Infrastructure and regtechLicence required

Payment acquiring and payment facilitator testing

FintechAssuranceLabs engineers test payment acquiring and payment facilitator platforms, the category of products like Stripe, Adyen, and Checkout.com. Acquiring platform testing covers authorisation, capture, and refunds, settlement files, interchange and scheme fee billing, sub-merchant onboarding and payouts, and reserves, with test evidence that an acquiring bank, a card network, or a payment regulator can review.

What breaks in authorisation, settlement, and merchant funding

An acquirer earns a take rate on every transaction and pays the merchant the captured amount minus that charge, interchange, and scheme fees. Sources below were checked on 2026-09-16.

Capture retried after a timeout and settled twice. The retry after a capture timeout carries a new idempotency key. Both captures clear, the payout includes the sale twice, and the take rate is charged twice. The cardholder disputes under Visa condition 12.6.1, Duplicate Processing, and Visa's Dispute Management Guidelines (June 2024) tell the merchant to accept the dispute when one purchase settled more than once. When the merchant balance cannot cover the dispute debit, the acquirer pays it. The payment idempotency testing guide lists the retry cases.
Currency exponent ignored in the payout job. ISO 4217 sets 0 minor units for JPY and 3 for KWD (SIX, list published 1 January 2026). A payout job that multiplies every amount by 100 pays a merchant 100 times a JPY sale and calculates the take rate on the inflated base. The overpayment comes out of funds owed to other merchants. PSD2 Article 10(1) requires a payment institution to safeguard all funds received for the execution of payment transactions, so the error opens a safeguarding shortfall.
Interchange billed from a stale BIN table. On interchange-plus-plus pricing, the fee engine bills an EEA consumer debit card at a commercial card rate while clearing charged the acquirer the capped rate. When the payer's and the payee's providers are both in the Union, Regulation (EU) 2015/751 caps consumer debit card interchange at 0.2% of the transaction value (Article 3(1)). The difference becomes margin inside the interchange line. Article 12(1)(c) requires the acquirer to show the merchant service charge and the interchange fee separately, aggregated only with the merchant's prior and explicit consent, so each misclassified card misstates the interchange fee.
Sub-merchant paid out without a TIN (US). A payment facilitator pays a sub-merchant before a taxpayer identification number (TIN) is collected. When the payee fails to furnish a TIN in the manner required for a payment reportable on Form 1099-K, 26 U.S.C. 3406 requires the payor to withhold at the backup withholding rate, 24 percent (IRS, updated 28 June 2026). Section 3406(h)(10) treats those payments as wages for withholding, so under section 3403 the platform owes the tax it did not withhold from each payout.
Reserve released while refunds and dispute debits still arrive. The release job pays each rolling reserve tranche on its date regardless of balance. A merchant that stopped trading receives its reserve, later refunds and dispute debits post against a zero balance, and the acquirer funds them. The Bank of Canada's case scenarios about acquirers (2 October 2024) treat an acquirer that keeps merchant funds at rest until a payout date as holding end-user funds under the Retail Payment Activities Act (RPAA). Section 15(2)(b) of the Retail Payment Activities Regulations (RPAR) requires such a provider to keep a ledger of each end user's funds, which a reserve ledger without per-merchant balances cannot produce.

Licence flag and the evidence acquiring banks and regulators ask for

Payment acquiring carries licence flag "yes": the acquirer is a licensed payment institution, e-money institution, or bank with card network membership, and a payment facilitator operates under a licensed acquirer.

European Union

PSD2 lists acquiring of payment transactions as a payment service (Annex I, point 5). An undertaking that is not a credit institution, e-money institution, or other provider listed in Article 1(1), and has no Article 32 or 33 exemption, obtains authorisation as a payment institution first (Article 11(1)), with initial capital of at least EUR 125,000 (Article 7(c)). When the payee or the payee's provider fails to accept strong customer authentication, it refunds the financial damage caused to the payer's provider (Article 74(2)); see the PSD2 SCA and 3-D Secure requirements. Evidence the competent authority can request:

daily safeguarding reconciliation per merchant under Article 10(1);
statement tests for IFR Article 12(1)(c) and fee information per card category and brand in merchant agreements under Article 9(2);
3-D Secure and exemption test results for every flag the acquirer sets.

