PSP (Payment Service Provider)

In plain words

Think of a PSP as the cashier, the card machine and the night-safe service for a shop, all rented from one company. You sell something. The PSP takes the customer’s card or bank details, asks whether the money is good, collects it, takes a fee and pays you the rest a few days later.

That is the everyday meaning, and it is what most people want when they search for a PSP: the company that lets a business take payments. Stripe, Adyen, Checkout.com, Mollie, HyperPay and Network International are all called PSPs in this sense, though they work in quite different ways.

The legal meaning is wider and stricter. In European law, a bank is a payment service provider, and so is an electronic money institution (EMI) or a payment institution (PI). Some firms that call themselves PSPs are not payment service providers in law at all, because they only pass data and never touch the money.

The gap between those two meanings causes most of the expensive surprises. Before you sign, or before you build one, you need three answers about any PSP: what does it actually do, who holds the money and when, and which regulator can act if it goes wrong.

Illustration

What sits inside a full-service PSP

Swipe sideways to see the whole diagram.

How it works

How a PSP handles one payment

The customer waits a couple of seconds. The money takes days to reach you, and the sale can still be reversed months later.

1. 1

   Collect the details

   The customer enters a card or chooses a wallet or bank. The PSP’s hosted page or field captures the details, so your systems ideally never see the card number.

2. 2

   Ask for approval

   The request travels through the acquirer and the card scheme to the issuer, which approves or declines it and may ask the customer to confirm it is them.

3. 3

   Capture and clear

   You confirm the sale. The approved payment goes into clearing, where amounts are matched and the fees are worked out.

4. 4

   Settle and pay out

   Money moves between issuer and acquirer in settlement. The PSP then pays you the balance, minus fees and any reserve.

SecondsSteps 1 and 2, while the customer waits

DaysSteps 3 and 4, and your cash flow depends on them

The two meanings of PSP

A sales page and a regulator can use the same three letters for different things.

In European law, the services that make a firm a payment service provider are listed in an annex: cash in and out, executing payments, issuing payment instruments and acquiring, money remittance, payment initiation and account information. Acquiring has a specific definition: contracting with a payee to accept and process payments, resulting in money reaching the payee. ¹

A second carve-out catches many platforms. A commercial agent is excluded when it can negotiate or conclude the sale for only the payer or only the payee. ^{1 2} PSD2 narrowed this because platforms acting for both sides, with no real margin to negotiate, were relying on it. If you run a marketplace that collects money from buyers and pays sellers, assume you may need a licence or a licensed partner until a lawyer tells you otherwise.

The types of PSP

Most confusion disappears once you separate the jobs. One company may do several of them, and labels vary: one Gulf provider we looked at describes itself as a “payment orchestration platform”, while others use “fintech platform” or “payment solutions provider”. Ignore the label and find out which of these jobs the company does.

Payment gateway

A gateway is the secure connection between your checkout and the payment networks. It encrypts and passes the data, and returns the answer. A pure gateway does not hold money or have the acquiring contract. You need a separate acquirer behind it. Gateway is not a defined term in the UAE regulation or in the Visa rules we reviewed, so what it means legally depends on what the firm does.

Processor

A processor runs the systems that carry authorisation and clearing messages. In Visa’s rules, a VisaNet Processor connects directly to Visa’s network and provides authorisation, clearing or settlement services. ³

Acquirer

The acquirer is the regulated firm that signs up the merchant and enters its transactions into the card network. Visa’s rules describe it as the member that contracts with a merchant or payment facilitator. ³ It carries the risk towards the scheme if a merchant fails, which explains its interest in your refund policy and chargeback rate. Every card payment has an acquirer somewhere, even if you never see its name.

Payment facilitator

A payment facilitator, or payfac, has one contract with an acquirer and signs up many small businesses beneath it. Those businesses are called sponsored merchants or sub-merchants. This is what makes instant onboarding possible: you skip a full acquirer application because the payfac has already done the heavy part. The trade-off is that you are one of many under someone else’s account, and the payfac can restrict you quickly.

