A complete white-label payment gateway with checkout, a merchant dashboard, routing and reporting, assembled from proven modules around your flow and owned 100% by you.
The product
The screens your customers use, in the order they meet them, shown with demo data. Your logo, colours and domain go on top.
Web app, plus iOS and Android apps
A guided checklist: business details, identity, website and the bank account for payouts. Test mode works from the first minute.
A hosted checkout made for the phone: wallets first, then cards, with every field checked as it is typed.
Volume, authorisation rate, disputes and payment methods at a glance, with the payments that need attention.
Each payment shows its timeline, risk score and 3-D Secure result, next to what the customer saw at checkout.
Merchants follow volume and payments from the app, and hear about anything that needs them.
Delivery
~30 days
Time to launch, on a 12-month scale
The gateway core exists in production form. We apply your brand, configure checkout and routing, deploy, and hand over the source code.
2–3 months
Time to launch, on a 12-month scale
A unique payment flow (subscriptions, payment links, marketplace splits) assembled from the module library around the same proven core.
Licensing
A gateway that only carries payment data is a technology service. Contracting with merchants to accept payments, or holding their money on the way, is a regulated payment service, licensed differently in each market.
Your home country's regulator grants it, and it passports across the EU. Acquiring for merchants needs it; a provider that never holds the funds can fall under the technical service provider exclusion (Article 3(j)), and the EBA calls payment gateways technical in nature. Expect initial capital, safeguarding, AML controls and a local head office; the regulator decides within three months of a complete application. PSD3 and a Payment Services Regulation, due to replace PSD2, still await adoption at 6 October 2026.
The FCA authorises payment institutions, or registers small ones below a volume threshold. Its guidance says payment facilitators contracting with merchants for acquiring are likely caught, while merely technical services such as online gateways are not acquiring. Expect initial capital, safeguarding and a UK head office, and a decision within three months of a complete application. Tighter safeguarding rules (CASS 15) have applied since 7 May 2026.
Onshore, the Central Bank licenses merchant acquiring and payment aggregation, which pools payments and passes them on to merchants. It asks for a UAE company, capital by licence category, UAE-based managers, a compliance function and, for settlement after 24 hours, a bank escrow account, insurance or a guarantee. Its regulation excludes technical providers that never hold the money, but the 2025 Central Bank law reaches any technology facilitating payments, with until 16 September 2026 to comply, so ask the Central Bank. In DIFC the DFSA, and in ADGM the FSRA, authorise Providing Money Services.
Many gateways launch under a licensed acquirer or payment institution: it signs the merchants and settles their funds, and your gateway runs checkout, routing and reporting in your brand. In the EU and the UK, a payment institution can also register you as its agent; the regulator answers within two months. A partner running its service on your gateway is outsourcing to you, which EU regulators must be told of and the UAE Central Bank must approve first.
The KYC / AML module verifies each merchant's business (KYB) and owners and screens them against sanctions and PEP lists; Compliance reporting monitors transactions and prepares suspicious activity reports, with an audit trail throughout. We help you choose acquirers and licensed partners. We are not lawyers: your counsel and your regulator decide what your model needs.
Applying for the licence yourself? Paynoramic Consulting prepares its technical side with you
General information, not legal advice. Checked against the sources above on 6 October 2026.
Launch
The software takes two to three months for a custom flow, or about 30 days on the ready core. The first live payment usually waits longer, on acquirer onboarding, PCI DSS validation and, if you hold funds, the licence or partner.
Assembled from
Each one running in production before it reaches your platform. See the whole library
How it works
One call. Tell us the product, the market and the launch date. We map it to the modules that already exist.
We pick the modules, apply your brand and set up your infrastructure. Every piece is already proven in production.
Your platform goes live on your domain, with your data, under your control.
Source code, documentation and the keys. The platform is yours, with no licence and no revenue share.
Questions
A one-off fee, scoped per module and agreed in writing, with no licence fee, no revenue share and no lock-in. Plan separately for what sits outside the software: a licence and its capital, if your model needs one, a PCI DSS assessment, and hosting. Contracts with the acquirers and providers you choose come alongside, and we help you get them.
Yes, while it stays technical. PSD2 excludes providers that support payments without ever holding the funds (Article 3(j)), and the EBA calls payment gateways technical in nature. Contracting with merchants to accept payments is acquiring, and holding their money on the way is a payment service too. Those need your own authorisation, a licensed partner taking those roles, or registration as its agent. Your regulator has the last word.
You choose, and the choice sets your licence. Either each merchant contracts with the acquirer, which pays it directly and your gateway never touches the funds, or you or your licensed partner receive settlement and pay merchants daily or weekly, after your fees, from safeguarded funds. The ledger books every payment, fee, refund and payout in double entry, and Payouts sends money on SEPA, Faster Payments, ACH and other rails.
PCI DSS covers anyone who stores, processes or transmits card data, or could affect its security, so as the operator you are a service provider in scope. Card brands and acquirers, not the PCI Security Standards Council, decide whether you validate by self-assessment or a Qualified Security Assessor's report. Systems that see only tokens from your processor's fields can fall outside scope; your own card vault cannot. Merchants on your hosted checkout never touch card data, which usually lets them use SAQ A.
Cards run through Adyen, Checkout.com, Stripe, Worldpay or Braintree, and merchants can keep their own contracts. Wallets include Apple Pay, Google Pay and PayPal; bank payments run through TrueLayer, Tink, Yapily, iDEAL, Bancontact and BLIK; Klarna adds pay later. Routing sends each payment to the processor with the best results for its card type and country, and retries declines elsewhere when the reason allows. USDT and USDC work too, but merchants in the UAE may accept only dirham payment tokens from licensed issuers, unless they sell virtual assets.
Through a guided checklist: business details, identity, website and payout bank account. The KYC / AML module runs business verification (KYB), checks owners' identity through providers such as Sumsub, Onfido or Veriff, and screens business and owners against sanctions and PEP lists with ComplyAdvantage or LSEG World-Check. Unclear cases go to a review queue, and every decision is logged. The Merchant onboarding module can add underwriting rules, registry and credit checks and e-signed agreements; an acquirer contracting with your merchants also runs its own checks.
Two clocks run side by side. The software takes two to three months for a custom flow, our usual advice for a gateway, or about 30 days if the ready core fits. Live payments also wait on the acquirer's onboarding, PCI DSS validation and, if you hold funds, the licence or partner; an EU or UK regulator's three months start only with a complete application. Meanwhile, merchants integrate in test mode.
You receive the full source code of the gateway: checkout, routing, merchant dashboard and app, ledger, payouts and backoffice, with infrastructure configuration, documentation and the keys. There is no licence fee, no revenue share and no lock-in. Your team or ours can extend it later: subscriptions or marketplace splits around the same core, or library modules such as Merchant onboarding, or Card acquiring for tap to pay on phones.
Guides
Gateway, acquirer, payment facilitator or payment institution: where the licence line falls, how the card schemes register payment facilitators, what merchant KYB demands, and the UK and UAE rules.
Paynoramic's Head of IT7 min read
What PCI DSS v4.0.1 asks of a payment gateway: who sets your validation level, when you need a Report on Compliance from a QSA, and how tokenisation and hosted fields shrink scope.
Paynoramic's Head of IT7 min read
What an e-money institution and a payment institution may do in the EU, the capital each needs, safeguarding, passporting, and launching as an agent first.
Paynoramic's Head of IT7 min read
More platforms
Start your project
One call is enough to map your product to the modules that already exist.
