settled before the freeze notice goes out. Our GCC operator guide to electronic voucher management covers those requirements in RFP terms.

Questions to ask any EVMS vendor about migration

  • Show us a state-mapping template from a previous migration, with customer details removed.
  • How do you re-encrypt PINs from our legacy keys, and who holds which key component?
  • Can you run a parallel reconciliation report against our legacy exports, and in what format?
  • How do you handle POS terminals that were offline during the freeze?
  • What is the rollback path for each channel, and how long does it take?
  • Which tasks sit with you, which with our SI, and which with us?

How MoboGage EVD System approaches a migration

We start with the state map and the dealer snapshot, not the screens. EVD System holds voucher inventory, the dealer hierarchy with wallets and credit limits, PIN and PINless sales across Android/Linux POS, apps, portals and APIs, and day-close reconciliation in one control plane. That makes it practical to run a parallel period against legacy exports and close each gate with evidence finance can read.

What we will not do is promise a date before seeing your data. The honest answer comes after a short discovery on a sample export.

FAQ

What is an electronic voucher management system?

An electronic voucher management system is software that controls prepaid vouchers end to end: generation or intake, inventory, allocation through the dealer hierarchy, sale, redemption into charging and reconciliation. MoboGage EVD System is one such platform for telecom operators and VAS partners.

How long does an EVMS migration take?

It depends on data quality, channel count and how many lifecycle states the legacy platform uses. Plan for discovery, a test migration on a data copy, a parallel run over several business days and phased channel cutover. Treat any date given before discovery as an estimate.

How do we move PIN data securely?

Use a key ceremony with dual control, re-encrypt PINs from legacy keys to target keys inside a protected environment such as an HSM, compare record counts and checksums, and log deletion of transfer files. Nobody should see clear-text PINs.

What happens to dealer wallet balances during cutover?

Freeze purchases and transfers, drain offline POS caches, resolve unknown-status top-ups, then snapshot balances per dealer and tier. Load that snapshot into the new platform and confirm the totals match exactly before reopening sales.

Should we cut over all channels at once?

No. Move API partners first, then the dealer portal, then the POS fleet in regional waves, and USSD or SMS last. Keep old endpoints returning a clear moved response so forgotten integrations surface quickly.

When should we roll back?

When a gate fails and cannot be fixed inside the agreed window: unexplained sellable-stock differences, unresolved distributor balance disputes, or redemptions with no sale record. Name the decision owner and the deadline before cutover.

Planning a voucher platform migration?

Replacing a legacy VMS or consolidating PIN and eTopup channels? Send us your current platform, channels and dealer tiers, and we will come back with a state-mapping outline and a realistic migration sequence.

Talk to MoboGage about your EVD System migration or email projects@mobogage.com.

Diagram of an electronic top up system for telecom airtime

Electronic Top-Up System for Telecom Operators

An electronic top up system (also called eTopup or PINless airtime distribution) lets mobile operators and their reseller hierarchies credit prepaid subscribers directly without handing over a printed scratch PIN. Value sits in dealer wallets as pre-funded float or an approved credit limit, the recharge request travels to the operator’s charging platform over USSD, POS, mobile app, or partner API, and the subscriber’s balance updates in seconds. Operators adopt it when physical card printing costs and denomination rigidity alongside warehouse leakage outweigh the familiarity of scratch cartons on a retail shelf.