The scheme rules set limits. Visa requires its acquirers to sign a direct merchant agreement with a sponsored merchant that goes above US$1 million in annual Visa volume, with some exemptions. The acquirer remains liable for everything the payfac and its merchants do. ³ Older documents quote other thresholds, so check the current rules.

Marketplace

A marketplace brings together cardholders and retailers online, processes the payments and receives settlement for them, under Visa’s definition. ³ It takes on liability for disputes and has to meet conditions about retailers based outside its own region. Scheme rules do not exempt a marketplace from licensing.

Merchant of record

A merchant of record is the company that legally sells to the customer and appears on the card statement. It handles the payment, refunds and, in most models, sales tax, then pays the real supplier its share. Software companies use it to sell across many countries. It is a commercial structure, not a licence, and we did not find it defined in the Visa rules. The price is usually higher, and the customer relationship is partly the provider’s.

Payment orchestration

An orchestrator sits above several PSPs and decides which one should process each payment: by country, card type, cost or current performance. It also usually stores card tokens independently. A pure orchestrator does not replace an acquirer, because you still need acquiring contracts behind it. We found no regulator’s definition of the term, and some firms sold as orchestrators also move funds, so apply the possession test.

Banks and all-in-one providers

Banks still acquire, often with in-store terminals and relationship pricing. All-in-one providers combine gateway, processing and acquiring on one platform and may hold a banking licence themselves: Adyen, for example, states that its Dutch entity is licensed as a credit institution. ⁴ Fewer parties can mean better data and simpler support, but more dependence on one company.

Illustration

Who sits on your money in each model

Swipe sideways to see the whole diagram.

From approval to money in the bank

Getting a “payment successful” message does not mean you have the money. Authorisation only reserves funds. Visa and Mastercard limit how long that hold can stay valid, usually around a week online according to one PSP’s documentation, so a business that ships late needs to plan for it. ⁵ Under Visa’s rules, the deposit should not happen until the transaction is complete or the goods have shipped. ³

Payout timing is set by your contract, not by a universal rule. We found no regulator or scheme standard for how many days a PSP takes to pay a merchant. As one dated example, Stripe’s documentation in October 2026 gave a default of three business days for the UK and EU, and said a first payout could take 7 to 14 days. ⁶

Illustration

How long a sale stays at risk

Swipe sideways to see the whole diagram.

Why good payments get declined

When a payment fails, the reason matters. Visa sorts decline codes into categories: some, such as a lost or stolen card, must never be retried, while others can be retried up to 20 times in 30 days. ³ People in the industry call these hard and soft declines. Mastercard also has rules and fees for excessive retries, which one PSP’s documentation sets out in detail. ⁷ A subscription business that retries blindly can pay extra and get worse results.

We found no independent or scheme-published benchmark for authorisation rates. Treat any provider’s “industry average” with care and compare on your own traffic: same countries, same card types, same period.

What a PSP really costs

The quoted rate is rarely the whole bill. A merchant’s cost is built from layers.

Interchange caps

In the EU, consumer card interchange is capped at 0.2% for debit and 0.3% for credit. Commercial cards and traditional three-party schemes, where the scheme itself acts as issuer and acquirer, fall outside those caps. ⁸ The UK’s version of the regulation carries the same percentages for UK transactions. ⁹

Blended pricing or interchange plus plus

Blended pricing gives you one simple rate. It is easy to forecast, and the provider takes the risk that your mix of cards costs more than expected. Interchange plus plus (IC++) passes through the actual interchange and scheme fees and adds a visible margin. It is more transparent, but your costs vary by card and the invoices are harder to read.

