Payment solutions

Payment solutions

SK Consult supports cross-border businesses with tailored payment solutions support—helping structure efficient processing flows, provider relationships, and operational continuity across jurisdictions.

Important note:
Licensed payment institutions, technical providers, and regulated partners are engaged in the relevant jurisdiction depending on your business needs and requests.here required, certified accountants and licensed auditors are engaged locally in the relevant jurisdiction.
Approvals are made independently by regulators/authorities

Getting a merchant account is not the hard part. Keeping it through growth, fraud and a scheme review is

Most payment problems are not caused by the provider. They are caused by a decision taken months earlier — which entity contracts with the customer, which one holds the licence, where settlement lands, what happens if a single acquirer withdraws. That decision is usually made quickly, by whoever is closest to the integration, and it becomes very expensive to revisit once volume is running through it.

We design the flow of funds first and select providers against it, rather than the other way round. Who is the merchant of record. Which entity carries the regulatory perimeter. How many independent acquiring relationships the business needs before a single termination stops revenue. What the descriptor says, what the refund policy does to the chargeback ratio, and what the reserve terms cost in working capital over a year. Only once that is settled does provider selection become a rational exercise instead of a search for whoever says yes.

SK Consult works on payment architecture for e-commerce and marketplace operators, SaaS and subscription businesses, iGaming and forex operators, crypto-asset businesses and licensed payment firms building their own stack. Because we also handle the corporate structure, the licensing and the compliance framework around the same business, the payment design is built to match what the underwriting file actually says — which is where most applications fail.

What the engagement covers

Engagements are scoped to the stage the business is at, but these components recur across almost every payment mandate.

01

Payment architecture and flow of funds

Mapping who contracts with the customer, who is the merchant of record, which entity is settled into, how funds move between group companies and where the regulatory perimeter sits. This is the document that determines whether the rest of the stack is buildable — and the one most businesses have never written down.

02

Acquiring strategy and provider selection

Identifying acquirers, PSPs and EMIs that genuinely serve your vertical, geography, currency set and volume band. Shortlisting against underwriting appetite rather than marketing pages, and preparing an application file that answers the questions the risk team will actually ask.

03

Merchant of record, direct acquiring and platform models

Choosing between contracting directly with an acquirer, using a merchant of record, operating a payment facilitator or marketplace model, or combining them by market. Each option shifts liability, VAT treatment, chargeback exposure and licensing requirements in a different direction.

04

Gateway, orchestration and redundancy

Designing the routing layer so that traffic can be moved between acquirers by geography, card scheme, currency or performance — and so that losing one relationship degrades approval rates instead of stopping revenue.

05

High-risk vertical positioning

iGaming, forex and CFD, crypto-asset services, nutraceuticals, adult, travel, subscriptions and marketplaces. Presenting the business accurately, with the licence, the corporate structure and the site content aligned, rather than hoping the classification is not examined.

06

Chargebacks, fraud and scheme monitoring programmes

Working the actual ratios: Visa VAMP, Mastercard ECM and HECM, the newer scam-merchant monitoring, and acquirer-level thresholds. Root-cause analysis, prevention alerts, 3-D Secure configuration, representment quality and the remediation plan an acquirer will accept.

07

Payouts, settlement, FX and treasury

Settlement currencies and cycles, reserve mechanics, mass payouts to customers, affiliates or suppliers, SEPA and instant-payment rails, and the account structure that keeps operating cash separate from settlement flow.

08

Technical and data compliance

PCI DSS scope reduction and the correct SAQ or ROC path, tokenisation and vaulting, strong customer authentication and 3-D Secure exemption strategy, and the data-protection consequences of where cardholder and transaction data is stored.

09

Commercial terms and contract negotiation

Rates, scheme-fee pass-through, rolling reserve percentage and release schedule, chargeback and refund fees, termination and portability of the MID, liability caps and what happens to funds on the day a provider decides to exit your vertical.

Who this is for

Businesses outgrowing a single provider

Merchants whose volume, geography or product range has passed the point where one all-in-one provider is adequate, and where a single account closure would stop revenue entirely.

