Glossary

Payment terms explained for payment companies, their merchants and their developers: who the parties are, how a payment moves, what the schemes, regulators and the platform call things.

3

3-D Secure

3-D Secure is the protocol of the card schemes, branded Visa Secure, Mastercard Identity Check and others, through which the issuer authenticates the cardholder during an online card payment: a push to the banking app, a one-time code or a biometric check. A payment authenticated through 3-D Secure shifts the liability for fraud chargebacks from the merchant to the issuer; the second version of the protocol lets low-risk payments pass without a challenge.

A

Account information service (AIS)

An account information service, AIS, is the regulated service of reading a customer's bank account data, balances, transactions and account holder details, with the customer's consent, through the bank's Open Banking interface. It is provided by licensed account information service providers and used for account verification before a payout, affordability and income checks, accounting and personal finance tools; the consent expires and must be renewed, every 180 days in the EU.

Acquirer

An acquirer, or acquiring bank, is the licensed financial institution that signs a merchant up for card acceptance, sends its transactions to Visa, Mastercard and the other schemes for authorisation, receives the funds from the card issuers and settles them to the merchant, and carries the chargebacks that come back. Every card payment has one acquirer on the merchant's side and one issuer on the cardholder's side.

Alternative payment method (APM)

An alternative payment method, APM, is any way to pay online other than an international card: bank transfers and instant payment rails such as PIX, UPI or BLIK, e-wallets such as PayPal or GoPay, cash vouchers such as Boleto or OXXO, buy-now-pay-later, mobile money such as M-Pesa, and crypto assets. In most of the world they are not alternative at all: they are how people pay, and a merchant without the local methods loses most of the market.

AML (anti-money laundering)

AML, anti-money laundering, is the body of law and practice that obliges financial businesses to know their customers, monitor transactions, report suspicious activity and keep records, so that criminal money cannot pass through them: in the EU the anti-money-laundering directives and the coming regulation, in the UK the Money Laundering Regulations, with the FATF recommendations behind them worldwide. Payment institutions, e-money institutions and banks are obliged entities; a software vendor that never holds funds is not, but its platform must give the obliged entity what its programme needs.

API key

An API key is the secret a merchant's server presents with every request to the platform's API to prove it is that merchant: a long random string issued in the merchant's cabinet, often as a pair of a public identifier and a private secret used to sign requests. It is a credential like a password with no person behind it, so it must be stored in a secrets store, never in code or a browser, rotated when people leave or systems change, and revoked at once when exposed.

Approval rate

The approval rate is the share of payment attempts that end approved, counted per terminal, method, country and merchant over a period. It is the first number a payment business manages: a few points of approval are worth more than a few basis points of fee. It falls with cross-border acquiring, with issuers' risk rules, with forced authentication and with provider outages, and it rises with domestic routing, correct BIN data, exemptions and cascading of soft declines.

Audit log

An audit log is the record of actions, as opposed to the payment journal's record of payments: who logged in, who changed a routing flow, who corrected a payment's status by hand and why, who approved a payout, who issued or revoked a key, who changed a merchant's limits or fees, with the time, the user, the before and after values and the reason. It is what an auditor, an acquirer or a regulator reads to see that the controls the business describes are the controls it runs.

Authorisation

Authorisation is the first step of a card payment: the merchant's request, sent through the acquirer and the scheme, asks the issuer whether the card is valid and the funds available. The issuer answers with an approval code or a decline reason and, on approval, places a hold on the cardholder's funds for the amount. No money moves yet: the hold becomes a debit through capture and clearing, or is released by a void or by expiry.

Available balance

The available balance is the part of a merchant's money the payment business can pay out now: the total balance less the funds the providers have not yet settled, the rolling reserve held against chargebacks, holds for open disputes and the fees still to be charged. The total balance says what the merchant has earned; the available balance says what can leave today. A payout request above the available balance must wait or be refused.

B

Billing descriptor

A billing descriptor is the text the cardholder sees on their statement for a payment: the merchant's trading name, often with a city, a phone number or a website, within the length the schemes allow, about 22 characters for the name. The acquirer sets it from the merchant agreement; a dynamic descriptor lets the merchant vary it per payment, for example with the product or the sub-merchant's name. A descriptor the cardholder does not recognise is the most common cause of avoidable chargebacks.

BIN (bank identification number)

The BIN, bank identification number, also called the IIN, is the first six to eight digits of a card number. It identifies the scheme, the issuing bank and its country, and the card's type and level: debit or credit, consumer or commercial, prepaid, premium. A BIN table lets a platform know, before any provider is called, where a card comes from and what rules apply to it.

