Payment gateway questions, answered before you commit.

A sandbox key is issued at registration — no contract, no call, no sales gate. Underwriting decisions run two to five working days once the file is complete, and the delay is almost always a missing document rather than a difficult judgement.

Shops running one of the supported plugins usually take live traffic in the same week the contract is signed. Custom integrations set their own pace, because the gating item is your release cycle, not our review.

The standard anti-money-laundering file, plus your live shopfront. We read the site as a shopper would: terms, refund policy, delivery timescales and a working contact route all have to be visible before anyone pays.

Company extract

Three months old at most

Beneficial owners

Identified at 25% and above

Settlement account

IBAN in the trading name

If you process today

Six months of statements

That is the intended order. The sandbox carries the full API surface — authorisation, 3-D Secure, webhooks, refunds and payouts — at no cost and with no volume ceiling.

Most teams have a working checkout before their first conversation with sales, which turns that conversation into one about rates rather than feasibility.

Developer quickstart

Two things move: the traffic and the vault. Stored cards transfer under a scheme-approved provider-to-provider migration, so your customers keep their saved cards and the network tokens keep billing without a re-entry prompt.

We normally run both gateways in parallel for a fortnight and shift traffic by share. A single overnight cutover saves nothing and removes your fallback.

At acquirer risk appetite plus scheme brand-protection rules — and drawn at application, not after ninety days of monitoring. Adult, gambling, crypto exchange, forex and CFDs, nutraceuticals, debt collection and long forward-delivery models sit outside it.

Borderline structures — marketplaces, ticketing, high-ticket B2B — get a written risk position before a contract exists. A narrow book is what keeps approval rates steady for everyone already on it.

Why the book stays narrow

Five inputs, in roughly this order of weight. A basket of consumer debit issued in your own market prices nothing like commercial cards issued outside Europe, and no blended headline can absorb that difference for long — it simply moves the drift somewhere you cannot see it.

Card mix

The single largest driver

Merchant category

Fixed at underwriting

Average order value

Weights the fixed fee

Dispute history

Reviewed at twelve months

Card settlement is T+2 by default, batched daily, with the payout instruction leaving on the same cycle. Euro-area transfers go out over SEPA Instant — mandatory for euro-area providers to send and receive since October 2025 — so the credit usually lands in seconds rather than the next working day.

Weekly or monthly cycles are available where your reconciliation would rather have fewer, larger files. The cadence is a setting, not a plan tier.

How payouts are routed

Usually not, and a deliberately low-risk book is what makes that possible. Where a reserve does apply it is in the written offer with its percentage, its holding period and its release schedule stated before you sign.

What we do not do is introduce one mid-contract because a good month made the balance look attractive.

Interchange the scheme returns to us is passed back to you, and our margin on the original authorisation is not charged a second time. The refund itself carries no separate gateway fee.

A chargeback is a different instrument entirely: the scheme's dispute fee applies whether or not you go on to win the case. That asymmetry is why a clear billing descriptor pays for itself.

You can settle in the currency you were paid in and keep the treasury decision, or have us convert into your settlement currency at a rate stamped on each settlement file with the conversion margin itemised on its own line.

Dynamic currency conversion at checkout is not offered by default. The economics of it favour whoever sells it, not the shopper who accepts it at the terminal.

None of the three. No gateway rental, no charge for the sandbox, no minimum monthly turnover. Notice is thirty days.

The vault leaves with you under a scheme-approved export, so switching costs you an integration rather than your customer base. Lock-in through hostage tokens is not part of the commercial model.

Your annual PCI paperwork, mostly. Hosted fields and hosted checkout keep every card-capture element on a BazPay origin, which is the condition that keeps you on SAQ A. The moment card data is typed into a form your own servers deliver, you are on SAQ A-EP with quarterly external scanning attached.

Both patterns look identical to a shopper. Only one of them lands on your audit calendar, so treat it as a scope decision rather than a styling preference.

Compare the checkout products

The sandbox is deterministic, not random. Specific test cards return specific ISO decline codes, specific amounts force a 3-D Secure challenge instead of a frictionless pass, and a reserved value holds the request open until it times out.

Build your error paths against those triggers before you build the happy path. Every integration that hurts in month three skipped this step in week one.

Versions are dated and pinned per account, so a new one never arrives because we deployed on a Tuesday. The previous version stays supported for twelve months after its successor ships.

Breaking changes are published in the changelog and pushed as a webhook event. Additive fields are not treated as breaking — parse defensively and they cost you nothing.

Nothing, provided the receiving end follows two rules: verify the signature on every payload before parsing it, and treat delivery as at-least-once by deduplicating on the event identifier.

Retry window

72 hours, exponential backoff

Guarantee

At least once, so dedupe

Replay

Any event, from the dashboard

No. The plugins for WooCommerce, Adobe Commerce (Magento 2), PrestaShop 8 and OpenCart 4 cover checkout, refunds and webhook handling without code — configuration is a key paste and a saved settings page.

A developer becomes necessary only when you want behaviour the plugin deliberately does not expose, such as a bespoke retry ladder or split settlement.