Public list prices in October 2026 show how differently these are presented. They are examples rather than a comparison, and they will change:

• Stripe UK: 1.5% + 20p for standard UK cards, 2.5% for EEA cards, 3.15% for other international cards, and a further 2% for currency conversion. ¹⁰ It also lists a £20 fee when a dispute is opened.
• Mollie: 1.80% + €0.25 for EEA consumer cards, 2.90% for commercial cards, 3.25% for non-EEA cards. ¹¹
• Adyen: US$0.13 per payment plus interchange++ and a 0.60% margin on Visa and Mastercard, with a minimum monthly invoice. ¹²

Reserves, chargebacks and account closures

This is the part most comparison pages leave out, and it does the most damage. A PSP pays you before it knows the sale is final. If customers later claw back money and you have gone, the acquirer pays the bill. Everything below exists to manage that exposure.

Chargebacks

A chargeback is a card payment reversed through the issuer after the cardholder disputes it. Under Visa’s rules, the window under several dispute conditions runs to 120 days from the processing date, though not every dispute reason works the same way. ³ You can contest with evidence, but you usually pay a fee either way and the money is held back in the meantime.

The schemes also monitor merchants as a whole. Since 2025, Visa has combined its fraud and dispute programmes into one, the Visa Acquirer Monitoring Program (VAMP). It adds reported fraud and disputes and divides them by settled card-not-present transactions. In Visa’s Europe region, and in Asia Pacific, Canada and the US, a merchant has counted as excessive at 1.5% since 1 April 2026; in the region that includes the Gulf (Central Europe, Middle East and Africa), the figure is 2.2%, with a lower minimum count. Acquirers have their own, much tighter limits. ¹³ Stripe’s documentation describes Mastercard’s equivalent as starting at 100 chargebacks and a 1.5% ratio. ¹⁴ These thresholds change often, so ask your PSP for the current figures.

Rolling reserves

A rolling reserve means the PSP keeps a percentage of each sale for a set period, then releases it. Adyen’s documentation for platforms gives an example of 10% held on a 30-day cycle. ¹⁵ Stripe says it reviews assessed risk and tells merchants about reserve terms by email. ¹⁶ There is no standard rate, and we would distrust anyone quoting one. Your contract, risk profile and product decide. Reserves can be imposed after you sign, usually when something changes: a spike in disputes, a sudden jump in volume, or a shift towards pre-orders.

Freezes, terminations and the blacklist

PSP contracts commonly allow fast suspension. Stripe’s services agreement, for example, allows termination at any time and immediate suspension for reasons including a rise in fraud. ¹⁷ An account closure can cut off a business’s revenue overnight, so it belongs in your risk register.

A termination can also follow you. Mastercard’s MATCH database lists merchants that acquirers have terminated, for five years according to Stripe’s documentation, and one listing reason covers chargebacks above 1% and US$5,000 in a month. ¹⁸ Visa has a similar service in Asia Pacific, Europe and its Central Europe, Middle East and Africa region, and its rules forbid refusing a merchant solely because of a listing. ³ In practice a listing can still make it much harder to open a new account.

What happens to your money if the PSP fails

Licensed payment firms in the EU and UK must protect relevant customer funds, for example by segregating them from their own money, a duty known as safeguarding. ¹ That is different from deposit insurance, and it can fail in practice.

The UK regulator found that payment firms that became insolvent between early 2018 and mid-2023 had average shortfalls of 65% of customers’ funds. ¹⁹ When the e-money firm Ipagoo entered administration in 2019, the FCA said its customers’ funds were not protected by the Financial Services Compensation Scheme. ²⁰ The FCA’s stricter safeguarding regime took effect on 7 May 2026. ²¹ Those cases involve e-money and payment firms rather than merchant acquirers, and we did not find a well-documented case of merchant settlement money lost at an acquirer. The questions still apply:

• Is my unpaid balance safeguarded, and in which bank?
• Does money reach me from a licensed entity, or through an unregulated group company?
• If you are a sub-merchant or a marketplace seller, whose name is on the safeguarded funds?
• How much money would be stuck if you stopped trading today? Keep that figure below what the business can survive.