High-risk and regulated verticals

iGaming, forex, crypto-asset, subscription and other classifications where acquiring appetite is narrow, underwriting is adversarial and the licence, entity and website have to tell one consistent story.

Platforms, marketplaces and payment firms

Businesses that move money for third parties and must decide between a payment facilitator model, a licensed structure of their own, or a partnership that keeps them outside the regulatory perimeter.

How the work runs

  1. Payment audit

    1–2 weeks

    Review of current providers, contracts, rates, reserves, MIDs, approval and decline data, chargeback and fraud ratios, settlement timing and concentration risk. Output: a written findings list separating what is costing money now from what will stop the business later.

  2. Architecture and target model

    1–2 weeks

    The flow-of-funds design, the entity and licensing implications, the number and type of acquiring relationships required, and the routing logic. Agreed with you before any application is filed.

  3. Provider selection and applications

    3–8 weeks

    Shortlisting, introductions, preparation of the underwriting file, handling of risk-team questions, and negotiation of rates, reserves and termination terms. Run in parallel across providers rather than sequentially.

  4. Integration, testing and go-live

    2–6 weeks

    Technical integration support, 3-D Secure and exemption configuration, descriptor setup, test transactions, refund and chargeback flow validation, and a controlled traffic ramp rather than a full switch.

  5. Monitoring and optimisation

    continuing

    Monthly review of approval rates, decline codes, fraud and chargeback ratios against scheme thresholds, reserve releases, fee reconciliation, and renegotiation once processing history justifies better terms.

Timelines are indicative. Underwriting duration varies substantially by vertical, jurisdiction and the quality of the file submitted; a well-prepared application in a moderate-risk category can complete in three weeks, while a high-risk application with an incomplete corporate picture can run past three months or be declined outright.

The rules and rails that currently govern acceptance

This is the live picture as at July 2026. Scheme thresholds tightened materially in 2026 and the EU payment rails are mid-transition, which is why monitoring is part of the engagement rather than a one-off check.

Rule or rail Status and key date What it means in practice
Visa VAMP Merchant threshold reduced to 1.50% on 1 April 2026, from 2.20%; acquirer thresholds 0.50% (above standard) and 0.70% (excessive) enforced since January 2026 The ratio is (fraud reports [TC40] + disputes [TC15]) divided by settled card-not-present transactions [TC05] — a count, not a value. A merchant is flagged only where the ratio and a combined monthly floor of 1,500 fraud reports and disputes are both met. First-time enrolments not flagged in the preceding twelve months normally receive a three-month grace period; CEMEA has retained the higher 2.20% level.
Mastercard ECM and HECM ECM: 100–299 chargebacks and a ratio of 1.50–2.99%. HECM: 300 or more chargebacks and a ratio of 3.00% or above Both the count and the ratio must be met, and the denominator is the previous month's sales — so a sharp drop in volume can push a merchant into the programme without any increase in disputes. Exit requires three consecutive months below the ECM thresholds.
Mastercard scam merchant monitoring Onboarding content scans required since January 2026; the full programme took effect on 24 July 2026 This is not a ratio programme. Where an investigation confirms scam activity, Mastercard and Maestro processing is terminated — no fine, no remediation window. Acquirers must scan a new merchant's website, including gated and member-only areas, before the first transaction, so site content and the described business model now sit inside the underwriting decision.
PCI DSS v4.0.1 Future-dated requirements mandatory since 31 March 2025; v3.2.1 retired 31 March 2024 Fifty-one of the sixty-four new requirements moved from best practice to mandatory, with the e-commerce script-integrity and phishing controls the most commonly missed. An annual self-assessment completed without addressing these is no longer a valid attestation.
Instant Payments Regulation Euro-area credit institutions: receive since 9 January 2025, send since 9 October 2025. Payment institutions and EMIs in the euro area: both, from 9 April 2027. Non-euro member states: receive 9 January 2027, send 9 July 2027; their PIs and EMIs from 9 July 2027 Ten-second euro transfers at no more than the cost of a standard transfer change customer expectations for payouts and refunds. For payment institutions and EMIs the build has a hard date of 9 April 2027 in the euro area, which is a 2026 planning item rather than a 2027 one.
Verification of Payee Euro area since 9 October 2025; non-euro member states from 9 July 2027 Payee name and account identifier are matched before a transfer is confirmed. Mismatches between the legal name on the account and the trading name used in payout files generate warnings, failed payouts and support volume — a reconciliation problem worth solving before it appears.
PSD3 and the Payment Services Regulation Political agreement November 2025; text put before national representatives on 22 April 2026; adoption expected during 2026. The Regulation applies twenty days after publication, the Directive after an 18-month transposition period — practical application is anticipated from late 2027 into 2028 The separate e-money regime is removed and EMIs become a sub-category of payment institution requiring re-authorisation. Fraud rules tighten, including payee matching and reimbursement for authorised push payment fraud. Nothing is directly applicable yet, and any adviser presenting PSD3 as current law should be treated with caution — but licensing and product decisions taken in 2026 will be lived with under it.