Platform and plugin coverage

The platform target is 99.9 per cent on the authorisation path, measured monthly and published on the status page rather than supplied on request. Incidents get a written note while they are still open, not a summary a week later.

Contractual remedies, where they apply, live in the agreement. We would rather you read that clause than take a figure from a marketing page.

A current PCI DSS Attestation of Compliance for the gateway, a responsibility matrix showing which requirement sits with whom, the data-processing agreement with its versioned sub-processor register, and a written statement of the SAQ level your integration pattern supports.

That last document is the one that ends the argument, because it names the pattern you actually deployed rather than the one you were sold.

Both, and the agreement says which applies where. For processing you instruct — taking a payment, storing a token, issuing a refund — we act as processor under Article 28 of the GDPR.

For the fraud, sanctions and anti-money-laundering checks we are legally obliged to run, we are an independent controller. You cannot instruct us to stop performing them, which is precisely why the roles have to be split in writing rather than blanket-labelled.

Tokens and the vault export are yours on request. Records tied to anti-money-laundering obligations are retained for five years from the end of the relationship, and no contract clause can shorten that.

Everything outside the statutory set is deleted on the schedule in the DPA rather than kept indefinitely because storage is cheap.

AML records

Five years, statutory

Vault

Exported to your next provider

Everything else

Deleted on the DPA schedule

We acknowledge it, we do not answer it on your behalf, and we forward it to your registered privacy contact within three working days with the transaction references attached.

Where we are the controller — the fraud and sanctions checks — we answer that part ourselves and tell you we have done so, so your own response stays complete.

It changes what has to be inside it. Where you fall under Regulation (EU) 2022/2554, the ICT third-party provisions — exit strategy, access and audit rights, incident-reporting timescales, subcontracting conditions — are added as a standing annex rather than negotiated line by line.

We also supply the register-of-information fields in the shape your supervisor expects, which is usually the part that consumes a quarter.

Visa and Mastercard, Apple Pay and Google Pay in-page, and the national schemes people in each market reach for first: iDEAL in the Netherlands, Bancontact in Belgium, BLIK and Przelewy24 in Poland, EPS in Austria.

SEPA Direct Debit and open banking bank transfer sit alongside them for recurring and high-ticket baskets. The method list is a configuration, not a second integration.

Yes — the licence is European, the card networks are not. An inter-regional credential authorises against the same acquiring contract and settles into the same balance; the difference shows up as an uncapped interchange line, not a refusal.

Strong customer authentication is formally out of scope for those one-leg transactions, though a foreign issuer may still choose to challenge. Local methods are the real limit: a national scheme only clears in its own market.

Almost always the data, not the protocol. A 3-D Secure 2 message carrying device signals, prior transaction history and a matching delivery address earns a frictionless pass; a sparse message earns a challenge screen, and every challenge screen loses a share of baskets.

The second suspect is soft declines being retried as fresh sales instead of re-presented with the authentication result attached. The dashboard separates the two, because the fix for each is different.

Frictionless pass

Full data set in the 3DS2 message

Exemption request

Carried by us, under PSD2 RTS

Soft decline

Re-present — never re-sell

The first charge is authenticated; the rest are flagged as merchant-initiated against that mandate. Fixed amounts on a fixed schedule stay exempt under Article 14 of the PSD2 technical standards, while variable amounts lean on transaction risk analysis and occasionally take a challenge.

Where the subscription is euro-denominated and predictable, SEPA Direct Debit sidesteps the question entirely — at the price of an eight-week no-questions refund right for the payer.

How recurring billing works

It is cheaper, and it is not a replacement. A bank transfer is pushed by the payer, so there is no chargeback to lose and no card to expire — but equally no card on file, and refunds go back as separate credit transfers.

It earns its place on high-ticket, one-off and B2B baskets. As a default checkout it costs you the convenience that made cards win in the first place.

Open banking pay-ins

The issuer raises it, we post it to the dashboard and fire a webhook the same day, and your evidence window is the scheme's rather than ours. Compelling evidence means delivery confirmation, the authentication result and the customer's own correspondence, uploaded once and completely.

If representment fails, pre-arbitration and arbitration carry fees that can exceed the disputed amount. On a small basket that makes conceding a commercial decision, not a defeat.

Long before a scheme writes to you. Visa and Mastercard both operate monitoring programmes with published ratio thresholds and escalating fees, and once you are inside one the exit takes months of clean volume.

We open the conversation at our own lower watch-line with the decline and dispute breakdown attached, because the fix is usually operational rather than technical.

Billing descriptor

First fix for “I don’t recognise this”

Delivery evidence

Attach at dispatch, not at dispute

Cancellation path

Visible, or it becomes a dispute

It can, which is exactly why the thresholds are yours rather than ours. Scores arrive with their reasons attached, borderline traffic can route to a review queue instead of a hard block, and allow lists survive rule changes.

A screening model whose reasoning you cannot see is a model you cannot tune — and an untunable model eventually gets switched off in a panic.

Payment-path incidents route to an on-call engineer through the status page and the support address at any hour. Billing and account questions wait for working hours, because paging an engineer about an invoice helps nobody.

Accounts on the Platform plan have a named payments specialist who already knows the shape of your integration before the call starts.

Reach the right desk