Security: what stays your job

The Payment Card Industry Data Security Standard (PCI DSS) applies to anyone handling card data. A PSP does not make it disappear, but your choice of integration decides how much of it you carry. The current version, v4.0.1, was published in June 2024, and its future-dated requirements took effect on 31 March 2025. ²²

The final mapping depends on your acquirer and your exact set-up, so ask for it in writing.

Strong customer authentication (SCA) is the other shared duty in Europe. A merchant cannot decide to skip it. The acquirer may request an exemption based on low fraud rates, up to €100, €250 or €500 depending on its card fraud rate, while the issuer has the final say. ²⁵ In the UK the equivalent limits are £85, £220 and £440. ²⁶ If a payee or its PSP does not accept SCA, it must refund the issuer’s financial damage. ¹ Payments you start yourself under a mandate are generally out of scope, but the customer must authenticate when setting up that mandate remotely. ²⁷

What PSP support actually looks like

We have not ranked providers on support. We found no independent benchmark of PSP support, and a few online reviews would be poor evidence. What you can do is understand how support is packaged and test it yourself.

How it is packaged

Two public examples, read in October 2026. Stripe sells Growth, Premium and Enterprise support plans on top of its baseline 24/7 support and quotes a 15-minute response target for critical issues at the relevant level. ²⁸ Adyen’s public status page shows platform availability but states that the figures do not represent contractual service levels. ²⁹ That is a fair distinction to look for everywhere: a status page tells you what the provider chooses to report. Only your contract gives you a right. Some status pages sit behind a login, so ask for access before signing.

The five moments that test support

1. An outage. How do you hear about it, how fast, and who tells you whether payments were lost or duplicated?
2. A frozen payout. Who can explain it, what evidence do they need, and how long does review take?
3. A fraud attack. Can someone change your rules at 2am, and can you do it yourself?
4. A chargeback spike. Will they warn you before the scheme does, and give you the data to respond?
5. A reconciliation mismatch. Can finance get a line-level explanation, or only a total? Good reconciliation data is a form of support.

How to test support before you sign

• Send a hard technical question through the same channel you would use after signing, not through sales.
• Ask for the severity definitions, response and resolution targets, and any service credits, in the contract.
• Ask for the last 12 months of incident summaries. Do not rely on a pretty uptime figure.
• Ask who handles risk reviews, whether they can be contacted directly, and their target turnaround time.
• In the Gulf and MENA, check Arabic support, working week and time zone, and whether the local entity or a head office abroad decides.
• Ask two current customers of your size and sector what happened the last time something went wrong.

The UK

The Financial Conduct Authority (FCA) authorises payment firms under the Payment Services Regulations 2017. An acquiring firm needs €125,000 of initial capital. ³⁰ Since 31 December 2020, UK firms have had no right to passport services into the EU. ³¹

• Safeguarding: the Supplementary Regime has applied since 7 May 2026, adding audits and monthly returns for firms in scope. A later stage has not been given a date. ²¹
• Contract terms: the Payment Systems Regulator (PSR) required 14 card-acquiring firms to provide summary boxes and online quotes, send trigger messages, and limit terminal contracts to 18 months. ³² These apply to smaller merchants, so ask whether you are covered.
• Cross-border fees: interchange on online UK-EEA consumer payments rose from 0.2% and 0.3% to 1.15% and 1.5% after Brexit. The PSR dropped its proposed interim cap in October 2025. ^{33 34} A UK shop with many EU customers should look at local acquiring.
• Regulator change: the government has decided to abolish the PSR and move its work to the FCA. This needs legislation, which was still in Parliament at the end of October 2026. ³⁵ Check the current position.

