Glossary
Fintech and crypto terms, in plain words.
Each term in two sentences first, then how it works, what it gets confused with and where the law or the standard says it. Written for people launching a product, and checked against the texts themselves.
#
B
C
Cards
Card programme manager
Programme manager · Program manager · Sponsored Program Manager
A card programme manager is the company that designs and runs a card programme, choosing the providers and often holding the customer relationship, while a licensed issuer, the BIN sponsor, issues the cards. The Mastercard Rules define the card programme manager as a Sponsored Program Manager in Rule 7.7.6, and allow one per card programme.
Crypto and trading
CASP
Crypto-asset service provider · CASP licence · MiCA authorisation
A CASP, or crypto-asset service provider, is a firm that provides one or more of the ten crypto-asset services listed in the EU's Markets in Crypto-Assets Regulation (MiCA) and is allowed to do so under Article 59 of that regulation. A CASP authorised in one EU member state may serve clients across the EU.
Crypto and trading
Crypto on-ramp
Fiat on-ramp · Off-ramp · Buy widget · Fiat-to-crypto gateway
A crypto on-ramp sells crypto-assets for ordinary money, paid by card or bank transfer, and delivers them to the customer's wallet, while an off-ramp does the reverse. On-ramp is not a legal term: in the EU the activity is usually the exchange of crypto-assets for funds, which needs authorisation under the Markets in Crypto-Assets Regulation (MiCA).
D
E
Crypto and trading
E-money token
EMT · Electronic money token · Fiat-backed stablecoin
An e-money token (EMT) is a crypto-asset that purports to keep a stable value by referencing one official currency, as defined in the EU's Markets in Crypto-Assets Regulation (MiCA). MiCA deems an e-money token to be electronic money, lets only a bank or an electronic money institution issue one, and gives holders the right to redeem at par.
Accounts, licences and compliance
Electronic money institution
EMI · E-money institution · E-money licence
An electronic money institution (EMI) is a company authorised to issue electronic money: a prepaid balance that is a claim on the issuer, redeemable at face value and accepted by others. Directive 2009/110/EC, the E-Money Directive, defines the electronic money institution in the EU, and the Electronic Money Regulations 2011 do so in the UK.
Accounts, licences and compliance
EMI agent
Agent of an e-money institution · Agent of a payment institution · PSD agent
An EMI agent is a person or company that provides payment services on behalf of a licensed electronic money institution or payment institution, once that institution has had the agent entered on the regulator's public register. The institution holds the licence and remains fully liable for the agent's acts under Directive (EU) 2015/2366 (PSD2), Articles 19 and 20.
I
K
M
Crypto and trading
Matching engine
Order matching engine · Trading engine · Central limit order book (CLOB)
A matching engine is the software in an exchange that keeps buy and sell orders in an order book and pairs them into trades by fixed rules, usually best price first and, at the same price, earliest order first. In the EU, Article 76 of the Markets in Crypto-Assets Regulation (MiCA) sets the rules for a crypto-asset trading platform.
Accepting payments
MPoC
Mobile Payments on COTS · PCI MPoC · CPoC · SPoC
MPoC, PCI Mobile Payments on COTS, is the PCI Security Standards Council's security standard for solutions that accept card payments on commercial off-the-shelf devices such as phones and tablets. MPoC covers contactless payments and PIN entry on the same device, and builds on two earlier standards, CPoC and SPoC.
P
Accepting payments
Payment facilitator
PayFac · PF · Merchant aggregator
A payment facilitator, or PayFac, is a company that contracts with an acquirer and signs up merchants under that contract, so that each merchant takes card payments without its own agreement with the acquirer. The Visa Core Rules and the Mastercard Rules both define the payment facilitator, and call its merchants sponsored merchants.
Cards
Payment tokenisation
Tokenization · Network token · Device token · DPAN
Payment tokenisation replaces a card's primary account number (PAN) with a substitute value, a token, so that the systems handling a payment do not hold the real number. EMVCo's EMV Payment Tokenisation Specification defines the payment tokens that card networks issue, each restricted in use, for example to one merchant or one device.
Accepting payments
PCI DSS
Payment Card Industry Data Security Standard · PCI compliance · PCI
PCI DSS, the Payment Card Industry Data Security Standard, is the PCI Security Standards Council's baseline of technical and operational requirements for every entity that stores, processes or transmits card data, or could affect its security. The version of PCI DSS in force is v4.0.1, published in June 2024.
S
Accounts, licences and compliance
Safeguarding
Safeguarding of customer funds · Safeguarding account · Relevant funds
Safeguarding is the duty of payment and electronic money institutions to protect the customer funds they hold, by keeping them apart from their own money or by covering them with insurance or a guarantee. PSD2, Directive (EU) 2015/2366, sets the safeguarding duty in Article 10 for the EU, and the UK's payment services and electronic money regulations do the same.
Accepting payments
SoftPOS
Tap to Pay · Tap on Phone · Tap to Phone
SoftPOS is software that turns an ordinary NFC phone or tablet into a contactless card terminal, with no separate card reader. The security standard for SoftPOS is PCI Mobile Payments on COTS (MPoC), published by the PCI Security Standards Council, and the Visa Core Rules define the device that runs SoftPOS as a Tap to Phone solution.
Accounts, licences and compliance
Strong customer authentication
SCA · Two-factor authentication for payments · PSD2 authentication
Strong customer authentication (SCA) is authentication based on two or more independent elements from the categories of knowledge (something only the user knows), possession (something only the user has) and inherence (something the user is). Directive (EU) 2015/2366 (PSD2) defines strong customer authentication in Article 4(30), and the UK's Payment Services Regulations 2017 use the same three categories.
T
General information, not legal advice: what applies to you depends on your services and your market.
Start your project
Tell us the idea. We'll show you the platform.
One call is enough to map your product to the modules that already exist.
- Response in under one business day
- NDA on request
- No obligation