Buy now, pay later (BNPL)

Buy now, pay later, BNPL, is credit offered at the checkout by a provider such as Klarna: the provider pays the merchant the full amount, minus a fee higher than a card's, and collects from the payer in instalments or after a delay. The payer gets credit without a card application; the merchant gets a bigger basket and no credit risk; the provider carries the default risk and earns the merchant fee and late fees. Refunds go through the provider, which adjusts the payer's plan.

C

Capture

Capture is the merchant's instruction to collect an authorised amount: the acquirer takes the captured sum into clearing, and the cardholder's hold becomes a debit. In a one-step sale authorisation and capture happen in the same request; in a two-step payment the merchant authorises first and captures later, when the goods ship or the service is confirmed, within the hold period, for the full amount or a part of it.

Card scheme

A card scheme is the network and the rulebook behind a card brand: Visa, Mastercard, American Express, Discover and Diners, JCB and UnionPay internationally, and the domestic schemes such as Elo in Brazil, RuPay in India, Cartes Bancaires in France, Bancontact in Belgium or Girocard in Germany. The scheme connects issuers and acquirers, sets interchange and scheme fees, defines the authorisation and clearing messages, the dispute rules and the monitoring programmes, and licenses banks to issue and acquire its cards.

Card testing

Card testing is the use of a merchant's checkout to validate stolen card numbers: a bot submits hundreds or thousands of small payments or zero-amount authorisations, keeps the cards that are approved and sells or uses them elsewhere. The merchant pays authorisation and scheme fees for every attempt, sees its approval rate collapse, gets flagged by the acquirer and the schemes, and the approved payments come back as chargebacks.

Card vault

A card vault is the isolated system that stores card numbers encrypted under managed keys and hands out tokens in their place; every other part of the platform, every merchant and every report works with the token. The vault is the one component in full PCI DSS scope, which is what keeps the others out of it. A vault owned by the payment business rather than by an acquirer lets a stored card be charged through any acquirer the routing picks.

Cascading

Cascading is the automatic retry of a declined payment on the next terminal of a route group, within the same checkout session and without asking the payer again. It recovers declines caused by the provider, such as its risk rules, limits or outages, and must not retry declines caused by the card itself, such as insufficient funds or a stolen card; the schemes limit reattempts and charge for excessive ones.

Cash voucher

A cash voucher is a payment method for payers without cards or bank accounts, or who prefer cash: the checkout generates a slip or a code with the amount and a reference, the payer takes it to a bank branch, a convenience store, a pharmacy or a kiosk and pays in cash, and the network reports the payment to the merchant hours or a day later. Boleto in Brazil, OXXO in Mexico, Efecty in Colombia, Pago Fácil and Rapipago in Argentina, PagoEfectivo in Peru and Fawry in Egypt are the large ones.

Chargeback

A chargeback is the forced reversal of a card payment initiated by the cardholder through the issuer: the issuer takes the money back from the acquirer, the acquirer from the merchant, and the merchant may contest it with evidence through representment. Chargebacks exist only for card payments; bank transfers, instant payments and Open Banking have refunds but no dispute mechanism of this kind. The schemes watch each merchant's chargeback ratio and fine or terminate those above the thresholds.

Chargeback ratio

The chargeback ratio is the number of chargebacks a merchant receives in a month divided by its number of transactions, counted per acquirer and per scheme. Visa and Mastercard run monitoring programmes with thresholds around one percent and a minimum count of disputes; a merchant above them pays fines each month it stays there and eventually loses its acquiring. The ratio is the single number high-risk payment businesses watch most.

Clearing

Clearing is the step after capture in which the acquirer sends the transaction records to the scheme, the scheme delivers them to the issuers and calculates the net positions of each bank, with interchange and scheme fees applied. Authorisation asks whether the money is there, clearing says how much actually changes hands, and settlement moves it. Clearing files are batched, usually daily, and the clearing date, not the authorisation date, drives interchange rates, currency conversion and the chargeback clock.

Cross-border acquiring

Cross-border acquiring is processing card payments from cardholders in one country through an acquirer licensed in another, under the international schemes' rules: one acquiring contract can reach cardholders in dozens of countries. It is the simplest way to sell internationally and the most expensive: cross-border interchange and scheme fees, currency conversion, higher issuer decline rates and no access to domestic schemes. Payment businesses use it for reach and keep local acquirers for the markets that matter.

D

Denylist (blocklist)

A denylist, also called a blocklist, is the business's own list of what it refuses to process: card numbers or their hashes after fraud, e-mails and phone numbers, device fingerprints, IP addresses and ranges, BIN ranges, countries and merchant categories. A payment that matches is declined before any provider is called. It is a business decision, unlike a sanctions list, which is a legal obligation, and it is only as good as the discipline that adds entries and removes stale ones.

Deposit (pay-in)

A deposit, also called a pay-in, is an incoming payment: the payer pays the merchant through a card, a bank transfer, a wallet, a voucher or a crypto asset, and the amount is credited to the merchant's balance once the provider confirms it. The word comes from gaming, trading and wallets, where a payer funds an account; in e-commerce the same operation is simply a payment. The opposite direction is a payout.