Example. A Manchester online retailer finds 30% of its sales now come from EU cards and pays cross-border rates on all of them. It asks its PSP about routing those through an EU acquiring entity, which requires a real EU presence or a provider set-up that allows it. It models the saving before moving.

Cards remained the UK’s most-used payment method in 2025, at 64% of payments. ³⁶ Account-to-account options are growing. Pay by bank uses Faster Payments, and commercial variable recurring payments began through an industry scheme in 2026, with the FCA due to consult on a framework by the end of the year. ³⁷ See our full guide to open banking.

The EU

A licence from one member state can be passported across the European Economic Area. An acquiring firm needs €125,000 of initial capital, and a remittance-only firm needs €20,000. ¹ Cards made up 57% of the euro area’s non-cash payments by number in the second half of 2025. ³⁸

• Ireland: the central bank reported 58 authorised payment and e-money firms at the end of 2025. It said most applicants are international groups setting up Irish subsidiaries, and passporting is significant. ³⁹
• The Netherlands: De Nederlandsche Bank (DNB) supervises Adyen’s Dutch entity as a credit institution, which shows that an acquirer does not have to be a PI. ⁴
• Lithuania: the Bank of Lithuania licenses many smaller payment and e-money firms, and it also revokes licences, as it did with Kevin EU in a case we cover in our open banking guide. ⁴⁰ A licence is a starting check, not a guarantee, so read the firm’s safeguarding arrangements too.

What PSD3 and the PSR will change

The replacement for PSD2 is a package: a directive, PSD3, and a directly applicable Payment Services Regulation. A provisional deal was reached in November 2025. As of October 2026 it had not been formally adopted: Parliament’s tracker showed it awaiting the Council’s position, with a plenary vote pencilled in for December. ⁴¹ Most rules would apply around 21 months after entry into force. The agreed direction includes refunds for some impersonation scams and platform liability if they do not remove reported fraud content. ⁴² It also tightens the agent exclusion for platforms, and adds duties for technical providers and scheme operators. Treat these details as provisional.

Instant payments and local methods

The Instant Payments Regulation requires PSPs that offer euro credit transfers to offer instant ones, 24 hours a day. Euro-area banks had to send instant payments from October 2025. Euro-area payment and e-money institutions have until 9 April 2027. Non-banks can now get access to central bank payment systems. ⁴³ This makes pay by bank more practical over time, but your checkout still needs a PSP that supports it.

Card acceptance alone is not enough in many countries:

Check this table against your PSP’s current coverage.

The UAE

The UAE has three separate regulatory zones, and DIFC and ADGM sit apart from the mainland. Choosing the wrong one can make a licence useless for the customers you want.

Mainland. The Central Bank of the UAE (CBUAE) regulates PSPs under the Retail Payment Services and Card Schemes Regulation. Merchant acquiring and payment aggregation both sit in Categories I, II and III. ⁴⁷

Four other points matter for anyone choosing or building a PSP here. A provider that never possesses the money is outside this regulation, and so are data and terminal services. Personal and payment data must be stored in the UAE. Banks are treated as licensed but need a no-objection letter for acquiring and aggregation. ⁴⁷ And the new central bank law, in Article 62, covers anyone carrying on, offering, issuing or facilitating a licensed activity, including through technology platforms. Its transition period ended in mid-September 2026. ⁴⁸ The central bank’s guidance says this creates no new licence categories and that the test is the underlying activity, and law firms read it as not targeting purely technical providers. ⁴⁹ If you connect merchants to payments in any way, take advice on where you now stand.

DIFC and ADGM. Both have their own regulators and rulebooks, and the new central bank law does not apply inside them. DIFC’s Dubai Financial Services Authority lists money transmission, payment accounts, payment instruments and stored value as financial services. ⁵⁰ ADGM treats money transmission as a regulated activity. ⁵¹ Neither rulebook passage we read gave a general position on merchant acquiring. The mainland regulation separately bars providing or promoting these services in the UAE without a CBUAE licence, so serving mainland merchants generally requires CBUAE authorisation. Confirm your own case with counsel.

