Payment gateway license: when a gateway, processor or acquirer needs one.

In the EU and the UK, usually not if it only carries payment data: a technical service provider that never takes possession of the funds is excluded (PSD2 Article 3(j), PSRs 2017 Schedule 1 Part 2), and the FCA confirms that providing terminals or online gateways is not in itself acquiring. India's 2025 payment aggregator Directions also leave out gateways with no involvement in handling funds. Other regimes draw the line wider: in Canada, transmitting an instruction for an electronic funds transfer is a payment function under the RPAA; in Singapore, merchant acquisition applies whether or not you hold the money; Pakistan's rules name electronic payment gateways. Once a gateway contracts with merchants to accept their payments or receives their money, expect a licence requirement - acquiring in the EU and UK, payment aggregation in India.

A gateway carries the transaction data from the merchant's checkout; a processor routes and authorises transactions for an acquirer; the acquirer contracts with the merchant to accept and process its payments and transfers the funds to it. That last step is why acquiring is the licensed activity (PSD2 Article 4(44)).

For acquiring, €125,000 initial capital in the EU and the UK. In India, ₹15 crore net worth when applying as a payment aggregator, rising to ₹25 crore by the end of the third financial year. In Singapore, S$100,000 base capital for a standard and S$250,000 for a major payment institution. In Thailand, THB 50 million for acquiring and THB 10 million for payment facilitating; in Pakistan, PKR 200 million paid-up for a PSO or PSP. In Brazil, capital follows the activities under Joint Resolution BCB/CMN 14/2025, and an acquirer counts as both credit and intermediation. In the UAE, from AED 500,000 to AED 3 million depending on category and monthly volume. In Malaysia, a non-bank merchant acquirer must maintain minimum capital funds of RM300,000 at all times, or RM1 million if its actual or projected average monthly transaction value exceeds RM10 million (since 15 September 2023).

Usually yes. A PayFac receives its sub-merchants' settlement before paying them out, and in the UK the FCA treats payment facilitators that contract with payees for acquiring services as likely to be acquiring (PERG 15.3, Q21). The card schemes register payment facilitators through the sponsoring acquirer under their own rules, but that registration does not replace a licence: a PayFac that receives the settlement usually needs a payment institution authorisation in the EU and UK and the RBI payment aggregator authorisation in India.

Not in India: the RBI authorises payment aggregators, which collect and settle merchants' funds through an escrow account (cross-border PAs through separate collection accounts), while payment gateways that only supply technology fall outside the 2025 Directions. Elsewhere, "payment gateway license" usually means the acquiring or aggregation licence.

No. PCI DSS is the card industry's data security standard, set by the PCI Security Standards Council for everyone who stores, processes or transmits cardholder data - merchants, processors, acquirers, issuers and service providers. Whether you must comply and how you prove it is decided by the card brands and your acquirer. An attestation of compliance is not a licence to provide payment services. Regulators can still require it: India's 2025 payment aggregator Directions make PCI-DSS controls mandatory for payment aggregators, ask for PCI-DSS compliance reports to their IT committee and require a check of merchants' PCI-DSS status at onboarding.

At federal level, FinCEN's definition excludes a person that only acts as a payment processor to facilitate the purchase of goods or services through a clearance and settlement system by agreement with the seller. State money transmission laws are separate, and their exemptions - often for an agent of the payee - are worded differently from state to state.

In Singapore, merchant acquisition is a payment service under the Payment Services Act 2019, licensed as a standard or major payment institution depending on monthly volumes. It applies whether or not the provider comes into possession of the money, and MAS notes that it usually includes providing a point-of-sale terminal or an online payment gateway. In Malaysia, merchant acquiring needs registration with Bank Negara Malaysia under sections 17(1) and 18 of the Financial Services Act 2013, and only a company incorporated in Malaysia can apply. For payment facilitators and gateways BNM checks the activities that together make up merchant acquiring: contracting with merchants, handling settlement, facilitating merchants' acceptance of payment instruments and taking part in a payment instrument network; the name alone neither requires nor exempts registration. In the UAE, merchant acquiring and payment aggregation fall under the Central Bank's Retail Payment Services and Card Schemes Regulation, in Categories I to III.

In the EU the supervisor must decide within three months of a complete application, and in the UK within three months of a complete application and twelve months at most. The clock starts only once the file is complete, so plan for longer; each country page gives its own timeline.

Yes. A payment institution authorised in one member state can passport its services across the EEA by notification. UK payment institutions have had no EU passport since Brexit.