Direct debit

A direct debit is a pull payment: the payer signs a mandate once, and the merchant, through its bank or provider, debits the payer's account on the agreed dates. SEPA Direct Debit in the euro area, ACH debit in the United States, Bacs in the UK and similar schemes elsewhere run on batch rails with settlement in one to several business days. It suits subscriptions, invoices and instalments; its weakness is the return: the payer can have a debit reversed for weeks after it settled.

Dispute

A dispute is a payer's claim that a payment was wrong: fraudulent, duplicated, for goods not received or not as described, or not refunded as promised. For cards it is raised with the issuer and runs through the scheme's stages: an inquiry or retrieval request, a chargeback, the merchant's representment, a second chargeback or pre-arbitration, and arbitration by the scheme. Wallets and marketplaces run their own dispute processes with similar stages and shorter timelines.

Dynamic currency conversion (DCC)

Dynamic currency conversion, DCC, is the offer to a cardholder paying abroad to be charged in their card's currency instead of the merchant's, at an exchange rate set by the acquirer or a DCC provider at the moment of payment. The cardholder sees the final amount in their currency; the acquirer and the merchant share the conversion margin that the issuer would otherwise take. The schemes require that the choice be the cardholder's and the rate and markup be disclosed, and the EU requires the markup to be shown against the central bank's rate.

E

E-wallet

An e-wallet is an account with a licensed provider that the payer funds or links to cards and bank accounts and pays from with a login, a code or a tap: PayPal and Apple Pay or Google Pay in the West, GoPay, DANA and OVO in Indonesia, MoMo and ZaloPay in Vietnam, Mercado Pago in Latin America, Kaspi Pay in Kazakhstan. For the merchant the wallet is one integration that hides the payer's funding source, usually without chargebacks in the card sense and with the wallet's own dispute rules.

Electronic money institution (EMI)

An electronic money institution, EMI, is a company authorised to issue electronic money, prepaid value held against funds received, and to provide the payment services a payment institution may offer. It can open accounts for customers and merchants, hold their balances indefinitely and run wallets and prepaid cards; the price is a higher initial capital, EUR 350,000 in the EU, and safeguarding of all outstanding e-money. Many payment businesses hold an EMI licence because it lets them keep merchant balances and offer accounts.

F

Flow builder

A flow builder is the editor in which a payment business composes its routing: conditions on amount, currency, country of the payer, the IP and the card, scheme, BIN range, method and time window branch into route groups of terminals with priorities, weights and limits, with fallbacks when a branch has no terminal available. A flow is saved as a version, tested against sample payments and activated for a network or a merchant; the previous version stays for rollback.

Fraud screening

Fraud screening is the set of checks that decide whether a payment should be attempted and how: rules on amount, country, BIN, velocity and lists, device and behaviour signals, and risk scores from models trained on past fraud. It happens at several points: the platform's rules before routing, the acquirer's and the provider's engines, the issuer's own risk decision in the authorisation, and 3-D Secure as the issuer's check with the payer. Each layer stops some fraud and some good payments.

Friendly fraud

Friendly fraud, which the schemes now call first-party misuse, is a chargeback filed by the genuine cardholder for a payment they, or someone in their household, actually made: they do not recognise the descriptor, they forgot a subscription, a child bought in a game, or they want the goods and the money. It is the largest share of disputes for digital goods, subscriptions and gaming, and it counts against the merchant's ratio exactly like a stolen card.

G

GDPR

The GDPR, Regulation (EU) 2016/679, governs the processing of personal data of people in the EU and the EEA: it requires a lawful basis, purpose limitation, data minimisation, limited retention, security, records of processing and respect for data subjects' rights, with notification of breaches to the authority within 72 hours. In payments almost every record is personal data: the payer's name, card and account details, IP address and e-mail, and the merchant's directors and beneficial owners.

H

Hard decline

A hard decline is a final refusal about the card or the cardholder: the card is reported lost or stolen, the number or expiry is invalid, the account is closed, the funds are insufficient, the authentication failed or the cardholder's bank has blocked the merchant category. Another acquirer will get the same answer, and the schemes penalise merchants that reattempt such transactions, so a hard decline ends the cascade and the payer is asked for another method.

High-risk merchant

A high-risk merchant is a business that acquirers and schemes treat as more likely to produce chargebacks, fraud, regulatory trouble or sudden closure: gambling and betting, adult content, forex and crypto, nutraceuticals and subscriptions with free trials, travel sold far in advance, debt collection, telemarketing, and any merchant with a history above the chargeback thresholds. The label comes from the merchant category code, the model and the history, and it means registration fees, a rolling reserve, higher pricing and closer monitoring.