TL;DR: eTopup vs PIN voucher distribution

Model What the dealer holds How the subscriber gets credit Primary operational control
eTopup (PINless recharge) Pre-funded wallet float or credit limit Direct recharge call (e.g. UCIP Refill or UpdateBalanceAndDate) to the MSISDN at sale time Float reservation, idempotent retry keys, and timeout reconciliation against charging CDRs
PIN voucher (EVD / scratch) Allocated serial batches or print-on-demand PIN entitlements Subscriber dials or enters a secret PIN after purchase to redeem value HSM-backed PIN custody, batch activation gates, and serial state tracking from generated to redeemed

In practice, dealer float replaces physical inventory exposure, so wallet reservations and velocity caps alongside day-close exception queues become the core operating controls across USSD, Android or Linux POS, dealer web portals or mobile agent apps and partner APIs. Operators choose eTopup when they need rapid bundle changes and lower card operating costs, while keeping a full electronic voucher management system whenever serialised PIN lifecycles or hybrid stock with batch-level reconciliation remain part of the commercial mix. Research from GSMA Mobile for Development has long examined how shifting prepaid volume from scratch cards to electronic channels reduces manufacturing and distribution overhead.

What an electronic top up system actually does

In daily retail operations, a shopkeeper takes cash or a digital payment from a subscriber, keys the MSISDN (normalised to E.164 format) and selects a denomination or data bundle, after which the platform reserves the dealer’s float and instructs the operator’s IN or OCS to credit the account. No carton is opened in a warehouse, and no PIN sheet is photocopied in a back office. Every transaction either closes with a confirmed charging correlation ID or enters a tracked pending state that finance can reconcile at day-close.

Industry literature refers to this flow as electronic reloading or direct top-up. Wikipedia’s overview of electronic reloading traces the transition away from physical prepaid cards toward commercial retailer load and digital credit, which provides helpful context when briefing channel teams that still plan around physical card stock.

Deploying eTopup does not force an operator to retire vouchers everywhere at once. Multi-country operators run both side by side, using PINless eTopup for everyday prepaid refills while keeping serialised PIN stock for rural wholesalers or gift and OTT products.

Comparing eTopup, EVD PIN print and physical scratch cards

Dimension Physical scratch cards EVD PIN print / electronic PIN sale Electronic top up (eTopup)
What the dealer holds Printed cards with concealed PINs Digital PIN inventory released at sale or print-on-demand Wallet float value with no PIN issued to the subscriber
Theft and leakage risk High across warehousing and transport Contained when PINs stay encrypted in a vault until sale No PIN leakage; duplicate recharges and float misuse are the main risks
Denomination or bundle update Requires a print and distribution cycle Catalogue or batch policy update Immediate product catalogue and charging profile update
Subscriber experience Scratch coating and dial USSD string Receive printed or SMS PIN and redeem Direct balance or bundle credit to MSISDN
Reconciliation focus Physical batch manifests vs activated sales Serial lifecycle states vs charging redemptions Dealer wallet debits and holds vs charging CDR credits
Best commercial fit Offline or remote print-heavy retail Markets needing gift vouchers, partner PINs, or hybrid stock High-velocity prepaid refills, micro-denominations, dense agent networks

Physical scratch cards remain familiar to cash-based retailers, yet they carry printing and warehousing overhead plus stock shrinkage that digital channels eliminate. Electronic PIN printing still fits wherever a bearer secret is required for gift cards or utility tokens, whereas eTopup fits wherever the commercial act is crediting a subscriber’s phone number immediately from a controlled dealer wallet. For the broader terminology across these models, see our guide to electronic voucher distribution (EVD) for full definitions across both models.

Dealer float: the real inventory of eTopup

Removing physical cards makes dealer float the working inventory of the distribution network. Operating an eTopup hierarchy requires five linked ledger steps:

  1. Onboard each hierarchy tier (master distributor, sub-distributor, dealer, and retail POS agent) with explicit parent-child rules.
  2. Fund distributor and dealer wallets against verified bank transfers, cash deposits, or maker-checker credit allocations.
  3. Enforce per-tier credit limits and velocity caps so a compromised terminal cannot drain upstream float.
  4. Convert wallet reservations into debits only on confirmed charging success, and credit float back only through audited reversals.
  5. Expose live balance and hold views so field supervisors do not rely on chat screenshots to verify stock.

