Which Authorisation a Payment Provider Actually Needs

A crypto payment provider performs activities spanning more than one regulatory category, and the permissions determine what happens to funds it holds for you. The commercial version of what follows is a crypto payment gateway with fiat settlement, and its terms are the shortest route to understanding it.

The permissions involved

Crypto asset service provider authorisation. Covers exchange, custody, transfer and related activities in crypto. Granted per activity.

Payment institution authorisation. Covers executing payment transactions in ordinary money and holding funds for that purpose. Carries safeguarding obligations.

Electronic money institution authorisation. Covers issuing electronic money and holding balances. Also carries safeguarding obligations.

Why it matters to a merchant

Between a customer paying and your settlement, the provider holds funds.

If that entity is authorised and the funds are safeguarded, they are protected in insolvency and returned to merchants ahead of general creditors.

If not, the balance is an unsecured claim.

At weekly settlement that is roughly a week of revenue.

Safeguarding, specifically

Relevant funds must be held in a segregated account at a credit institution, or covered by insurance or a comparable guarantee. Merchants see the mirror image, and a fintech payment gateway operates on that side.

Not the same as the crypto side’s client asset segregation, and both may be relevant to the same provider at different points in the flow.

The group structure question

Providers commonly operate through several entities: one holding the crypto authorisation, another the payment authorisation, a third contracting with merchants.

The safeguarding obligation attaches to the authorised entity that holds the funds. If that is not the entity in your agreement, the position needs explaining.

The question, in writing: which entity holds funds between payment and settlement, and is that entity authorised.

What to verify yourself

The register entry on the authority’s own site. Entity name matching your contract exactly. Permissions covering the activity. No restrictions.

Five minutes, and it is the only part of provider diligence that cannot be replaced by reading their material.

The control that applies regardless

Settlement frequency.

Authorisation determines what happens if a provider fails. Settlement frequency determines how much is exposed when it does.

Daily settlement is frequently available on request and rarely advertised. It is the single most effective thing a merchant can negotiate, and most negotiate the rate instead. The variable that only matters in a failure is worth checking first, and a crypto exchange with published fees states its position.