Hosted checkout

A hosted checkout is a payment page that the payment platform serves, by a redirect or a link, instead of a page the merchant builds: the payer enters the card or chooses a local method there, and the card data goes straight to the platform's vault. The merchant integrates a link and a webhook and stays in the lightest PCI DSS scope; the brand on the page can still be the merchant's or the PSP's.

I

Idempotency key

An idempotency key is a unique value, usually a UUID, that a client sends with a request that creates or changes something, so that repeating the same request after a timeout, a network error or a crash returns the same result instead of producing a duplicate. The server stores the key with the response for a period and, on a repeat, replays the stored response; a repeat with the same key but a different body is rejected. In payments it is what makes a retry safe.

Instant payment

An instant payment is a bank transfer cleared and settled within seconds, every day and hour, over a real-time payment rail run or mandated by the central bank: PIX in Brazil, UPI in India, SEPA Instant in the euro area, Faster Payments in the UK, PromptPay in Thailand, SPEI in Mexico. The payer sees the debit and the merchant the credit at once, the payment is final, and the rail usually carries a reference that lets the platform match it to the order.

Interchange

Interchange is the fee that flows from the acquirer to the issuer on every card payment, set by Visa, Mastercard and the other schemes in tables by card type, issuing region, merchant category and channel. It is the largest part of what a merchant pays for a card payment and it is regulated in several markets: the EU and the UK cap consumer interchange at 0.2 percent for debit and 0.3 percent for credit.

Issuer

An issuer, or issuing bank, is the licensed institution that issued the payment card to the cardholder and holds the account behind it. On every payment the issuer decides whether to approve: it checks the balance or credit limit, the card's status, its own risk rules and, where asked, authenticates the cardholder through 3-D Secure. The issuer's answer is what the merchant sees as approved or declined.

K

KYB (know your business)

KYB, know your business, is the verification of a business customer, in payments a merchant: company registration and good standing, directors and beneficial owners and their identity, the bank account the money will go to, the website and what it actually sells, its merchant category and risk, and the licences its activity needs. The licensed payment business performs it before activating a merchant and refreshes it during the relationship; the acquirer and the schemes require it and hold the business responsible for the merchants it brings.

KYC (know your customer)

KYC, know your customer, is the verification of an individual's identity and risk before and during a business relationship: identity document and liveness check, name, date of birth and address, screening against sanctions and politically exposed persons lists, and a risk rating that decides how closely the customer is monitored. Anti-money-laundering law requires it from obliged entities such as payment institutions, e-money institutions and banks for their own customers; merchants in regulated industries, such as gaming, run it on their players.

L

Ledger

A ledger is the platform's book of record: every payment, fee, refund, chargeback, reserve movement, settlement and payout is written as entries that balance, per merchant, per provider account and per currency. From it come the merchant's balance, what the business owes each merchant, what each provider owes the business and the business's own margin. Provider statements and bank accounts tell parts of the story; the ledger is the one place where they are put together.

Liability shift

Liability shift is the card schemes' rule that, when a payment was authenticated through 3-D Secure, or the issuer approved it under certain exemptions, the issuer rather than the merchant bears the loss if the cardholder later disputes it as fraud. It covers fraud reason codes only: a dispute for goods not received or not as described still lands on the merchant. Where the issuer did not take part in authentication, or the attempt failed, liability stays with the merchant.

Local acquiring

Local acquiring means processing a card payment through an acquirer in the cardholder's own country, so that issuer and acquirer are in the same market and the transaction is domestic: lower interchange and scheme fees, fewer issuer declines, local currency without conversion and access to domestic schemes and debit cards that cross-border acquirers cannot reach. It usually requires a local entity or a licensed local partner for the merchant, which is why payment businesses run several local acquirers and route by card country.

M

Merchant

A merchant is the business that sells to payers and accepts their payments: an online shop, a marketplace seller, a subscription service, a gaming operator, a school. It contracts with a licensed payment service provider or acquirer, integrates a checkout or an API, receives the money on the agreed settlement schedule and carries the refunds and chargebacks of its sales. In a platform the merchant is the account on whose behalf payments are created.

Merchant category code (MCC)

A merchant category code, MCC, is a four-digit code from ISO 18245 that the acquirer assigns to a merchant to describe its business: 5411 for grocery stores, 5812 for restaurants, 7995 for gambling, 6051 for crypto and quasi-cash, 5968 for subscriptions sold by direct marketing. It travels in every authorisation and clearing record and decides the interchange rate, how issuers treat the payment, whether the scheme requires registration and whether the merchant is high-risk for the acquirer.

Merchant discount rate (MDR)

The merchant discount rate, MDR, is the total fee a merchant pays on a card payment: the interchange that goes to the issuer, the scheme fees that go to Visa or Mastercard, and the margin of the acquirer or payment service provider. It is quoted as a percentage, sometimes with a fixed part, either blended as one rate or unbundled as interchange plus a markup.