What actually decides the outcome

The flow of funds decides the licence

Whether you need an authorisation at all, and which one, is determined by who holds customer money and for how long — not by the product description. Getting this wrong is the difference between a payment integration and an unlicensed payment service.

Concentration is the real risk

A single acquiring relationship means one risk committee, in a company you do not control, can end your revenue with thirty days' notice. Redundancy is not a nice-to-have once processing is material; it is the difference between a bad month and a closed business.

Ratios are counted, not measured in money

Both VAMP and the Mastercard programmes count events against transaction counts. Low-value, high-volume traffic is therefore far more exposed than average order value suggests, and a drop in sales volume can breach a threshold on its own.

Underwriting reads the whole structure

Risk teams compare the website, the licence, the entity, the ownership chain and the described business model. Where these do not agree, the application is declined without a stated reason — and the decline is visible to the next provider.

Descriptor and refund policy beat most fraud tools

A recognisable billing descriptor, a visible refund route and responsive support prevent more disputes than any rules engine, because the majority of chargebacks in most portfolios begin as a customer who could not identify a charge or could not reach anyone.

Reserves are negotiable and they are working capital

A ten per cent rolling reserve held for one hundred and eighty days is roughly five per cent of annual revenue sitting with a third party. The percentage, the holding period and the release schedule are commercial terms, and they move once processing history exists.

Where payment projects go wrong

  • Building the entire business on one MID with one acquirer, then discovering that a single risk decision stops all revenue at once.
  • Applying with a website, a corporate structure and a licence that describe three slightly different businesses — the most common cause of a silent decline.
  • Improving approval rates by removing 3-D Secure, losing the liability shift, and paying for it in disputes a quarter later.
  • Outsourcing chargeback representment without root-cause analysis, so the ratio that triggers a scheme programme never actually falls.
  • Suppressing chargebacks with liberal refunds, now that combined refund and chargeback behaviour is itself a monitoring trigger for newer merchants.
  • Accepting a rolling reserve with no defined release schedule, then finding the working-capital effect is permanent rather than temporary.
  • Using a billing descriptor customers do not recognise, which converts ordinary purchases into disputes at scale.
  • Treating PCI DSS as an annual questionnaire while the future-dated e-commerce controls, mandatory since March 2025, go unimplemented.

What we typically need from you

Providing this at the outset shortens the audit substantially and produces a far stronger underwriting file.

  • Group structure chart and the ownership chain up to the ultimate beneficial owners
  • Current processing agreements, schedules of rates and any reserve or termination correspondence
  • Twelve months of processing statistics: volume, average ticket, approval rate, decline codes by reason
  • Chargeback and fraud data with reason codes, plus current ratios against each scheme programme
  • Product and website details, including checkout flow, subscription terms and refund policy
  • Target markets, currencies, expected volumes and the payment methods customers actually ask for
  • Any licences held or applied for, and regulatory correspondence relating to payment activity
  • Existing bank, EMI and settlement account arrangements, with the current flow of funds
  • Current PCI DSS status, attestation and the scope on which it was based

What drives the cost

We quote per engagement once the scope is clear. These are the factors that move the number.