United States

Visa requires a payment facilitator to partner with an acquirer that meets Visa's minimum equity requirements, and to have the acquirer added to the merchant agreement once a sponsored merchant's annual Visa sales exceed US$1,000,000 (Visa, 15 February 2024). The acquirer remains responsible for the acts and obligations of every entity between it and the seller.

FinCEN's money transmitter definition excludes a person that only acts as a payment processor to facilitate the purchase of, or payment of a bill for, a good or service through a clearance and settlement system by agreement with the creditor or seller (31 CFR 1010.100(ff)(5)(ii)(B)). Section 3.01(b) of the CSBS Money Transmission Modernization Act exempts an agent of a payee collecting payment for goods or services, other than money transmission, that the payee provides, when a written agreement directs the agent to collect and process payments on the payee's behalf, the payee holds the agent out to the public as accepting payments on its behalf, and payment is treated as received by the payee on receipt by the agent, so the payor's obligation is extinguished and the payor bears no risk of loss if the agent fails to remit. Each state's enacted statute decides; see the money transmitter requirements. Evidence the acquiring bank asks for:

payout tests showing funds reach only the contracted seller under a signed sub-merchant agreement;
onboarding results for TIN collection and backup withholding holds;
annual Visa sales monitoring per sponsored merchant;
PCI DSS evidence for systems that store, process, or transmit cardholder data; see how we handle cardholder data.

Canada

The Bank of Canada's acquirer case scenarios conclude that an acquirer offering merchant accounts and a payment facilitator offering sub-merchant accounts through it both meet the payment service provider definition and need to register, assuming they meet the other registration criteria; see the RPAA requirements. The Code of Conduct for the Payment Card Industry in Canada (effective 30 October 2024) makes acquirers responsible for their downstream participants, gives merchants at least monthly access to the effective merchant discount rate per card type, and requires notice of new or increased fees between 30 and 60 calendar days before they take effect. Evidence to prepare:

end-of-day balances per merchant, including reserves, under RPAR 15(2)(b);
effective merchant discount rate recalculation on monthly statements;
fee notice tests at 29, 30, 60, and 61 days.

Payment gateway and acquiring test scenarios

Authorisation and capture. Partial and multiple captures up to the authorised amount, capture after authorisation expiry, void before capture, and a reversal when the final amount is lower.
Idempotency. Capture, refund, and payout retries with the same key; the same key with a different amount is rejected; concurrent requests produce one clearing record.
Refunds. Partial refunds that never exceed the captured amount, a refund after payout against a zero balance, and a refund only to the original card.
3-D Secure. Frictionless and challenge flows, a soft decline retried with authentication, and acquirer transaction risk analysis exemptions.
Settlement files. Duplicate and missing lines, a late file, zero-decimal and 3-decimal currencies, and cut-offs across time zones.
Interchange and scheme fees. BIN table updates, consumer and commercial cards, interchange-plus-plus and blended pricing, and statement totals that match clearing.
Sub-merchant onboarding. Business verification, TIN collection before the first payout, and a bank account change that holds payouts.
Payouts and reserves. Net settlement per merchant, rolling and fixed reserves, closure with refunds pending, and negative balance recovery.
Disputes as they hit settlement. A dispute debit and its reversal post to the correct merchant and reserve.