Merchant of record

The merchant of record, MoR, is the legal entity that sells to the payer in the eyes of the card schemes, the banks and the tax authorities: its name appears on the statement, it owes the sales tax or VAT, it answers for refunds and chargebacks and it must be the party with the acquiring contract. A marketplace can be the merchant of record for all its sellers or let each seller be its own; a reseller of software is often the merchant of record for the vendor's product.

Merchant-initiated transaction (MIT)

A merchant-initiated transaction, MIT, is a card payment the merchant charges without the cardholder being present, under an agreement established at a first, authenticated payment: a subscription renewal, an instalment, a top-up when a balance runs low, a charge for a no-show. The schemes require it to carry an indicator and a reference to the first transaction, and it is exempt from strong customer authentication because the cardholder authenticated the agreement, not each charge.

Mobile money

Mobile money is an account held with a mobile network operator or its financial arm, identified by the phone number, funded with cash at agents and used to pay, transfer and save from a basic phone or an app: M-Pesa in Kenya and Tanzania, MTN MoMo and Airtel Money across many African countries, Vodafone Cash in Ghana and Egypt. In much of Africa it is the main way money moves, with far more accounts than bank accounts, and online merchants reach their customers through it or not at all.

Multi-currency processing

Multi-currency processing is running payments in several currencies at once: the payer is charged in their own currency, the payment goes to a provider account in that currency, the merchant's balance is kept per currency, and the business settles in the currencies it chooses, converting where it decides to. It avoids conversion at the checkout, which lifts approvals and lowers the payer's cost, and it moves the exchange rate question to the business's treasury, where it belongs.

N

Network (brand on the platform)

A network is one brand on the platform: its domains for the checkout, the merchant cabinet and the admin panel, its logos, colours and mail sender, its users and roles, its merchants, its terminals and routing rules, its journal and ledger. Every record carries its network, and nothing of one network is visible to another; a client with several brands or countries runs several networks from one admin panel.

Network token

A network token is a substitute for the card number issued by the card scheme, Visa or Mastercard, through their token services: it is bound to one merchant, platform or wallet, carries a cryptogram at payment time and is updated by the scheme when the card is reissued or expires. Apple Pay and Google Pay run on network tokens; merchants and platforms can request them for stored cards. Issuers approve tokenised payments more often, and a token survives the card's expiry, which keeps subscriptions alive.

O

Open Banking

Open Banking is the set of rules and bank interfaces under which a customer can authorise a licensed third party to initiate a payment from their bank account or to read the account's data. In the EU it comes from PSD2, in the UK from the Open Banking standard built on it; Brazil, Australia and others have their own frameworks. For a merchant it means pay by bank: the payer confirms the payment in their banking app, the money arrives by transfer, and there is no card, no interchange and no chargeback.

P

PAN (primary account number)

The PAN, primary account number, is the card number: 13 to 19 digits, usually 16, made of the BIN that identifies the issuer, the cardholder's account identifier and a final check digit computed with the Luhn algorithm. It is the field PCI DSS exists to protect: it may be stored only encrypted or hashed, displayed only masked to the first six and last four digits, never logged, and never sent over an unprotected channel. In modern platforms it is replaced by a token everywhere except inside the vault.

Pay by bank

Pay by bank is a payment made straight from the payer's bank account: the checkout shows the payer's bank, the payer confirms in the banking app, and the money arrives by transfer, instant where the rail allows. Behind it is either Open Banking, with a licensed payment initiation provider connecting to the bank, or a national scheme such as iDEAL, PIX or UPI. No card data is entered, there is no interchange and no chargeback, and the merchant usually pays a flat fee.

Payment facilitator (PayFac)

A payment facilitator, PayFac, is a company that holds a merchant agreement with an acquirer and onboards other businesses, its sub-merchants, under it: it signs them up, screens them, accepts payments for them through its account and pays them out, taking a fee. The acquirer sees one merchant with many sub-merchants; the card schemes require the facilitator to register, to apply their onboarding and monitoring rules to sub-merchants and to carry their chargebacks and fines.

Payment gateway

A payment gateway is the software layer between the merchant's checkout and the acquirers or payment providers: it receives the payment request, collects or tokenises the card data, sends the transaction to the right provider, returns the result and notifies the merchant. It is technology, not a licence: the acquirer or the licensed payment service provider that operates the gateway contracts with merchants and handles the money. A white-label gateway is the same software run under the operator's brand.

Payment initiation service (PIS)

A payment initiation service, PIS, is the regulated service of starting a transfer from a payer's bank account at the payer's request, performed by a licensed payment initiation service provider through the bank's Open Banking interface. The payer authenticates at their bank, the provider receives confirmation that the transfer was initiated, and the merchant is told to expect the money; the provider never holds the funds, which travel from the payer's bank to the merchant's account.

