How to become a PSP or a payment facilitator

Gateway, acquirer, payment facilitator or payment institution: where the licence line falls, how the card schemes register payment facilitators, what merchant KYB demands, and the UK and UAE rules.

· Head of IT
· 7 min read
A laptop with a payment card, a gold euro coin and payout and team blocks

"PSP" covers business models with very different obligations, and one question decides most of them: do you ever hold your merchants' money?

This guide is general information, not legal advice: the details depend on your services and your market, so confirm them with a lawyer and the regulator before you apply.

Four models

  • Technical gateway. It passes transaction data from the merchant to the acquirer; Mastercard calls this a merchant payment gateway (Mastercard Rules, Rule 7.1).

  • Acquirer. It contracts with the merchant to accept and process payments, resulting in a transfer of funds to the merchant (PSD2, Article 4(44)).

  • Payment facilitator. It contracts with an acquirer to deposit transactions, receive settlement or contract on behalf of its sponsored merchants (Visa Rules, glossary). It signs those merchants as the acquirer's agent and must pay them (Mastercard Rules 7.8.1 and 7.8.2).

  • Payment institution. The EU licence for payment services such as acquiring (PSD2, Article 11 and Annex I, point 5).

Where the law draws the line

PSD2 excludes technical service providers that support payment services "without them entering at any time into possession of the funds to be transferred", such as data processing and storage, ICT and terminals (Article 3(j)). Mere processing and storage of data, or operating terminals, is not acquiring (recital 10).

Once you contract with merchants and the money passes through you, that exclusion no longer fits. The FCA's view is that the definition of acquiring is likely to capture payment facilitators that contract with payees, while technical services such as online gateways do not, on their own, amount to acquiring (PERG 15.3, Q21).

The card schemes agree: Mastercard forbids a service provider from accessing merchant funds, payment facilitators excepted (Rule 7.3), and forbids a third-party processor from possessing or controlling settlement funds (Rule 7.1).

What a payment institution licence asks for

In the EU, your home regulator grants it, and it is valid across the EU (PSD2, Articles 5 and 11).

  • Capital: at least €125,000 of initial capital to provide acquiring (Article 7), plus ongoing own funds (Articles 8 and 9).

  • People and governance: a programme of operations, a three-year business plan, governance and internal controls, qualifying shareholders and directors of good repute with the right knowledge and experience (Article 5).

  • Safeguarding: customer funds never mixed with your own; anything not paid out by the end of the next business day goes into a separate account at a credit institution or, at its discretion, a central bank, or into secure, liquid, low-risk assets, or is covered by insurance or a guarantee (Article 10).

  • AML: customer due diligence on every merchant (see below), with the controls described in your application (Article 5).

  • Local substance: your head office in the member state of your registered office, carrying on part of the business there (Article 11).

  • Technology and outsourcing: a security policy and incident procedures (Article 5), and outsourcing that does not weaken internal control, notified to the authority (Article 19).

The authority must decide within 3 months of receiving a complete application (Article 12). The rules will change: PSD3 and a Payment Services Regulation, which would replace PSD2, were both awaiting the Council's first-reading position on 6 October 2026 (PSD3 and PSR files, European Parliament Legislative Observatory).

Card scheme registration and the sponsor acquirer

A payment facilitator works under a sponsor acquirer, which answers to the scheme for it.

  • Visa: the acquirer is liable for everything its payment facilitator and sponsored merchants do (Visa Rules 5.3.1.2). It must have the facilitator's registration, including an attestation of due diligence, confirmed by Visa before submitting transactions, and assign Visa's facilitator identifier (5.3.1.3). A sponsored merchant above USD 1 million in annual transaction volume needs a direct agreement with the acquirer, with exceptions (5.3.1.4).

  • Mastercard: the acquirer is responsible for all acts of the facilitator and its sponsored merchants (Rule 7.6.5). The facilitator signs each sponsored merchant as the acquirer's agent (7.8.1). A sponsored merchant above USD 10,000,000 in combined annual Mastercard and Maestro volume must contract directly with an acquirer unless set conditions are met (7.8). Settlement funds the facilitator can access may be used only to pay sponsored merchants (7.6.5.1).

  • No nesting. Neither scheme lets a payment facilitator sign up another payment facilitator (Visa Rules 5.3.1.5; Mastercard Rule 7.8).