Local rails. Aani, the instant payment platform, is run by Al Etihad Payments. Jaywan, the domestic card scheme, was being issued in stages in mid-2026. The Ministry of Finance approved both for federal fee payments in August 2026. ⁵² We could not confirm a general rule requiring merchants to accept either, so ask your PSP about its plans.

Example. A Dubai cosmetics brand signs with a provider holding a Category II licence and asks for proof that the licence covers acquiring, not just transfers. When it starts selling into Saudi Arabia, it finds that the UAE licence does not reach there and that it needs a separate Saudi-licensed partner to offer mada.

Saudi Arabia

Electronic payments reached 85% of Saudi retail payments in 2025, according to the Saudi Central Bank (SAMA). ⁵³ The market is large and largely domestic in its payment habits. Under the 2021 Law of Payments and Payment Services, nobody may provide payment services in the Kingdom without a SAMA licence. ⁵⁴ The implementing regulations, in force from 2023, include acquiring and aggregation among the regulated services and exclude technical service providers. ⁵⁵

Limits and capital are from SAMA’s rulebook. ⁵⁶

Gateways have an explicit rule. A 2024 SAMA circular says that companies providing linkage and technical support “do not require a license from SAMA at this time”, but they need permits from Saudi Payments, and cannot contract with merchants, verify them or settle funds to them. ⁵⁷ Few regulators are this clear, so read the current text before relying on it.

mada is central. SAMA’s 2018 instruction to banks said domestic online stores must offer mada, and the Ministry of Commerce has inspected shops and penalised those without mada terminals. ^{58 59} We did not find a general current cap on mada merchant fees. Some older SAMA rules set narrow caps for specific uses, and the “0.8% or SAR 40” quoted on some vendor sites resembles one of those. Do not assume it applies to your business, and ask for the mada rate in writing. Sarie, the national instant payment system, runs 24/7 and handles transfers of up to SAR 20,000. ⁶⁰

Example. A Riyadh furniture retailer compares a global PSP with a SAMA-licensed local one. It tests mada online, Arabic receipts, SAR settlement and support during the Saudi working week. A global price advantage matters little if most of its customers pay with a card the global provider cannot acquire locally.

Other Gulf states

Domestic schemes such as Benefit in Bahrain, KNET in Kuwait, NAPS in Qatar and OmanNet in Oman are important to local shoppers. We could not find a general legal rule requiring merchants to accept each one, so ask each PSP for acceptance data for your market.

Egypt, Jordan, Morocco and the wider region

There is no regional passport. We found no MENA equivalent of the EU passport, and a partner at a regional law firm said in August 2026 that no mutual recognition agreement exists across the Gulf and Egypt. ⁶⁵ Buna, the Arab Monetary Fund’s cross-border system, connects banks and financial institutions, and does not give a PSP any right to operate in another country. ⁶⁶

Egypt. The Central Bank of Egypt issued licensing rules under Law 194 of 2020, published in June 2025. They cover institutions in Egypt and those serving Egyptian residents from abroad, with licensable activities that include technical payment aggregation and payment facilitation. Category A PSPs, above EGP 750 million a month on average, need EGP 30 million in capital. Category B firms need EGP 10 million. Foreign providers must apply, be licensed at home for the same activity and meet further tests. ⁶⁷ Existing firms had 12 months to apply, so check the current status of any provider. Meeza, the national card, reached 43.5 million cards by June 2025. ⁶⁸ InstaPay runs on the national instant payment network. ⁶⁹

Jordan. The Central Bank of Jordan licenses PSPs under the 2017 bylaw on electronic payments. ⁷⁰ JoPACC, owned 45% by the central bank and 55% by 18 banks, owns the CliQ instant payment system, JoMoPay and eFAWATEERcom bill payments. ⁷¹