Payment institution

A payment institution is a company authorised by a national regulator to provide payment services: acquiring card payments, executing transfers, money remittance, issuing payment instruments, payment initiation and account information. In the EU the status comes from PSD2 with initial capital from EUR 20,000 to EUR 125,000 depending on the services, safeguarding of customer funds, fit-and-proper management and ongoing reporting; the UK, Switzerland and other markets have equivalent regimes under different names.

Payment journal

A payment journal is the append-only record of everything that happened to a payment: the merchant's request, the routing decision, each provider call and its answer, callbacks, status changes, refunds, chargebacks, webhooks delivered and the people who touched it. It is kept for years because disputes, audits, tax and anti-money-laundering rules reach back that far, and it must contain enough to explain any payment while never containing a full card number or a secret.

Payment link

A payment link is a URL that opens a hosted checkout prepared for one payment: the amount, currency, description and often the payer's details are set when the link is created, by hand or through the API, and the payer pays through any method the checkout offers. It needs no integration on the merchant's side, which is why it serves invoices, social media sales, bookings and services agreed by phone or chat.

Payment orchestration

Payment orchestration is the software layer that connects a payment business to many providers through one integration and decides, for each payment, which provider handles it: routing by rules, cascading on declines, one vault and one checkout across providers, and one journal and ledger for all of them. It replaces the adapters and glue code a payment company would otherwise build and maintain itself.

Payment service provider (PSP)

A payment service provider, PSP, is a licensed company that offers merchants payment acceptance: it signs the merchant, connects it to one or several acquirers and local payment methods, collects and settles the funds, handles refunds and chargebacks, and carries the regulatory obligations of a payment institution. The PSP's product is the service to merchants; the software it runs on may be its own or licensed.

Payment status

A payment status is the state of a payment in its life: created, pending the payer's action, authorised, paid, declined, expired, cancelled, refunded in part or in full, charged back. Final statuses do not change on their own; pending ones change when the provider answers or the payer acts. Merchants read the status through webhooks and the API rather than the redirect, because the redirect may never arrive while the money still does.

Payment trace

A payment trace is the view of one payment's full history in order: the merchant's request and its data, the routing rule that fired, each terminal tried with its request, answer and reason code, 3-D Secure steps, callbacks received, status changes, webhooks sent and the merchant's responses, refunds and disputes, and every manual action with its author. It is built from the journal and is what a support agent, a merchant or an auditor opens to answer the question what happened to this payment.

Payout

A payout is a transfer initiated by the merchant or the payment business to a recipient: a player's winnings, a seller's earnings, a courier's pay, a refund to a method that has no return channel. It differs from a refund, which returns a specific payment, and from settlement, which is the provider or the business paying out a period's balance; a payout is a new outgoing transaction with its own recipient, rail and fee.

PCI DSS

PCI DSS is the security standard of the card schemes, maintained by the PCI Security Standards Council, for every organisation that stores, processes or transmits card data: merchants, service providers, processors. It sets requirements on networks, encryption, access control, logging, testing and policies; compliance is shown by a self-assessment questionnaire or an on-site assessment, depending on volume and role. Scope is the whole game: a hosted checkout and a vault keep card numbers away from the merchant's and the business's own systems.

Pre-authorisation

A pre-authorisation is an authorisation placed to reserve the cardholder's funds before the final amount is known: a hotel reserves the estimated stay, a car rental a deposit, a marketplace the order before stock is confirmed. The amount can be increased or extended with incremental authorisations where the scheme allows, and the payment is completed by a capture for the actual sum, which may be lower, or released by a void.

Processor

A processor is the technical operator that moves card transactions between the parties: it receives authorisation requests, formats them for the scheme, delivers the issuer's answer, builds the clearing files and settlement reports. An acquiring processor works for acquirers, an issuing processor for issuers; many acquirers outsource processing entirely and keep only the licence, the merchant contracts and the risk. A processor needs scheme certification and connections, not a payment licence.

Provider adapter

A provider adapter is the module of a payment platform that talks to one acquirer, bank or payment provider: it maps the platform's payment, refund, payout and status model onto that provider's API, signs the requests the way it requires, parses its responses and callbacks, and translates its statuses and reason codes into the platform's own. Everything above the adapter, routing, ledger, checkout, reports, sees one model; the adapter absorbs the provider's particularities.

PSD2

PSD2, Directive (EU) 2015/2366, is the European Union's framework for payment services: it defines which activities need a licence as a payment or e-money institution, requires strong customer authentication for electronic payments, and obliges banks to give licensed third parties access to customers' accounts for payment initiation and account information, which is Open Banking in Europe. Its article 3(j) excludes technical service providers that never hold funds from the licence requirement.