Integrations and protocols to cover

Processor and network links. ISO 8583 authorisation, reversal, and repeat messages, with response code mapping.
Clearing and settlement. Card network clearing files, interchange and scheme fee reports, and settlement files per currency.
EMV 3-D Secure. AReq, ARes, CReq, CRes, and RReq messages through a 3DS Server.
Card-present. Chip and contactless data from terminals; see the EMV requirements.
Gateway APIs. Payment, capture, refund, and payout endpoints with idempotency keys, and webhooks with signature, ordering, and replay checks.
Payout rails. Nacha ACH credit files, SEPA credit transfers as ISO 20022 pain.001, and Canadian Payments Association Standard 005 AFT files.
Onboarding vendors. Business verification APIs, sanctions screening, and IRS TIN Matching.

Standards

Services

Guides

Blog posts

Sample deliverable

Sample, synthetic data

reconciliation test scenariosReconciliation test scenarios: card settlement and partner bank payouts

Reconciliation test scenarios: card settlement and partner bank payouts
ID	Scenario	Expected ledger entries	Amount (XTS)	Expected reconciliation result
REC-01	Processor settlement file repeats the settlement line for one capture	Dr Processor receivable / Cr Merchant payable, posted once	120.00	Break: the second settlement line has no matching capture and is flagged as a duplicate
REC-02	Partial refund on a capture that settled the day before	Dr Merchant payable / Cr Processor receivable	45.50	Match: the refund line matches the refund entry and the original capture stays settled
REC-03	FX rounding difference between the capture amount and the settled amount	Dr FX rounding expense / Cr Processor receivable	0.01	Match with a rounding entry when the difference is inside the configured tolerance
REC-04	Processor fee line missing from the settlement file	Dr Processing fee expense / Cr Processor receivable	2.90	Break: net settlement is lower than gross captures and a missing fee exception opens
REC-05	Chargeback reversed after the merchant wins representment	Dr Processor receivable / Cr Chargeback liability	80.00	Match: the reversal line clears the open chargeback entry
REC-06	Refund request retried after a timeout, with the same idempotency key	Dr Merchant payable / Cr Processor receivable, posted once	30.00	Break: the settlement file has two refund lines for one refund entry, and the second line is flagged as a duplicate refund
REC-07	Partner bank credits the payout one business day after the expected value date	Dr Partner bank cash / Cr Processor receivable	1,000.00	Match on the payout reference, with the value date difference logged as a timing item

Amounts use XTS, the ISO 4217 code reserved for testing. Account names are generic ledger accounts.

Questions

What is a payment gateway?

A payment gateway is the service that receives payment details from a merchant's checkout or terminal, protects the card number by encryption or tokenisation, and sends the authorisation request to the acquirer or its processor. The gateway returns the approval or decline to the merchant. The acquirer, which may run its own gateway, holds the merchant contract and settles captured funds to the merchant.

How do payment gateways work?

A payment gateway passes an authorisation request from the merchant's checkout to the acquirer's processor, which sends the request through the card network to the card issuer. The issuer's approval or decline returns along the same path. The merchant then captures the approved amount, and the acquirer submits the capture for clearing through the card network and pays the merchant the captured amount minus fees.

What is payment gateway testing?

Payment gateway testing checks that a gateway and the acquiring systems behind the gateway authorise, capture, refund, and settle each payment exactly once, in the correct amount and currency, including under timeouts, retries, and declines. Payment gateway testing also covers 3-D Secure authentication, webhook delivery, and the reconciliation of settlement files against the merchant ledger, using test card numbers instead of real card data.

What is a payment facilitator?

A payment facilitator is a company that signs merchant agreements with sellers, called sponsored merchants or sub-merchants, on behalf of an acquirer, or receives settlement from the acquirer on behalf of those sellers. Visa's February 2024 guide to acceptance entities treats an entity that performs either function as a payment facilitator and states that the acquirer remains responsible for every entity between the acquirer and the seller.

Scope your acquiring platform testing

Send your processor links, settlement files, pricing model, and payout setup, and we return a test scope with the evidence your acquiring bank and regulators will ask for.

Scope your testing