A core ledger rule is separating reservation from debit inside the dealer ledger. When a retailer submits a top-up, the platform places an atomic hold on the dealer’s available float (tracked in ISO 4217 integer minor units, including three-decimal Gulf currencies such as the Kuwaiti dinar, Bahraini dinar, and Omani rial) before the charging adapter sends the request to the IN or OCS. If charging returns a confirmed success (responseCode = 0 on UCIP), the hold converts into a final debit and posts commission. If the request receives an explicit reject, the hold releases immediately. When a recharge call times out without a reply, the reservation stays locked under a pending-unknown state until a status query or the T+1 charging CDR file proves whether the subscriber received the credit.

When dealers cannot see their reserved versus available float clearly, they maintain side ledgers on paper or spreadsheets, which turns ordinary timing differences into support disputes. Credit limits also need policy-driven temporary lifts for salary weeks or festival peaks rather than manual database edits at midnight.

eTopup channels that move prepaid airtime

A production eTopup platform routes every retail and digital channel through one channel gateway, one float ledger, and one duplicate-detection policy.

USSD and SMS remain the primary interface where feature phones and assisted street retail dominate. Menus have to stay shallow to avoid session timeouts, and every request must log the target MSISDN, the dealer ID, the transaction amount, and the upstream result code. Android and Linux POS terminals serve high-throughput counters with receipt printing and device binding, alongside dealer web portals for bulk wallet transfers and sub-agent management. Mobile agent apps cover field sales and low-balance alerts, while partner APIs connect banks, super-apps, and payment aggregators using the same composite idempotency keys and velocity limits enforced on retail terminals.

Choosing between eTopup-first and a full EVMS

Most steering-committee debates come down to whether an operator needs a standalone PINless recharge switch or a combined voucher and eTopup control plane.

When an eTopup-first rollout fits

An eTopup-first scope makes sense when almost all prepaid volume is direct PINless credit to MSISDNs, commercial teams ship weekly bundle or promotional price changes that cannot wait for print runs, and dealer complaints centre on card stockouts across rural branches. It assumes your engineering team will invest in resilient charging adapters, client-generated idempotency keys, and automated timeout resolution.

When to keep a full electronic voucher management system

A full electronic voucher management system remains necessary when you run physical or hybrid PIN stock that needs serial-level lifecycle states, distribute gift cards or OTT entitlements alongside airtime, or require batch blacklisting and HSM-backed PIN custody for revenue assurance.

In GCC and MEA deployments, operators commonly combine both models by running MoboGage’s EVD System as the inventory and hierarchy control plane with PINless eTopup operating directly off the dealer wallet ledger. If your team is comparing vendor architectures for a tender, our guide on how to choose an electronic voucher management system covers the evaluation criteria across voucher vault security, IN charging integration, and day-close reconciliation.

Operational controls buyers should demand

During technical due diligence, ask shortlisted vendors to demonstrate seven controls on a live test bed rather than on slides:

  1. Idempotent top-up: The same client request ID never double-credits the subscriber or double-debits the dealer. (How that works when charging does not answer: airtime top-up timeouts and unknown status.)
  2. Explicit failure taxonomy: Clear separation between a network timeout (pending-unknown), a gateway validation error, and an upstream charging reject, with distinct operator reason codes.
  3. Reversal and refund governance: Automated correlation-ID reversals for incomplete legs kept separate from maker-checker financial refunds after settlement.
  4. Multi-level velocity limits: Configurable caps per dealer, per terminal, and per target MSISDN over rolling hourly and daily windows.
  5. Terminal binding and revocation: Ability to revoke a stolen POS session token at the gateway immediately and track active app versions across the fleet.
  6. Three-way day-close pack: Automated comparison of channel sales, dealer wallet movements, and charging CDR/EDR files with named owners for exceptions.
  7. Charging interface discipline: Documented UCIP, Diameter, or OCS API mappings scoped and tested against forced timeouts per project.