Q

QR payment

A QR payment is a payment the payer starts by scanning a code with a banking or wallet app: the code carries the merchant's identifier, the amount and a reference, the payer confirms in the app, and the money moves over the local instant payment rail or the wallet's ledger. National standards such as PIX in Brazil, UPI in India, PromptPay in Thailand and QRIS in Indonesia made the QR code the dominant way to pay in those markets, in shops and online alike.

R

Reason code

A reason code is the coded explanation attached to an answer: an authorisation response code says why a payment was declined, insufficient funds, do not honour, lost or stolen card, authentication required; a chargeback reason code says why a cardholder disputes a payment, fraud, goods not received, not as described, duplicate, credit not processed. Codes differ by scheme and are extended by acquirers and providers, so a platform maps them to one classification and keeps the original for support.

Reconciliation

Reconciliation is the comparison of three records that should agree and never quite do: the platform's journal and ledger of payments, refunds, chargebacks and fees; the providers' settlement statements; and the credits on the business's bank accounts. Every difference is a late settlement, a fee the provider charged differently, a refund booked on another day, a chargeback not yet recorded or an error, and each must be found and explained, usually daily per provider and monthly in full.

Recurring payment

A recurring payment is a charge repeated on a schedule under an agreement the payer gave once: a monthly subscription, an annual licence, a weekly delivery. With cards it is built on a stored token and merchant-initiated transactions after an authenticated first payment; with bank methods on mandates, such as UPI mandates in India or variable recurring payments in the UK. Its economics depend on retention: retries within the schemes' limits, updated cards and a payer told before a charge fails.

Refund

A refund is the merchant's decision to return all or part of a payment to the payer through the same method the payer used: back to the card, the bank account, the wallet or the crypto address. It is initiated by the merchant, unlike a chargeback, which the cardholder forces through the issuer, and it happens after settlement, unlike a reversal or void, which cancels an authorisation before the money moved.

Representment

Representment is the merchant's response to a chargeback: through its acquirer it sends the issuer evidence that the payment was valid and asks for the disputed amount back. The evidence depends on the reason code: proof of delivery for goods not received, the matching description for not as described, the authentication result for fraud, the refund already made for credit not processed. The merchant has a deadline of days to weeks, pays a fee, and wins when the evidence fits the code.

Retrieval request

A retrieval request, also called an inquiry or request for information, is the issuer's request to the acquirer for the documentation of a payment: the receipt, the order, the delivery proof. The cardholder has asked about a charge they do not recognise, and the issuer wants to check before filing a chargeback. The merchant has a short deadline to answer through its acquirer; a good answer often ends the matter, and no answer can turn into a chargeback the merchant cannot contest.

Risk score

A risk score is a number, often from 0 to 100 or 0 to 1, that a fraud engine assigns to a payment to say how likely it is to be fraudulent or disputed, based on the card, the payer's device and behaviour, the address, the merchant's history and the engine's past fraud. Scores come from the issuer's own engine in the authorisation decision, from the acquirer's or provider's screening, and from specialist vendors; a threshold turns the score into approve, challenge or decline.

Role-based access control

Role-based access control, RBAC, gives each user a role, and each role a set of permissions: view payments, refund, create a payout, approve a payout, change routing, onboard a merchant, manage users. In a payment platform the roles are also scoped: to a network, to a merchant, to a set of merchants, so that a partner's administrator sees only its brand and a merchant's accountant only its reports. Separation of duties, creating a payout and approving it as two roles, is what keeps one compromised account from moving money alone.

Rolling reserve

A rolling reserve is a share of a merchant's turnover, typically between five and fifteen percent, that the acquirer or the payment service provider holds for a fixed period, often 90 or 180 days, before releasing it, so that chargebacks and refunds that arrive after the sale can be covered. Each day's reserve is released on its own date, which is why it rolls; a merchant always has a moving window of held funds.

Route group

A route group is the ordered list of terminals that a routing branch ends in: the providers that can take this kind of payment, each with a priority, a weight for sharing traffic between equals, and limits. The first terminal by priority and weight that passes its limits gets the payment; on a soft decline the cascade moves to the next; the group's size and order decide both the recovery and the time the payer waits.

Routing

Routing is the set of rules that decides which provider processes a payment. The rules read the payment's fields, such as the amount, the customer's and the card's country, the scheme, the BIN range, the method and the time, and send it down a branch that ends in an ordered list of terminals; weights split traffic between equal terminals, and limits keep each within its contract. Routing is where approval rates and fees are managed without touching code.

S

Sanctions screening

Sanctions screening is the check of the people and companies a business deals with against the lists of sanctioned persons, entities, vessels and territories published by the EU, the UN, the UK, the US and other authorities, before onboarding and continuously as lists change. Licensed payment businesses must screen their merchants and the people behind them and, where the law requires, the parties to payments; dealing with a listed party is prohibited regardless of amount.