  • Vertical and risk classification — a moderate-risk e-commerce mandate and a high-risk gaming or forex mandate are not comparable exercises
  • Number of entities, markets and currencies in the target architecture
  • Whether an existing stack is being repaired and extended or a new one is being designed from nothing
  • Number of provider applications run, and whether they proceed in parallel
  • Depth of chargeback and fraud remediation required, including whether a scheme programme is already active
  • Whether licensing or corporate restructuring is needed to support the intended model
  • Ongoing support: monthly monitoring, renegotiation cycles and support during acquirer reviews

Questions clients ask before starting

Can you guarantee approval with a specific acquirer?

No, and anyone who does is selling something else. Underwriting is a risk decision taken by a third party we do not control. What we can do is materially improve the odds — accurate classification, a consistent corporate and licensing picture, a complete file, and applications directed only at providers whose appetite actually covers the vertical. We will also tell you before we start if the model as described is unlikely to be accepted anywhere, which saves more time than any application.

How many acquiring relationships do we actually need?

It depends on volume, geography and risk classification, but the principle is simple: enough that losing the largest one degrades performance rather than stopping revenue. For a single-market moderate-risk merchant that often means two live relationships and a third prepared. For high-risk or multi-market operations it is usually more, split by geography and card scheme so that a regional withdrawal does not affect the whole book.

We are already in a scheme monitoring programme. Is that recoverable?

Usually, but only through the ratio itself. Exit requires the underlying ratio to fall below the threshold and stay there — three consecutive months in the Mastercard programmes. That means root-cause work: identifying which products, traffic sources, geographies or subscription mechanics generate the disputes, and fixing those. Representment alone improves recovery rates without moving the ratio, because the chargeback is already counted when it is raised.

Do we need our own payment licence?

Only if you hold or transmit money for third parties. Accepting payments for your own products does not require an authorisation; operating a marketplace that settles to sellers, running a wallet, or executing payouts on behalf of others generally does. There are structures that keep a platform outside the perimeter — payment facilitator arrangements, partner-managed settlement, merchant of record models — and the right answer depends on economics and control, not only on regulation.

What is a realistic rolling reserve, and can it be reduced?

For high-risk verticals, five to ten per cent held for one hundred and eighty days is common at the outset; moderate-risk merchants often start lower or with none. It is negotiable in two stages — at signature, where the release schedule matters more than the percentage, and after six to twelve months of clean processing history, where a reduction should be requested with the data rather than waited for.

How does PSD3 affect decisions we take now?

It is not yet law: political agreement was reached in November 2025 and the text went before national representatives in April 2026, with adoption expected during 2026 and practical application anticipated from late 2027. It matters now because the e-money licence category disappears and EMIs become payment institutions subject to re-authorisation. If you are applying for or acquiring an EMI licence in 2026, the re-authorisation path belongs in the plan and in the price.

Do you work with the corporate and licensing side as well?

Yes, and in practice they cannot be separated. The entity that applies for acquiring is the entity a risk team investigates; the licence determines what the business may lawfully do with customer funds; the compliance framework is what the acquirer's periodic review examines. We handle company formation, licensing, banking and EMI onboarding and ongoing compliance for the same clients, which is why the payment design is built against a structure that will actually support it.

This page describes SK Consult services and general practice. It is not legal or financial advice and does not create a client relationship. Scheme rules, thresholds and payment legislation change frequently; any decision should be taken on advice addressing your own circumstances.

Contact us

If you need practical legal and compliance support for cross-border operations, please get in touch with a brief overview of your business model, the jurisdictions involved, and your key counterparties—such as banks, EMIs, PSPs, or other partners. Based on that information, a proposed scope of work and recommended next steps can be provided.

SK Consult office building in Aglantzia, Nicosia

Contact me

    Ready to define the right next step?

    Brief us on the objective, jurisdiction and current constraints.

    Discuss your matter