Without those seven controls in place, a high-throughput recharge switch simply creates reconciliation breaks faster than finance can investigate them.

Implementation path for an operator rollout

  1. Baseline current leakage and disputes: Measure where physical stock disappears, where promo launches stall, and how many daily support tickets stem from unconfirmed recharges.
  2. Pilot a single hierarchy slice: Start with one region and a controlled group of distributors on USSD or POS plus the dealer portal to prove wallet reservations and charging CDR alignment on live traffic.
  3. Encode commercial hierarchy rules: Configure multi-tier commission splits, credit limits, and maker-checker transfer approvals to match existing distributor contracts.
  4. Harden timeout and exception playbooks: Train operations and support teams on pending-unknown holds and T+1 CDR settlement before onboarding external aggregator APIs.
  5. Expand channels incrementally: Roll out mobile apps, additional POS hardware families, and bank or super-app APIs once the daily reconciliation pack closes cleanly.
  6. Run continuous revenue assurance: Monitor adapter latency, duplicate-block counts, and late-success refund exceptions as routine operational metrics.

Next steps for operators and VAS partners

If your prepaid distribution still depends on physical print logistics, or if your electronic channels leave finance reconciling wallet debits against charging CDRs in spreadsheets, audit one week of recharge traffic by channel and exception code. That baseline shows immediately where reservation holds, idempotency constraints, or voucher lifecycle controls are missing.

Operators and VAS partners evaluating MoboGage (founded in 2007 as company-reported, headquartered in Jaipur, India as its sole office, with company-reported reach across more than 1 million retailers and 17 countries via channel partners) can review the product overview on the electronic voucher management system page, see how a UCIP / IN charging integration handles recharge calls, read more About MoboGage, or reach the engineering team via the contact page (projects@mobogage.com, +91-9928 366 889).

FAQ

What is an electronic top up system?

It is software that lets dealers or digital channels credit prepaid subscribers from controlled float or wallets without issuing a physical scratch PIN, while posting the credit to the operator’s charging system and logging the transaction for day-close reconciliation.

Is eTopup the same as EVD?

Not quite. EVD (electronic voucher distribution) covers moving voucher value through reseller channels, whereas eTopup refers specifically to PINless airtime credit posted straight to the subscriber’s balance. Most operator deployments combine both models by running PINless eTopup as a primary sales mode on top of an EVD hierarchy and wallet ledger.

Do dealers still need inventory?

Dealers hold float inventory in the form of wallet balances and credit limits rather than cartons of printed cards. Serialised PIN inventory is still used alongside float whenever an operator sells voucher batches or third-party entitlements on the same terminals.

Which channels should we launch first?

Start with the channel that already carries your core prepaid volume, such as USSD or Android POS, and prove that dealer float debits and charging credits reconcile cleanly before adding partner APIs and mobile apps. Opening every channel on day one without a working day-close exception queue creates avoidable balance disputes.

When is a full EVMS still required?

A full EVMS is required whenever you manage serialised PIN lifecycles or hybrid voucher stock alongside multi-product catalogues for gift and OTT entitlements, or when finance requires batch-level inventory reconciliation beyond wallet float movements.

How does GSMA frame electronic airtime channels?

GSMA Mobile for Development research on airtime distribution savings examines how electronic top-up paths reduce scratch-card printing and warehousing expenses alongside channel discount costs compared with physical card distribution, providing a useful benchmark when building an operator business case.

Related operator reading: For the connected prepaid stack, compare voucher reconciliation and PIN security with multi-tier reseller voucher distribution, review our electronic voucher distribution (EVD) explainer, or see the EVMS product overview for full lifecycle controls across the prepaid stack.

For formal PIN voucher and eTopup definitions used across the prepaid stack, consult the EVMS glossary.

If your team is operating or bidding in the Gulf, read our regional guide to electronic voucher management for GCC telecom.