Sandbox

A sandbox is a test environment where a payment flow can be run end to end without real money: the merchant integrates against test API keys, pays with test card numbers and test wallets, and receives the same statuses and webhooks as in production. Providers run their own sandboxes with scripted outcomes, approved, declined, 3-D Secure challenge, and the platform's sandbox connects to them so that a merchant sees the whole flow before a real card is ever charged.

Scheme fee

Scheme fees, or network fees, are what Visa, Mastercard and the other card schemes charge their member banks for using the network: per authorisation, per cleared transaction, for cross-border and currency conversion, for tokens, for programmes and reports. They are a smaller part of a card payment's cost than interchange, less transparent, and they change several times a year; the acquirer passes them on to the merchant inside the merchant discount rate.

Settlement

Settlement is the movement of the money behind a payment: from the issuer to the acquirer through the scheme, from the acquirer or provider to the payment business, and from the business to its merchants. It follows a cycle, such as T+1 or T+2 for cards, weekly for some methods, instant for PIX, UPI or SEPA Instant, and it is usually net: the provider pays the gross amount less its fees, refunds and chargebacks of the period.

Soft decline

A soft decline is a refusal that does not say the card is bad: the acquirer's risk rule fired, a velocity limit was reached, the provider timed out or was down, the issuer asked for authentication, a currency or BIN was not supported. The same payment may be approved by another provider or a moment later, which is why soft declines are what a cascade retries and what approval-rate work is about.

Stablecoin

A stablecoin is a token on a public blockchain designed to keep the value of a fiat currency, most often the US dollar: USDT and USDC are the largest, backed by reserves of cash and short-term government debt held by their issuers. They move on networks such as Ethereum, Tron and Solana in minutes for cents, around the clock, which makes them useful for cross-border settlement, payouts to contractors and payers in countries with weak banking, and for merchants who want to be paid in a dollar-like asset.

Strong customer authentication (SCA)

Strong customer authentication, SCA, is the requirement of the EU's PSD2 and the UK's payment regulations that a payer authenticates an electronic payment with two independent factors: something they know, something they have or something they are. For cards it is delivered through 3-D Secure; for bank payments through the bank's own app. Exemptions cover low amounts, low-risk transactions, trusted beneficiaries and recurring payments after the first one; merchant-initiated transactions are outside its scope.

T

Technical service provider

A technical service provider is a company that supports the provision of payment services without at any time entering into possession of the funds: it processes and stores data, protects privacy, authenticates users, supplies IT and communication networks, terminals and devices. PSD2 article 3(j) excludes such providers from the licence requirement; the payment service, the contracts with merchants and the responsibility for the money stay with the licensed institution that uses the technology.

Terminal (provider account)

A terminal is a provider account as the platform sees it: the client's contract with an acquirer, a local method operator, an Open Banking or crypto provider, with the credentials, the currency, the operations it allows, its limits and its fees. Routing rules end in terminals; a payment is processed by exactly one terminal at a time, and a cascade moves it from one terminal to the next within a route group.

Tokenisation

Tokenisation replaces a card number with a token, a reference that stands for the card in every later request, journal and report, while the number itself stays in a vault. A merchant charges the token for recurring and one-click payments without storing the card; a stolen token is useless outside the vault that issued it. Tokens come from the schemes, from acquirers and from the platform's own vault, and a vault can hold all three for one card.

V

Velocity limit

A velocity limit caps how many payments, or how much, may pass in a time window for one key: a card number, a payer, a merchant or a terminal. Ten attempts per card per hour, a daily amount per merchant, a monthly volume per terminal that mirrors the acquirer's contract. It stops card testing, account takeover and runaway merchants, and it keeps each terminal inside what its provider allows.

Void (reversal)

A void, also called a reversal, cancels an authorisation that has not been captured: the acquirer tells the issuer to release the hold, the cardholder's available balance is restored, and no clearing takes place. It costs nothing beyond the authorisation fee and leaves no debit to refund. After capture a void is no longer possible: the money is returned by a refund, which takes days and keeps the acquirer's fee.

W

Webhook

A webhook is an HTTP request the platform sends to a URL the merchant configured when something happens to a payment: it was paid, declined, refunded, charged back, a payout was sent. It carries the payment's identifier, the merchant's reference, the new status and the amounts, and it is signed so the merchant can verify it came from the platform. Webhooks replace polling and the unreliable redirect; because networks fail, they are retried and may arrive more than once.

White-label

White-label is a product built by one company and sold under the brand of another: the checkout, the cabinets, the e-mails and the documents carry the seller's name while the software underneath comes from the builder. In payments a white-label gateway lets a PSP, a reseller or a bank offer payment acceptance under its own brand without building the platform; the licence behind the service stays with whoever is licensed, the seller or its payment partner.