Merchant onboarding (KYB)

EU AML law requires you to identify and verify each merchant and its beneficial owners, understand its ownership and control, establish the purpose of the relationship and monitor it on an ongoing basis (Directive (EU) 2015/849, Article 13). From 10 July 2027, the EU AML Regulation sets these duties directly and spells out checks for targeted financial sanctions and politically exposed persons (Regulation (EU) 2024/1624, Articles 20 and 90).

The schemes add their own checks:

  • an adequate due diligence review before contracting, including a site visit or a suitable alternative (Visa Rules 5.2.1.2);

  • confirmation that the merchant is financially responsible, operates in an allowed jurisdiction and does not misrepresent its location (1.5.1.3);

  • a query of a common terminated-merchant database before signing (10.10.1.2, effective 18 April 2026);

  • sanctions screening of merchants at onboarding and afterwards (Mastercard Rule 1.2.2);

  • ongoing monitoring of each sponsored merchant (7.8.2). The acquirer may let you verify that a merchant is a bona fide business, but it stays responsible (7.6.5.1).

The UK and the UAE, briefly

UK. Under the Payment Services Regulations 2017, acquiring needs FCA authorisation and initial capital of €125,000 (Schedule 3), and the FCA must decide within 3 months of a complete application or 12 months of an incomplete one (regulation 9). Above an average of €3m in monthly payment transactions, you need full authorisation rather than small payment institution registration. The FCA expects policies tailored to your business, stress-tested forecasts, and safeguarding and wind-down arrangements (FCA). Stricter safeguarding rules apply from 7 May 2026 (PS25/12).

UAE. Onshore, merchant acquiring and payment aggregation, which collects payments for merchants, pools them and passes them on, need a Central Bank licence (Retail Payment Services and Card Schemes Regulation, Articles 2 and 3). Category III, the lowest-capital licence covering both, needs initial capital of at least AED 500,000, or AED 1 million once monthly payment transactions average AED 10 million or more; Category II adds cross-border transfers and doubles both figures (Article 6). The applicant must be a UAE company with a chief executive ordinarily resident there, and payment data must be stored in the UAE (Articles 1 and 14). Funds may be held only in transit; settling merchants after 24 hours needs a bank escrow account, insurance or a bank guarantee (Article 14). Outsourcing needs prior approval (Article 16). No decision deadline is set; meeting the Licensing Division first is encouraged (Article 5).

The Regulation excludes technical providers that never hold the money. But the Central Bank Law is now Federal Decree-Law No. 6 of 2025, in force since 16 September 2025, and its Article 62 brings anyone facilitating a licensed financial activity, including through technology platforms for payments, under the Central Bank's jurisdiction. Firms had one year to comply, a period the Board may extend; existing circulars still apply, and the financial free zones are outside the law (CBUAE FAQs).

Routes to launch before your own licence

  • Stay technical. Merchants contract with the acquirer, funds go from the acquirer to them, and you never hold the money (PSD2, Article 3(j)). In the UAE, check this route with the Central Bank first (Article 62).

  • Become an agent of a licensed institution. It registers you with its regulator, which decides within 2 months, and stays fully liable for you (PSD2, Articles 19 and 20). In the UAE, licensed providers may also use agents (Article 15).

  • Work as a facilitator under a sponsor acquirer, once your role and money flow have been checked against the licence rules above.

Common mistakes

  • Treating scheme registration as a licence. Visa's registration does not confirm compliance with any requirement (Visa Rules 10.2.2.1), and it is not regulatory authorisation.

  • Signing merchants outside the jurisdiction and categories in your acquirer contract (5.3.1.3).

  • Touching the money as a "technical" provider, then holding it unprotected: funds not paid out by the end of the next business day must be safeguarded (PSD2, Article 10).

What this means for your platform

Our white-label payment gateway can process every merchant on your own processor contracts, route each merchant to its own contract, or mix the two. That choice decides whether you run a technical gateway or a payment facilitator, and so which licence you need. Merchants activate themselves through checks run by the KYC/AML module, and the ledger reconciles daily against processor and bank statements. Our SoftPOS platform adds merchant onboarding with KYB, registry and sanctions checks and your underwriting rules, and with your own acquiring licence it connects to your processing directly.

Sources

All checked on 6 October 2026.

Written by

Paynoramic's Head of IT

Head of IT

Head of IT at Paynoramic, responsible for the module library every platform is built from. Has worked on payment, banking and workforce platforms for companies including American Express, Teya and Indeed Flex, and for a global card issuer-processor. Writes about what a fintech or crypto launch needs beyond the software: licensing, certification and the real cost.

Keep reading

All insights

Building something like this?

Tell us the idea and we will show you the platform it maps to.

Start your project