Morocco. Acquiring here has just changed. After a complaint, the competition authority made commitments binding in October 2024 that require CMI, the historic near-monopoly acquirer, to sell its merchant and gateway contracts and become a technical processor. ⁷² Authorised payment institutions and bank subsidiaries could market acquiring from 1 May 2025, with portfolio transfers due by April 2026. Interchange was cut to 0.65% in October 2024, and a further cut to 0.50% was scheduled for 1 October 2026. ⁷³

Iraq, Turkey and exchange control. The Central Bank of Iraq lists about 20 licensed e-payment providers, so verify any provider by name there. ⁷⁴ Turkey shows the risk of ignoring local rules: PayPal stopped operating there in 2016 after being refused a licence, and linked this to rules requiring local IT systems. ⁷⁵ For Algeria, Tunisia and Lebanon we could not confirm a primary source on using foreign PSPs. Exchange controls and account rules can matter a lot in these markets, so take local legal advice before promising anything.

Example. A Cairo education platform wants to collect from Egyptian and Jordanian parents. It finds that one contract will not do the job: it needs a CBE-licensed route in Egypt with Meeza and wallets, and a separately licensed route in Jordan with CliQ and bill payment. Both feed the same ledger, so finance sees one view.

Provider examples

This is not a ranking or a recommendation. These are examples of how providers describe themselves, based on their own statements and press coverage read in October 2026. We did not check every claim against a regulator’s register. You should.

Always ask which legal entity will contract with you. A group can hold a licence in one country and serve you from another, and a press release may describe an in-principle approval rather than a final licence.

How to choose a PSP

Start from your business, not a list of brands. Most companies fit one of these starting points:

Twelve questions to put to every PSP

Contract traps

• Long terms and auto-renewal. In-store contracts can run for years, so note the notice date in your diary.
• Early termination charges that make leaving more expensive than staying.
• Monthly minimums that matter once your volume drops.
• Broad suspension rights without a time limit, a review process or a duty to explain, where the law allows them to give reasons.
• Fee changes by notice without a right to leave.
• Liability caps far smaller than one day of your sales if the service fails.

Switching and running a second PSP

Plan your exit before you start. Stored cards are the difficult part. Stripe says customers own their sensitive card data, and it exports it only to processors certified at PCI Level 1. ⁸⁰ Importing to Stripe takes about ten business days after valid data arrives, though the previous processor may take days to months, and CVC codes are not transferred. A new merchant ID can also cause a temporary rise in declines. ⁸¹ Network tokens are a separate question: Adyen says tokens it manages apply only to payments it acquires, though it supports other set-ups. ⁸² We found no scheme rule on token portability, so ask directly.

A second PSP gives you a fallback during an outage or a freeze, and useful data on pricing and approval rates. It also adds contracts, reconciliation and compliance work, so add one once a single outage or freeze would seriously hurt the business.

If you want to become a PSP

Many founders search for a PSP and then wonder whether they should be one. There is a ladder of options. Each step gives more control and takes more capital, compliance and time.

What a PSP actually has to run

• Merchant onboarding: KYB, website review, product and sector risk rating, and ongoing checks.
• Transaction layer: payments, refunds, payouts, routing, retries and status tracking.
• Ledger and reconciliation: every merchant balance, fee, reserve and chargeback, matched daily against scheme and bank files.
• Risk and financial crime: transaction monitoring, AML controls, sanctions screening and fraud rules.
• Disputes: intake, evidence, deadlines and the scheme monitoring programmes.
• Merchant-facing product: dashboard, reports, API documentation and support tools.
• Back office: role-based access, audit trails, regulatory reports and safeguarding evidence.
• Certification: PCI DSS as a service provider, plus scheme and regulator requirements in each market.

Our articles on UAE payment licences and when a small EMI makes sense go deeper on the licensing routes.

Example: Lina sells in Berlin and Dubai

Common misconceptions

FAQ