One integration for African and South American payments.

We underwrite low-risk MCCs only: physical e-commerce retail, subscription SaaS, digital goods with immediate fulfilment, and professional services billed on completion. We decline adult, gambling, CBD and nutraceuticals, forex, CFD and crypto exchange, debt collection, multi-level marketing, and any model built on long forward-delivery windows.

The basis is acquirer risk appetite plus scheme brand-protection rules — Visa's Integrity Risk Program and Mastercard's BRAM — layered with chargeback-ratio monitoring. Where a business model sits outside that appetite we decline at application rather than onboard it and terminate ninety days later.

Borderline models — marketplaces, ticketing, high-ticket B2B — receive a written risk position before contracts are signed, not after the first monitoring letter.

BazPay underwrites merchants in Sub-Saharan Africa and South America — Nigeria, Kenya, Ghana, South Africa and Tanzania on the African side; Brazil, Colombia, Chile, Peru and Argentina on the South American side. Those are the markets where we hold acquiring relationships and local settlement accounts, and where a merchant contract is signed.

The reach is wider than the licensing. On the pay-in side a Visa, Mastercard, Elo or Verve credential issued anywhere authorises against the same acquiring contract as a domestic one and settles into the same balance; inter-regional interchange is simply itemised at its own rate rather than the domestic one. Local methods are the exception, not the rule: Pix, PSE, M-Pesa and MTN MoMo are national schemes and only clear in their own market.

On the pay-out side domestic instant rails cover each market — Pix in Brazil, NIBSS Instant Payment in Nigeria, PayShap in South Africa, M-Pesa across East Africa — PAPSS handles intra-African corridors, beneficiaries elsewhere are reached over SWIFT, and push-to-card lands on any Visa or Mastercard credential the scheme permits. Corridors are approved per merchant at underwriting rather than switched on by default, because the sanctions and correspondent-banking checks differ by route.

Pay-in

Cards worldwide · local methods per market

Pay-out

Pix · NIP · PayShap · PAPSS · SWIFT

Corridor approval

Per merchant, at underwriting

SWIFT timing depends on the correspondent banks on the route, so a corridor is quoted rather than a settlement date promised. Coverage and settlement currency are confirmed in writing before onboarding.

Interchange++ is the default and the only model we quote to a new merchant. Each settled transaction itemises three components: the interchange the issuing bank keeps, the scheme fee, and the BazPay margin. Blended pricing conceals the first two, so a rate that looks flat drifts silently with your card mix.

Consumer debit, Brazil

0.50% interchange cap (BCB)

Local cards, Nigeria

0.50% MSC, ₦1,000 ceiling (CBN)

Commercial & inter-regional

Uncapped — itemised in full

Caps come from Resolução BCB nº 246/2022 in Brazil, the CBN Guide to Charges in Nigeria and the SARB interchange determination in South Africa, and they bind interchange only. Scheme fees and gateway margin are separate lines in the settlement file and we report them as such.

It does not. Card entry uses hosted fields served from a BazPay origin inside an iframe: the PAN is typed into our document, posted to our vault and returned to you as a token. Your application, your logs and your database hold that token and nothing else.

Vaulting happens inside BazPay's cardholder data environment, hosted in-region in São Paulo and Johannesburg. Tokens are registered with the schemes' network tokenisation services, so a reissued or expired card keeps billing without sending the customer back to a card form.

Tokens are portable. If you leave, we export the vault to your next provider under a scheme-approved migration — commercial lock-in is not part of our security model.

One condition: every element of the payment page that captures cardholder data must be delivered by the validated provider rather than by your site. Hosted fields and hosted checkout both satisfy it. Direct-post, or our script collecting card data inside your own DOM, moves you to SAQ A-EP — a self-assessment several times longer plus quarterly ASV scanning.

PCI DSS v4.0.1 moved the script-integrity requirements, 6.4.3 and 11.6.1, out of SAQ A and replaced them with an eligibility criterion; SAQ A-EP still carries both in full. Choosing hosted fields is therefore a scope decision, not a checkout-styling preference.

Hosted fields · hosted checkout

SAQ A

Direct-post · merchant-DOM capture

SAQ A-EP + ASV scanning

We will state our scope position in writing for your QSA, naming the integration pattern you actually deployed rather than the one you were sold.

Authorisation, vaulting and settlement reporting run in two in-region estates — São Paulo for South American traffic, Johannesburg for African traffic — so a Brazilian merchant's data stays under LGPD and a South African merchant's under POPIA rather than crossing an ocean to be processed. Nigerian and Kenyan traffic is handled under the NDPA 2023 and the Kenyan Data Protection Act 2019 respectively.

BazPay is your operator under LGPD Art. 39 and POPIA s.20 for merchant-instructed processing, and an independent controller for the fraud, sanctions and anti-money-laundering checks we are legally obliged to perform. The DPA sets out which role applies to which data category instead of labelling us an operator throughout.

Card schemes are global networks, so an authorisation message leaves the region when the issuer sits outside it. That transfer runs on the standard contractual safeguards each regime recognises — ANPD clauses in Brazil, s.72 POPIA conditions in South Africa — and is disclosed in the sub-processor register, which is versioned and dated.

Processing & vault regions

São Paulo · Johannesburg

Regimes

LGPD · POPIA · NDPA · Kenya DPA

AML record retention

5 years (FATF R.11)

Sub-processor changes are notified thirty days before they take effect, with a documented right to object.

Nigeria mandates two-factor authentication on card-not-present traffic under the CBN electronic-payments guidelines, and Brazilian issuers increasingly decline unauthenticated e-commerce outright, so the question is rarely whether to authenticate but how little friction it costs. We send the full 3-D Secure 2.2 data set — device, prior transaction history, delivery-address match — so the issuer can resolve the check frictionlessly, and fall back to a challenge screen only once it refuses.

Low value

≤ USD 30, counter-limited

Risk-based band

USD 100–500 by portfolio fraud rate

Fixed recurring

Merchant-initiated after the first authentication

Trusted beneficiary

Issuer-held allow list

Issuer decline reasons are surfaced verbatim in the dashboard, with soft declines, do-not-honour and 3-D Secure abandonment separated — the fix for each one is different.